daemon-sec-cheatsheet

commit 1b916cd283b7b20a7edda8ff4b148ed0cd420644
parent da75f457d3d99669e05cccdd85b4ef2160f3e56c
Author: DAEMON <zer0sec.xp@icloud.com>
Date:   Mon, 28 Sep 2026 04:25:12 +0100

Keep fetch-ired.py scratch out of the working copy

The helper defaulted its --get cache to <repo>/.ired-cache, so a run left
research markdown sitting in jj status. Default to the system temp dir
instead, and ignore the old path in case it is ever pointed back inside.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Diffstat:
M
.gitignore
 | 
2
++
M
scripts/fetch-ired.py
 | 
9
++++++++-

2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/.gitignore b/.gitignore
@@ -13,3 +13,5 @@ candidates.json
 .playwright-mcp/
 .vercel
 .env*
+# fetch-ired.py research scratch, if ever pointed back inside the repo
+.ired-cache/
diff --git a/scripts/fetch-ired.py b/scripts/fetch-ired.py
@@ -26,13 +26,20 @@ import json
 import os
 import re
 import sys
+import tempfile
 import urllib.error
 import urllib.request
 from urllib.parse import quote
 
 ROOT = os.path.normpath(os.path.join(os.path.dirname(os.path.abspath(__file__)), ".."))
 SOURCE_JSON = os.path.join(ROOT, "src", "data", "ired-source.json")
-DEFAULT_OUT = os.environ.get("CLAUDE_SCRATCHPAD") or os.path.join(ROOT, ".ired-cache")
+# Scratch belongs outside the working copy. An earlier default of
+# `<repo>/.ired-cache` meant every helper run dropped research markdown into
+# `jj status`, which is noise at best and an accidental commit at worst.
+DEFAULT_OUT = (
+    os.environ.get("CLAUDE_SCRATCHPAD")
+    or os.path.join(tempfile.gettempdir(), "ired-cache")
+)
 
 
 def load_source() -> dict: