acker-dacker 0.1.0 → 0.2.0

package/src/{git-handoff.ts → git/git-handoff.ts}

@@ -1,4 +1,4 @@
-import { chmod, lstat, mkdir, mkdtemp, readlink, realpath, rm, stat, symlink } from 'node:fs/promises';
+import { chmod, lstat, mkdir, mkdtemp, open, readlink, realpath, rm, stat, symlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { resolveGitWorktree } from './git';
@@ -7,6 +7,7 @@ import {
     resolveGitHandoffProfile,
     snapshotFile,
     validateHandoffSymlink,
+    validateSourceAncestry,
 } from './git-handoff-selection';
 import type {
     FileSnapshot,
@@ -15,11 +16,12 @@ import type {
     GitHandoffProfile,
     GitHandoffSelection,
 } from './git-handoff-selection';
-import { compareStableStrings, isPathWithin } from './path-patterns';
-import { createZipFile } from './zip';
+import { compareStableStrings, isPathWithin } from '../pack/path-patterns';
+import { createZipFile } from '../zip/zip';
 
 type GitHandoffReport = {
     readonly excluded: {
+        readonly deletedTrackedCount: number;
         readonly explicit: {
             readonly total: number;
             readonly patterns: readonly GitHandoffExclusion[];
@@ -44,6 +46,7 @@ type GitHandoffReport = {
     readonly version: 1;
 };
 
+
 type GitHandoffStats = {
     bytes: number;
     executableCount: number;
@@ -85,11 +88,13 @@ const assertSourceUnchanged = (sourcePath: string, before: FileSnapshot, after:
     }
 };
 
-const stageGitHandoffEntry = async (
+export const stageGitHandoffEntry = async (
     rootDir: string,
+    canonicalRoot: string,
     candidate: GitHandoffCandidate,
     destinationPath: string,
 ): Promise<StagedHandoffEntry> => {
+
     const sourceStats = await lstat(candidate.sourcePath).catch((error) => {
         throw new Error(`Git handoff could not read selected path ${candidate.relativePath}: ${error}`);
     });
@@ -98,6 +103,7 @@ const stageGitHandoffEntry = async (
     await mkdir(path.dirname(destinationPath), { recursive: true });
 
     if (sourceStats.isSymbolicLink()) {
+        await validateSourceAncestry(rootDir, candidate.sourcePath, canonicalRoot);
         const linkTarget = await readlink(candidate.sourcePath);
         await validateHandoffSymlink(rootDir, candidate.sourcePath, linkTarget);
         const afterStats = await lstat(candidate.sourcePath);
@@ -119,20 +125,42 @@ const stageGitHandoffEntry = async (
         throw new Error(`Git handoff refuses special or directory path: ${candidate.relativePath}`);
     }
 
-    await Bun.write(destinationPath, Bun.file(candidate.sourcePath));
-    const afterStats = await lstat(candidate.sourcePath);
-    assertSourceUnchanged(candidate.sourcePath, before, snapshotFile(afterStats));
-    assertSourceUnchanged(candidate.sourcePath, candidate.initialSnapshot, snapshotFile(afterStats));
-    await chmod(destinationPath, sourceStats.mode & 0o7777);
-    return {
-        bytes: sourceStats.size,
-        isSymlink: false,
-        mode: sourceStats.mode,
-    };
+    // f5: Bind regular-file copying to a checked open descriptor with matching fstat/snapshot checks
+    const handle = await open(candidate.sourcePath, 'r').catch((error) => {
+        throw new Error(`Git handoff could not read selected path ${candidate.relativePath}: ${error}`);
+    });
+    try {
+        const fdStats = await handle.stat();
+        if (!fdStats.isFile()) {
+            throw new Error(`Git handoff refuses special or directory path: ${candidate.relativePath}`);
+        }
+        const fdSnapshot = snapshotFile(fdStats);
+        assertSourceUnchanged(candidate.sourcePath, candidate.initialSnapshot, fdSnapshot);
+        assertSourceUnchanged(candidate.sourcePath, before, fdSnapshot);
+
+        await validateSourceAncestry(rootDir, candidate.sourcePath, canonicalRoot);
+
+        const content = await handle.readFile();
+        await Bun.write(destinationPath, content);
+        await chmod(destinationPath, fdStats.mode & 0o7777);
+
+        const afterStats = await lstat(candidate.sourcePath);
+        assertSourceUnchanged(candidate.sourcePath, before, snapshotFile(afterStats));
+        assertSourceUnchanged(candidate.sourcePath, candidate.initialSnapshot, snapshotFile(afterStats));
+
+        return {
+            bytes: fdStats.size,
+            isSymlink: false,
+            mode: fdStats.mode,
+        };
+    } finally {
+        await handle.close();
+    }
 };
 
 const stageGitHandoffFiles = async (
     rootDir: string,
+    canonicalRoot: string,
     stagingRoot: string,
     candidates: readonly GitHandoffCandidate[],
 ): Promise<GitHandoffStats> => {
@@ -148,7 +176,7 @@ const stageGitHandoffFiles = async (
 
     for (const candidate of candidates) {
         const destinationPath = path.join(archiveRoot, candidate.relativePath);
-        const staged = await stageGitHandoffEntry(rootDir, candidate, destinationPath);
+        const staged = await stageGitHandoffEntry(rootDir, canonicalRoot, candidate, destinationPath);
         stats.bytes += staged.bytes;
         stats.includedPaths.push(candidate.archivePath);
         if (candidate.isTracked) {
@@ -171,6 +199,7 @@ const makeGitHandoffReport = (
     stats: GitHandoffStats,
 ): GitHandoffReport => ({
     excluded: {
+        deletedTrackedCount: selection.deletedTrackedCount,
         explicit: {
             patterns: selection.explicitExclusions,
             total: selection.explicitExclusionTotal,
@@ -203,7 +232,7 @@ const emitGitHandoffReport = async (report: GitHandoffReport, reportFile: string
         `[git-handoff] Metadata: ${report.included.executableCount} executable files, ${report.included.symlinkCount} symlinks.`,
     );
     console.log(
-        `[git-handoff] Omitted ${report.excluded.explicit.total} explicit, ${report.excluded.filterCount} filter, ${report.excluded.profileFilteredCount} profile, ${report.excluded.sensitiveUntrackedCount} sensitive untracked, and ${report.excluded.safetyFilteredUntrackedCount} total safety-filtered untracked paths.`,
+        `[git-handoff] Omitted ${report.excluded.explicit.total} explicit, ${report.excluded.deletedTrackedCount} deleted tracked, ${report.excluded.filterCount} filter, ${report.excluded.profileFilteredCount} profile, ${report.excluded.sensitiveUntrackedCount} sensitive untracked, and ${report.excluded.safetyFilteredUntrackedCount} total safety-filtered untracked paths.`,
     );
     if (reportFile) {
         await mkdir(path.dirname(reportFile), { recursive: true });
@@ -212,24 +241,49 @@ const emitGitHandoffReport = async (report: GitHandoffReport, reportFile: string
     }
 };
 
+export const resolveCanonicalArtifactPath = async (targetPath: string): Promise<string> => {
+    const absolutePath = path.resolve(targetPath);
+    let current = absolutePath;
+    const tailSegments: string[] = [];
+
+    while (true) {
+        const stats = await lstat(current).catch(() => null);
+        if (stats) {
+            const real = await realpath(current);
+            return tailSegments.length > 0 ? path.join(real, ...tailSegments.reverse()) : real;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return tailSegments.length > 0 ? path.join(current, ...tailSegments.reverse()) : current;
+        }
+        tailSegments.push(path.basename(current));
+        current = parent;
+    }
+};
+
 const validateHandoffArtifactPath = async (
     rootDir: string,
+    canonicalRootDir: string,
     artifactPath: string,
     label: string,
-): Promise<void> => {
+): Promise<string> => {
     const resolvedArtifactPath = path.resolve(artifactPath);
     const existingStats = await lstat(resolvedArtifactPath).catch(() => null);
     if (existingStats?.isSymbolicLink()) {
         throw new Error(`Git handoff refuses a symlink ${label} path: ${resolvedArtifactPath}`);
     }
 
-    const resolvedParent = await realpath(path.dirname(resolvedArtifactPath)).catch(() =>
-        path.dirname(resolvedArtifactPath),
-    );
-    const canonicalArtifactPath = path.join(resolvedParent, path.basename(resolvedArtifactPath));
-    if (isPathWithin(resolvedArtifactPath, rootDir) || isPathWithin(canonicalArtifactPath, rootDir)) {
+    const canonicalArtifactPath = await resolveCanonicalArtifactPath(resolvedArtifactPath);
+    if (
+        isPathWithin(resolvedArtifactPath, rootDir) ||
+        isPathWithin(canonicalArtifactPath, rootDir) ||
+        isPathWithin(resolvedArtifactPath, canonicalRootDir) ||
+        isPathWithin(canonicalArtifactPath, canonicalRootDir)
+    ) {
         throw new Error(`Git handoff ${label} must be outside the Git worktree: ${resolvedArtifactPath}`);
     }
+
+    return canonicalArtifactPath;
 };
 
 export const runGitHandoff = async ({
@@ -242,16 +296,43 @@ export const runGitHandoff = async ({
 }: GitHandoffOptions): Promise<void> => {
     const resolvedProfile = resolveGitHandoffProfile(profile);
     const rootDir = await resolveGitWorktree(targetDir);
+    const canonicalRootDir = await realpath(rootDir);
     const resolvedOutputFile = path.resolve(
         outputFile ?? path.join(process.cwd(), `${path.basename(rootDir)}-git-handoff.zip`),
     );
+    const canonicalOutputFile = await validateHandoffArtifactPath(
+        rootDir,
+        canonicalRootDir,
+        resolvedOutputFile,
+        'output',
+    );
+    let canonicalReportFile: string | null = null;
     const resolvedReportFile = reportFile ? path.resolve(reportFile) : null;
-    if (resolvedReportFile === resolvedOutputFile) {
-        throw new Error('Git handoff output and report paths must be different.');
-    }
-    await validateHandoffArtifactPath(rootDir, resolvedOutputFile, 'output');
     if (resolvedReportFile) {
-        await validateHandoffArtifactPath(rootDir, resolvedReportFile, 'report');
+        canonicalReportFile = await validateHandoffArtifactPath(
+            rootDir,
+            canonicalRootDir,
+            resolvedReportFile,
+            'report',
+        );
+    }
+    if (resolvedReportFile !== null && canonicalReportFile !== null) {
+        if (canonicalReportFile === canonicalOutputFile || resolvedReportFile === resolvedOutputFile) {
+            throw new Error('Git handoff output and report paths must be different.');
+        }
+
+        const [outputStats, reportStats] = await Promise.all([
+            lstat(resolvedOutputFile).catch(() => null),
+            lstat(resolvedReportFile).catch(() => null),
+        ]);
+        if (
+            outputStats &&
+            reportStats &&
+            outputStats.dev === reportStats.dev &&
+            outputStats.ino === reportStats.ino
+        ) {
+            throw new Error('Git handoff output and report paths must be different.');
+        }
     }
     console.log(`[git-handoff] Git worktree: ${rootDir}`);
     if (filters.length > 0) {
@@ -271,7 +352,7 @@ export const runGitHandoff = async ({
 
     const stagingRoot = await mkdtemp(path.join(tmpdir(), 'pack-repo-git-handoff-'));
     try {
-        const stats = await stageGitHandoffFiles(rootDir, stagingRoot, selection.candidates);
+        const stats = await stageGitHandoffFiles(rootDir, canonicalRootDir, stagingRoot, selection.candidates);
         const report = makeGitHandoffReport(selection, stats);
         if (report.included.count === 0) {
             await emitGitHandoffReport(report, resolvedReportFile);

package/src/{git.ts → git/git.ts}

@@ -1,5 +1,6 @@
 import { realpath } from 'node:fs/promises';
 import path from 'node:path';
+import { compareStableStrings } from '../pack/path-patterns';
 
 export type ExternalCommandResult = {
     readonly exitCode: number;
@@ -82,3 +83,79 @@ export const resolveGitWorktree = async (targetDir: string): Promise<string> =>
     }
     return await realpath(path.resolve(rootOutput));
 };
+
+export const getGitConfigValue = async (key: string, cwd: string): Promise<string | null> => {
+    try {
+        const result = await runExternalCommand('git', ['-C', cwd, 'config', '--get', key], cwd);
+        if (result.exitCode === 0) {
+            const value = new TextDecoder().decode(result.stdout).trim();
+            return value.length > 0 ? value : null;
+        }
+    } catch {
+        // Git command unavailable or directory not a worktree
+    }
+    return null;
+};
+
+export const getGitCheckoutTag = async (cwd: string): Promise<string | null> => {
+    try {
+        const result = await runExternalCommand('git', ['-C', cwd, 'tag', '--points-at', 'HEAD'], cwd);
+        if (result.exitCode === 0) {
+            const output = new TextDecoder().decode(result.stdout).trim();
+            if (output.length === 0) {
+                return null;
+            }
+            const tags = output
+                .split('\n')
+                .map((tag) => tag.trim())
+                .filter((tag) => tag.length > 0);
+
+            if (tags.length === 0) {
+                return null;
+            }
+
+            // Prefer tags that match version patterns (e.g. v2.33, 1.0.0, v0.1.0-alpha)
+            const versionPattern = /^v?\d+(\.\d+)*([.-].+)?$/;
+            const versionTags = tags.filter((tag) => versionPattern.test(tag));
+            if (versionTags.length > 0) {
+                // If multiple version tags, sort them and return the last (highest numeric version)
+                versionTags.sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+                return versionTags[versionTags.length - 1]!; // highest version
+            }
+            tags.sort(compareStableStrings);
+            return tags[0]!;
+        }
+    } catch {
+        // Git command unavailable or directory not a worktree
+    }
+    return null;
+};
+
+export const getGitShortCommitHash = async (cwd: string): Promise<string | null> => {
+    try {
+        const result = await runExternalCommand('git', ['-C', cwd, 'rev-parse', '--short', 'HEAD'], cwd);
+        if (result.exitCode === 0) {
+            const hash = new TextDecoder().decode(result.stdout).trim();
+            return hash.length > 0 ? hash : null;
+        }
+    } catch {
+        // Git command unavailable or directory not a worktree
+    }
+    return null;
+};
+
+export const getGitInfoExcludePath = async (cwd: string): Promise<string | null> => {
+    try {
+        const result = await runExternalCommand('git', ['-C', cwd, 'rev-parse', '--git-path', 'info/exclude'], cwd);
+        if (result.exitCode === 0) {
+            const relOrAbs = new TextDecoder().decode(result.stdout).trim();
+            if (relOrAbs.length > 0) {
+                return path.resolve(cwd, relOrAbs);
+            }
+        }
+    } catch {
+        // Git command unavailable or directory not a worktree
+    }
+    return null;
+};
+

package/{index.ts → src/index.ts}

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { main } from './src/cli';
+import { main } from './cli/cli';
 
 try {
     await main();

package/src/{file-policy.ts → pack/file-policy.ts}

@@ -41,6 +41,7 @@ const ALLOWED_ENV_FILES = new Set(['.env.example', '.env.sample', '.env.template
 
 const EXCLUDED_FILE_NAMES = new Set([
     '.DS_Store',
+    '.git',
     '.gitignore',
     '.npmrc',
     '.pypirc',

package/src/pack/gitignore.ts

@@ -0,0 +1,272 @@
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { getGitConfigValue, getGitInfoExcludePath } from '../git/git';
+import { globPatternToRegexSource, isPathWithin, normalizeArchivePath } from './path-patterns';
+
+type GitIgnoreRule = {
+    readonly directoryOnly: boolean;
+    readonly matcher: RegExp;
+    readonly negated: boolean;
+};
+
+const parseGitIgnoreRule = (line: string): GitIgnoreRule | null => {
+    let pattern = line.replace(/[ \t]+$/u, '');
+    if (pattern.length === 0 || pattern.startsWith('#')) {
+        return null;
+    }
+
+    const escapedLeadingMarker = pattern.startsWith('\\#') || pattern.startsWith('\\!');
+    if (escapedLeadingMarker) {
+        pattern = pattern.slice(1);
+    }
+
+    let negated = false;
+    if (!escapedLeadingMarker && pattern.startsWith('!')) {
+        negated = true;
+        pattern = pattern.slice(1);
+    }
+
+    const directoryOnly = pattern.endsWith('/') && !pattern.endsWith('\\/');
+    if (directoryOnly) {
+        pattern = pattern.slice(0, -1);
+    }
+
+    const anchored = pattern.startsWith('/');
+    if (anchored) {
+        pattern = pattern.slice(1);
+    }
+    if (pattern.length === 0) {
+        return null;
+    }
+
+    const hasSlash = pattern.includes('/');
+    const source = globPatternToRegexSource(pattern);
+    const matcher = new RegExp(anchored || hasSlash ? `^${source}$` : `(?:^|/)${source}(?:$|/)`);
+
+    return { directoryOnly, matcher, negated };
+};
+
+const parseGitIgnoreRules = (contents: string, filePath: string): readonly GitIgnoreRule[] => {
+    const rules: GitIgnoreRule[] = [];
+    const lines = contents.split(/\r?\n/u);
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index]!;
+        try {
+            const rule = parseGitIgnoreRule(line);
+            if (rule) {
+                rules.push(rule);
+            }
+        } catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`Invalid ignore rule in ${filePath}:${index + 1}: "${line}" (${detail})`);
+        }
+    }
+    return rules;
+};
+
+const matchesGitIgnoreRule = (rule: GitIgnoreRule, relativePath: string, isDirectory: boolean): boolean => {
+    if (!rule.directoryOnly || isDirectory) {
+        return rule.matcher.test(relativePath);
+    }
+
+    const segments = relativePath.split('/');
+    for (let end = 1; end < segments.length; end += 1) {
+        if (rule.matcher.test(segments.slice(0, end).join('/'))) {
+            return true;
+        }
+    }
+    return false;
+};
+
+export const resolveGlobalGitIgnorePaths = async (cwd?: string): Promise<readonly string[]> => {
+    if (process.env.ACKER_DACKER_GLOBAL_GITIGNORE !== undefined) {
+        const val = process.env.ACKER_DACKER_GLOBAL_GITIGNORE.trim();
+        if (val.length === 0 || val === 'none') {
+            return [];
+        }
+        return [path.resolve(process.cwd(), val)];
+    }
+
+    const home = process.env.HOME || homedir();
+    const effectiveHome = home && home.trim().length > 0 ? home : null;
+    const paths: string[] = [];
+
+    // 1. Check git config core.excludesfile
+    const searchDir = cwd ?? process.cwd();
+    const configPath = await getGitConfigValue('core.excludesfile', searchDir);
+    if (configPath !== null) {
+        // core.excludesfile was explicitly configured. Even if missing on disk,
+        // it suppresses the XDG / home fallback.
+        if (configPath.trim().length > 0) {
+            let resolved: string | null = null;
+            if (configPath.startsWith('~')) {
+                if (effectiveHome) {
+                    resolved = path.resolve(effectiveHome, configPath.replace(/^~(?=$|\/|\\)/, ''));
+                }
+            } else {
+                resolved = path.resolve(searchDir, configPath);
+            }
+            if (resolved && (await Bun.file(resolved).exists())) {
+                paths.push(resolved);
+            }
+        }
+        return paths;
+    }
+
+    // 2. If no configured core.excludesfile was found, check standard XDG/home locations
+    const xdgConfigHome = process.env.XDG_CONFIG_HOME;
+    const xdgIgnore = xdgConfigHome
+        ? path.join(xdgConfigHome, 'git', 'ignore')
+        : effectiveHome
+          ? path.join(effectiveHome, '.config', 'git', 'ignore')
+          : null;
+
+    if (xdgIgnore && (await Bun.file(xdgIgnore).exists())) {
+        paths.push(xdgIgnore);
+    }
+
+    return paths;
+};
+
+export type GitIgnoreMatcherOptions = {
+    readonly globalIgnorePaths?: readonly string[];
+};
+
+export class GitIgnoreMatcher {
+    private readonly rulesByDirectory = new Map<string, readonly GitIgnoreRule[]>();
+    private globalRules: readonly GitIgnoreRule[] | null = null;
+    private infoExcludeRules: readonly GitIgnoreRule[] | null = null;
+    private readonly explicitGlobalIgnorePaths?: readonly string[];
+
+    public constructor(
+        private readonly rootDir: string,
+        options?: GitIgnoreMatcherOptions,
+    ) {
+        this.explicitGlobalIgnorePaths = options?.globalIgnorePaths;
+    }
+
+    private async loadGlobalRules(): Promise<readonly GitIgnoreRule[]> {
+        if (this.globalRules !== null) {
+            return this.globalRules;
+        }
+
+        const candidatePaths =
+            this.explicitGlobalIgnorePaths !== undefined
+                ? [...this.explicitGlobalIgnorePaths]
+                : [...(await resolveGlobalGitIgnorePaths(this.rootDir))];
+
+        const rules: GitIgnoreRule[] = [];
+        for (const filePath of candidatePaths) {
+            const file = Bun.file(filePath);
+            if (await file.exists()) {
+                rules.push(...parseGitIgnoreRules(await file.text(), filePath));
+            }
+        }
+
+        this.globalRules = rules;
+        return rules;
+    }
+
+    private async loadInfoExcludeRules(): Promise<readonly GitIgnoreRule[]> {
+        if (this.infoExcludeRules !== null) {
+            return this.infoExcludeRules;
+        }
+
+        const candidatePath =
+            (await getGitInfoExcludePath(this.rootDir)) ?? path.join(this.rootDir, '.git', 'info', 'exclude');
+
+        const file = Bun.file(candidatePath);
+        if (!(await file.exists())) {
+            this.infoExcludeRules = [];
+            return [];
+        }
+
+        const rules = parseGitIgnoreRules(await file.text(), candidatePath);
+        this.infoExcludeRules = rules;
+        return rules;
+    }
+
+    private async rulesForDirectory(directory: string): Promise<readonly GitIgnoreRule[]> {
+        const cachedRules = this.rulesByDirectory.get(directory);
+        if (cachedRules) {
+            return cachedRules;
+        }
+
+        const ignorePath = path.join(directory, '.gitignore');
+        const ignoreFile = Bun.file(ignorePath);
+        if (!(await ignoreFile.exists())) {
+            this.rulesByDirectory.set(directory, []);
+            return [];
+        }
+
+        const rules = parseGitIgnoreRules(await ignoreFile.text(), ignorePath);
+        this.rulesByDirectory.set(directory, rules);
+        return rules;
+    }
+
+    public async isIgnored(absolutePath: string, isDirectory: boolean): Promise<boolean> {
+        const parentDirectory = path.dirname(absolutePath);
+        if (!isPathWithin(parentDirectory, this.rootDir)) {
+            return false;
+        }
+
+        const directories: string[] = [];
+        let directory = parentDirectory;
+        while (true) {
+            directories.push(directory);
+            if (directory === this.rootDir) {
+                break;
+            }
+
+            const parent = path.dirname(directory);
+            if (parent === directory || !isPathWithin(parent, this.rootDir)) {
+                return false;
+            }
+            directory = parent;
+        }
+
+        directories.reverse();
+
+        let ignored = false;
+        const rootRelativePath = normalizeArchivePath(path.relative(this.rootDir, absolutePath));
+
+        // 1. Evaluate global rules
+        if (rootRelativePath.length > 0 && rootRelativePath !== '..' && !rootRelativePath.startsWith('../')) {
+            const globalRules = await this.loadGlobalRules();
+            for (const rule of globalRules) {
+                if (matchesGitIgnoreRule(rule, rootRelativePath, isDirectory)) {
+                    ignored = !rule.negated;
+                }
+            }
+        }
+
+        // 2. Evaluate repository info/exclude rules (precedence over global, lower than .gitignore)
+        if (rootRelativePath.length > 0 && rootRelativePath !== '..' && !rootRelativePath.startsWith('../')) {
+            const infoExcludeRules = await this.loadInfoExcludeRules();
+            for (const rule of infoExcludeRules) {
+                if (matchesGitIgnoreRule(rule, rootRelativePath, isDirectory)) {
+                    ignored = !rule.negated;
+                }
+            }
+        }
+
+        // 3. Evaluate directory .gitignore rules from rootDir down to target path's directory
+        for (const ruleDirectory of directories) {
+            const relativePath = normalizeArchivePath(path.relative(ruleDirectory, absolutePath));
+            if (relativePath.length === 0 || relativePath === '..' || relativePath.startsWith('../')) {
+                continue;
+            }
+
+            const rules = await this.rulesForDirectory(ruleDirectory);
+            for (const rule of rules) {
+                if (matchesGitIgnoreRule(rule, relativePath, isDirectory)) {
+                    ignored = !rule.negated;
+                }
+            }
+        }
+
+        return ignored;
+    }
+}
+
+