Resolves

Summary

With macOS File Provider the extension never read a .sync-exclude.lst; only the exclude list the main app sends over XPC (setIgnoreList, the global list) was applied. A file such as a.excl was uploaded although the root .sync-exclude.lst contained *.excl.

This change makes the extension read the .sync-exclude.lst in the root container of the domain and apply it to the whole domain together with the global list, like the classic sync engine does for the root of a synchronized folder.

• RootContainerExcludeList (new actor): finds the file in the local database, downloads it once per etag (concurrent callers share one download), caches the patterns in memory, treats a 404 as an empty list and returns a retryable NSFileProviderError when the file exists but cannot be read. After the extension itself uploads the file the contents are cached without a download.
• FileProviderExtension: createItem, modifyItem and deleteItem use the merged matcher.
• IgnoredFilesMatcher: pattern translation now follows ExcludedFiles in csync_exclude.cpp. Before, directory-only patterns (build/) never matched, and escapes, [!...] and a leading ] were not handled. Matching also receives whether the item is a directory.

Not covered, on purpose (kept out to stay focused): .sync-exclude.lst files in subfolders are still not read, and nothing is filtered in the server-to-local direction (same as the global list today). Items already synchronized are not affected retroactively.

Tests

• RootContainerExcludeListTests (new, XCTest because the package's Realm-backed suites rely on the process-wide default Realm configuration, which a parallel Swift Testing suite in the package overwrites), IgnoredFilesMatcherTests (extended), ItemCreateTests (extended).
• swift test in shell_integration/MacOSX/NextcloudFileProviderKit: XCTest 417 executed, 1 skipped, 0 failures; Swift Testing 122 tests in 14 suites passed (run on the branch rebased on master 1845220).

Manual test

On macOS with a locally built, development-signed app containing this change, against a test account: root .sync-exclude.lst with *.excl and skipdir/; created files and directories (also a 3410-file, 159-folder tree copied in one go), renamed into and out of excluded names, changed/removed/restored the list while running, restarted the extension. Excluded items were never sent to the server, everything else was uploaded. I have not tested the list being changed by another client (the etag path is only covered by the unit tests).

Known leftovers

swiftformat --lint (0.64.4, installed locally) reports findings in files this PR touches, but none on lines added here; they exist on master already.

Checklist

• Sign-off message is added to all commits.
• The commit messages are following The Conventional Commits specification.
• The commit history is clean with no merge commits.
  • How to rebase your commits
  • How to squash commits with rebase
• Uploaded screenshots from before and after for UI changes. (not applicable, no UI change)
• Test(s) added to branch, with before/after results included in PR description, for performance improvements where applicable. (not applicable, no performance claim)
• Documentation has been updated or is not required. (not required, nothing documents the exclude lists of the File Provider engine)
• Backports requested where applicable (critical bugfixes).
• Labels added where applicable (bug/enhancement).
• Milestone added for target version.

AI (if applicable)

• The content of this PR was partly or fully generated using AI
  • I have read the guidelines for AI-assisted contributions.
  • I have read Nextcloud's AI Contribution Policy.

Disclosure: the implementation, the tests and the commit were produced with Claude Code (claude-opus-5-5) and reviewed by me.