ssot: declare the one path-scoped link policy waiver

[yakimoto]

Declares the single link-policy waiver this repo needs, scoped to one package path rather than to the whole npm host.

What the scan reports today

A fleet-wide link policy check renders this repo's three published views — README.md, llms.txt, manifest.json — and reports any URL whose host is not a WAVE publish domain. One finding stands, in all three views:

https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk

That is the optional peer dependency the SDK-server section documents. It is a legitimate link, so it gets a reasoned exception rather than a removal.

Why the waiver is path-scoped

The obvious form — waive the host www.npmjs.com — would excuse every npm link in this repo, permanently, including one added years from now by someone who never saw the waiver. On a public repo that turns off the check in exactly the place it earns its keep: a dependency-links block that gets appended to over time.

So the waiver names the package path:

{
  "host": "www.npmjs.com",
  "pathPrefix": "/package/@anthropic-ai/claude-agent-sdk",
  "reason": "The optional peer dependency documented in the SDK-server section. …"
}

Path matching is on a segment boundary, not a bare string prefix, so a look-alike path under a different owner is not covered.

Receipts

Run through the scanner's own scan/count functions:

case	unwaived	meaning
path-scoped waiver	0	the documented dependency link is excused
+ an arbitrary npm package link	3	that link still blocks — npm is not wide open
host-only waiver instead (for comparison)	0	would have excused the arbitrary link too
no waiver at all	6	control: both links were being detected

The second row is the point of the change, and the fourth is what makes the second meaningful — without it, "0 unwaived" could just mean nothing was being found.

Nothing new reaches a published byte

The waiver is scanner metadata, not content. No renderer reads it. All three published views are byte-identical before and after:

README.md       byte-identical=true   (11148 chars, unchanged)
llms.txt        byte-identical=true   ( 9054 chars, unchanged)
manifest.json   byte-identical=true   (17116 chars, unchanged)

sentinel scan of the rendered output:
  absent  "policyWaivers"
  absent  "pathPrefix"
  absent  the waiver's reason text

So this PR changes what the checker permits, and changes nothing a reader of this package ever sees.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

Note

Low Risk
Metadata-only change to WAVE repo config; no runtime, auth, or published documentation bytes affected.

Overview
Adds a policyWaivers entry in .wave/repo.json so the fleet link-policy scan can allow the documented optional peer dependency URL (www.npmjs.com/package/@anthropic-ai/claude-agent-sdk) without waiving all npm links.

The waiver is path-scoped (pathPrefix on that package path) rather than host-wide, so other third-party npm URLs in published views still fail the check. This is scanner metadata only; it does not change rendered README.md, llms.txt, or manifest.json output.

^{Reviewed by Cursor Bugbot for commit a8dcf88. Configure here.}

---

Summary by cubic

Adds a path‑scoped link-policy waiver in .wave/repo.json for https://www.npmjs.com/package/@anthropic-ai/claude-agent-sdk, allowing the documented optional peer dependency link. Other npm links remain blocked; no published files change.

^{Written for commit a8dcf88. Summary will update on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: a8dcf88

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d4496932-bae3-442b-937d-1da95587dc81)

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 07cf16c0-3186-4de3-b70a-366cd2d1bc8b

📥 Commits

Reviewing files that changed from the base of the PR and between a199245 and a8dcf88.

📒 Files selected for processing (1)

• .wave/repo.json

---

_{Comment @coderabbitai help to get the list of available commands.}