fix(core): exclude dot-directories and node_modules from studio composition discovery and lint

[leorivastech]

Summary

Fixes #1384. walkDir only skipped three exact names (.thumbnails, node_modules, .git), so HTML inside any other dot-directory (.hyperframes/, .cache/, …) surfaced in the comps sidebar (each entry preview-rendered) and inflated the studio Lint badge with findings from files that aren't part of the video.

Changes

• New isInHiddenOrVendorDir helper in studio-api/helpers/safePath.ts: rejects paths with a dot-directory or node_modules segment.
• Applied to composition discovery (routes/projects.ts) and the studio lint route (routes/lint.ts) — the two surfaces named in the issue.
• The file tree is deliberately left unfiltered: this only gates discovery. Happy to extend the exclusion to walkDir itself if you'd rather hide dot-directories everywhere.
• The meta.json ignore-list idea from the issue would compose well on top of this; left out to keep the change minimal.

Tests

projects.test.ts + lint.test.ts (new, following the files.test.ts patterns): a vendored .hyperframes/examples/preset.html carrying data-composition-id is excluded from compositions and lint but stays visible in the file tree. Both exclusion tests fail against the pre-fix code.

Verification

• studio-api route tests — 14/14 pass
• typecheck on @hyperframes/core passes; oxlint / oxfmt --check clean; fallow audit gate clean

[miguel-heygen]

Real issue, clean fix.

walkDir only skips 3 hardcoded dirs (.thumbnails, node_modules, .git), so any HTML in .hyperframes/, .cache/, .waveform-cache/ etc. leaks into composition discovery and lint. The fix is minimal and correct:

• isInHiddenOrVendorDir checks path segments for dot-prefix or node_modules — segments.slice(0, -1) correctly excludes the filename itself so a root-level .foo.html isn't affected
• Applied only at the discovery/lint layer, not walkDir itself — file tree stays unfiltered (deliberate, and the right call)
• Tests create real temp dirs with .hyperframes/examples/preset.html carrying data-composition-id, verify exclusion from compositions + lint while confirming visibility in the file tree

No concerns. LGTM.

[miguel-heygen]

Looks good. This fixes the reported #1384 surfaces by filtering hidden/vendor directory HTML out of composition discovery and lint without hiding the files from the tree, and the route tests cover both behaviors. Live checks are green.

[jrusso1020]

@leorivastech I think you need to sign your commits for this to be mergable

more on it here https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification

https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

[leorivastech]

@jrusso1020 Got it — setting up commit signing now, will re-push the branch signed shortly.

[leorivastech]

@jrusso1020 Done — branch re-pushed with the commit signed (SSH signing set up); GitHub now shows it as Verified. Should be mergeable on your end.

[jrusso1020]

Re-review after the signing re-push — approving.

Signing (my earlier comment): resolved. Head commit fed58af now verifies verified: true / reason: valid, so the BLOCKED mergeStateStatus is purely the review-required gate, not a failing check (only CI check, WIP, is green).

@miguel-heygen already covered the core fix; this is additive on the bits worth confirming on a re-review:

Correctness

• isInHiddenOrVendorDir (safePath.ts) uses segments.slice(0, -1), so it gates dot-dir / node_modules path segments but never the filename — a root-level .foo.html composition still surfaces. Paths from walkDir are always /-joined regardless of OS, so the split("/") is consistent cross-platform.
• Complementary to walkDir's existing IGNORE_DIRS (it prunes .git/node_modules/.thumbnails at the dir level; this helper catches every other dot-dir it recurses into). No double-negative or conflict.

All discovery surfaces covered (the thing I most wanted to verify on re-review)

• The two project-wide HTML enumerators — filterCompositionFiles (projects.ts:10) and lint (lint.ts:12) — are both filtered.
• The only other data-composition-id match, files.ts:1084, operates on a single caller-addressed file (res.absPath), not a project walk, so it's correctly out of scope.
• File tree (files) intentionally left unfiltered — matches #1384's ask that vendored HTML stays browsable.

Tests — both projects.test.ts and lint.test.ts pin positive (real comps lint/discover) and negative (vendored .hyperframes/** excluded) and confirm file-tree visibility; both fail pre-fix.

nit (non-blocking): no explicit test for the deliberate root-level .foo.html keep-case or a node_modules/** exclusion — both are exercised implicitly but a one-line assert would pin the slice(0, -1) intent against future edits.

Verdict: APPROVE
Reasoning: Real bug, minimal and correct fix, all enumeration surfaces filtered, tests pin both directions, commit now signed/verified, CI green.