Fix CodeRabbit-identified issues: security, error handling, and UX gaps

git-ai/package.json

@@ -14,7 +14,7 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "lint": "tsc --noEmit",
-    "test": "echo \"No tests specified\"",
+    "test": "echo \"No tests specified\" && exit 1",
     "prepare": "npm run build"
   },
   "keywords": [

git-ai/src/cli/resolve-command.ts

@@ -10,7 +10,11 @@ export async function runResolveCommand() {
     const ai = new AIService(config);
     const resolver = new ConflictResolver(ai, git);
 
-    const conflicts = await resolver.getConflicts();
+    const { conflicts, skippedFiles } = await resolver.getConflicts();
+
+    if (skippedFiles.length > 0) {
+      console.warn(`⚠️ Could not read ${skippedFiles.length} conflicted file(s): ${skippedFiles.join(', ')}`);
+    }
 
     if (conflicts.length === 0) {
       console.log('✅ No merge conflicts detected.');

git-ai/src/commands/CommitCommand.ts

@@ -23,15 +23,15 @@ function validateCommitMessage(message: string): string | null {
 }
 
 export async function commitCommand() {
-  const config = new ConfigService();
-  const git = new GitService();
-  const ai = new AIService(config);
   const rl = readline.createInterface({
     input: process.stdin,
     output: process.stdout,
   });
 
   try {
+    const config = new ConfigService();
+    const git = new GitService();
+    const ai = new AIService(config);
     const diff = await git.getDiff();
     if (!diff) {
       console.log('⚠️  No staged changes found. Use "git add" first.');

git-ai/src/commands/InitCommand.ts

@@ -5,6 +5,30 @@ import readline from 'readline/promises';
 import { ConfigSchema, Config } from '../services/ConfigService.js';
 import { logger } from '../utils/logger.js';
 
+/**
+ * Reads a secret/password from the terminal without echoing characters.
+ * Falls back to normal readline if stdin is not a TTY (e.g. piped input).
+ */
+async function readSecretInput(rl: readline.Interface, prompt: string): Promise<string> {
+  const rlAny = rl as any;
+  const originalWrite = rlAny._writeToOutput;
+  // Suppress character echoing: only allow the initial prompt to be written
+  let promptWritten = false;
+  rlAny._writeToOutput = function _writeToOutput(str: string) {
+    if (!promptWritten) {
+      promptWritten = true;
+      process.stdout.write(str);
+    }
+    // Suppress all subsequent echoed characters
+  };
+  try {
+    return await rl.question(prompt);
+  } finally {
+    process.stdout.write('\n');
+    rlAny._writeToOutput = originalWrite;
+  }
+}
+
 export async function initCommand() {
   const rl = readline.createInterface({
     input: process.stdin,
@@ -16,7 +40,7 @@ export async function initCommand() {
   try {
     let apiKey = '';
     while (!apiKey) {
-      const apiKeyInput = await rl.question('🔑 Enter your Gemini API Key: ');
+      const apiKeyInput = await readSecretInput(rl, '🔑 Enter your Gemini API Key: ');
       apiKey = apiKeyInput.trim();
       if (!apiKey) {
         console.error('❌ API key cannot be empty. Please enter a valid key.');
@@ -41,7 +65,7 @@ export async function initCommand() {
       },
     };
 
-    // Validate with Zod
+    // Validate with Zod and persist with restricted permissions (mode 0o600)
     ConfigSchema.parse(newConfig);
 
     const configPath = path.join(os.homedir(), '.aigitrc');
@@ -64,7 +88,8 @@ export async function initCommand() {
       }
     }
 
-    fs.writeFileSync(configPath, JSON.stringify(newConfig, null, 2));
+    fs.writeFileSync(configPath, JSON.stringify(newConfig, null, 2), { mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
 
     console.log(`\n✅ Configuration saved to ${configPath}`);
     console.log('Try running: ai-git commit');

git-ai/src/commands/ResolveCommand.ts

@@ -10,37 +10,51 @@ export async function runResolveCommand() {
   const resolver = new ConflictResolver(ai, git);
 
   let conflicts;
+  let skippedFiles: string[] = [];
   try {
-    conflicts = await resolver.getConflicts();
+    ({ conflicts, skippedFiles } = await resolver.getConflicts());
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     console.error(`❌ Failed to list merge conflicts in runResolveCommand: ${message}`);
     process.exitCode = 1;
     return;
   }
-
+
+  if (skippedFiles.length > 0) {
+    console.warn(`⚠️ Could not read ${skippedFiles.length} conflicted file(s): ${skippedFiles.join(', ')}`);
+  }
+
   if (conflicts.length === 0) {
     console.log('✅ No conflicts found.');
+    if (skippedFiles.length > 0) process.exitCode = 1;
     return;
   }
 
   const failedFiles: string[] = [];
+  let successCount = 0;
 
   for (const conflict of conflicts) {
     console.log(`🤖 Resolving: ${conflict.file}...`);
     try {
       const solution = await resolver.suggestResolution(conflict);
       await resolver.applyResolution(conflict.file, solution);
       console.log(`✅ Applied AI fix to ${conflict.file}`);
+      successCount++;
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       console.error(`❌ Failed to resolve ${conflict.file}: ${message}`);
       failedFiles.push(conflict.file);
     }
   }
 
-  if (failedFiles.length > 0) {
-    console.error(`⚠️ Resolution failed for ${failedFiles.length} file(s): ${failedFiles.join(', ')}`);
+  if (successCount > 0) {
+    console.log(`\n🎉 Successfully resolved ${successCount} file(s).`);
+  }
+
+  if (failedFiles.length > 0 || skippedFiles.length > 0) {
+    if (failedFiles.length > 0) {
+      console.error(`⚠️ Resolution failed for ${failedFiles.length} file(s): ${failedFiles.join(', ')}`);
+    }
     process.exitCode = 1;
   }
 }

git-ai/src/services/ConflictResolver.ts

@@ -11,6 +11,12 @@ export interface ConflictDetail {
   suggestion?: string;
 }
 
+export interface ConflictsResult {
+  conflicts: ConflictDetail[];
+  /** Files that were identified as conflicted but could not be read. */
+  skippedFiles: string[];
+}
+
 /**
  * Patterns for detecting secrets and sensitive data in conflict content.
  */
@@ -66,13 +72,16 @@ export class ConflictResolver {
   ) {}
 
   /**
-   * Identifies files with merge conflicts and fetches their content
+   * Identifies files with merge conflicts and fetches their content.
+   * Returns both the successfully read conflicts and any files that could
+   * not be read (skippedFiles), so callers can surface partial-failure
+   * warnings to the user instead of silently ignoring them.
    */
-  public async getConflicts(): Promise<ConflictDetail[]> {
+  public async getConflicts(): Promise<ConflictsResult> {
     const status = await this.gitService.getStatus();
     const conflictFiles = status.conflicted;
 
-    if (conflictFiles.length === 0) return [];
+    if (conflictFiles.length === 0) return { conflicts: [], skippedFiles: [] };
 
     const results = await Promise.allSettled(
       conflictFiles.map(async (file) => {
@@ -83,6 +92,7 @@ export class ConflictResolver {
     );
 
     const conflicts: ConflictDetail[] = [];
+    const skippedFiles: string[] = [];
     for (let index = 0; index < results.length; index++) {
       const result = results[index];
       const file = conflictFiles[index];
@@ -93,9 +103,10 @@ export class ConflictResolver {
 
       const reason = result.reason instanceof Error ? result.reason.message : String(result.reason);
       logger.error(`Failed to read conflicted file ${file}: ${reason}`);
+      skippedFiles.push(file);
     }
 
-    return conflicts;
+    return { conflicts, skippedFiles };
   }
 
   /**

git-ai/src/ui/TreeUI.tsx

@@ -1,5 +1,5 @@
 import React, { useState, useEffect } from 'react';
-import { Box, Text } from 'ink';
+import { Box, Text, useApp } from 'ink';
 import archy from 'archy';
 import { GitService } from '../core/GitService.js';
 import { logger } from '../utils/logger.js';
@@ -9,6 +9,7 @@ interface TreeUIProps {
 }
 
 export const TreeUI: React.FC<TreeUIProps> = ({ gitService }) => {
+  const { exit } = useApp();
   const [treeOutput, setTreeOutput] = useState<string>('');
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
@@ -32,9 +33,9 @@ export const TreeUI: React.FC<TreeUIProps> = ({ gitService }) => {
 
         setTreeOutput(archy(data));
         setError(null);
-      } catch (error) {
-        setError(error instanceof Error ? error.message : String(error));
-        logger.error(error, 'Failed to build tree UI');
+      } catch (err) {
+        setError(err instanceof Error ? err.message : String(err));
+        logger.error(err, 'Failed to build tree UI');
       } finally {
         setLoading(false);
       }
@@ -43,6 +44,15 @@ export const TreeUI: React.FC<TreeUIProps> = ({ gitService }) => {
     buildTree();
   }, [gitService]);
 
+  useEffect(() => {
+    // Exit after loading completes (both on success and error) so the process
+    // doesn't hang. The rendered output (tree or error) remains visible in the
+    // terminal after Ink unmounts, because effects run after the render cycle.
+    if (!loading) {
+      exit();
+    }
+  }, [loading, exit]);
+
   if (loading) return <Text color="yellow">⏳ Mapping branches...</Text>;
   if (error) return <Text color="red">❌ Failed to build branch tree: {error}</Text>;