Keep a root node_modules out of the vault by loganfinney27 · Pull Request #953 · LAF-US/IDAHO-VAULT

loganfinney27 · 2026-08-11T05:29:20Z

AGENT PR TEMPLATE

Agent: Claude Code (agent:claude-code)
Date: 2026-08-11
Branch: claude/gitignore-node-modules-qzt7le → main

Changes Made

One rule appended to .gitignore, plus the comment explaining why it must stay last.

.gitignore:101 ignores **/node_modules/**. .gitignore:159 then re-includes markdown with !*.md — no slash, so it matches at any depth. Git takes the last matching pattern, so the re-include wins and every README.md inside any node_modules is stageable:

.gitignore:101:**/node_modules/**   node_modules/eslint/package.json   <- ignored
.gitignore:159:!*.md                node_modules/eslint/README.md      <- NOT ignored

That is correct for THE-GEMSTONE/node_modules — vendored content this vault tracks on purpose, 49 .md files, preserved deliberately in #939. It is wrong for a root node_modules, which npm regenerates from package-lock.json and which nobody should commit.

Measured, both ways

git add --dry-run node_modules/ after a real npm ci:

Dependency set	Files staged
main today (prettier only)	2
with the eight devDependencies #950 adds	466

All vendored README files. One git add -A after an npm install puts them in the repo — which is exactly why I staged #950 file-by-file rather than with -A.

Verified, all four cases

Case	Result
root `node_modules/*/.md`	now ignored (was caught by `!*.md`)
`git add --dry-run node_modules/`	0 files
`THE-GEMSTONE/node_modules/whatwg-encoding/lib/lib.md`	still tracked, unchanged
`CONSTITUTION.md`	unaffected
tracked file count	38,424, unchanged

The leading slash is what makes the third row true — it anchors the rule to the repo root, so the vendored tree is untouched.

Why this is its own PR

.gitignore is a shared surface, and the file's own header says to tread lightly there and to verify with check-ignore rather than eyeball it. So this stands alone as a proposal rather than being folded into #950: it changes nothing until you merge it, and the verification above is the evidence you'd want before doing so.

The hazard is live regardless of whether #950 merges — anyone who runs npm install at the root and then git add -A hits it today, just at 2 files instead of 466.

Related Work

Make .gitignore actually implement its own stated policy #939 — established the markdown re-include, deliberately, for THE-GEMSTONE. This does not weaken it.
Turn the Codacy tool toggles on, with every baseline measured #950 — adds the eight devDependencies that take the leak from 2 to 466.

Blockers

None.

Checklist:

Tests pass (or no tests required) — no suite. Verified with git check-ignore --no-index on all four cases above and git add --dry-run node_modules/ before and after, against a real npm ci tree. check_portable_paths.py passes.
No secrets in diff — one ignore rule.
Documentation updated IF needed — the rule carries its own explanation, in the style of the rest of the file.
Reviewer assigned — Logan.

Risk Level:

LOW: Single file fix, non-critical
MEDIUM: Multiple files, standard operation
HIGH: Core changes, requires human eyes

One file and one rule, but .gitignore is load-bearing here and a wrong pattern silently untracks content. Hence the four-case verification rather than a claim.

Labels to apply:

agent:claude-code

https://claude.ai/code/session_01EBV6TkrwsZhcwkh1b6NUHs

Generated by Claude Code

Summary by Sourcery

Build:

Update .gitignore to ignore root node_modules/**/*.md so npm-installed dependencies are not accidentally committed.

`.gitignore` ignores `**/node_modules/**`, then re-includes markdown at any depth with `!*.md` -- a pattern with no slash, so it matches everywhere. Git takes the last matching rule, so the re-include wins and every README.md inside node_modules is stageable. That is CORRECT for THE-GEMSTONE/node_modules, which is vendored content this vault tracks on purpose: 49 .md files, preserved deliberately in #939. It is wrong for a root node_modules, which npm regenerates from package-lock.json and which nobody should commit. Measured with `git add --dry-run node_modules/`: 2 files leak with main's dependencies today (prettier only) 466 files leak with the eight devDependencies #950 adds Both are vendored README files. One `git add -A` after an `npm install` puts them in the repo. The new rule is last in the file and must stay last -- it only beats the markdown re-include by coming after it. The leading slash anchors it to the repo root. Verified, all four cases: root node_modules markdown -> now ignored (was: !*.md at line 159) `git add --dry-run node_modules/` -> 0 files (was: 2 here, 466 with #950) THE-GEMSTONE/.../lib.md -> still tracked, unchanged CONSTITUTION.md -> unaffected tracked file count -> 38,424, unchanged This is a shared surface, so it is a proposal rather than something folded into another PR: it stands alone and changes nothing until merged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EBV6TkrwsZhcwkh1b6NUHs

coderabbitai · 2026-08-11T05:29:32Z

Warning

Review limit reached

@loganfinney27, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 61619fd2-9318-4fd2-a832-a2fa9a38ebfb

📥 Commits

Reviewing files that changed from the base of the PR and between c2d070e and 1226741.

📒 Files selected for processing (1)

.gitignore

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sourcery-ai · 2026-08-11T05:29:34Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

.gitignore is updated to ensure markdown files under a root-level node_modules are ignored while preserving tracking of vendored markdown files under THE-GEMSTONE/node_modules, with an explanatory comment about rule ordering and root anchoring.

File-Level Changes

Change	Details	Files
Adjust ignore patterns so root node_modules markdown files remain ignored despite the global markdown re-include, without affecting vendored node_modules content.	Append a new ignore rule that anchors to the repository root to ignore markdown files under the root node_modules tree. Add an inline comment explaining the interaction between the node_modules ignore, the !*.md re-include, and why the new rule must remain last. Verify behavior using git check-ignore and git add --dry-run to ensure root node_modules markdown is ignored while THE-GEMSTONE/node_modules markdown stays tracked.	`.gitignore`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

codacy-production · 2026-08-11T05:30:42Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

tenki-reviewer · 2026-08-11T05:31:39Z

Insufficient balance to process this code review. Please add funds or upgrade your plan in billing.

chatgpt-codex-connector · 2026-08-11T05:31:42Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Copilot

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

qodo-code-review · 2026-08-11T05:31:43Z

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

Copilot: the six entries were unanchored basename patterns, so git applied them at any depth. Measured before the fix: some/deep/dir/.pylintrc text: set .codex/skills/ruleset.xml text: set sub/.bandit text: set That directly contradicts this PR's own claim -- "no pattern, so no file outside the named six can be affected." A .gitattributes pattern with no slash is a basename match, exactly like .gitignore. Which is the same trap I documented in #953 one PR earlier, in the other direction. Each entry now carries a leading slash. Verified after: root .bandit/.pylintrc/.remarkrc/.shellcheckrc/.stylelintrc/ruleset.xml text: set (unchanged) some/deep/dir/.pylintrc text: unspecified (was: set) .codex/skills/ruleset.xml text: unspecified (was: set) sub/.bandit text: unspecified (was: set) RSS.xml text: unspecified (unchanged) The comment now explains the anchoring alongside the `*.xml` note, since the two traps have the same root cause: git pattern matching is path-anchored only when the pattern contains a slash. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EBV6TkrwsZhcwkh1b6NUHs

loganfinney27 · 2026-08-11T20:59:07Z

PING!

devactivity-app · 2026-08-12T02:48:46Z

Pull Request Summary by devActivity

Metrics

Achievements

@loganfinney27
Earned XP: 11⭐
Check Your Progress

loganfinney27 added the risk/med Filetype: med (computer code — executes). label Aug 11, 2026

loganfinney27 marked this pull request as ready for review August 11, 2026 05:31

Copilot AI balanced review requested due to automatic review settings August 11, 2026 05:31

Copilot AI reviewed Aug 11, 2026

View reviewed changes

sourcery-ai Bot reviewed Aug 11, 2026

View reviewed changes

loganfinney27 mentioned this pull request Aug 11, 2026

Declare the six extensionless tool configs as text #954

Merged

7 tasks

loganfinney27 enabled auto-merge August 11, 2026 06:04

This was referenced Aug 11, 2026

Add .codacy.yaml — the Codacy config file the platform actually reads #955

Merged

Turn the Codacy tool toggles on, with every baseline measured #950

Open

loganfinney27 mentioned this pull request Aug 12, 2026

SARIF crash: 7.10.1 bump DISPROVED by its own CI — diagnosis holds, fix does not #958

Merged

7 tasks

loganfinney27 added this pull request to the merge queue Aug 12, 2026

Merged via the queue into main with commit faf97ea Aug 12, 2026
44 of 45 checks passed

loganfinney27 deleted the claude/gitignore-node-modules-qzt7le branch August 12, 2026 02:48

Uh oh!

Uh oh!

Conversation

loganfinney27 commented Aug 11, 2026 • edited by sourcery-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AGENT PR TEMPLATE

Changes Made

Measured, both ways

Verified, all four cases

Why this is its own PR

Related Work

Blockers

Summary by Sourcery

Uh oh!

coderabbitai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

sourcery-ai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

codacy-production Bot commented Aug 11, 2026

Up to standards ✅

Uh oh!

tenki-reviewer Bot commented Aug 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

qodo-code-review Bot commented Aug 11, 2026

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

loganfinney27 commented Aug 11, 2026

Uh oh!

Uh oh!

devactivity-app Bot commented Aug 12, 2026

Pull Request Summary by devActivity

Metrics

Achievements

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

loganfinney27 commented Aug 11, 2026 •

edited by sourcery-ai Bot

Loading

coderabbitai Bot commented Aug 11, 2026 •

edited

Loading

sourcery-ai Bot commented Aug 11, 2026 •

edited

Loading