Add file exclusion via josh stored filters (v1.2.0)

New `exclude` config field per target generates .josh-filters/<name>.josh
files with josh :exclude clauses. Josh-proxy applies exclusions at the
transport layer — excluded files never appear in the subrepo.

Preflight checks that generated filter files are committed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/config.sh

@@ -7,6 +7,45 @@
 #
 # Requires: lib/core.sh sourced first, yq and jq on PATH
 
+# ─── Josh Filter File Generation ──────────────────────────────────
+# Generates .josh-filters/<target>.josh for targets with exclude patterns.
+# These files must be committed to the monorepo — josh-proxy reads them
+# from the repo at clone time via the :+ stored filter syntax.
+
+_generate_josh_filters() {
+  local has_excludes
+  has_excludes=$(echo "$JOSH_SYNC_TARGETS" | jq '[.[] | select((.exclude // []) | length > 0)] | length')
+
+  if [ "$has_excludes" -eq 0 ]; then
+    return
+  fi
+
+  mkdir -p .josh-filters
+
+  local target_name subfolder exclude_patterns filter_content
+  while IFS= read -r target_name; do
+    subfolder=$(echo "$JOSH_SYNC_TARGETS" | jq -r --arg n "$target_name" \
+      '.[] | select(.name == $n) | .subfolder')
+    exclude_patterns=$(echo "$JOSH_SYNC_TARGETS" | jq -r --arg n "$target_name" \
+      '.[] | select(.name == $n) | .exclude | map("  ::" + .) | join("\n")')
+
+    filter_content=":/${subfolder}:exclude[
+${exclude_patterns}
+]"
+
+    local filter_file=".josh-filters/${target_name}.josh"
+    local existing=""
+    if [ -f "$filter_file" ]; then
+      existing=$(cat "$filter_file")
+    fi
+
+    if [ "$filter_content" != "$existing" ]; then
+      echo "$filter_content" > "$filter_file"
+      log "WARN" "Generated ${filter_file} — commit this file to the monorepo"
+    fi
+  done < <(echo "$JOSH_SYNC_TARGETS" | jq -r '.[] | select((.exclude // []) | length > 0) | .name')
+}
+
 # ─── Phase 1: Parse Config ─────────────────────────────────────────
 
 parse_config() {
@@ -36,7 +75,10 @@ parse_config() {
   export JOSH_SYNC_TARGETS
   JOSH_SYNC_TARGETS=$(echo "$config_json" | jq '[.targets[] | . +
     # Auto-derive josh_filter from subfolder if not set
-    (if (.josh_filter // "") == "" then
+    # When exclude patterns are present, use a stored josh filter (:+.josh-filters/<name>)
+    (if (.exclude // [] | length) > 0 then
+      {josh_filter: (":+.josh-filters/" + .name)}
+    elif (.josh_filter // "") == "" then
       {josh_filter: (":/" + .subfolder)}
     else {} end) +
     # Derive gitea_host and subrepo_repo_path from subrepo_url
@@ -56,6 +98,9 @@ parse_config() {
     )
   ]')
 
+  # Generate .josh-filters/*.josh for targets with exclude patterns
+  _generate_josh_filters
+
   # Load .env credentials (if present, not required — CI sets these via secrets)
   if [ -f .env ]; then
     # shellcheck source=/dev/null