date: 2026-07-03 status: filed issue_number: 65 repo: gabriel/muse url: https://staging.musehub.ai/gabriel/muse/issues/65 title: "[RE-FILE] muse bridge git-export/import deletes ignored local files (.env, config/local.yaml) — still present in 0.2.0rc15" labels: [bug, bridge, data-loss, security] patch_status: proposal-drafted event_type: rediscover supersedes: docs/musehub-issues/2026-05-20-issue-XX-bridge-deletes-ignored-files.md tags: [musehub, bug-report, bridge, git-export, git-import, data-loss, rc15]

[RE-FILE] muse bridge deletes ignored local files — still present in 0.2.0rc15

This re-files the 2026-05-20 report (docs/musehub-issues/2026-05-20-issue-XX-bridge-deletes-ignored-files.md), which could not be submitted upstream (MuseHub API error 401: No registered keys for identity). The full root-cause analysis, proposed two-layer patch, sketch diff, and 7-tier upstream test suite live in that original document — this file adds fresh confirmation and the re-file instructions.

Why re-file now

A second production incident occurred (~2026-07-02, aaronrene/knowtation): .env and config/local.yaml were deleted again and had to be recreated from backup. Investigation on 2026-07-03 confirmed the upstream bug is unchanged through muse 0.2.0rc15 and that RC14/RC15 neither introduced nor fixed it.

Evidence gathered 2026-07-03 (Muse 0.2.0rc15)

Conclusion (verified fact, not inference): the deletions are caused solely by running muse bridge git-export (or git-import) with --git-dir pointed at a working tree. Muse's GitExporter.sync_to_git deletes every file under the target that is not on a hardcoded/--exclude list, without consulting git check-ignore, .gitignore, or .museignore. Ignored secrets are therefore deleted and are unrecoverable (they were never in the snapshot).

Reproduction (throwaway repo — safe)

tmp=$(mktemp -d); cd "$tmp"; git init -q
muse init --domain code
printf '.muse/\n.env\nconfig/local.yaml\n' > .gitignore
printf '[global]\npatterns=[".env","config/local.yaml"]\n[domain.code]\npatterns=[]\n' > .museignore
mkdir config; echo v1 > tracked.txt
muse code add tracked.txt .gitignore .museignore; muse commit -m seed
git checkout -b muse-mirror -q; git commit --allow-empty -qm seed; git checkout -q main || git checkout -qb main
echo 'SECRET=keep' > .env; echo 'x: keep' > config/local.yaml
muse bridge git-export --git-dir . --git-branch muse-mirror --git-remote origin --no-push
ls .env config/local.yaml   # EXPECTED (post-fix): both still exist. ACTUAL (rc15): both deleted.

Requested fix (see original doc for full patch + tests)

1. Delete only bridge-owned paths — persist the previous export manifest; delete candidates are owned_before − owned_now, never arbitrary files inside --git-dir.
2. Respect ignore rules before unlinking — batched git check-ignore --stdin (and .museignore); skip ignored paths unless the caller passes an explicit --allow-delete-ignored.
3. Ship the 7-tier test tests/cli/commands/test_bridge_protects_ignored.py from the original draft.

Severity: Critical — silent local data loss + secret-management risk. Affected: muse/cli/commands/bridge.py::GitExporter.sync_to_git. Verified in: 0.2.0rc7 (original) and 0.2.0rc15 (this re-file).

How to file (once identity/key registration is fixed)

muse hub issue create \
  --repo gabriel/musehub \
  --title 'muse bridge git-export/import deletes ignored local files (.env, config/local.yaml) — still present in 0.2.0rc15' \
  --body-file docs/musehub-issues/2026-07-03-bridge-deletes-ignored-files-rc15-refile.md \
  --label bug --label bridge --label data-loss --label security \
  --json

If the 401: No registered keys for identity block persists, register the CLI signing key for the account first (muse auth / key registration), then retry. Until filed upstream, the local guardrails (scripts/muse-bridge-deploy.sh, scripts/muse-local-setup.sh, the ~/.zshrc guard, and branch protection) are the mitigation — see the vault note areas/muse-ops/muse-local-hygiene.md.