fix: match nested review sources before the node_modules exclude

.changeset/review-source-pathspec-order.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/intent': patch
+---
+
+Match a skill source in `review` when its path is nested. Git dropped the matches when the source came before the `node_modules` exclude, so a valid source reported no available files.

packages/intent/src/review/review.ts

@@ -404,8 +404,8 @@ export function createReview(cwd: string, baseRef?: string): ReviewReport {
         '--exclude-standard',
         '-z',
         '--',
-        ...patterns,
         dependencyExclude,
+        ...patterns,
       ]),
     )
   const diff = (patterns: Array<string> = [], from = base) =>

packages/intent/tests/review.test.ts

@@ -229,6 +229,20 @@ it('excludes installed dependencies even without a gitignore entry', () => {
   ])
 })
 
+it('matches a single nested source while excluding installed dependencies', () => {
+  write('packages/client/src/index.ts', 'export const client = true\n')
+  write('packages/client/src/node_modules/installed/index.ts', 'dependency\n')
+  skill(['acme/library:packages/client/src/**'])
+  git('add', '.')
+  git('commit', '-qm', 'nested source')
+  const [item] = createReview(root).items
+  expect(item?.problems).toEqual([])
+  expect(Object.keys(item?.snapshot ?? {})).toEqual([
+    'packages/client/src/index.ts',
+    'skills/request/SKILL.md',
+  ])
+})
+
 it('includes staged, unstaged, untracked and deleted paths and uses Git glob semantics', () => {
   accept()
   write('src/nested/more.ts', 'new source\n')