rigjs 4.0.15 → 4.0.16

package/lib/wiki/ingest.ts

@@ -40,7 +40,7 @@ export default async function wikiIngest(source: string, opts: IngestOpts): Prom
     print.error(`source not found: ${source}`);
     process.exit(1);
   }
-  const guard = guardPath(absSource, target.root || target.path);
+  const guard = guardPath(absSource, target.root || target.path, target.root);
   if (!guard.ok) {
     print.error('refusing to ingest from a hidden or gitignored path.');
     // eslint-disable-next-line no-console

package/lib/wiki/init.ts

@@ -229,6 +229,9 @@ export default function wikiInit(scope?: string): void {
   print.succeed(`vault initialized at ${shortPath(vaultDir)} (${scopeLabel})`);
   print.info(`next: edit ${shortPath(path.join(vaultDir, 'purpose.md'))} to describe what this wiki is for.`);
   print.info(`then run \`rig wiki sync\` from anywhere inside ${shortPath(cwd)} to ingest, update, and prune in one shot.`);
+  if (!fs.existsSync(path.join(scopeAbs, '.wikiignore'))) {
+    print.info(`tip: drop a \`.wikiignore\` (gitignore syntax) at ${shortPath(scopeAbs)} for paths the wiki should skip even though git tracks them (e.g. \`keychain/\`, \`secrets/\`).`);
+  }
 }
 
 function writeIfMissing(file: string, content: string) {

package/lib/wiki/pathGuard.ts

@@ -1,13 +1,15 @@
-// Shared guards for rig wiki — refuse to operate on hidden paths or
-// .gitignored content. The user must explicitly copy such files into a
-// visible, tracked location before they can become wiki sources.
+// Shared guards for rig wiki — refuse to operate on hidden paths,
+// .gitignored content, or .wikiignored content. The user must explicitly
+// copy such files into a visible, tracked, non-wikiignored location
+// before they can become wiki sources.
 
 import path from 'path';
 import { spawnSync } from 'child_process';
+import { batchWikiIgnored } from './wikiignore';
 
 export interface PathGuardResult {
   ok: boolean;
-  reason?: 'hidden' | 'gitignored';
+  reason?: 'hidden' | 'gitignored' | 'wikiignored';
   segment?: string;       // for hidden: the offending segment
   detail?: string;        // human-readable detail
 }
@@ -49,9 +51,14 @@ export function isGitignored(p: string, repoCwd: string): boolean | null {
 
 /**
  * Validate a path as a wiki source / target. Returns ok if visible AND
- * not gitignored. Use for `init` target and `ingest` source.
+ * not gitignored AND not wikiignored. Use for `init` target and `ingest`
+ * source.
+ *
+ * `vaultRoot` (optional) enables the `.wikiignore` check; pass the
+ * project root so layered `.wikiignore` files are consulted. Omit for
+ * pre-vault callers (e.g. `init` deciding where the vault dir lives).
  */
-export function guardPath(absPath: string, repoCwd: string): PathGuardResult {
+export function guardPath(absPath: string, repoCwd: string, vaultRoot?: string): PathGuardResult {
   const seg = hiddenSegment(absPath);
   if (seg) {
     return {
@@ -69,6 +76,16 @@ export function guardPath(absPath: string, repoCwd: string): PathGuardResult {
       detail: '.gitignore matches this path',
     };
   }
+  if (vaultRoot) {
+    const wk = batchWikiIgnored([absPath], vaultRoot);
+    if (wk.has(absPath)) {
+      return {
+        ok: false,
+        reason: 'wikiignored',
+        detail: '.wikiignore matches this path',
+      };
+    }
+  }
   return { ok: true };
 }
 
@@ -77,7 +94,7 @@ export function refusalMessage(target: string, r: PathGuardResult): string {
     `refused: ${target}`,
     `  reason: ${r.reason} — ${r.detail}`,
     '',
-    '  rig wiki refuses to operate on hidden files/dirs or .gitignored content.',
+    '  rig wiki refuses to operate on hidden files/dirs, .gitignored, or .wikiignored content.',
     '  If you really need this content, copy it to a visible, tracked location first:',
     '',
     '    cp -R <hidden-or-ignored> <wiki>/raw/manual-copy/    # then `rig wiki ingest`',

package/lib/wiki/survey.ts

@@ -18,6 +18,7 @@ import print from '../print';
 import { requireVault, loadRigConfig, WikiEntry } from './config';
 import { isBinaryExtension } from './fileTypes';
 import { batchGitignored } from './gitignore';
+import { batchWikiIgnored } from './wikiignore';
 import { adapters } from './agent/registry';
 import { default as wikiIngest } from './ingest';
 
@@ -105,10 +106,15 @@ function collectCandidates(entry: WikiEntry): Candidate[] {
       }
     }
   }
-  // Gitignore filter via batch `git check-ignore --stdin -z` (best-effort,
-  // silent fallback outside a git repo)
-  const ignored = batchGitignored(out.map(c => c.abs));
-  return out.filter(c => !ignored.has(c.abs));
+  // Two-layer ignore filter:
+  //   1. .gitignore — multi-repo-aware via `git check-ignore --stdin`
+  //   2. .wikiignore — same syntax, wiki-only (lets us hide paths git
+  //      tracks intentionally, e.g. overmind's `keychain/`)
+  // A candidate is dropped if either layer matches.
+  const absList = out.map(c => c.abs);
+  const giIgnored = batchGitignored(absList);
+  const wkIgnored = batchWikiIgnored(absList, entry.root);
+  return out.filter(c => !giIgnored.has(c.abs) && !wkIgnored.has(c.abs));
 }
 
 async function classifyWithAgent(target: WikiEntry, candidates: Candidate[]): Promise<SurveyRow[]> {

package/lib/wiki/wikiignore.ts

@@ -0,0 +1,93 @@
+// .wikiignore — wiki-only ignore file with the same syntax as .gitignore.
+//
+// Why a separate file? `.gitignore` is shared with git; many repos
+// (including the overmind workspace) intentionally commit directories
+// like `keychain/` that the wiki MUST NEVER ingest. Mixing wiki-only
+// excludes into `.gitignore` would break that contract. `.wikiignore`
+// is read only by the wiki walker.
+//
+// Lookup rule: starting from each candidate's directory, walk up
+// looking for `.wikiignore`. Every `.wikiignore` found along the path
+// up to (and including) `vaultRoot` contributes rules, with patterns
+// resolved relative to the dir that file lives in — same as gitignore.
+//
+// Implementation note: we use the `ignore` package because it
+// faithfully implements gitignore semantics (anchoring, negation,
+// `**`, trailing slash). Inlining a hand-rolled matcher invites subtle
+// bugs that would silently exfiltrate sensitive paths.
+
+import fs from 'fs';
+import path from 'path';
+import ignore, { Ignore } from 'ignore';
+
+const FILENAME = '.wikiignore';
+
+interface Layer {
+  dir: string;        // dir the .wikiignore lives in
+  matcher: Ignore;
+}
+
+/**
+ * Returns the set of absolute paths matched by any `.wikiignore` file
+ * found in `vaultRoot` or any directory between a candidate and
+ * `vaultRoot` (inclusive). Paths above `vaultRoot` are NOT consulted.
+ */
+export function batchWikiIgnored(absPaths: string[], vaultRoot: string): Set<string> {
+  const ignored = new Set<string>();
+  if (absPaths.length === 0) return ignored;
+
+  const root = path.resolve(vaultRoot);
+  const layerCache = new Map<string, Layer | null>();
+
+  // Build the ordered list of layers (root-most first) that apply to a
+  // given candidate. Layers above `root` are ignored.
+  function layersFor(abs: string): Layer[] {
+    const layers: Layer[] = [];
+    let dir = path.dirname(abs);
+    while (true) {
+      const cached = layerCache.get(dir);
+      if (cached !== undefined) {
+        if (cached) layers.push(cached);
+      } else {
+        const file = path.join(dir, FILENAME);
+        let layer: Layer | null = null;
+        if (fs.existsSync(file)) {
+          try {
+            const src = fs.readFileSync(file, 'utf8');
+            layer = { dir, matcher: ignore().add(src) };
+          } catch { /* unreadable — treat as no layer */ }
+        }
+        layerCache.set(dir, layer);
+        if (layer) layers.push(layer);
+      }
+      if (dir === root) break;
+      const parent = path.dirname(dir);
+      if (parent === dir) break;        // hit filesystem root before vaultRoot
+      dir = parent;
+    }
+    // root-most should win on equal-specificity → reverse so root is first
+    return layers.reverse();
+  }
+
+  for (const abs of absPaths) {
+    if (!abs.startsWith(root + path.sep) && abs !== root) continue;
+    const layers = layersFor(abs);
+    if (layers.length === 0) continue;
+    // Each layer matches paths relative to its own dir, gitignore-style.
+    // A later layer's negation can override an earlier match.
+    let isIgnored = false;
+    for (const layer of layers) {
+      const rel = path.relative(layer.dir, abs);
+      if (!rel || rel.startsWith('..')) continue;
+      // `ignore` returns { ignored, unignored } via .test(); we mirror its
+      // semantics by chaining .test() so negations later in the same file
+      // can flip the bit back.
+      const res = layer.matcher.test(rel);
+      if (res.ignored) isIgnored = true;
+      else if (res.unignored) isIgnored = false;
+    }
+    if (isIgnored) ignored.add(abs);
+  }
+
+  return ignored;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rigjs",
-  "version": "4.0.15",
-  "versionCode": 26052422,
+  "version": "4.0.16",
+  "versionCode": 26052423,
   "description": "A multi-repos dev tool based on yarn and git.Rigjs is intended to be the simplest way to develop,share and deliver codes between different developers or different projects.",
   "keywords": [
     "modular",
@@ -78,6 +78,7 @@
     "compare-versions": "^4.1.3",
     "dayjs": "^1.11.0",
     "dotenv": "^16.0.3",
+    "ignore": "^7.0.5",
     "inquirer": "7.3.3",
     "js-yaml": "^4.1.1",
     "json5": "2.1.3",