GodSay GitHub Publication and Privacy Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Publish a maintainable GodSay source repository without local credentials and expose a bilingual Chrome Web Store privacy policy at a stable public GitHub URL.

Architecture: Keep the credential-bearing src/local-config.js outside Git, document its empty shape in a tracked example, and exclude generated release artifacts from source control. Describe the extension’s actual browser-to-provider data flow in a root-level PRIVACY.md, then verify both the staged Git snapshot and the public GitHub result.

Tech Stack: Git, GitHub HTTPS remote, Chrome Extension Manifest V3, CommonJS/Node.js test runner, Markdown.

File Map

  • Modify .gitignore: exclude credentials, generated packages, OS metadata, and local environment files.
  • Create src/local-config.example.js: publish the safe configuration shape with empty values.
  • Create PRIVACY.md: provide the bilingual, review-facing privacy policy.
  • Modify README.md: document safe local setup and the public privacy-policy URL.
  • Create docs/superpowers/plans/2026-07-13-github-publication-privacy.md: track this implementation plan.

Task 1: Establish Repository Safety Boundaries

Files:

  • Modify: .gitignore

  • Create: src/local-config.example.js

  • Step 1: Replace local-only Git identity before publication

Run:

git config user.name "zomvs"
git config user.email "zomvs@users.noreply.github.com"
git rebase --root --exec 'git commit --amend --no-edit --reset-author'

Expected: every unpublished local commit uses a public-safe noreply identity instead of a local hostname address.

  • Step 2: Expand ignore rules

Set .gitignore to:

.DS_Store
dist/
.env
.env.*
src/local-config.js
  • Step 3: Add a safe configuration example

Create src/local-config.example.js with:

// Copy this file to local-config.js or run `npm run sync:codex-config`.
// Never commit local-config.js because it may contain an API key.
globalThis.ETH_ALPHA_LOCAL_CONFIG = {
  baseUrl: '',
  apiKey: '',
  model: ''
};
  • Step 4: Verify credential-bearing files are ignored

Run:

git check-ignore -v src/local-config.js dist/shenshuo-extension.zip .DS_Store
git status --short --ignored

Expected: src/local-config.js, dist/, and .DS_Store are reported as ignored; the example file remains untracked and eligible for commit.

Task 2: Publish the Chrome Review Privacy Policy

Files:

  • Create: PRIVACY.md

  • Step 1: Write the bilingual policy

Create PRIVACY.md with these complete sections in both Chinese and English:

  1. Effective date and product identity.
  2. Data processed: visible X post text, author handle, post URL, creation time, source-language signal, reply/repost/like counts, API endpoint, model, API key, reply-language preference, advertising toggle, and optional advertising text.
  3. Purpose: rank relevant posts, build a reply-generation prompt, call the user-selected OpenAI-compatible provider, and fill a draft for manual review.
  4. Storage: settings use chrome.storage.sync; transient post data remains in extension memory; the developer operates no collection server.
  5. Sharing: prompt data and API credentials go only to the provider selected by the user; provider handling follows its own policy; no sale, ad profiling, or unrelated transfers.
  6. User control: settings can be cleared in the extension or with Chrome extension data removal; uninstalling removes local extension data, subject to Chrome Sync behavior.
  7. Permissions: activeTab, sidePanel, storage, X/Twitter host access, and configured API host access.
  8. Chrome Limited Use: use and transfer comply with the Chrome Web Store User Data Policy, including Limited Use requirements.
  9. Security, policy updates, and GitHub Issues contact.

Use https://github.com/zomvs/godsay/issues as the support channel and https://github.com/zomvs/godsay/blob/main/PRIVACY.md as the review URL.

  • Step 2: Validate required disclosures

Run:

rg -n "Effective Date|生效日期|chrome.storage.sync|OpenAI-compatible|Limited Use|github.com/zomvs/godsay/issues" PRIVACY.md

Expected: every required term appears in the policy and the command exits successfully.

Task 3: Document Safe Setup and Verify the Source Snapshot

Files:

  • Modify: README.md

  • Step 1: Update local configuration instructions

Document both supported setup paths:

cp src/local-config.example.js src/local-config.js

or:

npm run sync:codex-config

State that src/local-config.js can contain an API key and must never be committed or shared.

  • Step 2: Add the privacy-policy link

Add a README privacy section linking to:

https://github.com/zomvs/godsay/blob/main/PRIVACY.md
  • Step 3: Run project verification

Run:

npm test
node -e "JSON.parse(require('fs').readFileSync('manifest.json','utf8')); JSON.parse(require('fs').readFileSync('package.json','utf8')); console.log('json ok')"
node --check src/core.js
node --check src/background.js
node --check src/content.js
node --check src/sidepanel.js
node --check src/options.js

Expected: 31 tests pass, JSON parsing prints json ok, and every syntax check exits successfully.

  • Step 4: Stage the intended repository files

Run:

git add .gitignore README.md PRIVACY.md manifest.json package.json icons scripts src store-assets tests docs
git status --short
git diff --cached --check

Expected: source and documentation are staged; src/local-config.js, .DS_Store, and dist/ do not appear; the diff check exits successfully.

  • Step 5: Scan the exact staged snapshot for the local API key

Run this without printing the key:

node -e "require('./src/local-config.js'); const key=globalThis.ETH_ALPHA_LOCAL_CONFIG?.apiKey||''; const files=require('child_process').execFileSync('git',['diff','--cached','--name-only','--diff-filter=ACMR'],{encoding:'utf8'}).trim().split(/\n/).filter(Boolean); const leaked=key&&files.filter(file=>require('fs').readFileSync(file).includes(key)); if(leaked.length){console.error('local API key found in staged files:',leaked.join(', '));process.exit(1)} console.log('staged secret check ok')"

Expected: staged secret check ok and exit code 0.

  • Step 6: Commit the publishable source

Run:

git commit -m "chore: publish extension source and privacy policy"

Expected: one commit records all publishable project files without ignored local data.

Task 4: Push and Verify Public Review Access

Files:

  • No file changes.

  • Step 1: Configure the remote and push main

Run:

git remote add origin https://github.com/zomvs/godsay.git
git push -u origin main

If origin already exists, run git remote set-url origin https://github.com/zomvs/godsay.git before pushing.

Expected: GitHub accepts main and configures the upstream branch.

  • Step 2: Verify remote branch parity

Run:

test "$(git rev-parse HEAD)" = "$(git ls-remote origin refs/heads/main | cut -f1)"
git status --short --branch

Expected: local and remote commit IDs match and the working tree is clean apart from ignored files.

  • Step 3: Verify unauthenticated privacy-policy access

Run:

curl -fsSL https://raw.githubusercontent.com/zomvs/godsay/main/PRIVACY.md | rg "GodSay|神说|Limited Use|chrome.storage.sync"

Expected: the public raw URL returns the policy without authentication and all required markers are present.

  • Step 4: Report the Chrome Web Store URL

Provide this URL for the Chrome Web Store privacy-policy field:

https://github.com/zomvs/godsay/blob/main/PRIVACY.md