@lovrozagar/grunt 0.4.0 → 0.4.1

package/CLAUDE.md

@@ -1,36 +1,44 @@
+<!-- grunt:begin -->
 Voice: `.rulesync/reference/output.md` — cite once; apply every turn.
-en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo only. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
+en-US unless asked. every output maximal superterse. Fragments OK. Sacrifice grammar; keep meaning. Parent and child. Every turn, not final-only. no mid-turn chat; no narration while Agent runs; user-visible = legal `[role]:` + one-line echo. Advise leftover: numbered pick each on own line after recap. Zero user-visible tokens before spawn/peek. In-flight host Stop → only `[orchestrator]: wait grunt`.
 All output exclude AI attribution, Co-Authored-By, trailers, generated markers.
 Protocol: `.rulesync/reference/cascade.md`. Do not paste.
 Always-do:
 
 | signal | next |
 |---|---|
-| create/change product files | small/simple or prompt-is-spec → implementer; large/complex + no spec → thinker then implementer. Never parent Write/Bash/Skill |
-| plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
+| create/change product files | grunt facts → thinker plan/recap-stop before writes; default thinker unless prompt-is-spec or small/simple → implementer. Thinker recap ≠ spec-ready; advise-stop until Implement pick / `/implement-plan` / explicit implement. Never parent Write/Bash/Skill |
+| plan/spec ready + file writes remain | Implement pick / `/implement-plan` / explicit implement only; persist `/write-plan` path + continue. `ok`/`yes`/`y`/`continue` ≠ implement after conversational advise. Thinker recap alone = recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
-| write defined solution | spawn implementer |
-| plan/deep reason | spawn thinker |
-| child returned | recap `[orchestrator]:` `[grunt]:` `[implementer]:` `[thinker]:` `[handoff]:` echo |
+| write defined solution | spawn implementer; **blocked if advise-class stems present** unless prompt-is-spec / obvious comment-spec false+ |
+| think / plan / advise / recommend / how / why / explain (ask us; not slash `/explain` not one-cmd/last-log/source-token) | spawn thinker; facts=grunt/`need:`; **no implementer this turn**. Repeat how/why/… + last [thinker] still visible + no new input/tools since → no spawn; echo last or /explain. Unsure → thinker |
+| child returned | recap per output.md (echo=report not command). e.g. `[orchestrator]: wrote /abs/a` |
 | child `need:` | parse-need + parallel grunt; `resume_from` + new verdicts; max 3 |
 | ⚠ / validate / sim | spawn implementer with findings; do not recap; spawn; no parent-edit |
-| work remains | spawn; do not stop |
-| children done + no findings | recap; stop allowed only if no writes remain and spawn count > 0 when the user asked for a file change |
+| work remains | spawn; do not stop. Advise recap ≠ leftover writes |
+| children done + no findings | recap; advise-first stop wins. Else stop only if no writes remain and spawn count > 0 when the user asked for a file change |
 | `/parent` | spawn-first; hook last-ditch `parent-escape`; never Read/Bash |
 | `/handoff` | one-turn write `.tmp/grunt/handoffs/`; recap `[handoff]:` |
 | `/pickup` | spawn-first; grunt resolve if needed; never parent Read; not a mode |
-| `/write-plan` plan-only | recap + `next: /implement-plan` |
+| `/write-plan` plan-only | recap; remainder `/implement-plan` (ask) |
 | `/explain` | spawn if facts/work; then human recap of child output; screenshot/visible=context no Read |
 | `/solo` | session escape only; stamp grunt-off-{sid}; else spawn-first |
 | `/cascade` | unlink solo stamp; spawn-first |
 
+Precedence: slash → obvious fact/false+/reuse → advise-class row → prompt-is-spec → write. Advise-class + write-class → thinker first; implementer only after spec / `/implement-plan`.
+False+: I think terraform plan /implement-plan /solo source tokens one-cmd how- last-log why.
+Advise finals: numbered pick each on own line after tagged recap:
+1. Implement
+2. Tweak
+Slash `/implement-plan` + explicit implement = Implement. `ok`/`yes`/`y`/`continue` ≠ implement after conversational advise.
 Parent = this file not `.claude/agents/orchestrator.md`. You do not talk. Spawn wait echo.
 Spawn only grunt|implementer|thinker. Never spawn orchestrator. Children never spawn.
-You do not talk. First token = spawn. Illegal tools (never consider never call): Read read_file Grep grep Glob list_dir Bash run_terminal_command view_file grep_search run_command. Not in toolkit. Hook deny = backstop not UX. Next=spawn not retry. Only /solo (stamp grunt-off-{sid} this session) escapes spawn workflow. /explain=voice+post-child recap never parent Read. No try-then-spawn. No parent probe. After child: legal tag + one-line echo only. Siblings still run: `[grunt]:` echo. No skip-spawn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`. `/pickup` spawn-first; grunt resolve if needed; never parent Read; not a mode.
+You do not talk. First token = spawn. Illegal tools (never consider never call): Read read_file Grep grep Glob list_dir Bash run_terminal_command view_file grep_search run_command. Not in toolkit. Hook deny = backstop not UX. Next=spawn not retry. Only /solo (stamp grunt-off-{sid} this session) escapes spawn workflow. /explain=voice+post-child recap never parent Read. No try-then-spawn. No parent probe. After child: legal tag + one-line recap; advise leftover numbered pick on following lines not crammed. Echo = report not command. Siblings still run: `[grunt]:` echo. No skip-spawn. /handoff = one-turn in-parent write to `.tmp/grunt/handoffs/`; recap `[handoff]:`. `/pickup` spawn-first; grunt resolve if needed; never parent Read; not a mode.
 `/parent` hook last-ditch only. Skills spawn-first. Only `/solo` escapes spawn workflow.
-grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution. thinker ← plan/deep reason.
+grunt ← tools (facts/search/exec/git/web/test/low-reason mechanical write; world fact: `job: web` never memory). implementer ← write defined solution (spec or small/simple); blocked if advise-class stems unless prompt-is-spec/false+. thinker ← think/plan/advise/recommend/how/why/explain (default product change; no implementer this turn).
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. `timeout_ms=60000` every peek. GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.
 `need:` JSON → parse-need + parallel grunt; one `resume_from` + new verdicts; max 3; no re-send task; no fresh-spawn.
 Child: this file does not apply; your agent file gates you. Never spawn.
+<!-- grunt:end -->

package/README.md

@@ -105,10 +105,10 @@ SoT: `.rulesync/subagents/{orchestrator grunt implementer thinker}.md`
 
 Emit: `.claude/` `.grok/` `.agents/` `.gemini/`
 
-- **orchestrator** (parent) — always spawn+prompt; user-facing only `[orchestrator]:` (or child role tag) one-line echo. `/parent` one-turn; `/handoff` writes `.tmp/grunt/handoffs/{serial}-{slug}-{stamp}.md`; `/pickup` spawn-first pickup (inverse of `/handoff`; not a mode). `/solo` session escape; `/cascade` restores it. Small/low router. First token spawn. No parent Read/Bash/Grep. Does not implement, plan, or fetch world facts
+- **orchestrator** (parent) — always spawn+prompt; user-facing `[orchestrator]:` (or child role tag) one-line recap; advise leftover numbered pick each on own line after that recap (do not cram `1. Implement 2. Tweak` onto the recap line). `/parent` one-turn; `/handoff` writes `.tmp/grunt/handoffs/{serial}-{slug}-{stamp}.md`; `/pickup` spawn-first pickup (inverse of `/handoff`; not a mode). `/solo` session escape; `/cascade` restores it. Small/low router. First token spawn. No parent Read/Bash/Grep. Does not implement, plan, or fetch world facts
 - **grunt** — tools: facts/search/exec/git/web/test/low-reason mechanical write. Isolation `verdict:`. Never feature solution. Never spawn. World fact: `job: web`
 - **implementer** — write already-defined solution on allowlisted paths. TDD when spec/plan says tests. Validate + sim after write. Fat dumps via `need:`. Never spawn. Never plan. Id is **implementer** (not Implementor)
-- **thinker** — plan/deep reason; edge cases. Read-only named-file Read of prompt SSOT; trees/search/exec/web/test → `need:`. Never spawn. No bash. Never implement
+- **thinker** — think/plan/advise/recommend/how/why/explain; unsure→thinker; cheap false+; edge cases. Read-only named-file Read of prompt SSOT; trees/search/exec/web/test → `need:`. Never spawn. No bash. Never implement
 
 Children never spawn. Spawn only grunt|implementer|thinker. Omit model on spawn; frontmatter on agent files picks haiku/sonnet/opus vs grok-4.5 / grok-4.6 / other hosts. Voice: `.rulesync/reference/output.md`. Protocol: `.rulesync/reference/cascade.md`. `AGENTS.md`/`CLAUDE.md` spawn-first. `GEMINI.md` → `@AGENTS.md`. Goals: synced configs across grok build claude code codex gemini cli antigravity; max situational speed; superterse token savings; max/min reasoning by role.
 
@@ -123,7 +123,7 @@ Lightpanda-first session CLI: `node scripts/browser.mjs nav|snap|click|fill|shot
 Present under `.claude` / `.rulesync` / `.agents`:
 
 - `browser` `cascade` `commit` `commit-and-push` `commit-push` `commit-push-deploy` `commit-push-release` `explain` `handoff` `pickup` `parent` `solo`
-- Grok-only: `write-plan` `implement-plan` (`/write-plan` plan-only → `next: /implement-plan`)
+- Grok-only: `write-plan` `implement-plan` (`/write-plan` plan-only → `next: /implement-plan`; advise unlock = pick **1. Implement**, not `ok`/`yes`/`go`; slash `/implement-plan` still valid alias)
 
 ## Generate
 
@@ -162,7 +162,7 @@ Same topology as the session recap; every legal edge labeled.
 ```
  USER
   │
-  │  session in/out  (parent only; tagged one-line recap)
+  │  session in/out  (parent only; tagged one-line recap; advise leftover 1./2. own lines)
   │  TUI local; completion tokens from Model API (mixed)
   ▼
 ┌──────────────────────── CLI HOST (this process) ────────────────────────┐
@@ -251,7 +251,7 @@ Implementer or thinker that still needs a fat dump **stops** on a `need:` JSON l
 | node | inside host? | local vs AI-server | notes |
 | --- | --- | --- | --- |
 | User | no | mixed | Speaks only to parent session. Never a child edge. |
-| Session in/out / TUI | yes | mixed | TUI is local; recap tokens come from the model. Legal `[role]:` one-line echo only. |
+| Session in/out / TUI | yes | mixed | TUI is local; recap tokens come from the model. Legal `[role]:` one-line recap; advise leftover numbered pick each on own line after (not crammed onto the recap line). |
 | CLI host process | yes (is the box) | local process | Grok Build / Claude Code / Codex / Gemini / Antigravity. Not a peer of another CLI. |
 | Parent orchestrator | yes | AI-server **turn** | Spawn-first low router. No parent Read/Bash/Grep. Lives in this session, not a sidecar. |
 | `grunt` sibling | yes | AI-server **turn** | Facts/tools/mechanical write. Never spawn. Never feature solution. |
@@ -349,7 +349,7 @@ npm i && npm test
 
 Keep these four flows only:
 
-1. “Create me a react weather app” → thinker plan → implementer write → orchestrator recap
+1. “Create me a react weather app” → thinker plan/recap-stop + pick 1.Implement 2.Tweak → user picks 1 or `/implement-plan` → implementer write → recap
 2. “What is 2+2” → grunt → `[grunt]:` echo
 3. Marvel theatrical next → grunt `job:web` → recap
 4. `.logs` 3/6/2021 tag `framework bug` → grunt local search → recap

package/cli/init.mjs

@@ -9,6 +9,7 @@ const PRODUCT_SCRIPTS = [
   "check-globals.mjs",
   "emit-agent-shell-tools.mjs",
   "emit-gemini.mjs",
+  "guarded-roots.mjs",
   "emit-mcp-policy.mjs",
   "gate-fat-tools.mjs",
   "hooks-union.mjs",
@@ -28,12 +29,16 @@ const PRODUCT_SCRIPTS = [
 
 const COPY_DIRS = [".rulesync", ".grok", ".codex", ".claude", ".agents"]
 const GUARDED_MD_FILES = ["AGENTS.md", "CLAUDE.md"]
+export const GUARDED_ROOT_FILES = ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]
 // .mcp.json is intentionally not copied here: scripts/emit-mcp-policy.mjs
 // (run via `rulesync:generate`, see mergeClaudeSettings ordering) owns and
 // merges it, so a plain-copy would just be clobbered/redundant.
 const OWNED_HOOK_FILES = ["scrub-spawn-prompt.mjs", "gate-fat-tools.mjs", "orchestrate-parent.js"]
-const SENTINEL_BEGIN = "<!-- grunt:begin -->"
-const SENTINEL_END = "<!-- grunt:end -->"
+export const SENTINEL_BEGIN = "<!-- grunt:begin -->"
+export const SENTINEL_END = "<!-- grunt:end -->"
+export const MAX_GUARDED_MARKDOWN_BYTES = 2 * 1024 * 1024
+const GRUNT_REGION_RE = /<!-- grunt:begin -->\r?\n?[\s\S]*?<!-- grunt:end -->\r?\n?/g
+const GRUNT_INTERIOR_RE = /<!-- grunt:begin -->\r?\n?([\s\S]*?)<!-- grunt:end -->/g
 
 function sortKeys(obj) {
   return Object.fromEntries(Object.keys(obj).sort().map((k) => [k, obj[k]]))
@@ -79,33 +84,199 @@ export function shouldAutoSkipGlobals(dest) {
   return destHasGruntSentinel(dest) || fs.existsSync(path.join(dest, "scripts", "telemetry.mjs"))
 }
 
+function detectNewline(text) {
+  return String(text).includes("\r\n") ? "\r\n" : "\n"
+}
+
+function toNewline(text, nl) {
+  return String(text).replace(/\r\n/g, "\n").replace(/\n/g, nl)
+}
+
+function trimTrailingNewlines(text) {
+  return String(text).replace(/(?:\r?\n)+$/, "")
+}
+
+function normEq(a, b) {
+  return trimTrailingNewlines(String(a).replace(/\r\n/g, "\n")) ===
+    trimTrailingNewlines(String(b).replace(/\r\n/g, "\n"))
+}
+
+function cloneRe(re) {
+  return new RegExp(re.source, re.flags)
+}
+
+function inspectGuardedBuffer(buf) {
+  if (buf.length > MAX_GUARDED_MARKDOWN_BYTES) return "huge"
+  if (buf.includes(0)) return "binary"
+  return null
+}
+
+export function extractUserMarkdown(text) {
+  return String(text).replace(cloneRe(GRUNT_REGION_RE), "")
+}
+
+export function extractGruntBody(text) {
+  const parts = []
+  const re = cloneRe(GRUNT_INTERIOR_RE)
+  let m
+  while ((m = re.exec(String(text)))) {
+    parts.push(trimTrailingNewlines(m[1]))
+  }
+  if (!parts.length) return null
+  return parts.join("\n")
+}
+
+function userRemainderIsBlank(user) {
+  return String(user).replace(/\r\n/g, "\n").replace(/\n/g, "") === ""
+}
+
+export function composeGuardedMarkdown(gruntBody, userRemainder, nl = "\n") {
+  const body = toNewline(trimTrailingNewlines(gruntBody), nl)
+  const block = `${SENTINEL_BEGIN}${nl}${body}${nl}${SENTINEL_END}${nl}`
+  const user = userRemainder == null ? "" : String(userRemainder)
+  if (!user || userRemainderIsBlank(user)) return block
+  return block + toNewline(user, nl)
+}
+
+export function mergeGuardedContent(existingText, gruntBody) {
+  const existing = existingText == null ? "" : String(existingText)
+  const nl = existing.includes("\r\n") || String(gruntBody).includes("\r\n")
+    ? detectNewline(existing || gruntBody)
+    : "\n"
+  if (!existing) return composeGuardedMarkdown(gruntBody, "", nl)
+  const hadSentinel = existing.includes(SENTINEL_BEGIN) && existing.includes(SENTINEL_END)
+  const user = extractUserMarkdown(existing)
+  if (!hadSentinel && normEq(existing, gruntBody)) {
+    return composeGuardedMarkdown(gruntBody, "", nl)
+  }
+  return composeGuardedMarkdown(gruntBody, user, nl)
+}
+
+export function writeMergedGuardedFile(destPath, gruntBody) {
+  if (!fs.existsSync(destPath)) {
+    fs.writeFileSync(destPath, mergeGuardedContent("", gruntBody))
+    return
+  }
+  const buf = fs.readFileSync(destPath)
+  if (inspectGuardedBuffer(buf)) return "aborted-unsafe"
+  fs.writeFileSync(destPath, mergeGuardedContent(buf.toString("utf8"), gruntBody))
+}
+
+export function guardedMarkdownDrift(destPath, gruntBody) {
+  if (!fs.existsSync(destPath)) return true
+  const buf = fs.readFileSync(destPath)
+  if (inspectGuardedBuffer(buf)) return true
+  const text = buf.toString("utf8")
+  const interior = extractGruntBody(text)
+  if (interior == null) return !normEq(text, gruntBody)
+  return !normEq(interior, gruntBody)
+}
+
 export function mergeGuardedMarkdown(dest, pkgRoot, file, { alreadyInited = false } = {}) {
+  void alreadyInited
   const src = path.join(pkgRoot, file)
   const d = path.join(dest, file)
   if (samePath(src, d)) return
   const srcText = fs.readFileSync(src, "utf8")
+  return writeMergedGuardedFile(d, srcText)
+}
 
-  if (!fs.existsSync(d)) {
-    fs.writeFileSync(d, `${SENTINEL_BEGIN}\n${srcText}\n${SENTINEL_END}\n`)
-    return
+export function snapshotGuardedRoots(root) {
+  const snap = {}
+  for (const file of GUARDED_ROOT_FILES) {
+    const p = path.join(root, file)
+    if (!fs.existsSync(p)) continue
+    const buf = fs.readFileSync(p)
+    const unsafe = inspectGuardedBuffer(buf)
+    if (unsafe) {
+      snap[file] = { unsafe, rawBuf: buf }
+      continue
+    }
+    const raw = buf.toString("utf8")
+    snap[file] = { raw, user: extractUserMarkdown(raw) }
   }
+  return snap
+}
 
-  const destText = fs.readFileSync(d, "utf8")
-  const hasSentinel = [SENTINEL_BEGIN, SENTINEL_END].every((marker) => destText.includes(marker))
+export function remergeGuardedRoots(root, snap) {
+  for (const file of GUARDED_ROOT_FILES) {
+    const p = path.join(root, file)
+    const rec = snap[file]
+    if (rec?.unsafe) {
+      fs.writeFileSync(p, rec.rawBuf)
+      continue
+    }
+    if (!fs.existsSync(p)) {
+      if (rec?.raw != null) fs.writeFileSync(p, rec.raw)
+      continue
+    }
+    const buf = fs.readFileSync(p)
+    if (inspectGuardedBuffer(buf)) {
+      if (rec?.raw != null) fs.writeFileSync(p, rec.raw)
+      continue
+    }
+    const current = buf.toString("utf8")
+    if (rec && current === rec.raw) continue
+    const gruntBody = extractGruntBody(current) ?? current
+    const nl = detectNewline((rec && rec.raw) || current)
+    let user = rec ? rec.user : extractUserMarkdown(current)
+    if (rec && !rec.raw.includes(SENTINEL_BEGIN) && normEq(rec.raw, gruntBody)) user = ""
+    if (!rec && extractGruntBody(current) == null && normEq(current, gruntBody)) user = ""
+    fs.writeFileSync(p, composeGuardedMarkdown(gruntBody, user, nl))
+  }
+}
 
-  if (!hasSentinel) {
-    if (alreadyInited) return "skipped-side-file"
-    const gruntFile = file.replace(/\.md$/, ".grunt.md")
-    fs.writeFileSync(path.join(dest, gruntFile), srcText)
-    console.log(`${file} exists without grunt sentinel; wrote ${gruntFile} instead (original untouched)`)
+export function healGuardedRootFile(root, file, snap) {
+  if (!GUARDED_ROOT_FILES.includes(file)) return
+  const p = path.join(root, file)
+  const rec = snap[file]
+  if (!fs.existsSync(p)) return
+  if (rec?.unsafe) {
+    fs.writeFileSync(p, rec.rawBuf)
+    return
+  }
+  const buf = fs.readFileSync(p)
+  if (inspectGuardedBuffer(buf)) {
+    if (rec?.raw != null) fs.writeFileSync(p, rec.raw)
     return
   }
+  const current = buf.toString("utf8")
+  const interior = extractGruntBody(current)
+  if (interior != null) {
+    snap[file] = { raw: current, user: extractUserMarkdown(current) }
+    return
+  }
+  if (rec && current === rec.raw) return
+  const gruntBody = current
+  const nl = detectNewline((rec && rec.raw) || current)
+  let user = rec ? rec.user : extractUserMarkdown(current)
+  if (rec && !rec.raw.includes(SENTINEL_BEGIN) && normEq(rec.raw, gruntBody)) user = ""
+  if (!rec && normEq(current, gruntBody)) user = ""
+  const out = composeGuardedMarkdown(gruntBody, user, nl)
+  fs.writeFileSync(p, out)
+  snap[file] = { raw: out, user }
+}
 
-  const beginIdx = destText.indexOf(SENTINEL_BEGIN)
-  const endIdx = destText.indexOf(SENTINEL_END)
-  const before = destText.slice(0, beginIdx)
-  const after = destText.slice(endIdx + SENTINEL_END.length)
-  fs.writeFileSync(d, `${before}${SENTINEL_BEGIN}\n${srcText}\n${SENTINEL_END}${after}`)
+export function withGuardedCheckInteriors(root, fn) {
+  const snap = snapshotGuardedRoots(root)
+  try {
+    for (const file of GUARDED_ROOT_FILES) {
+      const rec = snap[file]
+      if (!rec || rec.unsafe) continue
+      const body = extractGruntBody(rec.raw)
+      if (body == null) continue
+      const nl = detectNewline(rec.raw)
+      fs.writeFileSync(path.join(root, file), `${toNewline(trimTrailingNewlines(body), nl)}${nl}`)
+    }
+    return fn()
+  } finally {
+    for (const file of GUARDED_ROOT_FILES) {
+      const rec = snap[file]
+      if (!rec) continue
+      if (rec.unsafe) fs.writeFileSync(path.join(root, file), rec.rawBuf)
+      else fs.writeFileSync(path.join(root, file), rec.raw)
+    }
+  }
 }
 
 export function mergeClaudeSettings(destRoot, pkgRoot) {
@@ -222,7 +393,6 @@ export function mergePackageJson(dest, pkgRoot) {
 export function init(dest, { pkgRoot: pkgRootOpt, execFileSync: exec = execFileSync, skipGlobals = false, applyGlobals, onPhase } = {}) {
   dest = path.resolve(dest)
   const pkgRoot = path.resolve(pkgRootOpt ?? PKG_ROOT)
-  const alreadyInited = destAlreadyInited(dest)
   const skipGlobalsApply =
     applyGlobals === true ? false : skipGlobals || shouldAutoSkipGlobals(dest)
 
@@ -255,14 +425,8 @@ export function init(dest, { pkgRoot: pkgRootOpt, execFileSync: exec = execFileS
       }
     }
 
-    let skippedSideFile = false
     for (const file of GUARDED_MD_FILES) {
-      if (mergeGuardedMarkdown(dest, pkgRoot, file, { alreadyInited }) === "skipped-side-file") {
-        skippedSideFile = true
-      }
-    }
-    if (skippedSideFile) {
-      console.log("AGENTS.md/CLAUDE.md lack markers and were left alone")
+      mergeGuardedMarkdown(dest, pkgRoot, file)
     }
 
     fs.mkdirSync(path.join(dest, "scripts"), { recursive: true })
@@ -291,9 +455,13 @@ export function init(dest, { pkgRoot: pkgRootOpt, execFileSync: exec = execFileS
     exec("npm", args, { cwd: dest, stdio: "inherit" })
   }
   runNpm("install", ["install"])
+  const guardedSnap = snapshotGuardedRoots(dest)
   runNpm("generate", ["run", "rulesync:generate"])
+  remergeGuardedRoots(dest, guardedSnap)
   if (!skipGlobalsApply) {
     runNpm("sync-globals", ["run", "sync:globals:apply"])
   }
-  runNpm("check", ["run", "rulesync:check"])
+  withGuardedCheckInteriors(dest, () => {
+    runNpm("check", ["run", "rulesync:check"])
+  })
 }