feat: add .nixmacignore support for agent file exclusion

[Scott McMaster (scottmcmaster)]

Summary

This addresses old Linear issue 212. The high-level feature is to have a way to not expose certain files to the agent BUT allow them to be checked into the repo (e.g. not gitignored). See the module comment in the file nixmac_ignore.rs for the business rules.

To hook this up, I integrated it into the existing places where we DID check .gitignore (namely, list and search-code), and I hijacked the existing "nixmac_edit_allowed" function (which didn't have a comment so I felt free to repurpose it since it seems to be called in exactly the right places) to also incorporate the check into edits.

Please let me know if there are any other entry points in the tools that need to respect this and I missed. Thanks.

Test Plan

Lots of new/modofied unit tests, and I did some targeted manual testing with some additional logging hooked up to see files get nixmac-ignored.

• No test plan needed

Docs

• Docs updated (companion PR in darkmatter/nixmac-web: #___)
• No docs update needed

[Scott McMaster (scottmcmaster)]

• feat: add .nixmacignore support for agent file exclusion #592 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

	Warnings
⚠️	No Linear issue ID found in this PR's title, description, or branch name (expected something like ENG-123). Add one so this work is traceable in Linear, or add #no-linear to the PR description to acknowledge it's intentionally untracked.
⚠️	This PR touches behavior-sensitive code that is documented in darkmatter/nixmac-web. Please either: Open a companion docs PR and check Docs updated in the PR description, or Check No docs update needed if the change doesn't affect user-facing behavior.

📋 PR Overview

Lines changed	593 (+548 / -45)
Files	2 added, 11 modified, 0 deleted
Draft / WIP	no
Has Test Plan	yes
Linear issue	no
No Test Plan Needed	no
New UI components	no
New Storybook stories	no
New Rust modules	yes (1)
New TS source files	no
New tests	no
package.json touched	no
Cargo.toml touched	yes
Infra / CI touched	no

🔬 Coverage

Report	Lines	Statements	Functions	Branches
apps/native/coverage/coverage-summary.json	35.6%	35.3%	30.6%	30.0%

Generated by 🚫 dangerJS against f6f9357

[darkmatter]

🎨 Storybook preview

Open Storybook preview

Updated for f6f9357

[Copilot]

Pull request overview

Adds a repository-root .nixmacignore mechanism to prevent the evolution agent from listing/searching/editing specified files (even if tracked by git), integrating the checks into the existing list_files, search_code, and edit-guard paths in the Rust backend.

Changes:

• Introduces NixmacIgnoreChecker to load/apply .nixmacignore with mandatory ignores (.git, result) and “.nixmac is immune” rules.
• Threads a nixmac_ignore_matcher through tool dispatch, applying it in search_code filtering and in ensure_nixmac_edit_allowed for edit tools.
• Adds a .nixmacignore template file and updates Rust dependencies to use the ignore crate directly.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Cargo.lock	Updates lockfile for new/updated Rust dependency usage.
apps/native/templates/nix-darwin-determinate/.nixmacignore	Adds a starter .nixmacignore file for the nix-darwin template.
apps/native/src/ipc/types.ts	Minor generated-types diff (whitespace/newline changes).
apps/native/src-tauri/src/evolve/tools/search_code.rs	Passes nixmac-ignore matcher into execute_search_code.
apps/native/src-tauri/src/evolve/tools/list_files.rs	Applies nixmac-ignore filtering during file listing.
apps/native/src-tauri/src/evolve/tools/ensure_secret.rs	Enforces nixmac-ignore in edit-guard for injected secret file paths.
apps/native/src-tauri/src/evolve/tools/edit_nix_file.rs	Enforces nixmac-ignore in edit-guard for nix edits.
apps/native/src-tauri/src/evolve/tools/edit_file.rs	Enforces nixmac-ignore in edit-guard for plain edits.
apps/native/src-tauri/src/evolve/tools.rs	Extends tool context/dispatch and updates ensure_nixmac_edit_allowed to include nixmac-ignore rules.
apps/native/src-tauri/src/evolve/search_code.rs	Extends search filtering to hide nixmac-ignored matches.
apps/native/src-tauri/src/evolve/nixmac_ignore.rs	New module implementing .nixmacignore business rules and matcher.
apps/native/src-tauri/src/evolve/mod.rs	Wires nixmac-ignore matcher creation into evolution setup and tool execution.
apps/native/src-tauri/Cargo.toml	Adds ignore = "0.4.31" dependency.
.vscode/settings.json	Simplifies rust-analyzer settings (removes extraArgs).

Comments suppressed due to low confidence (1)

apps/native/src-tauri/src/evolve/search_code.rs:99

• The grep fallback no longer excludes mandatory nixmac-ignored directories. Unlike ripgrep, grep -rn will recurse into .git/ and result/, which can be extremely slow and may surface content indirectly via errors/timeouts even though matches are filtered later. Add back the directory excludes here.

            // Fallback to grep if rg is not available.
            let mut grep_cmd = Command::new("grep");
            grep_cmd.arg("-rn");
            grep_cmd
                .arg("--max-count")
                .arg(MAX_SEARCH_RESULTS.to_string());
            let output = grep_cmd.arg(pattern).arg(".").current_dir(base).output()?;
            let stdout = String::from_utf8_lossy(&output.stdout);
            let filtered = filter_grep_matches(&stdout, visible.as_ref(), nixmac_ignore);