pi-code 1.0.23 → 1.0.24

package/extensions/claude-rules.ts

@@ -21,8 +21,10 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { claudeMdExcludeFiles, isExcludedPath, readClaudeMdExcludes } from './context-imports.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { publishInstructionLoad } from './internal/instruction-events.js'
+import { readManagedSettings } from './internal/managed-settings.js'
 import { type CompiledGlob, compileGlobs, matchesCompiledGlobs } from './internal/path-rules.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { findNearestDir } from './internal/project-root.js'
@@ -147,12 +149,36 @@ interface RuleSet {
 
 const EMPTY_RULES: RuleSet = { inline: [], scoped: [] }
 
+/** The canonical form of a path. A target that does not exist yet (a write
+ * creating a new file) canonicalises its nearest existing ancestor and keeps the
+ * remaining segments, so both sides of the attach match compare realpaths even
+ * for brand-new files in a symlinked checkout. */
+function realpathOr(target: string): string {
+  try {
+    return fs.realpathSync(target)
+  } catch {
+    const dir = path.dirname(target)
+    if (dir === target) return target
+    return path.join(realpathOr(dir), path.basename(target))
+  }
+}
+
 /** Unscoped rules are inlined; path-scoped ones keep their scope as pointers,
- * mirroring Claude Code, where scoped rules attach only to matching files. */
-function readRules(rulesDir: string): RuleSet {
+ * mirroring Claude Code, where scoped rules attach only to matching files. Files
+ * matching `claudeMdExcludes` are skipped entirely, as the docs' monorepo recipe
+ * (excluding another team's `.claude/rules/**`) relies on; the check runs on the
+ * realpath so a symlink cannot dodge an exclusion. */
+function readRules(rulesDir: string, isExcluded?: (realPath: string) => boolean): RuleSet {
   const inline: string[] = []
   const scoped: ScopedRule[] = []
   for (const file of findMarkdownFiles(rulesDir)) {
+    if (isExcluded) {
+      // Both spellings count: a glob written against the lexical path and one
+      // written against the resolved real path each exclude, which can only
+      // widen an exclusion, never dodge one.
+      const lexical = path.join(rulesDir, file)
+      if (isExcluded(lexical) || isExcluded(realpathOr(lexical))) continue
+    }
     let parsed: Frontmatter
     try {
       parsed = parseFrontmatter(fs.readFileSync(path.join(rulesDir, file), 'utf-8'))
@@ -223,15 +249,20 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
   let attachTargets: AttachTarget[] = []
 
   pi.on('session_start', async (_event, ctx) => {
-    globalRules = readRules(globalRulesDir)
     // Project rules are repository text landing in the system prompt, so they load
     // only once the project is approved. isProjectTrusted alone is true for a repo
     // pi never asked about; see project-approval.
     const approved = await isProjectApproved(ctx)
+    // Claude's claudeMdExcludes covers rules files too (the docs' monorepo recipe
+    // excludes another team's .claude/rules/**), so the same merged glob list the
+    // context loader honors gates rule files here.
+    const excludeGlobs = readClaudeMdExcludes(claudeMdExcludeFiles(ctx.cwd, os.homedir(), approved), readManagedSettings())
+    const isExcluded = (realPath: string): boolean => isExcludedPath(realPath, excludeGlobs, os.homedir())
+    globalRules = readRules(globalRulesDir, isExcluded)
     // Nearest at-or-above cwd, so a subdirectory session still reads the rules the
     // approval walk gated on.
     const projectRulesDir = approved ? findNearestDir(ctx.cwd, path.join('.claude', 'rules')) : null
-    projectRules = projectRulesDir ? readRules(projectRulesDir) : EMPTY_RULES
+    projectRules = projectRulesDir ? readRules(projectRulesDir, isExcluded) : EMPTY_RULES
 
     // Global globs are relative to cwd; project globs to the project root (the dir
     // holding .claude), so `db/**` in a repo rule matches repo-relative paths even
@@ -239,8 +270,8 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     // than on every tool result; rebuilt per session so a re-run re-attaches.
     const projectRoot = projectRulesDir ? path.dirname(path.dirname(projectRulesDir)) : ctx.cwd
     attachTargets = [
-      ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: ctx.cwd, file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
-      ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: projectRoot, file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
+      ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: realpathOr(ctx.cwd), file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
+      ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: realpathOr(projectRoot), file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
     ]
     pendingScopedRules = attachTargets.length
     // Relative to cwd, which the read tool resolves: an ancestor dir yields a
@@ -274,7 +305,9 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     if (event.toolName !== 'read' && event.toolName !== 'edit' && event.toolName !== 'write') return
     const rel = (event.input as { path?: unknown } | undefined)?.path
     if (typeof rel !== 'string' || rel.length === 0) return
-    const abs = path.resolve(ctx.cwd, rel)
+    // Realpath both sides (roots canonicalise at session_start): a tool reporting
+    // the resolved real path in a symlinked checkout must still match.
+    const abs = realpathOr(path.resolve(ctx.cwd, rel))
 
     const bodies: string[] = []
     const remaining: AttachTarget[] = []

package/extensions/internal/path-rules.ts

@@ -7,8 +7,10 @@
  * root (the settings source), and bare or `./` from the current directory. As
  * allow rules, a single-segment directory pattern anchors at cwd; a bare
  * filename matches at any depth. `*` stays within one segment, `**` crosses
- * directories. Matching is lexical, on resolved paths; bracket expressions are
- * not supported and match literally, which can only over-block, never widen.
+ * directories. Matching is lexical, on resolved paths. Bracket expressions parse
+ * per Claude's documented glob contract: `[abc]` classes with ranges and `!`
+ * negation, an unreadable `[` making the pattern match nothing, and `\[` for a
+ * literal bracket.
  */
 
 import * as path from 'node:path'
@@ -79,26 +81,63 @@ function expandBraces(pattern: string): string[] | null {
   return expanded
 }
 
-/** One glob pattern, braces already expanded, as a regular expression source. */
-function translateGlob(pattern: string): string {
+/** The end index of a bracket expression starting at `start` (`[`), or -1 when it
+ * cannot be read as one, which per Claude makes the whole pattern invalid. A `]`
+ * directly after the opening (or after a leading negation) is a literal member. */
+function bracketEnd(pattern: string, start: number): number {
+  let i = start + 1
+  if (pattern[i] === '!' || pattern[i] === '^') i += 1
+  if (pattern[i] === ']') i += 1
+  for (; i < pattern.length; i += 1) {
+    if (pattern[i] === ']') return i
+  }
+  return -1
+}
+
+/** A bracket expression body as a regex character class, escaping regex-relevant
+ * characters while keeping `-` ranges; a leading `!` (or `^`) negates. */
+function bracketClass(body: string): string {
+  const negated = body.startsWith('!') || body.startsWith('^')
+  const members = (negated ? body.slice(1) : body).replace(/[\\\]^]/g, (ch) => `\\${ch}`)
+  return `[${negated ? '^' : ''}${members}]`
+}
+
+/** A `*` run starting at `i`: a double star followed by a slash spans whole
+ * directories, a bare double star crosses segments, and a single `*` stays within
+ * one. Returns the regex source and the index after the run. */
+function translateStar(pattern: string, i: number): { source: string; next: number } {
+  if (pattern[i + 1] === '*') {
+    const prevSlash = i === 0 || pattern[i - 1] === '/'
+    if (prevSlash && pattern[i + 2] === '/') return { source: '(?:[^/]+/)*', next: i + 3 }
+    return { source: '.*', next: i + 2 }
+  }
+  return { source: '[^/]*', next: i + 1 }
+}
+
+function translateGlob(pattern: string): string | null {
   let out = ''
   let i = 0
   while (i < pattern.length) {
     const ch = pattern[i]
+    // Claude: to match a literal bracket, escape it; the escape consumes both chars.
+    if (ch === '\\' && (pattern[i + 1] === '[' || pattern[i + 1] === ']')) {
+      out += escapeRegExp(pattern[i + 1])
+      i += 2
+      continue
+    }
+    // Claude: `[` starts a bracket expression such as `[abc]`; a `[` that cannot be
+    // read as one makes the pattern invalid, matching nothing.
+    if (ch === '[') {
+      const end = bracketEnd(pattern, i)
+      if (end === -1) return null
+      out += bracketClass(pattern.slice(i + 1, end))
+      i = end + 1
+      continue
+    }
     if (ch === '*') {
-      if (pattern[i + 1] === '*') {
-        const prevSlash = i === 0 || pattern[i - 1] === '/'
-        if (prevSlash && pattern[i + 2] === '/') {
-          out += '(?:[^/]+/)*' // `**/` spans zero or more whole directories
-          i += 3
-          continue
-        }
-        out += '.*'
-        i += 2
-        continue
-      }
-      out += '[^/]*'
-      i += 1
+      const star = translateStar(pattern, i)
+      out += star.source
+      i = star.next
       continue
     }
     if (ch === '?') {
@@ -112,13 +151,20 @@ function translateGlob(pattern: string): string {
   return out
 }
 
+/** A regex source that matches nothing: the compiled form of an invalid pattern. */
+const NEVER_MATCH = '(?!)'
+
 /** One gitignore-style pattern as an anchored regular expression source. Brace
  * groups (`{ts,tsx}`, nested, Cartesian across groups) expand into ORed
- * alternatives; an over-budget expansion falls back to the literal pattern. */
+ * alternatives; an over-budget expansion falls back to the literal pattern. An
+ * invalid pattern (an unreadable bracket expression) matches nothing, as Claude
+ * documents, rather than matching its literal spelling. */
 export function globToRegExpSource(pattern: string): string {
   const alternatives = expandBraces(pattern) ?? [pattern]
-  if (alternatives.length === 1) return translateGlob(alternatives[0])
-  return `(?:${alternatives.map(translateGlob).join('|')})`
+  const sources = alternatives.map(translateGlob)
+  if (sources.includes(null)) return NEVER_MATCH
+  if (sources.length === 1) return sources[0] as string
+  return `(?:${sources.join('|')})`
 }
 
 /** A rule resolved to an absolute glob per its anchor form. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.23",
+  "version": "1.0.24",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",