@adaptic/maestro 1.5.0 → 1.5.1

package/bin/maestro.mjs

@@ -741,6 +741,62 @@ function walkFiles(root) {
   return out;
 }
 
+// .maestroignore — gitignore-style allowlist of paths the upgrade must NOT
+// touch. Supports comments (#), directory prefixes (trailing /), exact paths,
+// simple globs (* matches a single path segment, ** matches recursively), and
+// negation (! prefix to un-ignore). Match order is top-to-bottom; last match
+// wins, like .gitignore.
+function loadMaestroignore(cwd) {
+  const file = join(cwd, ".maestroignore");
+  if (!existsSync(file)) return null;
+  const patterns = [];
+  for (const raw of readFileSync(file, "utf-8").split(/\r?\n/)) {
+    const stripped = raw.replace(/^\s+|\s+$/g, "");
+    if (!stripped || stripped.startsWith("#")) continue;
+    const negate = stripped.startsWith("!");
+    const pat = negate ? stripped.slice(1).trim() : stripped;
+    if (!pat) continue;
+    patterns.push({ pat, negate });
+  }
+  return patterns.length ? patterns : null;
+}
+
+function patternToRegex(pat) {
+  // Directory prefix: `scripts/daemon/` matches scripts/daemon/* (recursive)
+  if (pat.endsWith("/")) {
+    const prefix = pat.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    return new RegExp("^" + prefix);
+  }
+  // Glob with * and **.
+  // Step order matters: ** must be captured before single * to preserve
+  // recursive semantics. * is intentionally NOT in the regex-escape char
+  // class so we can rewrite it after escaping the other specials.
+  if (pat.includes("*")) {
+    const escaped = pat
+      .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+      .replace(/\*\*/g, "<DBL>")
+      .replace(/\*/g, "[^/]*")
+      .replace(/<DBL>/g, ".*");
+    return new RegExp("^" + escaped + "$");
+  }
+  // Exact: also match anything underneath (a path like `scripts/daemon`
+  // without trailing slash should still protect the whole directory if
+  // it resolves to one — gitignore semantics).
+  const escaped = pat.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  return new RegExp("^" + escaped + "(/|$)");
+}
+
+function matchesIgnore(repoRel, patterns) {
+  if (!patterns) return false;
+  let ignored = false;
+  for (const { pat, negate } of patterns) {
+    if (patternToRegex(pat).test(repoRel)) {
+      ignored = !negate;
+    }
+  }
+  return ignored;
+}
+
 function isGitRepo(cwd) {
   try {
     execFileSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd, stdio: "pipe" });
@@ -804,6 +860,23 @@ Flags:
   --no-incoming          Don't write .maestro/incoming/ shadows for preserved files
   --verbose, -v          Print classification for every file
   --help, -h             Show this help
+
+Per-file behaviour:
+  added     — new upstream file → copy
+  updated   — existed, byte-equal to your committed copy → safe overwrite
+  same      — existed and already byte-identical to upstream → skip
+  ignored   — matches a pattern in .maestroignore → never touched (any state)
+  preserved — has uncommitted local edits → keep yours, upstream lands at
+              .maestro/incoming/<path> for manual diff
+  mergeKept — under agents/ → never overwrite (custom agents preserved)
+  forced    — overwritten by --force-overwrite; backup at .maestro/backup/<path>
+
+.maestroignore format (gitignore-style, top-down, last match wins):
+  scripts/slack-send.sh          exact file
+  scripts/daemon/                directory and everything beneath
+  scripts/send-email-*.py        single-segment glob
+  workflows/**                   recursive glob
+  !workflows/quarterly/          un-ignore (force overwrite)
 `);
     return;
   }
@@ -823,12 +896,17 @@ Flags:
   }
 
   const dirty = inGit ? dirtyPathSet(cwd) : null;
+  const ignorePatterns = loadMaestroignore(cwd);
+  if (ignorePatterns) {
+    log(`.maestroignore loaded (${ignorePatterns.length} pattern${ignorePatterns.length === 1 ? "" : "s"})`);
+  }
 
   const banner = flags.dryRun ? "DRY RUN — " : "";
   log(`${banner}Upgrading framework files from @adaptic/maestro...`);
 
-  const counts = { added: 0, updated: 0, same: 0, preserved: 0, mergeKept: 0, forced: 0 };
+  const counts = { added: 0, updated: 0, same: 0, ignored: 0, preserved: 0, mergeKept: 0, forced: 0 };
   const preservedFiles = [];
+  const ignoredFiles = [];
 
   for (const { path: relRoot, mode } of UPGRADE_PATHS) {
     const srcRoot = join(MAESTRO_ROOT, relRoot);
@@ -841,6 +919,18 @@ Flags:
       const dstFile = join(dstRoot, relFromRoot);
       const repoRel = relative(cwd, dstFile).split(sep).join("/");
 
+      const isIgnored = matchesIgnore(repoRel, ignorePatterns);
+
+      // Case 0: .maestroignore match — never touch, regardless of state.
+      // Checked BEFORE existsSync so that protected new-files-from-upstream
+      // are never silently introduced into the agent repo either.
+      if (isIgnored) {
+        counts.ignored++;
+        ignoredFiles.push(repoRel);
+        if (flags.verbose) console.log(`  · ${repoRel} (ignored via .maestroignore)`);
+        continue;
+      }
+
       // Case 1: new file (doesn't exist in agent) — always copy.
       if (!existsSync(dstFile)) {
         if (!flags.dryRun) {
@@ -929,6 +1019,7 @@ Flags:
   if (counts.added)     ok(`${counts.added} added (new files)`);
   if (counts.updated)   ok(`${counts.updated} updated (vendored, no local edits)`);
   if (counts.same)      console.log(`  = ${counts.same} already up-to-date`);
+  if (counts.ignored)   console.log(`  · ${counts.ignored} ignored (.maestroignore protected)`);
   if (counts.mergeKept) console.log(`  ~ ${counts.mergeKept} merge-mode kept (agents/ custom files preserved)`);
   if (counts.preserved) warn(`${counts.preserved} preserved (local edits — kept your version)`);
   if (counts.forced)    warn(`${counts.forced} force-overwritten (backups in .maestro/backup/)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adaptic/maestro",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Maestro — Autonomous AI agent operating system. Deploy AI employees on dedicated Mac minis.",
   "type": "module",
   "bin": {