docs(policy): declare a path-scoped waiver for the Claude Agent SDK npm link

[yakimoto]

Refs wave-av/wave-context#91 — the mcp-server half of its acceptance criterion. wave-dispatch already carries its own waivers (0 unwaived / 12 waived), so once this lands, wave-context#91 can be closed.

The findings

The rendered README, llms.txt, and manifest.json all link https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk — the dependency this server is built on, and legitimately part of "for consumers already running inside a Claude Agent SDK …" prose. Every publish-domain scan reports 3 unwaived findings on this repo, all the same URL.

Before, from a scan on origin/main:

✗ @wave-av/mcp-server — 3 unwaived, 0 waived:
    [README.md]     disallowed-url: https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk
    [llms.txt]      (same URL)
    [manifest.json] (same URL)

After this waiver, same CLI:

~ @wave-av/mcp-server — 0 unwaived, 3 waived
fleet: 0 unwaived / 3 waived

Why path-scoped, not host-scoped

Per wave-av/wave-context#104, which was measured on this very repo: {host: "www.npmjs.com"} alone silently excuses every npm link in the repo forever, including one added later by someone who never saw this diff. pathPrefix scopes the exception to the exact package. The matcher is segment-boundary (matchesPathPrefix) — verified live by mutation.

Mutations killed by the policy CLI itself, each reverted with the inverse edit:

mutation	expected	got
pathPrefix → /package/@anthropic-ai/some-other-pkg	3 unwaived	3 unwaived ✓
pathPrefix → /package/@some-other-owner/claude-agent-sdk	3 unwaived	3 unwaived ✓
pathPrefix → /package/@anthropic-a (prefix-injection)	3 unwaived	3 unwaived ✓

Owner-only /package/@anthropic-ai does waive /package/@anthropic-ai/* — that's the intended semantics of the prefix. The narrower single-package spelling is used here to keep the scope truthful to the reason.

🤖 Generated with Claude Code

---

Note

Low Risk
Metadata-only policy waiver in .wave/repo.json; no runtime, auth, or API behavior changes.

Overview
Adds a policyWaivers entry in .wave/repo.json so publish-domain scans no longer flag three unwaived disallowed-url findings for https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk (README, llms.txt, manifest).

The waiver is path-scoped (pathPrefix /package/@anthropic-ai/claude-agent-sdk on www.npmjs.com), not host-wide, so other npm links added later stay reportable per wave-context#104.

Also fixes the JSON file terminator (newline after closing }).

^{Reviewed by Cursor Bugbot for commit cb44630. Configure here.}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

Summary by cubic

Add a path-scoped publish-domain waiver for the npm link to @anthropic-ai/claude-agent-sdk in docs to stop false-positive scan findings. Result: 0 unwaived, 3 waived. Refs wave-av/wave-context#91 (mcp-server half).

• Bug Fixes
  • Added a policyWaivers entry in .wave/repo.json for www.npmjs.com with pathPrefix /package/@anthropic-ai/claude-agent-sdk.
  • Waiver is limited to that package only; other npm links remain reported.

^{Written for commit cb44630. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: cb44630

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_48999263-b13c-434e-a7c8-b2978026f44c)

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 1 minute

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e68a52de-618f-42db-959a-28387fada195

📥 Commits

Reviewing files that changed from the base of the PR and between a199245 and cb44630.

📒 Files selected for processing (1)

• .wave/repo.json

---

_{Comment @coderabbitai help to get the list of available commands.}

[yakimoto]

Closing as a duplicate of #69, which predates this by a day and declares the identical waiver (same host, same pathPrefix, only the reason prose differs).

I opened this without checking for an existing PR on the repo first — my mistake, and the check that would have caught it is gh pr list on the target repo before writing, not just the tracking issue.

The measurement in this PR still stands and applies to #69 unchanged: before, ✗ 3 unwaived, 0 waived; after, ~ 0 unwaived, 3 waived. Three mutations confirm the path scope discriminates — swapping the prefix to another package, to another owner, or to a truncated /package/@anthropic-a all return to 3 unwaived. #69 is the one to merge.