fix(sync): guard overlapping hidden watch roots

Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

src/basic_memory/sync/watch_service.py

@@ -93,6 +93,7 @@ def __init__(
         self.status_path = app_config.data_dir_path / WATCH_STATUS_JSON
         self.status_path.parent.mkdir(parents=True, exist_ok=True)
         self._ignore_patterns_cache: dict[Path, Set[str]] = {}
+        self._watch_filter_roots: tuple[Path, ...] | None = None
         self._sync_service_factory = sync_service_factory
         # When set (typically from BASIC_MEMORY_MCP_PROJECT), the watch cycle
         # only observes this project. Without it, each `basic-memory mcp --project X`
@@ -126,41 +127,48 @@ def _get_ignore_patterns(self, project_path: Path) -> Set[str]:
     async def _watch_projects_cycle(self, projects: Sequence[Project], stop_event: asyncio.Event):
         """Run one cycle of watching the given projects until stop_event is set."""
         project_paths = [project.path for project in projects]
+        previous_filter_roots = self._watch_filter_roots
+        self._watch_filter_roots = tuple(
+            Path(project.path).expanduser().resolve() for project in projects
+        )
 
-        async for changes in awatch(
-            *project_paths,
-            debounce=self.app_config.sync_delay,
-            watch_filter=self.filter_changes,
-            recursive=True,
-            stop_event=stop_event,
-        ):
-            # group changes by project and filter using ignore patterns
-            project_changes = defaultdict(list)
-            for change, path in changes:
-                for project in projects:
-                    if self.is_project_path(project, path):
-                        # Check if the file should be ignored based on gitignore patterns
-                        project_path = Path(project.path)
-                        file_path = Path(path)
-                        ignore_patterns = self._get_ignore_patterns(project_path)
-
-                        if should_ignore_path(file_path, project_path, ignore_patterns):
-                            logger.trace(
-                                f"Ignoring watched file change: {file_path.relative_to(project_path)}"
-                            )
-                            continue
-
-                        project_changes[project].append((change, path))
-                        break
+        try:
+            async for changes in awatch(
+                *project_paths,
+                debounce=self.app_config.sync_delay,
+                watch_filter=self.filter_changes,
+                recursive=True,
+                stop_event=stop_event,
+            ):
+                # group changes by project and filter using ignore patterns
+                project_changes = defaultdict(list)
+                for change, path in changes:
+                    for project in projects:
+                        if self.is_project_path(project, path):
+                            # Check if the file should be ignored based on gitignore patterns
+                            project_path = Path(project.path)
+                            file_path = Path(path)
+                            ignore_patterns = self._get_ignore_patterns(project_path)
+
+                            if should_ignore_path(file_path, project_path, ignore_patterns):
+                                logger.trace(
+                                    f"Ignoring watched file change: {file_path.relative_to(project_path)}"
+                                )
+                                continue
+
+                            project_changes[project].append((change, path))
+                            break
 
-            # create coroutines to handle changes
-            change_handlers = [
-                self.handle_changes(project, set(changes))
-                for project, changes in project_changes.items()
-            ]
+                # create coroutines to handle changes
+                change_handlers = [
+                    self.handle_changes(project, set(changes))
+                    for project, changes in project_changes.items()
+                ]
 
-            # process changes
-            await asyncio.gather(*change_handlers)
+                # process changes
+                await asyncio.gather(*change_handlers)
+        finally:
+            self._watch_filter_roots = previous_filter_roots
 
     async def _select_projects_to_watch(self) -> list[Project]:
         """Return the set of projects this watch cycle should observe.
@@ -276,14 +284,20 @@ def filter_changes(self, change: Change, path: str) -> bool:  # pragma: no cover
 
         path_obj = Path(path).expanduser().resolve()
 
-        project_paths = sorted(
-            (
+        project_roots = self._watch_filter_roots
+        if project_roots is None:
+            project_roots = tuple(
                 Path(entry.path).expanduser().resolve()
                 for entry in self.app_config.projects.values()
                 if entry.path
-            ),
+            )
+
+        project_paths = sorted(
+            project_roots,
+            # Trigger: configured project roots can overlap.
+            # Why: an enclosing project's hidden directory should still hide descendants.
+            # Outcome: choose the outermost matching root when checking hidden path parts.
             key=lambda project_path: len(project_path.parts),
-            reverse=True,
         )
 
         relative_path = None

tests/sync/test_watch_service_edge_cases.py

@@ -28,6 +28,7 @@ def test_filter_changes_allows_project_under_hidden_parent(watch_service, tmp_pa
     project_home = tmp_path / ".claude" / "projects" / "memory"
     project_home.mkdir(parents=True)
     watch_service.app_config.projects["hidden-parent"] = ProjectEntry(path=str(project_home))
+    watch_service._watch_filter_roots = (project_home.resolve(),)
 
     visible_note = project_home / "notes" / "visible.md"
     hidden_note = project_home / "notes" / ".drafts" / "hidden.md"
@@ -36,6 +37,20 @@ def test_filter_changes_allows_project_under_hidden_parent(watch_service, tmp_pa
     assert watch_service.filter_changes(Change.added, str(hidden_note)) is False
 
 
+def test_filter_changes_rejects_nested_project_inside_hidden_directory(watch_service, tmp_path):
+    """A nested project must not make its enclosing project's hidden path visible."""
+    outer_project = tmp_path / "outer"
+    nested_project = outer_project / ".private" / "subproject"
+    nested_project.mkdir(parents=True)
+    watch_service.app_config.projects["outer"] = ProjectEntry(path=str(outer_project))
+    watch_service.app_config.projects["nested"] = ProjectEntry(path=str(nested_project))
+    watch_service._watch_filter_roots = (outer_project.resolve(), nested_project.resolve())
+
+    nested_note = nested_project / "notes" / "visible.md"
+
+    assert watch_service.filter_changes(Change.added, str(nested_note)) is False
+
+
 def test_filter_changes_hidden_path(watch_service, project_config):
     """Test the filter_changes method with hidden files/directories."""
     # Hidden file (starts with dot)