@webpieces/rules-config 0.4.737 → 0.4.739

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.737",
+  "version": "0.4.739",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/templates/webpieces.location-matrix.md

@@ -11,8 +11,11 @@ decides whether the tooling can be trusted cannot be configured by the file it h
 
 
 **Code:** `packages/tooling/ai-hook-rules/src/core/effective-tree.ts` (`EffectiveTreeResolver`,
-`TreeKind`) · `packages/tooling/ai-hook-rules/src/core/runner.ts` (`l1LocationBlock`,
-`filterByExcludedPaths`, the `foreign` check) · `.../force-to-root.ts` (`ForceToRootGuard`) ·
+`TreeKind`) · `packages/tooling/ai-hook-rules/src/core/target-tree.ts` (`TargetTreeResolver`,
+`GovernedPath` — the same question asked about a FILE) ·
+`packages/tooling/ai-hook-rules/src/core/runner.ts` (`l1LocationBlock`, the `foreign` check) ·
+`packages/tooling/ai-hook-rules/src/core/excluded-paths.ts` (`filterByExcludedPaths`) ·
+`.../force-to-root.ts` (`ForceToRootGuard`) ·
 `packages/tooling/ai-hook-rules/src/core/missing-directory.ts` (`MissingDirectoryGuard`) ·
 `packages/tooling/ai-hook-rules/src/core/version-sync.ts` (`VersionSyncGuard`,
 `WebpiecesVersions`).
@@ -75,6 +78,15 @@ NO companion `".webpieces/**"` glob seeded into `excludePaths`: a config entry t
 nothing is a second and WEAKER spelling — the matcher below misses the bare directory that the
 predicate matches — and it invites a consumer to delete it and believe the exemption went too.
 
+<!-- webpieces-disable no-state-paths-in-templates -- this paragraph's subject IS the two spellings of the state dir; a computed path would print one of them and lose the contrast -->
+The skip is asked about the path relative to the tree that **OWNS** the file, not to the governed
+root, and the two differ in exactly one place: a linked worktree. `<primary>/.webpieces/…` was
+exempt while `<primary>/.claude/worktrees/agent-＜id＞/.webpieces/pr-review/…/review.json` — the same
+kind of file, in a worktree's own state dir — was not, because governed-root-relative it begins
+`.claude`. That is the file `wp-review-upsert-pr` REQUIRES before `wp-finish-upsert-pr` will open a
+PR, so the guard could forbid a file the gate demands (issue #851). `GovernedPath` carries both
+spellings together so a caller cannot reach for the wrong one.
+
 `excludePaths` is **ONE glob list** (canonical: `"excludePaths": ["repositories/**"]`). The
 `{ rules: [...], guards: [...] }` object is **retired and rejected**, with the union it must become
 named in the error. `wp-install-ai-hooks` migrates it in place.
@@ -190,6 +202,7 @@ section head (neither the shell's cwd nor a `cd`'s persistence can be assumed).
 | 18 | every command from a worktree another agent REAPED mid-session is blocked | `m` — row 7 | BLOCK_AI_CURE | Option 1 (preferred): run the printed `cd <root> && <the work>` line — it does NOT route back through the dead path<br>Do NOT: re-`cd` into the worktree, or `git worktree add` it back expecting your uncommitted work; that work is gone |
 | 19 | the same block for a NON-git command there — `m` does not care about G | `m` — row 7; K alone decides it | BLOCK_AI_CURE | Option 1 (preferred): the same printed line. A vanished cwd is not a git question — nothing at all can run in a directory that does not exist |
 | 20 | Write `.webpieces/worktrees/agent-＊/pr-review/…/review-＊.json` allowed on main, with `excludePaths` empty | filter — `.webpieces/` is HARD-CODED exempt (`isWebpiecesStateDir`), ahead of the config list | ALLOW_EXEMPT | none needed — the dir is gitignored, so no config can put it back under governance |
+| 21 | Write a reviewer verdict into a WORKTREE's own state dir — the `.webpieces` under `.claude/worktrees/agent-＊`, not the primary's | filter — the state-dir skip is asked about the path relative to the tree that OWNS it, not the governed root | ALLOW_EXEMPT | none — it was NOT exempt before (governed-root-relative that path begins `.claude`), and `wp-review-upsert-pr` requires the file before a PR can be opened |
 
 Row 8 is the one that changed. It used to be ALLOWED, because the predicate was
 `shellAtRoot || cdsToRoot` — two variables OR'd, so the same destination got opposite verdicts
@@ -242,6 +255,7 @@ That resolver has three consumers — L1's K, L2's scope dimension, and `exclude
 | trinary-version-skew (row 8), V, R | `ai-hook-rules/src/core/version-sync.ts` | `VersionSyncGuard`, `WebpiecesVersions` |
 | force-to-root (row 5) | `ai-hook-rules/src/core/force-to-root.ts` | `ForceToRootGuard` |
 | the directory is gone (row 7) | `ai-hook-rules/src/core/missing-directory.ts` | `MissingDirectoryGuard` |
-| the filter | `ai-hook-rules/src/core/runner.ts` | `filterByExcludedPaths` |
+| the filter | `ai-hook-rules/src/core/excluded-paths.ts` | `filterByExcludedPaths` |
+| which tree owns a TARGET PATH | `ai-hook-rules/src/core/target-tree.ts` | `TargetTreeResolver`, `GovernedPath` |
 | `excludePaths` shape | `rules-config/src/exclude-hook-paths.ts`, `validate-config.ts`, `retired-config-keys.ts` | `ExcludePaths`, `validateExcludePaths` |
 | the `.webpieces/` skip | `rules-config/src/exclude-hook-paths.ts` | `isWebpiecesStateDir` |