fix: restore vault sonar env and TS tailwind scan for QA screenshots

.env

@@ -0,0 +1,58 @@
+# This file is committed to git no secrets.
+
+#!/usr/bin/env bash
+
+# Vault environment loader wrapper
+# Usage: source .env (never run directly)
+
+set -o pipefail
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    echo "This script must be sourced: source .env" >&2
+    exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HELPER_PATH="${VAULT_HELPER_PATH:-${SCRIPT_DIR}/scripts/vault-helper.sh}"
+
+if [[ ! -r "$HELPER_PATH" ]]; then
+    echo "Vault helper not found at $HELPER_PATH" >&2
+    return 1
+fi
+
+# shellcheck source=./scripts/vault-helper.sh
+source "$HELPER_PATH"
+
+DEFAULT_VAULT_SECRET_DEFS=$'kv/Sonarqube/sonarqube|SONAR_TOKEN=SONAR_TOKEN SONAR_TOKEN=sonar_token SONAR_TOKEN=token\nkv/dependencytrack|DTRACK_API_KEY=DTRACK_API_KEY DTRACK_API_KEY=api_key DTRACK_API_KEY=token'
+DEFAULT_VAULT_REQUIRED_VARS="SONAR_TOKEN DTRACK_API_KEY"
+
+if [[ -z "${VAULT_TOKEN:-}" ]]; then
+    token_candidates=()
+    if [[ -n "${VAULT_TOKEN_FILE:-}" ]]; then
+        token_candidates+=("$VAULT_TOKEN_FILE")
+    fi
+    token_candidates+=("${HOME}/.vault-token" "/home/vscode/.vault-token" "/root/.vault-token")
+    for token_path in "${token_candidates[@]}"; do
+        if [[ -r "$token_path" ]]; then
+            VAULT_TOKEN_FILE="$token_path"
+            export VAULT_TOKEN_FILE
+            break
+        fi
+    done
+fi
+
+SECRET_DEFS="${VAULT_SECRET_PATHS:-$DEFAULT_VAULT_SECRET_DEFS}"
+REQUIRED_VARS="${VAULT_REQUIRED_VARS:-$DEFAULT_VAULT_REQUIRED_VARS}"
+
+vault_helper::load_from_definitions "$SECRET_DEFS" "$REQUIRED_VARS" "$VAULT_TOKEN_FILE"
+
+# Commented out for CI/automated testing
+# SONAR_TOKEN=""
+DTR_PROJECT_KEY=
+# DTRACK_API_KEY=""
+DTRACK_PROJECT=ai-code-fusion
+DTRACK_PROJECT_VERSION=main
+
+# Local SonarQube defaults (cross-platform, no secrets)
+SONAR_PROJECT_KEY=ai-code-fusion
+# SONAR_TOKEN=

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - dependabot
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - dependabot

.github/workflows/secrets-gate.yml

@@ -0,0 +1,66 @@
+name: Secrets Gate
+
+on:
+  pull_request:
+    branches: ['main']
+  push:
+    branches: ['main']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.24.3
+        run: |
+          set -euo pipefail
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
+          tar -xzf gitleaks.tar.gz gitleaks
+          chmod +x gitleaks
+          echo "${PWD}" >> "${GITHUB_PATH}"
+
+      - name: Determine git scan range
+        id: scan-range
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo "log_opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" >> "${GITHUB_OUTPUT}"
+          elif [[ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]]; then
+            echo "log_opts=${{ github.event.before }}..${{ github.sha }}" >> "${GITHUB_OUTPUT}"
+          else
+            echo "log_opts=${{ github.sha }}" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - name: Scan commit range for secrets
+        run: |
+          set -euo pipefail
+          gitleaks git \
+            --redact \
+            --no-banner \
+            --exit-code 1 \
+            --log-opts="${{ steps.scan-range.outputs.log_opts }}" \
+            --report-format json \
+            --report-path gitleaks-report.json
+
+      - name: Upload gitleaks report
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: gitleaks-report
+          path: gitleaks-report.json
+          if-no-files-found: ignore
+          retention-days: 14

.gitignore

@@ -62,7 +62,6 @@ $RECYCLE.BIN/
 ._*
 
 # Environment variables and local config
-.env
 .env.local
 .env.*
 .scannerwork/
@@ -74,3 +73,6 @@ start/*
 src/renderer/bundle.js.LICENSE.txt
 src/renderer/bundle.js.map
 src/renderer/bundle.js
+
+# Test artifacts
+/test-results

.husky/pre-commit

@@ -1,5 +1,10 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
+set -e
+
 # Run lint-staged (works on both Windows with Git Bash and Linux)
 npx lint-staged
+
+# Block commits that introduce secrets.
+npm run gitleaks

AGENTS.md

@@ -0,0 +1,32 @@
+# AGENTS.md
+
+Lightweight rules for automated agents and contributors in this repository.
+
+## Scope
+
+- Keep changes focused and minimal.
+- Do not make unrelated refactors.
+
+## Tests and Quality
+
+- Before proposing merge-ready changes, run:
+  - `npm run lint`
+  - `npm test -- --runInBand`
+- If UI behavior/layout is changed, also run:
+  - `npm run qa:screenshot`
+- Do not mark work complete while required CI checks are failing.
+- Use `tests/catalog.md` as the source of truth for test targets and use cases.
+
+## `.env` Policy (Local-Only)
+
+- `.env` in this repo is for local development bootstrap only.
+- Keep `.env` tracked; do not remove/rename it.
+- Do not over-engineer or heavily refactor `.env` for non-local use.
+- Never commit secrets/tokens in `.env`.
+- Use Vault/environment-provided secrets for real credentials.
+
+## Review Focus for Agents
+
+- Treat `.env` changes as sensitive even when local-only.
+- Ensure `.env` updates are minimal, intentional, and documented in PR notes.
+- Reject any hardcoded secret, token, or credential exposure in code, docs, or PR text.

docs/DEVELOPMENT.md

@@ -94,5 +94,3 @@ node scripts/index.js release <version>
 ```
 
 Where `<version>` is a semantic version (`1.2.3`) or one of `patch`, `minor`, `major`.
-
-For update metadata and signing rollout planning, see `docs/UPDATES_AND_SIGNING.md`.