fix(build): anchor .distignore patterns and install no-dev composer deps

[superdav42]

Summary

Fixes the activation fatal in the production zip introduced in #1305 / #1307. The published superdav-ai-agent-1.11.1-wporg.zip cannot be activated because two distribution-build bugs combined to break the Jetpack autoloader filemap.

Bug 1 — unanchored .distignore patterns

bin/build.sh feeds .distignore to rsync --exclude-from. Per rsync semantics, unanchored patterns match at any depth. Entries like src, tests, bin, docs were intended to drop the plugin's own top-level directories but were also wiping vendor/*/src/, vendor/*/tests/, vendor/*/bin/, vendor/*/docs/. In particular, vendor/php-di/php-di/src/ (the entire library) was being stripped, so activation hard-fatalled with:

require_once(.../vendor/php-di/php-di/src/functions.php): Failed to open stream: No such file or directory
in vendor/jetpack-autoloader/class-version-loader.php on line 109

42 vendor src/ directories were affected.

Bug 2 — autoloader filemap referenced dev-only packages

After the rsync fix exposed the next layer: the bundled vendor/composer/jetpack_autoload_filemap.php was generated with dev deps installed (e.g. myclabs/deep-copy via phpunit), but the zip intentionally excludes vendor/myclabs. Same fatal class, different file:

require_once(.../vendor/myclabs/deep-copy/src/DeepCopy/deep_copy.php): Failed to open stream

Changes

• .distignore — Anchor every top-level-only pattern with a leading slash (/src, /tests, /bin, /docs, /.git, /.github, /.beads, /.claude, /.husky, all top-level config files, top-level READMEs etc.). Tree-wide patterns that should match anywhere (*.zip, *.log, *.map, **/.codex, **/.editorconfig, vendor/sebastian, etc.) are kept unanchored or use explicit **/. Adds a documented preamble explaining the rules and pointing at this regression.
• .distignore — Adds vendor/**/.beads, vendor/**/.claude, vendor/**/.github to drop vendor-internal dev directories that don't belong in a production zip.
• bin/build.sh — Runs composer install --no-dev -o before build_variant() so the bundled autoloader filemap matches what is actually shipped. Restores the dev install via an EXIT trap, so the working tree is unchanged after the build.
• bin/build.sh — Trims the inline EXTRA exclude block to only safe tree-wide dotfile patterns (**/.eslintrc* etc.). The unanchored tests, test, .phpunit*, phpunit* entries are removed because the intent is now covered by anchored entries in .distignore.

Verification

• bin/build.sh --target=both produces:
  • superdav-ai-agent-1.11.1.zip — 2.2 MB / 904 files
  • superdav-ai-agent-1.11.1-wporg.zip — 2.1 MB / fewer files
• vendor/php-di/php-di/src/functions.php is present in the zip.
• vendor/sebastian/, vendor/phpunit/, vendor/myclabs/, vendor/x-wp/di/.beads/, vendor/x-wp/di/.claude/, top-level src/, top-level tests/, .playwright-mcp/, and .codex files are all absent.
• wp plugin install /path/to/superdav-ai-agent-1.11.1-wporg.zip --activate on a fresh WordPress 7.0 install succeeds with HTTP 200 on the homepage and a clean debug.log (no fatals related to this plugin).

Out of scope

• The unrelated RestControllerTest::test_tool_result_409_* PHPUnit failures pre-existing on main.
• Top-level vendor/x-wp/di/.beads/ etc. only matter for the source tree; they are now also stripped from the zip via the new vendor/**/.beads pattern.

[coderabbitai]

Warning

Rate limit exceeded

@superdav42 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 28 minutes and 23 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c836aeaf-eeba-42ac-9c91-9caec3e3d3b8

📥 Commits

Reviewing files that changed from the base of the PR and between 6210458 and 0420824.

📒 Files selected for processing (2)

• .distignore
• bin/build.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/distignore-vendor-src-strip

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}