chore(pack): pin compatible test CLI and exclude dependency dotenv files

pnpm-lock.yaml

@@ -921,8 +921,8 @@ importers:
         version: 4.1.6(@opentelemetry/api@1.9.1)(@types/node@24.12.2)(jsdom@29.1.1)(vite@7.3.3(@types/node@24.12.2)(jiti@2.6.1)(lightningcss@1.32.0)(tsx@4.22.3)(yaml@2.9.0))
     optionalDependencies:
       '@powerformer/vela-cli':
-        specifier: 0.1.4
-        version: 0.1.4
+        specifier: 0.1.7-test.0
+        version: 0.1.7-test.0
 
   tools/release:
     dependencies:
@@ -2620,33 +2620,33 @@ packages:
   '@posthog/types@1.374.2':
     resolution: {integrity: sha512-ZghQSFMi+HFJNPvPjBoyY/jWQ+q6mSQVtWQxOHMSbBidUZjsyYbxYxBFbHy2qWLNe4mEpX+Wqir2Q4I/4AVvJQ==}
 
-  '@powerformer/vela-cli-darwin-arm64@0.1.4':
-    resolution: {integrity: sha512-2rkHT6MWmuDZEJzLNJy6Fj8euNnwiOzRo8AS5MVVDyyPvzEzNAEx8VLQW7I4CoxBRwyX/LHF6PjW31pW9i+RUg==}
+  '@powerformer/vela-cli-darwin-arm64@0.1.7-test.0':
+    resolution: {integrity: sha512-JLpEb76bkT37m9Mf5ocA/Tz+OiHZCkTR+BpcbW3Z4TpEdoWdiyccrO+Z7GUxxw9e9MMOZySkkxpXncK3WocOow==}
     cpu: [arm64]
     os: [darwin]
 
-  '@powerformer/vela-cli-darwin-x64@0.1.4':
-    resolution: {integrity: sha512-Oa2iLDSkz1hpHtov8AlyGpt/utuOB8Box5wtHqvXs6YQbjHhPPcP2N0ey9IW3Oi2d32Ylm+hi7LJNR4A18oPvg==}
+  '@powerformer/vela-cli-darwin-x64@0.1.7-test.0':
+    resolution: {integrity: sha512-5al43vPdNwH4XcEa4xFJYS9RydMwXtl+EKjpZQxQoQaM9UEWohP7yScWjfFaMTNoI11nSb/LW7sKibr7IFmCWA==}
     cpu: [x64]
     os: [darwin]
 
-  '@powerformer/vela-cli-linux-arm64@0.1.4':
-    resolution: {integrity: sha512-T7cw3xhtubCLWiaqbJV8tEs4F4wYZghwsOeBSJxwC+Q+AnLPiloNZV0lEuFyveBnfto+JPaKzJpMCuv95i2nTA==}
+  '@powerformer/vela-cli-linux-arm64@0.1.7-test.0':
+    resolution: {integrity: sha512-T6ZnMvEXpKhPv577q46TL7PaQUEICrld45grc2IMHvs8bKyNhl/rBmBS5YXlT7U9BMWzgQSBE1vJYI9dcQsnSg==}
     cpu: [arm64]
     os: [linux]
 
-  '@powerformer/vela-cli-linux-x64@0.1.4':
-    resolution: {integrity: sha512-Co0xwcSN1h/A7UgM7h0c1sJWJkJZeQGzeFt4WLDCJ3vVaP23dC+bcJwHzPJr2XZV0DJ4hwJAnOFME94wkfDDow==}
+  '@powerformer/vela-cli-linux-x64@0.1.7-test.0':
+    resolution: {integrity: sha512-B7i2GdZy7azBcFOCaVFHTdLbyNq4u8hctAWoZRdh7npV/HyCpjuyVzg73NcVvCa+4OaYW0rJj0i76xCz7GFhzw==}
     cpu: [x64]
     os: [linux]
 
-  '@powerformer/vela-cli-win32-x64@0.1.4':
-    resolution: {integrity: sha512-t/9JzqdKS6AWWjdT78U7ND1LcgBZg5zbuA4hpbf0ccGbeICZ0NPIkTgSvRk/pZgQ+0ZDn05vEO4/WgQgZHy3IA==}
+  '@powerformer/vela-cli-win32-x64@0.1.7-test.0':
+    resolution: {integrity: sha512-6DJYpvCVhPPyZwebF5VkdKgsbt3ZFruR8Tetx2W9HCCZRz/iIMV7OEMM12Q15b9cOSHkHKpkmghpEXUzFWu6rA==}
     cpu: [x64]
     os: [win32]
 
-  '@powerformer/vela-cli@0.1.4':
-    resolution: {integrity: sha512-jzdAsUXVgbm8Xsax1RbOq2Xj4exyM7jPtiCgmAT01/GdEANq3qmNOEIDUvTq5dMx0c7/+gJsegozYv6QT/CirQ==}
+  '@powerformer/vela-cli@0.1.7-test.0':
+    resolution: {integrity: sha512-pycZad8An+9B7yXZN9t0QUxMQn8AsbHCkQ3VpAgRCZ5cYM4Gj8k2Zk3SLi/l2bf7wzyWl68S3HxEEh/ozdYcKw==}
     hasBin: true
 
   '@preact/signals-core@1.14.2':
@@ -8341,28 +8341,28 @@ snapshots:
 
   '@posthog/types@1.374.2': {}
 
-  '@powerformer/vela-cli-darwin-arm64@0.1.4':
+  '@powerformer/vela-cli-darwin-arm64@0.1.7-test.0':
     optional: true
 
-  '@powerformer/vela-cli-darwin-x64@0.1.4':
+  '@powerformer/vela-cli-darwin-x64@0.1.7-test.0':
     optional: true
 
-  '@powerformer/vela-cli-linux-arm64@0.1.4':
+  '@powerformer/vela-cli-linux-arm64@0.1.7-test.0':
     optional: true
 
-  '@powerformer/vela-cli-linux-x64@0.1.4':
+  '@powerformer/vela-cli-linux-x64@0.1.7-test.0':
     optional: true
 
-  '@powerformer/vela-cli-win32-x64@0.1.4':
+  '@powerformer/vela-cli-win32-x64@0.1.7-test.0':
     optional: true
 
-  '@powerformer/vela-cli@0.1.4':
+  '@powerformer/vela-cli@0.1.7-test.0':
     optionalDependencies:
-      '@powerformer/vela-cli-darwin-arm64': 0.1.4
-      '@powerformer/vela-cli-darwin-x64': 0.1.4
-      '@powerformer/vela-cli-linux-arm64': 0.1.4
-      '@powerformer/vela-cli-linux-x64': 0.1.4
-      '@powerformer/vela-cli-win32-x64': 0.1.4
+      '@powerformer/vela-cli-darwin-arm64': 0.1.7-test.0
+      '@powerformer/vela-cli-darwin-x64': 0.1.7-test.0
+      '@powerformer/vela-cli-linux-arm64': 0.1.7-test.0
+      '@powerformer/vela-cli-linux-x64': 0.1.7-test.0
+      '@powerformer/vela-cli-win32-x64': 0.1.7-test.0
     optional: true
 
   '@preact/signals-core@1.14.2': {}

tools/pack/package.json

@@ -25,7 +25,7 @@
     "resedit": "1.7.2"
   },
   "optionalDependencies": {
-    "@powerformer/vela-cli": "0.1.4"
+    "@powerformer/vela-cli": "0.1.7-test.0"
   },
   "devDependencies": {
     "@types/node": "24.12.2",

tools/pack/src/mac/constants.ts

@@ -31,6 +31,9 @@ export const ELECTRON_BUILDER_FILE_PATTERNS = [
   "**/*",
   "!**/node_modules/.bin",
   "!**/node_modules/electron{,/**/*}",
+  // Dependency tarballs can carry dotenv credentials; never ship them.
+  "!**/.env",
+  "!**/.env.*",
   "!**/*.map",
   "!**/*.tsbuildinfo",
   "!**/.next/cache",

tools/pack/tests/mac.test.ts

@@ -409,6 +409,7 @@ describe("runElectronBuilder", () => {
     await runElectronBuilder(config, paths, ["dir"]);
 
     return JSON.parse(await readFile(paths.appBuilderConfigPath, "utf8")) as {
+      files: string[];
       afterSign?: string;
       mac?: {
         notarize?: boolean;
@@ -428,6 +429,17 @@ describe("runElectronBuilder", () => {
     }
   });
 
+  it("excludes dependency dotenv credentials from the packaged app", async () => {
+    const root = await mkdtemp(join(tmpdir(), "open-design-tools-pack-mac-"));
+    try {
+      const builderConfig = await prepareElectronBuilderConfig(root, { macNotarize: false });
+
+      expect(builderConfig.files).toEqual(expect.arrayContaining(["!**/.env", "!**/.env.*"]));
+    } finally {
+      await rm(root, { force: true, recursive: true });
+    }
+  });
+
   it("keeps signed-only mac builds from invoking electron-builder notarization", async () => {
     const root = await mkdtemp(join(tmpdir(), "open-design-tools-pack-mac-"));
     try {