fix(cli): honor strict ignore rules and resource title links

Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

src/basic_memory/ignore_utils.py

@@ -201,7 +201,9 @@ def load_bmignore_patterns() -> Set[str]:
     return patterns
 
 
-def load_gitignore_patterns(base_path: Path, use_gitignore: bool = True) -> Set[str]:
+def load_gitignore_patterns(
+    base_path: Path, use_gitignore: bool = True, *, strict: bool = False
+) -> Set[str]:
     """Load gitignore patterns from .gitignore file and .bmignore.
 
     Combines patterns from:
@@ -212,10 +214,30 @@ def load_gitignore_patterns(base_path: Path, use_gitignore: bool = True) -> Set[
     Args:
         base_path: The base directory to search for .gitignore file
         use_gitignore: If False, only load patterns from .bmignore (default: True)
+        strict: Read without creating files; only missing ignore files permit defaults.
 
     Returns:
         Set of patterns to ignore
     """
+    if strict:
+        # Publishing a snapshot must never silently include files excluded by unreadable rules.
+        patterns: set[str] = set()
+        bmignore_path = get_bmignore_path()
+        paths = [bmignore_path, base_path / ".gitignore"] if use_gitignore else [bmignore_path]
+        for path in paths:
+            try:
+                content = path.read_text(encoding="utf-8")
+            except FileNotFoundError:
+                content = ""
+            patterns.update(
+                pattern
+                for line in content.splitlines()
+                if (pattern := _parse_ignore_pattern_line(line)) is not None
+            )
+            if path == bmignore_path and not patterns:
+                patterns.update(DEFAULT_IGNORE_PATTERNS)
+        return patterns
+
     # Start with patterns from .bmignore
     patterns = load_bmignore_patterns()
 

src/basic_memory/okf/export.py

@@ -78,11 +78,14 @@ async def recorded_history(
 
 
 def snapshot_files(root: Path) -> tuple[ExportFile, ...]:
+    from basic_memory.ignore_utils import load_gitignore_patterns
     from basic_memory.index.local_project import scan_local_project_index_files
     from basic_memory.index.local_wiki_projection import _is_projector_owned
     from basic_memory.runtime.storage import runtime_file_path_is_markdown_note
 
-    scan = scan_local_project_index_files(root, strict=True)
+    scan = scan_local_project_index_files(
+        root, ignore_patterns=load_gitignore_patterns(root, strict=True), strict=True
+    )
     if scan.unreadable_directories:
         raise OSError("Incomplete project scan: " + ", ".join(scan.unreadable_directories))
     files = []

src/basic_memory/okf/render.py

@@ -286,10 +286,6 @@ def render_bundle(snapshot: ExportSnapshot) -> tuple[ExportFile, ...]:
             if note_type is not None
             else "note"
         )
-        if title in title_targets and title_targets[title] != file.path:
-            ambiguous.add(title)
-        else:
-            title_targets[title] = file.path
         permalink = normalize_frontmatter_value(source_metadata.get("permalink"))
         if not isinstance(permalink, str) or not permalink:
             permalink = build_canonical_permalink(
@@ -303,6 +299,13 @@ def render_bundle(snapshot: ExportSnapshot) -> tuple[ExportFile, ...]:
                     f"{permalinks[permalink]}"
                 )
             permalinks[permalink] = file.path
+    # Resources use their full filename as the canonical indexed title.
+    for file in snapshot.files:
+        title = titles.get(file.path, PurePosixPath(file.path).name)
+        if title in title_targets and title_targets[title] != file.path:
+            ambiguous.add(title)
+        else:
+            title_targets[title] = file.path
     for alias in ambiguous:
         title_targets.pop(alias)
     # Relative path resolution uses exact file identities, separate from semantic names.

tests/okf/test_export_failures.py

@@ -382,3 +382,55 @@ async def test_exact_project_name_precedes_normalized_alias(source_config, tmp_p
     assert report.success and report.concepts == 1
     assert (destination / "chosen.md").is_file()
     assert not (destination / "a.md").exists()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("ignore_name", [".gitignore", ".bmignore"])
+async def test_unreadable_ignore_file_aborts_publication(
+    source_config, tmp_path, monkeypatch, ignore_name
+):
+    from basic_memory.ignore_utils import get_bmignore_path
+
+    root = Path(source_config.projects["export"].path)
+    ignore = root / ignore_name if ignore_name == ".gitignore" else get_bmignore_path()
+    ignore.parent.mkdir(parents=True, exist_ok=True)
+    ignore.write_text("credentials.json\n", encoding="utf-8")
+    (root / "credentials.json").write_text("excluded bytes", encoding="utf-8")
+    destination = tmp_path / "bundle"
+    destination.mkdir()
+    (destination / "keep").write_bytes(b"previous bundle")
+    original_read = Path.read_text
+
+    def denied_read(path, *args, **kwargs):
+        if path == ignore:
+            raise PermissionError(13, "ignore rules unreadable", str(path))
+        return original_read(path, *args, **kwargs)
+
+    monkeypatch.setattr(Path, "read_text", denied_read)
+    with pytest.raises(PermissionError, match="ignore rules unreadable"):
+        await export_project(source_config, "export", destination, replace=True)
+    assert (destination / "keep").read_bytes() == b"previous bundle"
+    monkeypatch.setattr(Path, "read_text", original_read)
+    assert (await export_project(source_config, "export", destination, replace=True)).success
+    assert not (destination / "credentials.json").exists()
+
+
+@pytest.mark.parametrize("empty_bmignore", [False, True])
+def test_strict_ignore_defaults_do_not_create_files(tmp_path, monkeypatch, empty_bmignore):
+    from basic_memory.ignore_utils import (
+        DEFAULT_IGNORE_PATTERNS,
+        create_default_bmignore,
+        load_gitignore_patterns,
+    )
+
+    bmignore = tmp_path / ".bmignore"
+    monkeypatch.setattr("basic_memory.ignore_utils.get_bmignore_path", lambda: bmignore)
+    if empty_bmignore:
+        bmignore.write_text("# no custom rules\n", encoding="utf-8")
+    assert load_gitignore_patterns(tmp_path, use_gitignore=False, strict=True) == (
+        DEFAULT_IGNORE_PATTERNS
+    )
+    assert bmignore.exists() is empty_bmignore
+    if empty_bmignore:
+        create_default_bmignore()
+        assert bmignore.read_text(encoding="utf-8") == "# no custom rules\n"

tests/okf/test_okf.py

@@ -861,3 +861,27 @@ def test_network_path_wikilinks_remain_literal():
     assert convert_wikilinks(body, "source.md", {"a.md": "a.md"}, "p") == (
         "[[//example.com/a]] [[//example.com/a|alias]] [/a.md](/a.md)"
     )
+
+
+@pytest.mark.parametrize("duplicate", [False, True])
+def test_nested_resource_titles_resolve_with_ambiguity_handling(test_project, duplicate):
+    from basic_memory.models import Entity
+    from basic_memory.services.bulk_link_resolver import ProjectEntityIdentityIndex
+
+    owner = Entity(title="paper.pdf", file_path="refs/paper.pdf")
+    entities = [owner]
+    files = [ExportFile("refs/paper.pdf", b"pdf"), ExportFile("source.md", b"[[paper.pdf]]")]
+    if duplicate:
+        entities.append(Entity(title="paper.pdf", file_path="other/paper.pdf"))
+        files.append(ExportFile("other/paper.pdf", b"other pdf"))
+    index = ProjectEntityIdentityIndex.from_entities(test_project, entities)
+    resolved = index.resolve_strict(
+        "paper.pdf", include_project_permalinks=True, workspace_permalink=None
+    ).entity
+    assert resolved is (None if duplicate else owner)
+    source = next(
+        file.content
+        for file in render_bundle(ExportSnapshot("p", tuple(files)))
+        if file.path == "source.md"
+    )
+    assert (b"[paper.pdf](/paper.pdf)" if duplicate else b"[paper.pdf](/refs/paper.pdf)") in source