fix(daemon): list dot-prefixed user content in managed projects

[mturac]

Fixes #6175

Why

Hit this while keeping project notes in a .notes.md file: @-mentioning it from the chat composer silently finds nothing, and the same happens for .github/ or .vscode/ content. The file and folder listing helpers in apps/daemon/src/projects.ts apply a blanket startsWith('.') filter, so every dot-prefixed entry is invisible to mention autocomplete and project search, not just the internal directories the filter was meant to hide.

What users will see

In managed projects, @-mention autocomplete and project search now find dot-prefixed user content such as .github/workflows/ci.yml, .vscode/settings.json, or .notes.md. Managed full and batch archives follow the same visibility policy. Internal directories (.git, .od, .live-artifacts, .file-versions, node_modules, etc.) stay hidden. Imported folders (external baseDir) are unchanged: hidden entries remain unlisted and unavailable to archive requests, consistent with the existing hidden-path guard for user-owned directories.

Surface area

• Default behavior change: dot-prefixed user files become visible in listing, search, and archives for managed projects. They were previously always hidden.

Bug fix verification

• Test path: apps/daemon/tests/project-hidden-files.test.ts
• Red on main, green on this branch: yes. Two managed-listing cases failed on main; the focused cases pass with the fix.

Validation

• vitest run tests/project-hidden-files.test.ts tests/live-artifacts-store.test.ts tests/project-archive.test.ts tests/folder-import-projects.test.ts tests/projects-list-files.test.ts tests/project-watchers.test.ts tests/project-file-rename.test.ts: 103 passed.
• tsc -p tsconfig.json --noEmit && tsc -p tsconfig.tests.json --noEmit: clean.
• pnpm guard: passed.
• QA accepted head 8827edc0 after verifying managed dotfile listing, search, mention autocomplete, full archives, and batch archives in the real Web runtime. Imported-folder hidden paths remained blocked.

Windows-native UI smoke testing was not included in the QA pass.

[lefarcen]

🧪 Queued for QA validation — this PR changes a user-facing runtime path, so we’ll run a manual QA pass before merge. Nothing needed from you right now; we’ll update here once that pass is done. Thanks for the contribution! 🙏

[nettee]

I found one behavior mismatch in the new managed-project hidden-file policy that should be fixed before this lands.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

Hey @mturac — the current blocker on this head is the mismatch @nettee called out: managed projects can now surface dot-prefixed user content, but project archive export still drops those entries.

Once the archive behavior and the surrounding contract are aligned, this should be in much better shape for the next pass.

[nettee]

@mturac I re-checked the archive/listing parity in apps/daemon/src/projects.ts and the follow-up now lines up managed-project dotfile visibility across full archives, batch archives, and imported-folder guards. The added regression coverage around managed vs. imported projects, reserved daemon paths, and archive root handling matches the code paths this change touches. I couldn't rerun Vitest in this prepared checkout because the worktree has no node_modules, but the implementation and new tests are coherent. Nice follow-through on closing the archive mismatch.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[ivy-ting]

@mturac

Thanks for the contribution. I completed QA validation for this PR.

QA Acceptance Record

Scope:

• Managed-project dotfile listing, search, mention autocomplete, full archives, and batch archives
• Imported-folder hidden-path boundaries

Verified:

• 103 targeted daemon tests passed
• Daemon source/test type checks and repository guard passed
• On the real Web runtime for head 8827edc0, .notes.md, .github/workflows/ci.yml, and .storybook/main.ts were visible
• @.notes and @.github returned the expected suggestions, while internal .git/ content remained hidden
• Managed full and batch ZIP exports included visible dotfiles
• Imported folders continued to hide and reject hidden listing/archive paths

Not verified:

• Windows-native UI smoke test

Risks / notes:

• The PR body should be updated because its archive open question and 100-test count are stale; the current implementation aligns archives with listing behavior and the targeted run passed 103 tests.

Conclusion:

• Accepted

[lefarcen]

@mturac — both reviews are done (nettee ✅ and the QA pass ✅) and there are no open threads. The only thing keeping this from the merge queue is that the PR is still marked as a draft. When you're ready, click "Ready for review" at the top of the page to lift the draft flag — that's all that's left.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8827edc060

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[nettee]

The current archive/listing policy now hides the newly identified daemon state, but two consistency gaps remain: live-artifact selector validation is not synchronized with the expanded reserved-path policy, and explicit archive roots can bypass the ignored-directory policy. Both can produce incorrect or unsafe project exports, so I’m requesting changes.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

Hey @mturac — the current blocker on this head is @nettee’s latest review: the live-artifact selector validator needs to stay in sync with the expanded reserved-path policy, and explicit archive roots need the same ignored/reserved-directory guard as the recursive walk. Once those two gaps are closed, this should be ready for another pass.

💡 To drive this PR to merge hands-free, paste this to your AI coding agent (Claude Code / Codex / opencode / Cursor …):
Take over nexu-io/open-design#6214 until it merges — read https://raw.githubusercontent.com/nexu-io/looper/main/skills/pr-takeover/SKILL.md and follow it.

[nettee]

One blocking security issue remains in the canonicalized archive-root guard; the focused daemon suites pass locally, but they do not cover an imported symlink alias to a hidden directory. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[lefarcen]

@mturac quick state update: your latest push moved the PR to commit 4821c4e, so @nettee’s blocking review is now against the previous head.

The next pass here is a re-check of the imported symlink → hidden-directory archive case called out in that review.

[nettee]

@mturac I reviewed all final changed ranges covering managed-project dotfile visibility, reserved daemon-state filtering, archive-root canonicalization, imported-folder hidden-path protection, and live-artifact selector parity. The focused and adjacent daemon suites, TypeScript checks, guard, and live PR diff validation all pass. Thanks for the careful follow-through on the archive and symlink-safety fixes—this is a thoughtful, well-tested resolution.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}