@intellectronica/ruler 0.3.42 → 0.3.43

package/dist/core/apply-engine.js

@@ -105,6 +105,7 @@ async function createHierarchicalConfiguration(rulerDir, files, config, cliConfi
         config,
         concatenatedRules,
         rulerMcpJson,
+        projectRoot: directoryRoot,
     };
 }
 async function loadConfigForRulerDir(rulerDir, cliConfigPath, resolvedNested, localOnly) {
@@ -139,6 +140,12 @@ function cloneLoadedConfig(config) {
         clonedAgentConfigs[agent] = {
             ...agentConfig,
             mcp: agentConfig.mcp ? { ...agentConfig.mcp } : undefined,
+            mcpServers: agentConfig.mcpServers
+                ? Object.fromEntries(Object.entries(agentConfig.mcpServers).map(([name, server]) => [
+                    name,
+                    { ...server },
+                ]))
+                : undefined,
         };
     }
     return {
@@ -194,9 +201,10 @@ async function loadSingleConfiguration(projectRoot, configPath, localOnly) {
     const { dirs: rulerDirs, primaryDir } = await findRulerDirectories(projectRoot, localOnly, false);
     // Warn about legacy mcp.json
     await warnAboutLegacyMcpJson(primaryDir);
+    const effectiveProjectRoot = FileSystemUtils.resolveProjectRootForRulerDir(projectRoot, primaryDir);
     // Load the ruler.toml configuration
     const config = await (0, ConfigLoader_1.loadConfig)({
-        projectRoot,
+        projectRoot: effectiveProjectRoot,
         configPath,
         checkGlobal: !localOnly,
     });
@@ -210,7 +218,7 @@ async function loadSingleConfiguration(projectRoot, configPath, localOnly) {
     // Load unified config to get merged MCP configuration
     const { loadUnifiedConfig } = await Promise.resolve().then(() => __importStar(require('./UnifiedConfigLoader')));
     const unifiedConfig = await loadUnifiedConfig({
-        projectRoot,
+        projectRoot: effectiveProjectRoot,
         configPath,
         checkGlobal: !localOnly,
     });
@@ -225,6 +233,7 @@ async function loadSingleConfiguration(projectRoot, configPath, localOnly) {
         config,
         concatenatedRules,
         rulerMcpJson,
+        projectRoot: effectiveProjectRoot,
     };
 }
 /**
@@ -282,7 +291,7 @@ async function applyConfigurationsToAgents(agents, concatenatedRules, rulerMcpJs
         (0, constants_1.logInfo)(`Applying rules for ${agent.getName()}...`, dryRun);
         (0, constants_1.logVerbose)(`Processing agent: ${agent.getName()}`, verbose);
         const agentConfig = config.agentConfigs[agent.getIdentifier()];
-        const agentRulerMcpJson = rulerMcpJson;
+        const agentRulerMcpJson = mergeAgentMcpServers(rulerMcpJson, agentConfig);
         // Collect output paths for .gitignore
         const outputPaths = (0, agent_utils_1.getAgentOutputPaths)(agent, projectRoot, agentConfig);
         (0, constants_1.logVerbose)(`Agent ${agent.getName()} output paths: ${outputPaths.join(', ')}`, verbose);
@@ -358,6 +367,19 @@ async function handleMcpConfiguration(agent, agentConfig, config, rulerMcpJson,
 function shouldUseEngineManagedMcp(agent) {
     return (agent.getIdentifier() === 'codex' || agent.getIdentifier() === 'opencode');
 }
+function mergeAgentMcpServers(rulerMcpJson, agentConfig) {
+    const baseServers = rulerMcpJson?.mcpServers && typeof rulerMcpJson.mcpServers === 'object'
+        ? rulerMcpJson.mcpServers
+        : {};
+    const agentServers = agentConfig?.mcpServers ?? {};
+    const mergedServers = {
+        ...baseServers,
+        ...agentServers,
+    };
+    return Object.keys(mergedServers).length > 0
+        ? { mcpServers: mergedServers }
+        : null;
+}
 async function resolveMcpDestination(agent, agentConfig, projectRoot) {
     if (agentConfig?.outputPathConfig) {
         return path.resolve(projectRoot, agentConfig.outputPathConfig);
@@ -412,10 +434,10 @@ async function applyMcpConfiguration(agent, filteredMcpJson, dest, agentConfig,
     }
     const agentMcpJson = sanitizeMcpTimeoutsForAgent(agent, filteredMcpJson, dryRun);
     if (agent.getIdentifier() === 'openhands') {
-        return await applyOpenHandsMcpConfiguration(agentMcpJson, dest, cliMcpStrategy ?? agentConfig?.mcp?.strategy ?? config.mcp?.strategy, dryRun, verbose, backup);
+        return await applyOpenHandsMcpConfiguration(agentMcpJson, dest, projectRoot, cliMcpStrategy ?? agentConfig?.mcp?.strategy ?? config.mcp?.strategy, dryRun, verbose, backup);
     }
     if (agent.getIdentifier() === 'opencode') {
-        return await applyOpenCodeMcpConfiguration(agentMcpJson, dest, cliMcpStrategy ?? agentConfig?.mcp?.strategy ?? config.mcp?.strategy, dryRun, verbose, backup);
+        return await applyOpenCodeMcpConfiguration(agentMcpJson, dest, projectRoot, cliMcpStrategy ?? agentConfig?.mcp?.strategy ?? config.mcp?.strategy, dryRun, verbose, backup);
     }
     // Agents that handle MCP configuration internally should not have external MCP handling
     if (agent.getIdentifier() === 'zed' ||
@@ -425,22 +447,22 @@ async function applyMcpConfiguration(agent, filteredMcpJson, dest, agentConfig,
         (0, constants_1.logVerbose)(`Skipping external MCP config for ${agent.getName()} - handled internally by agent`, verbose);
         return;
     }
-    return await applyStandardMcpConfiguration(agent, agentMcpJson, dest, agentConfig, config, cliMcpStrategy, dryRun, verbose, backup);
+    return await applyStandardMcpConfiguration(agent, agentMcpJson, dest, agentConfig, config, projectRoot, cliMcpStrategy, dryRun, verbose, backup);
 }
-async function applyOpenHandsMcpConfiguration(filteredMcpJson, dest, strategy, dryRun, verbose, backup = true) {
+async function applyOpenHandsMcpConfiguration(filteredMcpJson, dest, projectRoot, strategy, dryRun, verbose, backup = true) {
     if (dryRun) {
         (0, constants_1.logVerbose)(`DRY RUN: Would apply MCP config by updating TOML file: ${dest}`, verbose);
     }
     else {
-        await (0, propagateOpenHandsMcp_1.propagateMcpToOpenHands)(filteredMcpJson, dest, backup, strategy);
+        await (0, propagateOpenHandsMcp_1.propagateMcpToOpenHands)(filteredMcpJson, dest, backup, strategy, projectRoot);
     }
 }
-async function applyOpenCodeMcpConfiguration(filteredMcpJson, dest, strategy, dryRun, verbose, backup = true) {
+async function applyOpenCodeMcpConfiguration(filteredMcpJson, dest, projectRoot, strategy, dryRun, verbose, backup = true) {
     if (dryRun) {
         (0, constants_1.logVerbose)(`DRY RUN: Would apply MCP config by updating OpenCode config file: ${dest}`, verbose);
     }
     else {
-        await (0, propagateOpenCodeMcp_1.propagateMcpToOpenCode)(filteredMcpJson, dest, backup, strategy);
+        await (0, propagateOpenCodeMcp_1.propagateMcpToOpenCode)(filteredMcpJson, dest, backup, strategy, projectRoot);
     }
 }
 /**
@@ -536,7 +558,7 @@ function transformMcpForFactoryDroid(mcpJson) {
     transformedMcp.mcpServers = transformedServers;
     return transformedMcp;
 }
-async function applyStandardMcpConfiguration(agent, filteredMcpJson, dest, agentConfig, config, cliMcpStrategy, dryRun, verbose, backup = true) {
+async function applyStandardMcpConfiguration(agent, filteredMcpJson, dest, agentConfig, config, projectRoot, cliMcpStrategy, dryRun, verbose, backup = true) {
     const strategy = cliMcpStrategy ??
         agentConfig?.mcp?.strategy ??
         config.mcp?.strategy ??
@@ -554,7 +576,8 @@ async function applyStandardMcpConfiguration(agent, filteredMcpJson, dest, agent
     else {
         // Transform MCP config for agent-specific compatibility
         let mcpToMerge = filteredMcpJson;
-        if (agent.getIdentifier() === 'claude') {
+        if (agent.getIdentifier() === 'claude' ||
+            agent.getIdentifier() === 'aider') {
             mcpToMerge = transformMcpForClaude(filteredMcpJson);
         }
         else if (agent.getIdentifier() === 'kilocode') {
@@ -633,13 +656,13 @@ async function applyStandardMcpConfiguration(agent, filteredMcpJson, dest, agent
         if (currentContent !== newContent) {
             if (backup) {
                 const { backupFile } = await Promise.resolve().then(() => __importStar(require('../core/FileSystemUtils')));
-                await backupFile(dest);
+                await backupFile(dest, projectRoot);
             }
             if (isCodexToml) {
-                await FileSystemUtils.writeGeneratedFile(dest, (0, toml_1.stringify)(toWrite));
+                await FileSystemUtils.writeGeneratedFile(dest, (0, toml_1.stringify)(toWrite), projectRoot);
             }
             else {
-                await (0, mcp_1.writeNativeMcp)(dest, toWrite);
+                await (0, mcp_1.writeNativeMcp)(dest, toWrite, projectRoot);
             }
         }
         else {

package/dist/core/revert-engine.d.ts

@@ -20,7 +20,7 @@ export interface CleanUpResult {
  * @param agent The agent to revert
  * @param projectRoot Root directory of the project
  * @param agentConfig Agent-specific configuration
- * @param keepBackups Whether to keep backup files
+ * @param keepBackups Whether restored backup files should be preserved
  * @param verbose Whether to enable verbose logging
  * @param dryRun Whether to perform a dry run
  * @returns Promise resolving to revert statistics
@@ -34,3 +34,4 @@ export declare function revertAgentConfiguration(agent: IAgent, projectRoot: str
  * @returns Promise resolving to cleanup statistics
  */
 export declare function cleanUpAuxiliaryFiles(projectRoot: string, verbose: boolean, dryRun: boolean): Promise<CleanUpResult>;
+export declare function cleanUpAgentDirectories(agent: IAgent, projectRoot: string, agentConfig: IAgentConfig | undefined, verbose: boolean, dryRun: boolean): Promise<number>;

package/dist/core/revert-engine.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.revertAgentConfiguration = revertAgentConfiguration;
 exports.cleanUpAuxiliaryFiles = cleanUpAuxiliaryFiles;
+exports.cleanUpAgentDirectories = cleanUpAgentDirectories;
 const path = __importStar(require("path"));
 const fs_1 = require("fs");
 const agent_utils_1 = require("../agents/agent-utils");
@@ -43,9 +44,20 @@ const constants_1 = require("../constants");
 const GitignoreUtils_1 = require("./GitignoreUtils");
 const settings_1 = require("../vscode/settings");
 const path_utils_1 = require("./path-utils");
+const FileSystemUtils_1 = require("./FileSystemUtils");
 const RULER_START_MARKER = '# START Ruler Generated Files';
 const RULER_END_MARKER = '# END Ruler Generated Files';
 const RULER_GENERATED_MARKER = '<!-- Generated by Ruler -->';
+const RULER_SOURCE_MARKER_PREFIXES = [
+    '<!-- Source: .ruler/',
+    '<!-- Source: ruler/',
+];
+async function resolveMcpPathForRevert(agent, projectRoot, agentConfig) {
+    if (agentConfig?.outputPathConfig) {
+        return path.resolve(projectRoot, agentConfig.outputPathConfig);
+    }
+    return await (0, mcp_1.getNativeMcpPath)(agent.getName(), projectRoot);
+}
 /**
  * Checks if a file exists.
  */
@@ -90,6 +102,10 @@ async function hasRulerGeneratedProvenance(filePath, projectRoot) {
         if (content.startsWith(RULER_GENERATED_MARKER)) {
             return true;
         }
+        const trimmedContent = content.trimStart();
+        if (RULER_SOURCE_MARKER_PREFIXES.some((prefix) => trimmedContent.startsWith(prefix))) {
+            return true;
+        }
     }
     catch {
         return false;
@@ -109,7 +125,7 @@ async function hasRulerGeneratedProvenance(filePath, projectRoot) {
 /**
  * Restores a file from its backup if the backup exists.
  */
-async function restoreFromBackup(filePath, verbose, dryRun) {
+async function restoreFromBackup(filePath, verbose, dryRun, projectRoot) {
     const backupPath = `${filePath}.bak`;
     const backupExists = await fileExists(backupPath);
     if (!backupExists) {
@@ -121,6 +137,10 @@ async function restoreFromBackup(filePath, verbose, dryRun) {
         (0, constants_1.logVerbose)(`${prefix} Would restore: ${filePath} from backup`, verbose);
     }
     else {
+        if (projectRoot) {
+            await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(filePath, projectRoot, 'Refusing to restore backup through symlinked output path');
+            await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(backupPath, projectRoot, 'Refusing to restore from backup through symlinked backup path');
+        }
         await fs_1.promises.copyFile(backupPath, filePath);
         (0, constants_1.logVerbose)(`${prefix} Restored: ${filePath} from backup`, verbose);
     }
@@ -150,6 +170,9 @@ async function removeGeneratedFile(filePath, verbose, dryRun, projectRoot) {
         (0, constants_1.logVerbose)(`${prefix} Would remove generated file: ${filePath}`, verbose);
     }
     else {
+        if (projectRoot) {
+            await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(filePath, projectRoot, 'Refusing to remove generated file through symlinked path');
+        }
         await fs_1.promises.unlink(filePath);
         (0, constants_1.logVerbose)(`${prefix} Removed generated file: ${filePath}`, verbose);
     }
@@ -158,7 +181,7 @@ async function removeGeneratedFile(filePath, verbose, dryRun, projectRoot) {
 /**
  * Removes backup files.
  */
-async function removeBackupFile(filePath, verbose, dryRun) {
+async function removeBackupFile(filePath, verbose, dryRun, projectRoot) {
     const backupPath = `${filePath}.bak`;
     const backupExists = await fileExists(backupPath);
     if (!backupExists) {
@@ -169,6 +192,9 @@ async function removeBackupFile(filePath, verbose, dryRun) {
         (0, constants_1.logVerbose)(`${prefix} Would remove backup file: ${backupPath}`, verbose);
     }
     else {
+        if (projectRoot) {
+            await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(backupPath, projectRoot, 'Refusing to remove backup file through symlinked path');
+        }
         await fs_1.promises.unlink(backupPath);
         (0, constants_1.logVerbose)(`${prefix} Removed backup file: ${backupPath}`, verbose);
     }
@@ -320,7 +346,7 @@ async function removeAdditionalAgentFiles(projectRoot, verbose, dryRun) {
             }
             const backupExists = await fileExists(`${fullPath}.bak`);
             if (backupExists) {
-                const restored = await restoreFromBackup(fullPath, verbose, dryRun);
+                const restored = await restoreFromBackup(fullPath, verbose, dryRun, projectRoot);
                 if (restored) {
                     filesRemoved++;
                 }
@@ -346,7 +372,7 @@ async function removeAdditionalAgentFiles(projectRoot, verbose, dryRun) {
     const settingsPath = (0, settings_1.getVSCodeSettingsPath)(projectRoot);
     const backupPath = `${settingsPath}.bak`;
     if (await fileExists(backupPath)) {
-        const restored = await restoreFromBackup(settingsPath, verbose, dryRun);
+        const restored = await restoreFromBackup(settingsPath, verbose, dryRun, projectRoot);
         if (restored) {
             filesRemoved++;
             (0, constants_1.logVerbose)(`${prefix} Restored VSCode settings from backup`, verbose);
@@ -374,11 +400,12 @@ async function removeAdditionalAgentFiles(projectRoot, verbose, dryRun) {
                     delete settings['augment.advanced'];
                     const remainingKeys = Object.keys(settings);
                     if (remainingKeys.length === 0) {
+                        await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(settingsPath, projectRoot, 'Refusing to remove VSCode settings through symlinked path');
                         await fs_1.promises.unlink(settingsPath);
                         (0, constants_1.logVerbose)(`${prefix} Removed empty VSCode settings file`, verbose);
                     }
                     else {
-                        await (0, settings_1.writeVSCodeSettings)(settingsPath, settings);
+                        await (0, settings_1.writeVSCodeSettings)(settingsPath, settings, projectRoot);
                         (0, constants_1.logVerbose)(`${prefix} Removed augment.advanced section from VSCode settings`, verbose);
                     }
                     filesRemoved++;
@@ -399,7 +426,7 @@ async function removeAdditionalAgentFiles(projectRoot, verbose, dryRun) {
  * @param agent The agent to revert
  * @param projectRoot Root directory of the project
  * @param agentConfig Agent-specific configuration
- * @param keepBackups Whether to keep backup files
+ * @param keepBackups Whether restored backup files should be preserved
  * @param verbose Whether to enable verbose logging
  * @param dryRun Whether to perform a dry run
  * @returns Promise resolving to revert statistics
@@ -411,13 +438,20 @@ async function revertAgentConfiguration(agent, projectRoot, agentConfig, keepBac
         backupsRemoved: 0,
     };
     const outputPaths = (0, agent_utils_1.getAgentOutputPaths)(agent, projectRoot, agentConfig);
+    const processedPaths = new Set();
     (0, constants_1.logVerbose)(`Agent ${agent.getName()} output paths: ${outputPaths.join(', ')}`, verbose);
-    for (const outputPath of outputPaths) {
-        const restored = await restoreFromBackup(outputPath, verbose, dryRun);
+    const processPath = async (outputPath) => {
+        const resolvedPath = path.resolve(projectRoot, outputPath);
+        if (processedPaths.has(resolvedPath)) {
+            (0, constants_1.logVerbose)(`Skipping already processed path: ${outputPath}`, verbose);
+            return;
+        }
+        processedPaths.add(resolvedPath);
+        const restored = await restoreFromBackup(outputPath, verbose, dryRun, projectRoot);
         if (restored) {
             result.restored++;
             if (!keepBackups) {
-                const backupRemoved = await removeBackupFile(outputPath, verbose, dryRun);
+                const backupRemoved = await removeBackupFile(outputPath, verbose, dryRun, projectRoot);
                 if (backupRemoved) {
                     result.backupsRemoved++;
                 }
@@ -429,31 +463,19 @@ async function revertAgentConfiguration(agent, projectRoot, agentConfig, keepBac
                 result.removed++;
             }
         }
+    };
+    for (const outputPath of outputPaths) {
+        await processPath(outputPath);
     }
     // Handle MCP files
-    const mcpPath = await (0, mcp_1.getNativeMcpPath)(agent.getName(), projectRoot);
+    const mcpPath = await resolveMcpPathForRevert(agent, projectRoot, agentConfig);
     if (mcpPath && (0, path_utils_1.isPathInsideOrEqual)(projectRoot, mcpPath)) {
         if (agent.getName() === 'AugmentCode' &&
             mcpPath.endsWith('.vscode/settings.json')) {
             (0, constants_1.logVerbose)(`Skipping MCP handling for AugmentCode settings.json - handled separately`, verbose);
         }
         else {
-            const mcpRestored = await restoreFromBackup(mcpPath, verbose, dryRun);
-            if (mcpRestored) {
-                result.restored++;
-                if (!keepBackups) {
-                    const mcpBackupRemoved = await removeBackupFile(mcpPath, verbose, dryRun);
-                    if (mcpBackupRemoved) {
-                        result.backupsRemoved++;
-                    }
-                }
-            }
-            else {
-                const mcpRemoved = await removeGeneratedFile(mcpPath, verbose, dryRun, projectRoot);
-                if (mcpRemoved) {
-                    result.removed++;
-                }
-            }
+            await processPath(mcpPath);
         }
     }
     return result;
@@ -473,3 +495,28 @@ async function cleanUpAuxiliaryFiles(projectRoot, verbose, dryRun) {
         directoriesRemoved,
     };
 }
+async function cleanUpAgentDirectories(agent, projectRoot, agentConfig, verbose, dryRun) {
+    const candidateFiles = (0, agent_utils_1.getAgentOutputPaths)(agent, projectRoot, agentConfig);
+    const mcpPath = await (0, mcp_1.getNativeMcpPath)(agent.getName(), projectRoot);
+    if (mcpPath && (0, path_utils_1.isPathInsideOrEqual)(projectRoot, mcpPath)) {
+        candidateFiles.push(mcpPath);
+    }
+    const candidateDirs = [
+        ...new Set(candidateFiles.map((filePath) => path.dirname(filePath))),
+    ];
+    let directoriesRemoved = 0;
+    const resolvedProjectRoot = path.resolve(projectRoot);
+    for (const candidateDir of candidateDirs) {
+        let currentDir = path.resolve(candidateDir);
+        while (currentDir !== resolvedProjectRoot &&
+            (0, path_utils_1.isPathInsideOrEqual)(resolvedProjectRoot, currentDir)) {
+            const removed = await removeEmptyDirectory(currentDir, verbose, dryRun);
+            if (!removed) {
+                break;
+            }
+            directoriesRemoved++;
+            currentDir = path.dirname(currentDir);
+        }
+    }
+    return directoriesRemoved;
+}

package/dist/lib.js

@@ -102,6 +102,7 @@ async function applyAllAgentConfigs(projectRoot, includedAgents, configPath, cli
     let selectedAgents;
     let generatedPaths;
     let loadedConfig;
+    let outputProjectRoot = projectRoot;
     if (nested) {
         const hierarchicalConfigs = await (0, apply_engine_1.loadNestedConfigurations)(projectRoot, configPath, localOnly, nested);
         if (hierarchicalConfigs.length === 0) {
@@ -147,6 +148,8 @@ async function applyAllAgentConfigs(projectRoot, includedAgents, configPath, cli
     }
     else {
         const singleConfig = await (0, apply_engine_1.loadSingleConfiguration)(projectRoot, configPath, localOnly);
+        const singleProjectRoot = singleConfig.projectRoot;
+        outputProjectRoot = singleProjectRoot;
         loadedConfig = singleConfig.config;
         singleConfig.config.cliAgents = includedAgents;
         (0, constants_1.logVerbose)(`Loaded configuration with ${Object.keys(singleConfig.config.agentConfigs).length} agent configs`, verbose);
@@ -158,7 +161,7 @@ async function applyAllAgentConfigs(projectRoot, includedAgents, configPath, cli
         const skillsEnabledResolved = resolveSkillsEnabled(skillsEnabled, singleConfig.config.skills?.enabled);
         if (skillsEnabledResolved) {
             const { propagateSkills } = await Promise.resolve().then(() => __importStar(require('./core/SkillsProcessor')));
-            await propagateSkills(projectRoot, selectedAgents, skillsEnabledResolved, verbose, dryRun);
+            await propagateSkills(singleProjectRoot, selectedAgents, skillsEnabledResolved, verbose, dryRun);
         }
         // Propagate subagents (mirrors skills handling).
         const subagentsEnabledResolvedSingle = resolveSubagentsEnabled(subagentsEnabled, singleConfig.config.subagents?.enabled);
@@ -166,9 +169,9 @@ async function applyAllAgentConfigs(projectRoot, includedAgents, configPath, cli
         const backupEnabledResolvedSingle = resolveBackupEnabled(backup, singleConfig.config.backup?.enabled);
         {
             const { propagateSubagents } = await Promise.resolve().then(() => __importStar(require('./core/SubagentsProcessor')));
-            await propagateSubagents(projectRoot, selectedAgents, subagentsEnabledResolvedSingle, subagentsCleanupOrphanedSingle, verbose, dryRun);
+            await propagateSubagents(singleProjectRoot, selectedAgents, subagentsEnabledResolvedSingle, subagentsCleanupOrphanedSingle, verbose, dryRun);
         }
-        generatedPaths = await (0, apply_engine_1.processSingleConfiguration)(selectedAgents, singleConfig, projectRoot, verbose, dryRun, cliMcpEnabled, cliMcpStrategy, backupEnabledResolvedSingle);
+        generatedPaths = await (0, apply_engine_1.processSingleConfiguration)(selectedAgents, singleConfig, singleProjectRoot, verbose, dryRun, cliMcpEnabled, cliMcpStrategy, backupEnabledResolvedSingle);
     }
     // Add skills-generated paths to gitignore if skills are enabled
     let allGeneratedPaths = generatedPaths;
@@ -176,17 +179,17 @@ async function applyAllAgentConfigs(projectRoot, includedAgents, configPath, cli
     if (skillsEnabledForGitignore) {
         // Skills enabled by default or explicitly
         const { getSkillsGitignorePaths } = await Promise.resolve().then(() => __importStar(require('./core/SkillsProcessor')));
-        const skillsPaths = await getSkillsGitignorePaths(projectRoot, selectedAgents);
+        const skillsPaths = await getSkillsGitignorePaths(outputProjectRoot, selectedAgents);
         allGeneratedPaths = [...allGeneratedPaths, ...skillsPaths];
     }
     // Add subagents-generated paths to gitignore if subagents are enabled.
     const subagentsEnabledForGitignore = resolveSubagentsEnabled(subagentsEnabled, loadedConfig.subagents?.enabled);
     if (subagentsEnabledForGitignore) {
         const { getSubagentsGitignorePaths } = await Promise.resolve().then(() => __importStar(require('./core/SubagentsProcessor')));
-        const subagentPaths = await getSubagentsGitignorePaths(projectRoot, selectedAgents);
+        const subagentPaths = await getSubagentsGitignorePaths(outputProjectRoot, selectedAgents);
         allGeneratedPaths = [...allGeneratedPaths, ...subagentPaths];
     }
-    await (0, apply_engine_1.updateGitignore)(projectRoot, allGeneratedPaths, loadedConfig, cliGitignoreEnabled, dryRun, cliGitignoreLocal);
+    await (0, apply_engine_1.updateGitignore)(outputProjectRoot, allGeneratedPaths, loadedConfig, cliGitignoreEnabled, dryRun, cliGitignoreLocal);
 }
 /**
  * Normalizes per-agent config keys to agent identifiers for consistent lookup.

package/dist/mcp/merge.js

@@ -8,6 +8,29 @@ const MCP_SERVER_KEYS = [
     'mcp_servers',
     'context_servers',
 ];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function collectMcpServers(config, serverKey) {
+    const servers = {};
+    const aliases = MCP_SERVER_KEYS.filter((key) => key !== serverKey);
+    for (const key of [...aliases, serverKey]) {
+        const value = config[key];
+        if (isRecord(value)) {
+            Object.assign(servers, value);
+        }
+    }
+    return servers;
+}
+function removeServerAliases(config, serverKey) {
+    const result = { ...config };
+    for (const key of MCP_SERVER_KEYS) {
+        if (key !== serverKey) {
+            delete result[key];
+        }
+    }
+    return result;
+}
 /**
  * Merge native and incoming MCP server configurations according to strategy.
  * @param base Existing native MCP config object.
@@ -18,38 +41,17 @@ const MCP_SERVER_KEYS = [
  */
 function mergeMcp(base, incoming, strategy, serverKey) {
     if (strategy === 'overwrite') {
-        // Ensure the incoming object uses the correct server key.
-        // Transform from the standard (Crush) MCP config format
-        const incomingServers = incoming[serverKey] ||
-            incoming.mcpServers ||
-            incoming.mcp ||
-            {};
-        const preservedBase = { ...base };
-        for (const key of MCP_SERVER_KEYS) {
-            if (key !== serverKey) {
-                delete preservedBase[key];
-            }
-        }
+        const incomingServers = collectMcpServers(incoming, serverKey);
+        const preservedBase = removeServerAliases(base, serverKey);
         return {
             ...preservedBase,
             [serverKey]: incomingServers,
         };
     }
-    const baseServers = base[serverKey] ||
-        base.mcpServers ||
-        base.mcp ||
-        {};
-    const incomingServers = incoming[serverKey] ||
-        incoming.mcpServers ||
-        incoming.mcp ||
-        {};
+    const baseServers = collectMcpServers(base, serverKey);
+    const incomingServers = collectMcpServers(incoming, serverKey);
     const mergedServers = { ...baseServers, ...incomingServers };
-    const newBase = { ...base };
-    for (const key of MCP_SERVER_KEYS) {
-        if (key !== serverKey) {
-            delete newBase[key];
-        }
-    }
+    const newBase = removeServerAliases(base, serverKey);
     return {
         ...newBase,
         [serverKey]: mergedServers,

package/dist/mcp/propagateOpenCodeMcp.d.ts

@@ -1,2 +1,2 @@
 import { McpStrategy } from '../types';
-export declare function propagateMcpToOpenCode(rulerMcpData: Record<string, unknown> | null, openCodeConfigPath: string, backup?: boolean, strategy?: McpStrategy): Promise<void>;
+export declare function propagateMcpToOpenCode(rulerMcpData: Record<string, unknown> | null, openCodeConfigPath: string, backup?: boolean, strategy?: McpStrategy, containmentRoot?: string): Promise<void>;

package/dist/mcp/propagateOpenCodeMcp.js

@@ -91,8 +91,11 @@ function transformToOpenCodeFormat(rulerMcp) {
         mcp: openCodeServers,
     };
 }
-async function propagateMcpToOpenCode(rulerMcpData, openCodeConfigPath, backup = true, strategy = 'merge') {
+async function propagateMcpToOpenCode(rulerMcpData, openCodeConfigPath, backup = true, strategy = 'merge', containmentRoot) {
     const rulerMcp = rulerMcpData || {};
+    if (containmentRoot) {
+        await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(openCodeConfigPath, containmentRoot, 'Refusing to write generated file outside project');
+    }
     // Read existing OpenCode config if it exists
     let existingConfig = {};
     let existingContent;
@@ -125,10 +128,14 @@ async function propagateMcpToOpenCode(rulerMcpData, openCodeConfigPath, backup =
                 ...transformedConfig.mcp,
             },
     };
+    const finalContent = JSON.stringify(finalConfig, null, 2) + '\n';
+    if (existingContent === finalContent) {
+        return;
+    }
     await (0, FileSystemUtils_1.ensureDirExists)(path.dirname(openCodeConfigPath));
     if (backup) {
         const { backupFile } = await Promise.resolve().then(() => __importStar(require('../core/FileSystemUtils')));
-        await backupFile(openCodeConfigPath);
+        await backupFile(openCodeConfigPath, containmentRoot);
     }
-    await fs.writeFile(openCodeConfigPath, JSON.stringify(finalConfig, null, 2) + '\n');
+    await (0, FileSystemUtils_1.writeGeneratedFile)(openCodeConfigPath, finalContent, containmentRoot);
 }

package/dist/mcp/propagateOpenHandsMcp.d.ts

@@ -1,2 +1,2 @@
 import { McpStrategy } from '../types';
-export declare function propagateMcpToOpenHands(rulerMcpData: Record<string, unknown> | null, openHandsConfigPath: string, backup?: boolean, strategy?: McpStrategy): Promise<void>;
+export declare function propagateMcpToOpenHands(rulerMcpData: Record<string, unknown> | null, openHandsConfigPath: string, backup?: boolean, strategy?: McpStrategy, containmentRoot?: string): Promise<void>;

package/dist/mcp/propagateOpenHandsMcp.js

@@ -67,10 +67,14 @@ function extractApiKey(headers) {
     }
     return null;
 }
-function createRemoteServerEntry(url, headers) {
+function createRemoteServerEntry(name, url, headers) {
+    const hasHeaders = headers && Object.keys(headers).length > 0;
     const apiKey = extractApiKey(headers);
-    if (apiKey) {
-        return { url, api_key: apiKey };
+    if (hasHeaders) {
+        if (apiKey) {
+            return { url, api_key: apiKey };
+        }
+        throw new Error(`OpenHands MCP remote server "${name}" has unsupported headers. OpenHands config.toml can only represent a Bearer Authorization header as api_key.`);
     }
     return url;
 }
@@ -89,8 +93,11 @@ function normalizeRemoteServerArray(entries) {
     // All entries are strings, keep as is
     return entries;
 }
-async function propagateMcpToOpenHands(rulerMcpData, openHandsConfigPath, backup = true, strategy = 'merge') {
+async function propagateMcpToOpenHands(rulerMcpData, openHandsConfigPath, backup = true, strategy = 'merge', containmentRoot) {
     const rulerMcp = rulerMcpData || {};
+    if (containmentRoot) {
+        await (0, FileSystemUtils_1.assertManagedPathInsideRoot)(openHandsConfigPath, containmentRoot, 'Refusing to write generated file outside project');
+    }
     // Always use the legacy Ruler MCP config format as input (top-level "mcpServers" key)
     const rulerServers = rulerMcp.mcpServers || {};
     // Return early if no servers to process
@@ -162,7 +169,7 @@ async function propagateMcpToOpenHands(rulerMcpData, openHandsConfigPath, backup
             else if (serverDef.url) {
                 // Remote server
                 const classification = classifyRemoteServer(serverDef.url);
-                const entry = createRemoteServerEntry(serverDef.url, serverDef.headers);
+                const entry = createRemoteServerEntry(name, serverDef.url, serverDef.headers);
                 if (classification === 'sse') {
                     existingSseServers.set(serverDef.url, entry);
                 }
@@ -176,10 +183,14 @@ async function propagateMcpToOpenHands(rulerMcpData, openHandsConfigPath, backup
     config.mcp.stdio_servers = Array.from(existingStdioServers.values());
     config.mcp.sse_servers = normalizeRemoteServerArray(Array.from(existingSseServers.values()));
     config.mcp.shttp_servers = normalizeRemoteServerArray(Array.from(existingShttpServers.values()));
+    const finalContent = (0, toml_1.stringify)(config);
+    if (tomlContent === finalContent) {
+        return;
+    }
     await (0, FileSystemUtils_1.ensureDirExists)(path.dirname(openHandsConfigPath));
     if (backup) {
         const { backupFile } = await Promise.resolve().then(() => __importStar(require('../core/FileSystemUtils')));
-        await backupFile(openHandsConfigPath);
+        await backupFile(openHandsConfigPath, containmentRoot);
     }
-    await fs.writeFile(openHandsConfigPath, (0, toml_1.stringify)(config));
+    await (0, FileSystemUtils_1.writeGeneratedFile)(openHandsConfigPath, finalContent, containmentRoot);
 }

package/dist/paths/mcp.d.ts

@@ -5,4 +5,4 @@ export declare function readNativeMcp(filePath: string): Promise<Record<string,
 /** Read native Codex TOML MCP config from disk, or return empty object if missing. */
 export declare function readNativeMcpToml(filePath: string, parseToml: (text: string) => Record<string, unknown>): Promise<Record<string, unknown>>;
 /** Write native MCP config to disk, creating parent directories as needed. */
-export declare function writeNativeMcp(filePath: string, data: unknown): Promise<void>;
+export declare function writeNativeMcp(filePath: string, data: unknown, containmentRoot?: string): Promise<void>;

package/dist/paths/mcp.js

@@ -39,6 +39,10 @@ exports.readNativeMcpToml = readNativeMcpToml;
 exports.writeNativeMcp = writeNativeMcp;
 const path = __importStar(require("path"));
 const fs_1 = require("fs");
+const FileSystemUtils_1 = require("../core/FileSystemUtils");
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /** Determine the native MCP config path for a given agent. */
 async function getNativeMcpPath(adapterName, projectRoot) {
     const candidates = [];
@@ -125,7 +129,11 @@ async function readNativeMcp(filePath) {
         throw new Error(`Could not read MCP config at ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
     }
     try {
-        return JSON.parse(text);
+        const parsed = JSON.parse(text);
+        if (!isRecord(parsed)) {
+            throw new Error('must be a JSON object');
+        }
+        return parsed;
     }
     catch (error) {
         throw new Error(`Invalid MCP config at ${filePath}: ${error instanceof Error ? error.message : String(error)}`);
@@ -151,8 +159,7 @@ async function readNativeMcpToml(filePath, parseToml) {
     }
 }
 /** Write native MCP config to disk, creating parent directories as needed. */
-async function writeNativeMcp(filePath, data) {
-    await fs_1.promises.mkdir(path.dirname(filePath), { recursive: true });
+async function writeNativeMcp(filePath, data, containmentRoot) {
     const text = JSON.stringify(data, null, 2) + '\n';
-    await fs_1.promises.writeFile(filePath, text, 'utf8');
+    await (0, FileSystemUtils_1.writeGeneratedFile)(filePath, text, containmentRoot);
 }