feat: surface privacy policy and auto-gitignore shard files

- updateGitignore now adds both .supermodel/ and *.graph.* to
  .gitignore automatically on first run, so shard files never
  clutter the repo
- Show a zero-data-retention note + privacy URL before every upload
  in Generate (the sync step users care most about)
- Surface the same privacy statement in the setup wizard's Shard Mode
  step, alongside an explanation that .graph files are gitignored
  automatically

Addresses user feedback: shard files cluttering repo, and lack of
visible trust signal during code upload.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: greynewell

internal/setup/wizard.go

@@ -141,6 +141,13 @@ func Run(ctx context.Context, cfg *config.Config) error {
 	fmt.Printf("  %sAgents read them automatically via grep and cat — no extra%s\n", dWhite, reset)
 	fmt.Printf("  %sprompt changes, no new tools to learn.%s\n", dWhite, reset)
 	fmt.Println()
+	fmt.Printf("  %s🔒 Privacy: your code is uploaded for analysis and immediately%s\n", dWhite, reset)
+	fmt.Printf("  %sdeleted from our servers. Zero data retained. No training.%s\n", dWhite, reset)
+	fmt.Printf("  %s   supermodeltools.com/privacy%s\n", dWhite, reset)
+	fmt.Println()
+	fmt.Printf("  %s.graph files are generated output — they will be added to%s\n", dWhite, reset)
+	fmt.Printf("  %s.gitignore automatically so they don't clutter your repo.%s\n", dWhite, reset)
+	fmt.Println()
 	fmt.Printf("  %sDisable at any time with:%s %ssupermodel clean%s\n", dWhite, reset, bWhite, reset)
 	fmt.Println()
 

internal/shards/handler.go

@@ -147,6 +147,9 @@ func Generate(ctx context.Context, cfg *config.Config, dir string, opts Generate
 	client := api.New(cfg)
 	idemKey := newUUID()
 
+	fmt.Fprintf(os.Stderr, "  %s🔒 Your code is analyzed server-side and immediately deleted — zero data retained.%s\n", ansiDim, ansiReset)
+	fmt.Fprintf(os.Stderr, "     %ssupermodeltools.com/privacy%s\n\n", ansiDim, ansiReset)
+
 	spin = ui.Start("Uploading and analyzing repository…")
 	ir, err := client.AnalyzeShards(ctx, zipPath, "shards-"+idemKey[:8], prevDomains)
 	spin.Stop()
@@ -448,22 +451,39 @@ func Render(dir string, opts RenderOptions) error {
 	return nil
 }
 
-// updateGitignore ensures .supermodel/ is in the repo's .gitignore.
+// updateGitignore ensures .supermodel/ and *.graph.* are in the repo's .gitignore.
+// Both entries are added silently the first time Generate runs — the shard files
+// are generated output and should not be committed.
 func updateGitignore(repoDir string) error {
 	gitignorePath := filepath.Join(repoDir, ".gitignore")
-	const entry = ".supermodel/"
+
+	entries := []string{".supermodel/", "*.graph.*"}
 
 	data, err := os.ReadFile(gitignorePath)
 	if err != nil && !os.IsNotExist(err) {
 		return nil // can't read, skip silently
 	}
 
 	content := string(data)
+	existing := make(map[string]bool)
 	for _, line := range strings.Split(content, "\n") {
-		if strings.TrimSpace(line) == entry || strings.TrimSpace(line) == ".supermodel" {
-			return nil // already present
+		t := strings.TrimSpace(line)
+		existing[t] = true
+	}
+	// Treat bare ".supermodel" as equivalent to ".supermodel/"
+	if existing[".supermodel"] {
+		existing[".supermodel/"] = true
+	}
+
+	var missing []string
+	for _, e := range entries {
+		if !existing[e] {
+			missing = append(missing, e)
 		}
 	}
+	if len(missing) == 0 {
+		return nil // all entries already present
+	}
 
 	f, err := os.OpenFile(gitignorePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600) //nolint:gosec // .gitignore is a standard repo file; 0o600 satisfies gosec while remaining functional
 	if err != nil {
@@ -474,6 +494,8 @@ func updateGitignore(repoDir string) error {
 	if content != "" && !strings.HasSuffix(content, "\n") {
 		fmt.Fprintln(f)
 	}
-	fmt.Fprintln(f, entry)
+	for _, e := range missing {
+		fmt.Fprintln(f, e)
+	}
 	return nil
 }

internal/shards/render_test.go

@@ -518,33 +518,55 @@ func TestUpdateGitignore_AddsEntry(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(string(data), ".supermodel/") {
-		t.Errorf("expected .supermodel/ in gitignore: %s", data)
+	content := string(data)
+	if !strings.Contains(content, ".supermodel/") {
+		t.Errorf("expected .supermodel/ in gitignore: %s", content)
+	}
+	if !strings.Contains(content, "*.graph.*") {
+		t.Errorf("expected *.graph.* in gitignore: %s", content)
 	}
 }
 
 func TestUpdateGitignore_DoesNotDuplicate(t *testing.T) {
 	dir := t.TempDir()
-	// Call twice; the entry should appear exactly once.
+	// Call twice; each entry should appear exactly once.
 	updateGitignore(dir) //nolint:errcheck
 	updateGitignore(dir) //nolint:errcheck
 	data, _ := os.ReadFile(dir + "/.gitignore")
 	content := string(data)
-	first := strings.Index(content, ".supermodel/")
-	last := strings.LastIndex(content, ".supermodel/")
-	if first != last {
-		t.Errorf(".supermodel/ appears more than once in gitignore:\n%s", content)
+	for _, entry := range []string{".supermodel/", "*.graph.*"} {
+		if strings.Count(content, entry) != 1 {
+			t.Errorf("%q appears more than once in gitignore:\n%s", entry, content)
+		}
 	}
 }
 
 func TestUpdateGitignore_ExistingEntrySkipped(t *testing.T) {
 	dir := t.TempDir()
-	// Pre-populate with the entry
+	// Pre-populate with both entries.
+	os.WriteFile(dir+"/.gitignore", []byte(".supermodel/\n*.graph.*\n"), 0o600) //nolint:errcheck
+	updateGitignore(dir)                                                        //nolint:errcheck
+	data, _ := os.ReadFile(dir + "/.gitignore")
+	content := string(data)
+	for _, entry := range []string{".supermodel/", "*.graph.*"} {
+		if strings.Count(content, entry) != 1 {
+			t.Errorf("%q should not be duplicated: %s", entry, content)
+		}
+	}
+}
+
+func TestUpdateGitignore_AddsOnlyMissingEntries(t *testing.T) {
+	dir := t.TempDir()
+	// Pre-populate with only .supermodel/ — *.graph.* should be added.
 	os.WriteFile(dir+"/.gitignore", []byte(".supermodel/\n"), 0o600) //nolint:errcheck
 	updateGitignore(dir)                                             //nolint:errcheck
 	data, _ := os.ReadFile(dir + "/.gitignore")
-	if strings.Count(string(data), ".supermodel/") != 1 {
-		t.Errorf("should not add duplicate: %s", data)
+	content := string(data)
+	if strings.Count(content, ".supermodel/") != 1 {
+		t.Errorf(".supermodel/ should appear exactly once: %s", content)
+	}
+	if !strings.Contains(content, "*.graph.*") {
+		t.Errorf("*.graph.* should have been added: %s", content)
 	}
 }