Problem Description
In insight/utils.py, lines 50–52 contain a critical logic inversion:
for file in files:
# Check for both extension and exact filename match (for Dockerfile, etc.)
if file.lower().endswith(SUPPORTED_EXTS) or file in IGNORED_DIRS:
yield os.path.join(root, file)
IGNORED_DIRS is populated by get_ignored_dirs() from .insightignore and default ignore sets (e.g. .env, venv). Because the condition checks:
or file in IGNORED_DIRS
Any file explicitly specified to be ignored (such as .env or files inside .insightignore) is matched and yielded as a source file to be parsed and sent to the Gemini API!
Furthermore, extensionless build/config files like Dockerfile, Makefile, Jenkinsfile are never matched because SUPPORTED_EXTS contains ".dockerfile" and ".makefile", but not the actual filenames "Dockerfile" and "Makefile".
Steps to Reproduce
- Create a
.insightignore containing .env.
- Create a
.env file with API_SECRET=supersecret and a main.py.
- Call
list_source_files(".").
- Output includes
['.env', 'main.py']. .env is read, parsed, and its secrets are sent to Gemini!
Expected Behavior
- Files and directories in
.insightignore and default ignore sets must never be yielded.
- Filenames like
Dockerfile and Makefile should be matched by an explicit set of supported filenames (e.g., SUPPORTED_FILENAMES = {"dockerfile", "makefile", "containerfile", "jenkinsfile"}).
Affected Files
Proposed Solution
- Define
SUPPORTED_FILENAMES = {"dockerfile", "makefile", "containerfile", "jenkinsfile"}.
- Filter out ignored files:
for file in files:
if file in IGNORED_DIRS:
continue
if file.lower().endswith(SUPPORTED_EXTS) or file.lower() in SUPPORTED_FILENAMES:
yield os.path.join(root, file)
Problem Description
In
insight/utils.py, lines 50–52 contain a critical logic inversion:IGNORED_DIRSis populated byget_ignored_dirs()from.insightignoreand default ignore sets (e.g..env,venv). Because the condition checks:or file in IGNORED_DIRSAny file explicitly specified to be ignored (such as
.envor files inside.insightignore) is matched and yielded as a source file to be parsed and sent to the Gemini API!Furthermore, extensionless build/config files like
Dockerfile,Makefile,Jenkinsfileare never matched becauseSUPPORTED_EXTScontains".dockerfile"and".makefile", but not the actual filenames"Dockerfile"and"Makefile".Steps to Reproduce
.insightignorecontaining.env..envfile withAPI_SECRET=supersecretand amain.py.list_source_files(".").['.env', 'main.py']..envis read, parsed, and its secrets are sent to Gemini!Expected Behavior
.insightignoreand default ignore sets must never be yielded.DockerfileandMakefileshould be matched by an explicit set of supported filenames (e.g.,SUPPORTED_FILENAMES = {"dockerfile", "makefile", "containerfile", "jenkinsfile"}).Affected Files
insight/utils.py:45-52Proposed Solution
SUPPORTED_FILENAMES = {"dockerfile", "makefile", "containerfile", "jenkinsfile"}.