rigjs 4.0.14 → 4.0.16

package/lib/wiki/indexCmd.ts

@@ -7,7 +7,7 @@ interface IndexOpts { force?: boolean; }
 export default async function wikiIndex(opts: IndexOpts): Promise<void> {
   const t = requireVault();
   print.start(`qmd embed: ${t.name}`);
-  const res = await qmdEmbed(t.name, t.path, { force: !!opts.force });
+  const res = await qmdEmbed(t.name, t.path, t.root, { force: !!opts.force });
   if (res.ok) print.succeed(`qmd embed: ${t.name} done`);
   else {
     print.error(`qmd embed: ${t.name} failed: ${res.stderr.trim()}`);

package/lib/wiki/ingest.ts

@@ -40,7 +40,7 @@ export default async function wikiIngest(source: string, opts: IngestOpts): Prom
     print.error(`source not found: ${source}`);
     process.exit(1);
   }
-  const guard = guardPath(absSource, target.root || target.path);
+  const guard = guardPath(absSource, target.root || target.path, target.root);
   if (!guard.ok) {
     print.error('refusing to ingest from a hidden or gitignored path.');
     // eslint-disable-next-line no-console
@@ -112,7 +112,7 @@ export default async function wikiIngest(source: string, opts: IngestOpts): Prom
 
   // Real ingest — trigger incremental embed.
   print.info(`applied ${applied.length} file change${applied.length === 1 ? '' : 's'}; rejected ${rejected.length}.`);
-  const embedRes = await qmdEmbed(target.name, target.path);
+  const embedRes = await qmdEmbed(target.name, target.path, target.root);
   if (!embedRes.ok) {
     print.warn(`qmd embed failed after ingest: ${embedRes.stderr.trim().slice(0, 300)}`);
     print.warn('your wiki content is committed to disk; only the vector index is stale.');

package/lib/wiki/init.ts

@@ -109,10 +109,7 @@ cases.
 const SUBDIRS = ['sources', 'entities', 'concepts', 'synthesis', 'queries'];
 
 const GITIGNORE_TMPL = `# rig wiki — local-only artifacts (do not commit)
-# qmd vector cache (sqlite-vec, machine-specific, rebuildable)
-.qmd/index.sqlite*
-.qmd/*.sqlite-wal
-.qmd/*.sqlite-shm
+# (vector cache lives outside the vault at ~/.rig/<project>/wiki/)
 # auto-generated reports
 lint-report-*.md
 # daemon proposal queue (per-machine)
@@ -232,6 +229,9 @@ export default function wikiInit(scope?: string): void {
   print.succeed(`vault initialized at ${shortPath(vaultDir)} (${scopeLabel})`);
   print.info(`next: edit ${shortPath(path.join(vaultDir, 'purpose.md'))} to describe what this wiki is for.`);
   print.info(`then run \`rig wiki sync\` from anywhere inside ${shortPath(cwd)} to ingest, update, and prune in one shot.`);
+  if (!fs.existsSync(path.join(scopeAbs, '.wikiignore'))) {
+    print.info(`tip: drop a \`.wikiignore\` (gitignore syntax) at ${shortPath(scopeAbs)} for paths the wiki should skip even though git tracks them (e.g. \`keychain/\`, \`secrets/\`).`);
+  }
 }
 
 function writeIfMissing(file: string, content: string) {

package/lib/wiki/pathGuard.ts

@@ -1,13 +1,15 @@
-// Shared guards for rig wiki — refuse to operate on hidden paths or
-// .gitignored content. The user must explicitly copy such files into a
-// visible, tracked location before they can become wiki sources.
+// Shared guards for rig wiki — refuse to operate on hidden paths,
+// .gitignored content, or .wikiignored content. The user must explicitly
+// copy such files into a visible, tracked, non-wikiignored location
+// before they can become wiki sources.
 
 import path from 'path';
 import { spawnSync } from 'child_process';
+import { batchWikiIgnored } from './wikiignore';
 
 export interface PathGuardResult {
   ok: boolean;
-  reason?: 'hidden' | 'gitignored';
+  reason?: 'hidden' | 'gitignored' | 'wikiignored';
   segment?: string;       // for hidden: the offending segment
   detail?: string;        // human-readable detail
 }
@@ -49,9 +51,14 @@ export function isGitignored(p: string, repoCwd: string): boolean | null {
 
 /**
  * Validate a path as a wiki source / target. Returns ok if visible AND
- * not gitignored. Use for `init` target and `ingest` source.
+ * not gitignored AND not wikiignored. Use for `init` target and `ingest`
+ * source.
+ *
+ * `vaultRoot` (optional) enables the `.wikiignore` check; pass the
+ * project root so layered `.wikiignore` files are consulted. Omit for
+ * pre-vault callers (e.g. `init` deciding where the vault dir lives).
  */
-export function guardPath(absPath: string, repoCwd: string): PathGuardResult {
+export function guardPath(absPath: string, repoCwd: string, vaultRoot?: string): PathGuardResult {
   const seg = hiddenSegment(absPath);
   if (seg) {
     return {
@@ -69,6 +76,16 @@ export function guardPath(absPath: string, repoCwd: string): PathGuardResult {
       detail: '.gitignore matches this path',
     };
   }
+  if (vaultRoot) {
+    const wk = batchWikiIgnored([absPath], vaultRoot);
+    if (wk.has(absPath)) {
+      return {
+        ok: false,
+        reason: 'wikiignored',
+        detail: '.wikiignore matches this path',
+      };
+    }
+  }
   return { ok: true };
 }
 
@@ -77,7 +94,7 @@ export function refusalMessage(target: string, r: PathGuardResult): string {
     `refused: ${target}`,
     `  reason: ${r.reason} — ${r.detail}`,
     '',
-    '  rig wiki refuses to operate on hidden files/dirs or .gitignored content.',
+    '  rig wiki refuses to operate on hidden files/dirs, .gitignored, or .wikiignored content.',
     '  If you really need this content, copy it to a visible, tracked location first:',
     '',
     '    cp -R <hidden-or-ignored> <wiki>/raw/manual-copy/    # then `rig wiki ingest`',

package/lib/wiki/qmd.ts

@@ -9,8 +9,13 @@
 //   - Embed: Qwen3-Embedding-0.6B   (~610MB, sets QMD_EMBED_MODEL)
 //   - Rerank: Qwen3-Reranker-0.6B   (~610MB, sets QMD_RERANK_MODEL)
 //
-// Per-wiki SQLite DB lives at `~/.rig/cache/qmd/<wiki>.sqlite`. Model GGUFs
-// cache in `~/.cache/qmd/models/` (hardcoded inside qmd).
+// Per-wiki SQLite DB lives at `~/.rig/<project>/wiki/<wiki>.sqlite`, where
+// `<project>` is the `name` from the nearest `package.json` walking up from
+// the vault root (fallback: vault-root basename). The extra `wiki/` segment
+// reserves room for other per-project rig artifacts as siblings. Legacy
+// `~/.rig/cache/qmd/<wiki>.sqlite` is migrated lazily on first open.
+//
+// Model GGUFs still cache in `~/.cache/qmd/models/` (hardcoded inside qmd).
 //
 // Concurrency note: qmd's `setConfigSource` is module-global; serialize
 // store lifetimes by opening + closing inside each call.
@@ -71,10 +76,58 @@ function qmdVersion(): string {
   return 'unknown';
 }
 
-function dbPathFor(wikiName: string): string {
-  const dir = path.join(paths.cache, 'qmd');
+/**
+ * Resolve the project name for a vault: read the `name` field from the
+ * nearest `package.json` walking up from `vaultRoot`. Falls back to
+ * `basename(vaultRoot)` if no package.json with a usable name is found.
+ * Scoped names (`@scope/foo`) are flattened to `scope_foo`.
+ */
+function resolveProjectName(vaultRoot: string): string {
+  let dir = path.resolve(vaultRoot);
+  while (true) {
+    const pkg = path.join(dir, 'package.json');
+    if (fs.existsSync(pkg)) {
+      try {
+        const parsed = JSON.parse(fs.readFileSync(pkg, 'utf8'));
+        if (typeof parsed.name === 'string' && parsed.name.trim()) {
+          return sanitizeSegment(parsed.name.trim());
+        }
+      } catch { /* malformed package.json — keep walking */ }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return sanitizeSegment(path.basename(vaultRoot)) || 'unknown';
+}
+
+function sanitizeSegment(s: string): string {
+  // npm scoped names use `/`; flatten so we don't create unintended nesting.
+  // Also defang filesystem-hostile chars and leading dots.
+  return s
+    .replace(/^@/, '')
+    .replace(/[/\\]/g, '_')
+    .replace(/[<>:"|?*\x00-\x1f]/g, '_')
+    .replace(/^\.+/, '');
+}
+
+function dbPathFor(wikiName: string, vaultRoot: string): string {
+  const projectName = resolveProjectName(vaultRoot);
+  const dir = path.join(paths.home, projectName, 'wiki');
   fs.mkdirSync(dir, { recursive: true });
-  return path.join(dir, `${wikiName}.sqlite`);
+  const target = path.join(dir, `${wikiName}.sqlite`);
+  // One-shot migration from the legacy flat layout.
+  const legacy = path.join(paths.cache, 'qmd', `${wikiName}.sqlite`);
+  if (!fs.existsSync(target) && fs.existsSync(legacy)) {
+    for (const suffix of ['', '-wal', '-shm']) {
+      const src = legacy + suffix;
+      if (fs.existsSync(src)) {
+        try { fs.renameSync(src, target + suffix); }
+        catch { /* cross-device? leave the legacy file in place */ }
+      }
+    }
+  }
+  return target;
 }
 
 async function loadQmd(): Promise<{ createStore: any }> {
@@ -90,12 +143,13 @@ async function loadQmd(): Promise<{ createStore: any }> {
 export async function qmdEmbed(
   wikiName: string,
   dir: string,
+  vaultRoot: string,
   opts: { force?: boolean } = {}
 ): Promise<{ ok: boolean; stderr: string }> {
   try {
     const { createStore } = await loadQmd();
     const store = await createStore({
-      dbPath: dbPathFor(wikiName),
+      dbPath: dbPathFor(wikiName, vaultRoot),
       config: {
         collections: { [wikiName]: { path: dir, pattern: '**/*.md' } },
       },
@@ -134,6 +188,7 @@ export interface QmdHit {
 export async function qmdQuery(
   q: string,
   wikiName: string,
+  vaultRoot: string,
   opts: { limit?: number; candidateLimit?: number; rerank?: boolean } = {}
 ): Promise<QmdHit[] | null> {
   const limit = opts.limit ?? 10;
@@ -142,7 +197,7 @@ export async function qmdQuery(
 
   try {
     const { createStore } = await loadQmd();
-    const store = await createStore({ dbPath: dbPathFor(wikiName) });
+    const store = await createStore({ dbPath: dbPathFor(wikiName, vaultRoot) });
     try {
       const raw = await store.searchVector(q, { limit: candidateLimit, collection: wikiName });
       const candidates: QmdHit[] = Array.isArray(raw) ? raw.map(normalizeHit) : [];
@@ -191,8 +246,8 @@ function normalizeHit(h: any): QmdHit {
 }
 
 /** Wipe the per-wiki SQLite store on disk. Caller should then qmdEmbed. */
-export function qmdResetStore(wikiName: string): void {
-  const p = dbPathFor(wikiName);
+export function qmdResetStore(wikiName: string, vaultRoot: string): void {
+  const p = dbPathFor(wikiName, vaultRoot);
   for (const suffix of ['', '-wal', '-shm']) {
     const f = p + suffix;
     if (fs.existsSync(f)) fs.rmSync(f, { force: true });

package/lib/wiki/query.ts

@@ -30,7 +30,7 @@ export default async function wikiQuery(q: string, opts: QueryOpts): Promise<voi
   const target = requireVault();
 
   const limit = Math.max(1, Math.min(50, opts.limit || 10));
-  const hits = await qmdQuery(q, target.name, { limit, rerank: opts.rerank !== false });
+  const hits = await qmdQuery(q, target.name, target.root, { limit, rerank: opts.rerank !== false });
   if (hits === null) {
     print.error('qmd query failed. Run `rig wiki index` first to (re)build the vector store.');
     process.exit(1);

package/lib/wiki/rebuild.ts

@@ -2,7 +2,7 @@
 //
 // Use cases:
 //   1. New device: source markdown is checked out, but ~/.rig/state.db and
-//      ~/.rig/cache/qmd/<wiki>.sqlite are empty. Rebuild populates both.
+//      ~/.rig/<project>/wiki/<wiki>.sqlite are empty. Rebuild populates both.
 //   2. Switched embedding model: old vectors are now meaningless. Rebuild
 //      re-embeds against the current QMD_EMBED_MODEL.
 //   3. Local cache corruption: nuke and start over.
@@ -27,10 +27,10 @@ export default async function wikiRebuild(opts: RebuildOpts): Promise<void> {
   const del = db.prepare('DELETE FROM source_sha WHERE wiki = ?').run(t.name);
   print.info(`  cleared ${del.changes} source_sha rows for ${t.name}`);
 
-  qmdResetStore(t.name);
+  qmdResetStore(t.name, t.root);
 
   if (!opts.skipEmbed) {
-    const res = await qmdEmbed(t.name, t.path, { force: true });
+    const res = await qmdEmbed(t.name, t.path, t.root, { force: true });
     if (res.ok) print.info(`  qmd embed: ${t.name} done`);
     else {
       print.error(`  qmd embed: ${t.name} failed: ${res.stderr.trim()}`);

package/lib/wiki/survey.ts

@@ -18,6 +18,7 @@ import print from '../print';
 import { requireVault, loadRigConfig, WikiEntry } from './config';
 import { isBinaryExtension } from './fileTypes';
 import { batchGitignored } from './gitignore';
+import { batchWikiIgnored } from './wikiignore';
 import { adapters } from './agent/registry';
 import { default as wikiIngest } from './ingest';
 
@@ -105,10 +106,15 @@ function collectCandidates(entry: WikiEntry): Candidate[] {
       }
     }
   }
-  // Gitignore filter via batch `git check-ignore --stdin -z` (best-effort,
-  // silent fallback outside a git repo)
-  const ignored = batchGitignored(out.map(c => c.abs));
-  return out.filter(c => !ignored.has(c.abs));
+  // Two-layer ignore filter:
+  //   1. .gitignore — multi-repo-aware via `git check-ignore --stdin`
+  //   2. .wikiignore — same syntax, wiki-only (lets us hide paths git
+  //      tracks intentionally, e.g. overmind's `keychain/`)
+  // A candidate is dropped if either layer matches.
+  const absList = out.map(c => c.abs);
+  const giIgnored = batchGitignored(absList);
+  const wkIgnored = batchWikiIgnored(absList, entry.root);
+  return out.filter(c => !giIgnored.has(c.abs) && !wkIgnored.has(c.abs));
 }
 
 async function classifyWithAgent(target: WikiEntry, candidates: Candidate[]): Promise<SurveyRow[]> {

package/lib/wiki/wikiignore.ts

@@ -0,0 +1,93 @@
+// .wikiignore — wiki-only ignore file with the same syntax as .gitignore.
+//
+// Why a separate file? `.gitignore` is shared with git; many repos
+// (including the overmind workspace) intentionally commit directories
+// like `keychain/` that the wiki MUST NEVER ingest. Mixing wiki-only
+// excludes into `.gitignore` would break that contract. `.wikiignore`
+// is read only by the wiki walker.
+//
+// Lookup rule: starting from each candidate's directory, walk up
+// looking for `.wikiignore`. Every `.wikiignore` found along the path
+// up to (and including) `vaultRoot` contributes rules, with patterns
+// resolved relative to the dir that file lives in — same as gitignore.
+//
+// Implementation note: we use the `ignore` package because it
+// faithfully implements gitignore semantics (anchoring, negation,
+// `**`, trailing slash). Inlining a hand-rolled matcher invites subtle
+// bugs that would silently exfiltrate sensitive paths.
+
+import fs from 'fs';
+import path from 'path';
+import ignore, { Ignore } from 'ignore';
+
+const FILENAME = '.wikiignore';
+
+interface Layer {
+  dir: string;        // dir the .wikiignore lives in
+  matcher: Ignore;
+}
+
+/**
+ * Returns the set of absolute paths matched by any `.wikiignore` file
+ * found in `vaultRoot` or any directory between a candidate and
+ * `vaultRoot` (inclusive). Paths above `vaultRoot` are NOT consulted.
+ */
+export function batchWikiIgnored(absPaths: string[], vaultRoot: string): Set<string> {
+  const ignored = new Set<string>();
+  if (absPaths.length === 0) return ignored;
+
+  const root = path.resolve(vaultRoot);
+  const layerCache = new Map<string, Layer | null>();
+
+  // Build the ordered list of layers (root-most first) that apply to a
+  // given candidate. Layers above `root` are ignored.
+  function layersFor(abs: string): Layer[] {
+    const layers: Layer[] = [];
+    let dir = path.dirname(abs);
+    while (true) {
+      const cached = layerCache.get(dir);
+      if (cached !== undefined) {
+        if (cached) layers.push(cached);
+      } else {
+        const file = path.join(dir, FILENAME);
+        let layer: Layer | null = null;
+        if (fs.existsSync(file)) {
+          try {
+            const src = fs.readFileSync(file, 'utf8');
+            layer = { dir, matcher: ignore().add(src) };
+          } catch { /* unreadable — treat as no layer */ }
+        }
+        layerCache.set(dir, layer);
+        if (layer) layers.push(layer);
+      }
+      if (dir === root) break;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;        // hit filesystem root before vaultRoot
+      dir = parent;
+    }
+    // root-most should win on equal-specificity → reverse so root is first
+    return layers.reverse();
+  }
+
+  for (const abs of absPaths) {
+    if (!abs.startsWith(root + path.sep) && abs !== root) continue;
+    const layers = layersFor(abs);
+    if (layers.length === 0) continue;
+    // Each layer matches paths relative to its own dir, gitignore-style.
+    // A later layer's negation can override an earlier match.
+    let isIgnored = false;
+    for (const layer of layers) {
+      const rel = path.relative(layer.dir, abs);
+      if (!rel || rel.startsWith('..')) continue;
+      // `ignore` returns { ignored, unignored } via .test(); we mirror its
+      // semantics by chaining .test() so negations later in the same file
+      // can flip the bit back.
+      const res = layer.matcher.test(rel);
+      if (res.ignored) isIgnored = true;
+      else if (res.unignored) isIgnored = false;
+    }
+    if (isIgnored) ignored.add(abs);
+  }
+
+  return ignored;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rigjs",
-  "version": "4.0.14",
-  "versionCode": 26052420,
+  "version": "4.0.16",
+  "versionCode": 26052423,
   "description": "A multi-repos dev tool based on yarn and git.Rigjs is intended to be the simplest way to develop,share and deliver codes between different developers or different projects.",
   "keywords": [
     "modular",
@@ -78,6 +78,7 @@
     "compare-versions": "^4.1.3",
     "dayjs": "^1.11.0",
     "dotenv": "^16.0.3",
+    "ignore": "^7.0.5",
     "inquirer": "7.3.3",
     "js-yaml": "^4.1.1",
     "json5": "2.1.3",