fix(collab): mirror the owner's deriveddata- prefix rule

The owner hides any `deriveddata-*` name (isIgnoredProjectDirName falls
back to a startsWith check), but the push only carried the `.env` prefix,
so Xcode's prefixed derived-data directories still fanned out to every
member mirror. Send the rule directory-scoped, matching how the owner
applies it and leaving a regular file that happens to start with the
prefix as ordinary project content.

Author: lefarcen

apps/daemon/src/collab/vela-cli-resource-adapter.ts

@@ -73,7 +73,21 @@ const MEMBER_MIRROR_EXCLUDED_ENTRIES = [
   'terraform.tfstate',
   'terraform.tfstate.backup',
 ] as const;
-const MEMBER_MIRROR_EXCLUDED_PREFIXES = ['.env'] as const;
+/**
+ * Name prefixes a snapshot skips.
+ *
+ * `.env` is secret-bearing, so it is bare and matches any entry type — a
+ * `.env.local` file and a stray `.envrc` directory are equally unwelcome in a
+ * member mirror.
+ *
+ * `deriveddata-` mirrors the owner-side rule (`isIgnoredProjectDirName` treats
+ * any `deriveddata-*` name as hidden) and is directory-scoped for the same
+ * reason the generated-tree names are: a regular file starting with that
+ * prefix is ordinary project content. See
+ * {@link MEMBER_MIRROR_PUSH_EXCLUDED_ENTRIES} for the trailing-slash contract
+ * and why it degrades safely on a Vela that predates it.
+ */
+const MEMBER_MIRROR_EXCLUDED_PREFIXES = ['.env', 'deriveddata-/'] as const;
 
 /**
  * Every entry name a `vela resource push` snapshot skips.

apps/daemon/tests/vela-cli-resource-adapter.test.ts

@@ -132,6 +132,8 @@ describe('createVelaCliResourceAdapter', () => {
       ...EXPECTED_PUSH_EXCLUDE_ARGS,
       '--exclude-prefix',
       '.env',
+      '--exclude-prefix',
+      'deriveddata-/',
     ]);
   });
 
@@ -155,6 +157,21 @@ describe('createVelaCliResourceAdapter', () => {
     expect(calls[0]![prefixAt + 1]).toBe('.env');
   });
 
+  it('carries the owner-side deriveddata- prefix rule, directory-scoped', async () => {
+    const { run, calls } = recordingRun({ push: JSON.stringify({ version: 1 }) });
+    const adapter = createVelaCliResourceAdapter({ ...OPTS, run });
+    await adapter.publish({ projectId: 'p1', reason: 'edit' });
+
+    const prefixes = calls[0]!.flatMap((arg, i) =>
+      arg === '--exclude-prefix' ? [calls[0]![i + 1]!] : []);
+    // The owner hides any `deriveddata-*` DIRECTORY; a regular file starting
+    // with that prefix is ordinary content and must still reach members.
+    expect(prefixes).toContain('deriveddata-/');
+    expect(prefixes).not.toContain('deriveddata-');
+    // `.env` stays bare: a secret is unwelcome as a file or a directory.
+    expect(prefixes).toContain('.env');
+  });
+
   it('scopes generated-tree exclusions to directories so same-named files still sync', async () => {
     const { run, calls } = recordingRun({ push: JSON.stringify({ version: 1 }) });
     const adapter = createVelaCliResourceAdapter({ ...OPTS, run });
@@ -196,6 +213,8 @@ describe('createVelaCliResourceAdapter', () => {
       ...EXPECTED_PUSH_EXCLUDE_ARGS,
       '--exclude-prefix',
       '.env',
+      '--exclude-prefix',
+      'deriveddata-/',
       '--metadata-json',
       JSON.stringify({ name: 'Launch Deck', metadata: { kind: 'deck' } }),
     ]);