paqad-ai 1.60.1 → 1.60.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # paqad-ai
 
+## 1.60.2
+
+### Patch Changes
+
+- 3900daf: Prevent onboarding repository discovery from scanning dot directories, ignored paths, generated trees, and nested Git checkouts.
+
 ## 1.60.1
 
 ### Patch Changes

package/dist/cli/index.js

@@ -15707,7 +15707,7 @@ function buildDetectionReport(input3) {
 init_esm_shims();
 import { existsSync as existsSync24, readFileSync as readFileSync25 } from "fs";
 import { join as join49 } from "path";
-import fg5 from "fast-glob";
+import fg6 from "fast-glob";
 
 // src/introspection/stack-introspector.ts
 init_esm_shims();
@@ -15715,8 +15715,41 @@ import { join as join47 } from "path";
 
 // src/repository/discovery.ts
 init_esm_shims();
-import { readdir as readdir4 } from "fs/promises";
+import { lstat as lstat2, readdir as readdir4 } from "fs/promises";
 import { basename as basename4, join as join42 } from "path";
+
+// src/core/fs/gitignore-scan.ts
+init_esm_shims();
+import { execFileSync as execFileSync2 } from "child_process";
+import fg5 from "fast-glob";
+var DEFAULT_SOURCE_GLOBS = ["**/*.{ts,tsx,js,jsx,mjs,cjs,vue,svelte}"];
+var DEFAULT_IGNORE_GLOBS = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/.paqad/**",
+  "**/build/**",
+  "**/vendor/**"
+];
+function dropGitIgnored(projectRoot, files) {
+  try {
+    const out = execFileSync2("git", ["check-ignore", "-z", "--stdin"], {
+      cwd: projectRoot,
+      input: files.join("\0"),
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+    const ignored = new Set(out.toString("utf8").split("\0").filter(Boolean));
+    return files.filter((f) => !ignored.has(f));
+  } catch {
+    return files;
+  }
+}
+function scanWorkingTree(projectRoot, globs = DEFAULT_SOURCE_GLOBS, ignore = DEFAULT_IGNORE_GLOBS) {
+  const listed = fg5.sync(globs, { cwd: projectRoot, ignore, onlyFiles: true });
+  return dropGitIgnored(projectRoot, listed).sort();
+}
+
+// src/repository/discovery.ts
+init_path_utils();
 var DEFAULT_SCAN_MAX_DEPTH = 5;
 var PROJECT_MARKERS = /* @__PURE__ */ new Map([
   ["package.json", "node"],
@@ -15745,9 +15778,12 @@ var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
   "build",
   "coverage",
   "dist",
+  "docs",
+  "modules",
   "node_modules",
   "out",
   "target",
+  "tests",
   "vendor"
 ]);
 var NON_CANONICAL_DIRECTORIES = /* @__PURE__ */ new Set([
@@ -15794,7 +15830,19 @@ async function walk(projectRoot, relativeDir, depth, maxDepth, candidates, ignor
     return;
   }
   const entryNames = new Set(entries.map((entry) => entry.name));
-  const markers = Array.from(PROJECT_MARKERS.keys()).filter((marker) => entryNames.has(marker));
+  const markerCandidates = Array.from(PROJECT_MARKERS.keys()).filter(
+    (marker) => entryNames.has(marker)
+  );
+  const markerPaths = markerCandidates.map((marker) => repositoryPath(relativeDir, marker));
+  const visibleMarkerPaths = new Set(dropGitIgnored(projectRoot, markerPaths));
+  const markers = markerCandidates.filter((marker) => {
+    const markerPath = repositoryPath(relativeDir, marker);
+    if (visibleMarkerPaths.has(markerPath)) {
+      return true;
+    }
+    ignoredPaths.add(markerPath);
+    return false;
+  });
   if (markers.length > 0) {
     const ecosystems = Array.from(
       new Set(markers.map((marker) => PROJECT_MARKERS.get(marker)).filter(isDefined))
@@ -15810,16 +15858,48 @@ async function walk(projectRoot, relativeDir, depth, maxDepth, candidates, ignor
   if (depth >= maxDepth) {
     return;
   }
+  const childDirectories = [];
   for (const entry of entries) {
+    const childRelativePath = repositoryPath(relativeDir, entry.name);
+    if (entry.name.startsWith(".")) {
+      ignoredPaths.add(childRelativePath);
+      continue;
+    }
     if (!entry.isDirectory()) {
       continue;
     }
-    const childRelativePath = relativeDir === "." ? entry.name : join42(relativeDir, entry.name);
     if (IGNORED_DIRECTORIES.has(entry.name) || NON_CANONICAL_DIRECTORIES.has(entry.name)) {
       ignoredPaths.add(childRelativePath);
       continue;
     }
-    await walk(projectRoot, childRelativePath, depth + 1, maxDepth, candidates, ignoredPaths);
+    childDirectories.push({
+      absolutePath: join42(absoluteDir, entry.name),
+      relativePath: childRelativePath
+    });
+  }
+  const visibleDirectories = new Set(
+    dropGitIgnored(
+      projectRoot,
+      childDirectories.map((directory) => directory.relativePath)
+    )
+  );
+  for (const child of childDirectories) {
+    if (!visibleDirectories.has(child.relativePath) || await hasVcsBoundary(child.absolutePath)) {
+      ignoredPaths.add(child.relativePath);
+      continue;
+    }
+    await walk(projectRoot, child.relativePath, depth + 1, maxDepth, candidates, ignoredPaths);
+  }
+}
+function repositoryPath(relativeDir, entryName) {
+  return toPosixPath(relativeDir === "." ? entryName : join42(relativeDir, entryName));
+}
+async function hasVcsBoundary(absoluteDir) {
+  try {
+    await lstat2(join42(absoluteDir, ".git"));
+    return true;
+  } catch {
+    return false;
   }
 }
 function classifyProjects(candidates) {
@@ -17149,7 +17229,7 @@ function matchesRuleAtRoot(projectRoot, root, rule, packageNames) {
   const absoluteRoot = root === "." ? projectRoot : join49(projectRoot, root);
   const fileMatched = rule.file ? existsSync24(join49(absoluteRoot, rule.file)) : true;
   const directoryMatched = rule.directory ? existsSync24(join49(absoluteRoot, rule.directory)) : true;
-  const patternsMatched = rule.patterns === void 0 || rule.patterns.every((pattern) => fg5.sync(pattern, { cwd: absoluteRoot }).length > 0);
+  const patternsMatched = rule.patterns === void 0 || rule.patterns.every((pattern) => fg6.sync(pattern, { cwd: absoluteRoot }).length > 0);
   const contentMatched = rule.content_match === void 0 || rule.file !== void 0 && existsSync24(join49(absoluteRoot, rule.file)) && readFileSync25(join49(absoluteRoot, rule.file), "utf8").includes(rule.content_match);
   const fieldsMatched = evaluateFieldRules(absoluteRoot, rule);
   const fieldAbsentMatched = evaluateFieldAbsentRules(absoluteRoot, rule);
@@ -17757,7 +17837,7 @@ init_esm_shims();
 
 // src/health/checker.ts
 init_esm_shims();
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync32, readdirSync as readdirSync9, readFileSync as readFileSync33, statSync as statSync4 } from "fs";
 import { join as join60, relative as relative4 } from "path";
 init_chunk_index();
@@ -17811,7 +17891,7 @@ init_runtime_paths();
 import { createHash as createHash16 } from "crypto";
 import { mkdir as mkdir21, readFile as readFile23, readdir as readdir5, rm as rm4, stat as stat5, writeFile as writeFile20 } from "fs/promises";
 import { join as join57 } from "path";
-import fg6 from "fast-glob";
+import fg7 from "fast-glob";
 
 // src/skills/frontmatter-parser.ts
 init_esm_shims();
@@ -18213,7 +18293,7 @@ var SkillCacheManager = class {
     }
   }
   async loadCacheability() {
-    const files = await fg6(
+    const files = await fg7(
       [
         "base/skills/**/SKILL.md",
         "capabilities/coding/skills/**/SKILL.md",
@@ -18242,7 +18322,7 @@ init_esm_shims();
 // src/test-output/service.ts
 init_esm_shims();
 import { readFile as readFile24 } from "fs/promises";
-import fg7 from "fast-glob";
+import fg8 from "fast-glob";
 
 // src/token-efficiency/index.ts
 init_esm_shims();
@@ -18843,7 +18923,7 @@ async function collectRawSources(options) {
     if (!options.runner.output_path_pattern) {
       return [];
     }
-    const matches = await fg7(options.runner.output_path_pattern, {
+    const matches = await fg8(options.runner.output_path_pattern, {
       cwd: options.cwd,
       absolute: true,
       onlyFiles: true
@@ -19578,7 +19658,7 @@ Time: 0.01s`
 init_esm_shims();
 import { mkdir as mkdir22, readFile as readFile25, rename as rename5, writeFile as writeFile21 } from "fs/promises";
 import { dirname as dirname29, join as join58 } from "path";
-import fg8 from "fast-glob";
+import fg9 from "fast-glob";
 init_paths();
 function deriveHealthTier(metrics) {
   const coverage = metrics.coverage_pct ?? null;
@@ -19608,7 +19688,7 @@ async function writeModuleHealthProfile(root, profile) {
 async function readAllModuleHealth(root) {
   const dir = join58(root, PATHS.PLANNING_MODULE_HEALTH_DIR);
   try {
-    const files = await fg8("**/*.json", { cwd: dir, onlyFiles: true });
+    const files = await fg9("**/*.json", { cwd: dir, onlyFiles: true });
     const profiles = await Promise.all(
       files.filter((file) => !file.split("/").includes("evidence")).map(async (file) => {
         const raw = await readFile25(join58(dir, file), "utf8");
@@ -19776,7 +19856,7 @@ var HealthChecker = class {
   isPathIgnored(projectRoot, relPath) {
     const target = relPath.replace(/\/$/, "");
     try {
-      execFileSync2("git", ["check-ignore", "-q", "--", target], {
+      execFileSync3("git", ["check-ignore", "-q", "--", target], {
         cwd: projectRoot,
         stdio: "ignore"
       });
@@ -21267,7 +21347,7 @@ init_project_packs();
 
 // src/resolver/resolver.ts
 init_esm_shims();
-import fg9 from "fast-glob";
+import fg10 from "fast-glob";
 import { basename as basename6, extname as extname3, relative as relative8 } from "pathe";
 
 // src/resolver/artifact-types.ts
@@ -21525,7 +21605,7 @@ var Resolver = class {
     const entries = [];
     const overrides = /* @__PURE__ */ new Map();
     for (const directory of directories) {
-      const files = await fg9("**/*", {
+      const files = await fg10("**/*", {
         cwd: directory.path,
         onlyFiles: true,
         absolute: true,
@@ -21577,7 +21657,7 @@ init_paths();
 init_path_utils();
 import { readFileSync as readFileSync36, writeFileSync as writeFileSync16 } from "fs";
 import { join as join71 } from "path";
-import fg10 from "fast-glob";
+import fg11 from "fast-glob";
 
 // src/rule-scripts/rule-file.ts
 init_esm_shims();
@@ -21682,7 +21762,7 @@ var RULE_SCRIPT_MAP_SCHEMA_VERSION = 1;
 
 // src/rule-scripts/analyzer.ts
 function collectRuleFiles(projectRoot) {
-  const rel = fg10.sync("**/*.md", {
+  const rel = fg11.sync("**/*.md", {
     cwd: join71(projectRoot, PATHS.RULES_DIR),
     onlyFiles: true
   });
@@ -21924,36 +22004,6 @@ import { createHash as createHash19 } from "crypto";
 import { existsSync as existsSync37, mkdirSync as mkdirSync22, readFileSync as readFileSync39, writeFileSync as writeFileSync18 } from "fs";
 import { dirname as dirname37, join as join75 } from "path";
 
-// src/core/fs/gitignore-scan.ts
-init_esm_shims();
-import { execFileSync as execFileSync3 } from "child_process";
-import fg11 from "fast-glob";
-var DEFAULT_SOURCE_GLOBS = ["**/*.{ts,tsx,js,jsx,mjs,cjs,vue,svelte}"];
-var DEFAULT_IGNORE_GLOBS = [
-  "**/node_modules/**",
-  "**/dist/**",
-  "**/.paqad/**",
-  "**/build/**",
-  "**/vendor/**"
-];
-function dropGitIgnored(projectRoot, files) {
-  try {
-    const out = execFileSync3("git", ["check-ignore", "-z", "--stdin"], {
-      cwd: projectRoot,
-      input: files.join("\0"),
-      stdio: ["pipe", "pipe", "ignore"]
-    });
-    const ignored = new Set(out.toString("utf8").split("\0").filter(Boolean));
-    return files.filter((f) => !ignored.has(f));
-  } catch {
-    return files;
-  }
-}
-function scanWorkingTree(projectRoot, globs = DEFAULT_SOURCE_GLOBS, ignore = DEFAULT_IGNORE_GLOBS) {
-  const listed = fg11.sync(globs, { cwd: projectRoot, ignore, onlyFiles: true });
-  return dropGitIgnored(projectRoot, listed).sort();
-}
-
 // src/rule-scripts/execute.ts
 init_esm_shims();
 import { spawnSync } from "child_process";
@@ -30360,7 +30410,7 @@ init_cancelled_error();
 init_events();
 
 // src/index.ts
-var VERSION = "1.60.1";
+var VERSION = "1.60.2";
 
 // src/cli/commands/audit.ts
 init_esm_shims();