fix: exclude .claude-pr snapshot from git staging (#1277)

src/github/operations/restore-config.ts

@@ -1,5 +1,13 @@
 import { execFileSync } from "child_process";
-import { cpSync, existsSync, rmSync } from "fs";
+import {
+  appendFileSync,
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+} from "fs";
+import { dirname } from "path";
 
 // Paths that are both PR-controllable and read from cwd at CLI startup.
 //
@@ -20,6 +28,30 @@ const SENSITIVE_PATHS = [
   ".husky",
 ];
 
+const CLAUDE_PR_EXCLUDE_PATTERN = "/.claude-pr/";
+
+function ensureClaudePrExcludedFromGit(): void {
+  const excludePath = execFileSync(
+    "git",
+    ["rev-parse", "--git-path", "info/exclude"],
+    { encoding: "utf8" },
+  ).trim();
+
+  const excludeContents = existsSync(excludePath)
+    ? readFileSync(excludePath, "utf8")
+    : "";
+
+  if (excludeContents.split(/\r?\n/).includes(CLAUDE_PR_EXCLUDE_PATTERN)) {
+    return;
+  }
+
+  mkdirSync(dirname(excludePath), { recursive: true });
+
+  const prefix =
+    excludeContents.length === 0 || excludeContents.endsWith("\n") ? "" : "\n";
+  appendFileSync(excludePath, `${prefix}${CLAUDE_PR_EXCLUDE_PATTERN}\n`);
+}
+
 /**
  * Restores security-sensitive config paths from the PR base branch.
  *
@@ -59,8 +91,9 @@ export function restoreConfigFromBase(baseBranch: string): void {
   }
   if (existsSync(".claude-pr")) {
     console.log(
-      "Preserved PR's sensitive paths → .claude-pr/ for review agents (not executed)",
+      "Preserved PR's sensitive paths -> .claude-pr/ for review agents (not executed)",
     );
+    ensureClaudePrExcludedFromGit();
   }
 
   // Delete PR-controlled versions BEFORE fetching so the attacker-controlled