Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 require-ready-label-and-ci

Greptile Summary

This PR prevents raw HAR captures and oversized capture files from being bundled into published CLI packages by routing all manuscript copy operations through a new CopyPublishableManuscriptDir filter. The filter is applied consistently across archive, lock/promote, and publish-package flows.

• New filter (copyDirFiltered): skips files (and symlinks, by name and resolved-target check) whose extension is .har (case-insensitive) or whose size is ≥ 100 MB; CopyDir is unchanged and still passes nil for backward compatibility.
• Publish package hardening: staged .manuscripts copied from the source CLI is stripped before manuscripts are re-added through the filter; a fallback reads embedded manuscripts from the source CLI directory when the archive root has no matching run.
• Test coverage: all three affected copy sites gain before/after assertions for .har exclusion, large-file exclusion, and preservation of derived artifacts (traffic analysis JSON, research notes, proofs).

Confidence Score: 5/5

Safe to merge. The filter is applied consistently across all three copy sites (archive, promote, publish), the two-pass symlink check correctly covers both symlink names and resolved targets, and every changed code path has a corresponding test that verifies both exclusion and inclusion behavior.

The filter logic in copyDirFiltered is straightforward — regular files are checked directly by name and size, symlinks get a two-pass check (symlink name first, then os.Stat-followed target name and size). CopyDir is unchanged and backward-compatible. The publish-package fallback cleanly strips the staged manuscripts directory before re-adding through the filter, sourcing from the original dir rather than the staged copy. Test coverage spans all three call sites and explicitly exercises the threshold boundary (exactly 100 MB file, symlink-to-.har, symlink-to-large-file).

No files require special attention.

Important Files Changed

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Manuscript source] --> B{copyDirFiltered}
    B --> C{Entry type?}
    C -->|Regular file| D{.har ext OR size >= 100 MB?}
    C -->|Symlink| E{Symlink name ends in .har?}
    D -->|Yes| SKIP1[Skip]
    D -->|No| COPY1[Copy file to dst]
    E -->|Yes| SKIP2[Skip]
    E -->|No| F{Target name .har OR target size >= 100 MB?}
    F -->|Yes| SKIP3[Skip]
    F -->|No| COPY2[Create symlink in dst]
    C -->|Directory| MKDIR[MkdirAll in dst]

    subgraph Callers
        AR[ArchiveRunArtifacts] -->|CopyPublishableManuscriptDir| B
        LK[stageRunstateManuscripts] -->|CopyPublishableManuscriptDir| B
        PP[publish package] --> G{Archive run found?}
        G -->|Yes| H[Use archive path]
        G -->|No| I[Fallback: embedded .manuscripts]
        H -->|CopyPublishableManuscriptDir| B
        I -->|CopyPublishableManuscriptDir| B
    end

_{Reviews (3): Last reviewed commit: "fix(cli): filter manuscript symlink targ..." | Re-trigger Greptile}

Merge Queue Status

• ✅ Entered queue — 2026-05-31 17:49 UTC · Rule: default
• ✅ Checks passed · on draft merge queue: embarking main (6f5518f), #2532, #2527 and #2525 together #2541
• ✅ Merged — 2026-05-31 18:07 UTC · at b6947ef797e7f11b78da3c10eb844aa27ba93973 · squash

This pull request spent 17 minutes 29 seconds in the queue, including 14 minutes 29 seconds running CI.