fix(engine): reject over-complex screenshotTableGate whenPaths globs at normalization

[shin-core]

What & why

matchesAny fails toward matching for a glob whose wildcard-group count exceeds the compiler's safety cap:

return globs.some((g) => hasUnsafeWildcardCount(g) || globToRegExp(g).test(canonicalPath));

That is the right default for hardGuardrailGlobs (an over-complex guardrail glob still forces a human hold). It is the wrong default for the screenshot-table gate's whenPaths, which matchesAny also backs (via matchesAnyWithExclusions), where "matches everything" means "every PR in the repo is in scope". whenPaths was normalized for type/emptiness/count/length but never wildcard count, so:

1. Include glob. whenPaths: ["apps/**/src/**/*.tsx"] (3 groups) makes matchesAny return true for every changed file → every PR in scope for a close-tier visual gate, reachable by a typo-free, plausible monorepo scoping value.
2. Exclusion glob. !**/*.generated.* (3-group body) compiles with globToRegExp directly, whose over-complex fallback is NEVER_MATCHES, so it excludes nothing — silently reverting the operator to the pre-exclusion behaviour.

Both silent (no warning anywhere). Every other maintainer-supplied glob surface in the manifest already rejects this shape with a warning via the exported hasUnsafeWildcardCount — screenshot-table-gate.ts was the one that didn't.

The fix

Give normalizeStringList a caller-selected glob mode, enabled for whenPaths only. An entry whose glob body (the string after a leading !) has an unsafe wildcard count is dropped with a warning naming the field and index — mirroring focus-manifest.ts's normalizeOptionalGlob. Measuring on the body means an exclusion is judged by the pattern matchesAnyWithExclusions actually compiles; a bare "!" (no body, which matchesAnyWithExclusions would mis-route into the include list) is dropped too. Remaining valid entries are kept, exactly like the existing per-entry drop behaviour.

Unchanged: whenLabels / requireViewports / requireThemes normalization is byte-identical; matchesAny's fail-toward-matching semantics, globToRegExp's NEVER_MATCHES fallback, MAX_GLOB_WILDCARD_GROUPS, countWildcardGroups, and hardGuardrailGlobs behaviour are all untouched (the guardrail's fail-safe direction is correct and load-bearing). The cap value is not moved and no second threshold is added.

Tests

• Engine (packages/loopover-engine/test/screenshot-table-gate.test.ts, node:test): a 3-group whenPaths glob is dropped with a warning and no longer puts an unrelated file (README.md) in scope while the valid entry (apps/ui/src/App.tsx) still is; an exclusion is judged by its body and a bare "!" is dropped; a 2-group glob and a valid exclusion are preserved unchanged.
• Root (test/unit/screenshot-table-gate.test.ts): the same three normalization outcomes plus the isScreenshotTableGateInScope behaviour change.
• All new assertions fail on main and pass with the fix.

Validation

• Diff coverage on packages/loopover-engine/src/review/screenshot-table-gate.ts is 100% line and branch (the glob mode, the !-body/no-! arms, and the body === "" || unsafe arms). Engine lines credited via the root-vitest upload; the added test is also in packages/loopover-engine/test/** for the dual-upload union.
• npm run typecheck clean for these files; npm run engine-parity:drift-check passes; the engine's own node --test suite is green; npm run dead-exports:check clean.
• git diff --check clean; no schema/migration/generated-artifact change.

Closes #9993

[loopover-orb]

Tip

✅ LoopOver review result - approve/merge recommended

_{Review updated: 2026-07-31 08:12:43 UTC}

3 files · 1 AI reviewer · no blockers · readiness 98/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR closes issue #9993 by making whenPaths glob normalization reject over-complex (>2 wildcard-group) globs the same way every other manifest glob surface does, instead of letting matchesAnyWithExclusions fail open and match every file. The exclusion-glob handling correctly measures the wildcard count against the glob body (post `!` strip) since that's what the matcher actually compiles, and a bare `!` with no body is also dropped to avoid mis-routing into the include list. The change is small, source-layer (fixed exactly where the glob is normalized rather than patching a symptom downstream), and is paired with tests in both the package suite and dist-consuming test that exercise the include-glob, exclusion-glob, bare-`!`, and pass-through (2-group) cases.

Nits — 3 non-blocking

• screenshot-table-gate.ts: the glob is length-capped via `.slice(0, maxChars)` before the wildcard-count check runs on the truncated string — an edge case where truncation itself changes the wildcard count isn't tested, though this is a pre-existing ordering, not something the diff introduces.
• The new `engine(gate): reject over-complex screenshotTableGate whenPaths globs instead of letting them match every path #9993` tests are duplicated near-verbatim across `packages/loopover-engine/test/screenshot-table-gate.test.ts` and `test/unit/screenshot-table-gate.test.ts` — consistent with this repo's existing dual-import-identity convention per the `Screenshot gate auto-closed non-visual PRs via apps/loopover-ui/public/** (openapi.json); verify sibling repos #9434` comment, but worth confirming that's still the intended pattern rather than incidental duplication.
• Consider adding one boundary-case test at exactly 2 vs 3 wildcard groups directly against `hasUnsafeWildcardCount`'s threshold to make the cap explicit at the call site, mirroring `focus-manifest.ts`'s own boundary tests if any exist.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#9993
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 50 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	shin-core; Gittensor profile; 65 PR(s), 0 issue(s).
Improvement	✅ Minor	risk: clean · value: minor · LLM: significant

Linked issue satisfaction

Addressed
The diff adds a glob-mode flag to normalizeStringList applied only to whenPaths, using hasUnsafeWildcardCount on the glob body (stripping a leading '!') and dropping bare '!' entries with warnings while preserving other valid entries, matching the required normalizeOptionalGlob pattern and leaving whenLabels/requireViewports/requireThemes untouched. Tests cover the include-glob, exclusion-body, ba

Review context

• Author: shin-core
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.95%. Comparing base (9f673b8) to head (cb979ac).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10115   +/-   ##
=======================================
  Coverage   91.95%   91.95%           
=======================================
  Files         931      931           
  Lines      113921   113935   +14     
  Branches    27504    27514   +10     
=======================================
+ Hits       104757   104772   +15     
+ Misses       7863     7858    -5     
- Partials     1301     1305    +4     

Flag	Coverage Δ
backend	95.66% <100.00%> (-0.01%)	⬇️
engine	72.78% <100.00%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...oopover-engine/src/review/screenshot-table-gate.ts	74.80% <100.00%> (+1.48%)	⬆️

... and 2 files with indirect coverage changes

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.