docs: except cursor.directory from the online link check

[kyle-sexton]

No related issue: org-wide online link sweep requested by the repository owner.

Summary

An online lychee 0.24.2 run (network on, no GitHub token, shared lychee.toml from standards) over tracked markdown checked 248 links and failed only https://cursor.directory/, cited in docs/official-docs.md and plugins/plugin-ops/reference/doc-sources.md.

Fix

Adds .lycheeignore with one exact-URL entry, ^https://cursor\.directory/?$, and its evidence:

• The 429 is not a rate limit. Every non-browser client (lychee, curl, curl with a browser User-Agent, WebFetch) gets X-Vercel-Mitigated: challenge and a "Vercel Security Checkpoint" page (2026-10-11).
• A JavaScript-rendering fetch (firecrawl) returned the live plugin index ("Extend Cursor with community plugins.") the same day.

medley mentions cursor.directory only as inline code, not a link, so this exception is needed in one repository and is not proposed as a shared exclude.

Verification

• Rerun of the same online command against this branch: 248 links, 0 errors, 0 timeouts.
• lychee.toml is untouched; no Verified date in the docs was changed.

Related

• Online sweep row G of the org lychee audit; shared config from fix(lychee): regenerate private inventory, check dot-directories, retry 429s, remap JS anchors standards#767.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T15:24:43.012924Z	b128aee	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 1m 13s —— View job

---

Security review — no issues found

• Gather context (PR diff, CLAUDE.md/AGENTS.md instructions)
• Invoke /review:security-review skill
• Post findings

Scope: PR #106 changes exactly one file — a new .lycheeignore adding a single anchored regex, ^https://cursor\.directory/?$, to exempt that one URL from the lychee link checker, with an evidence comment explaining the exemption (Vercel bot-challenge 429s to non-browser clients, confirmed live via a JS-rendering fetch).

Skip-gate result: this change has no security-relevant surface.

• No executable logic, no injection surface (command/SQL/path/template), no token/secret/credential handling.
• The regex is a narrow, fully-anchored exact-domain match — no wildcard or unanchored pattern that could silently widen to exempt other URLs, and no catastrophic-backtracking shape.
• This isn't an instruction-surface deletion: .lycheeignore is a link-checker config file, not CLAUDE.md/AGENTS.md, a rules file, a skill/agent body, or a hook's block/allow list, so the instruction-exception-register lens doesn't apply.
• Confirmed via .github/workflows/pr-require-checks.yml that CI's lychee job runs lychee offline (lychee-offline action) — this file only ever affects which URLs get skipped, never adds network calls or alters trust boundaries either in CI or in the manual online sweep described in the PR body.

No CRITICAL / IMPORTANT / SUGGESTION findings to report.

[claude]

Claude finished @kyle-sexton's task in 2m 26s —— View job

---

Code review complete

• Gather context (PR diff, CLAUDE.md/AGENTS.md, lychee config)
• Review .lycheeignore for correctness and scope
• Check alignment with repo conventions (CI, docs conventions)
• Post findings

No blocking findings.

Reviewed the single changed file, .lycheeignore, against this repo's conventions:

• Placing the exclude in a new repo-local .lycheeignore rather than editing lychee.toml is the correct call, not just a style choice: lychee.toml is one of the repo-root files AGENTS.md says are synced from melodic-software/standards and must stay byte-identical (.github/workflows/pr-require-checks.yml lines 7–12), so hand-editing it would violate that rule.
• The regex ^https://cursor\.directory/?$ correctly anchors and escapes the literal dot, and matches both citation sites verbatim (docs/official-docs.md:65,72, plugins/plugin-ops/reference/doc-sources.md:30,52), both of which use the bare https://cursor.directory form with no www., path, or query string — so the narrower "exact URL" pattern (vs. the broader (www\.)?...([?#].*)? style used elsewhere in lychee.toml for other bot-blocked hosts) is appropriately scoped here, not under-scoped.
• The evidence comment (429 is a Vercel bot checkpoint, not a rate limit, observed across lychee/curl/browser-UA/WebFetch, with a JS-rendering fetch confirming the page is live) follows the same "verified-dated, checker-side limitation" convention as the other exclude entries in lychee.toml.
• This file has no effect on the required CI lychee job, which runs with --offline and skips external URLs entirely (lychee.toml top comment) — it only matters for the manual online run the PR describes, consistent with the PR's own framing.

Caveat: I don't have network access in this environment, so I could not independently re-run lychee to confirm the exclude actually suppresses the cursor.directory failure (the PR's "248 links, 0 errors" result is author-claimed and unverified by me). The pattern and placement are correct on static review; I'm not vouching for the live run.

[github-actions]

claude-security-review has reviewed this pull request through b128aee; a later push is reviewed from there.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b128aeec79

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review has reviewed this pull request through b128aee; a later push is reviewed from there.