@promptscript/cli 1.17.0 → 1.17.1

package/index.js

@@ -4445,12 +4445,12 @@ var init_services = __esm({
         return rm3(...args);
       },
       lstat: async (path2) => {
-        const { lstat: lstat9 } = await import("node:fs/promises");
-        return lstat9(path2);
+        const { lstat: lstat10 } = await import("node:fs/promises");
+        return lstat10(path2);
       },
       realpath: async (path2) => {
-        const { realpath: realpath6 } = await import("node:fs/promises");
-        return realpath6(path2);
+        const { realpath: realpath7 } = await import("node:fs/promises");
+        return realpath7(path2);
       }
     };
     defaultPrompts = {
@@ -27444,13 +27444,7 @@ function getSkillWrites(targets) {
   const skillSource = resolve7(BUNDLED_SKILLS_DIR, skillName, "SKILL.md");
   try {
     const rawSkillContent = readFileSync3(skillSource, "utf-8");
-    let skillContent = rawSkillContent;
-    const hasMarker = rawSkillContent.includes("<!-- PromptScript") || rawSkillContent.includes("# promptscript-generated:");
-    if (!hasMarker && rawSkillContent.startsWith("---")) {
-      const yamlMarker = "# promptscript-generated: true";
-      skillContent = `---
-${yamlMarker}${rawSkillContent.slice(3)}`;
-    }
+    const skillContent = addPromptScriptMarker(rawSkillContent);
     writes.push({
       path: `.promptscript/skills/${skillName}/SKILL.md`,
       content: skillContent
@@ -27458,7 +27452,14 @@ ${yamlMarker}${rawSkillContent.slice(3)}`;
     for (const target of targets) {
       const targetSkillDir = getTargetSkillDir(target, skillName);
       if (targetSkillDir && !writes.some((write) => write.path === targetSkillDir.path)) {
-        writes.push({ path: targetSkillDir.path, content: skillContent });
+        const formatter = FormatterRegistry.get(target);
+        let targetContent = skillContent;
+        if (formatter?.transformInjectedSkillContent) {
+          targetContent = addPromptScriptMarker(
+            formatter.transformInjectedSkillContent(rawSkillContent)
+          );
+        }
+        writes.push({ path: targetSkillDir.path, content: targetContent });
       }
     }
   } catch {
@@ -27466,6 +27467,11 @@ ${yamlMarker}${rawSkillContent.slice(3)}`;
   }
   return writes;
 }
+function addPromptScriptMarker(content) {
+  const hasMarker = content.includes("<!-- PromptScript") || content.includes("# promptscript-generated:");
+  return !hasMarker && content.startsWith("---") ? `---
+# promptscript-generated: true${content.slice(3)}` : content;
+}
 async function resolveConfig(options, projectInfo, aiToolsDetection, prettierConfigPath, manifest, services) {
   if (options.yes) {
     const userConfig = await loadUserConfig();
@@ -28037,13 +28043,13 @@ var require_ipv4 = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.Address4 = void 0;
     var common = __importStar(require_common());
-    var constants3 = __importStar(require_constants());
+    var constants4 = __importStar(require_constants());
     var address_error_1 = require_address_error();
-    var isCorrect4 = common.isCorrect(constants3.BITS);
+    var isCorrect4 = common.isCorrect(constants4.BITS);
     var Address4 = class _Address4 {
       constructor(address) {
         this.addressMinusSuffix = "";
-        this.groups = constants3.GROUPS;
+        this.groups = constants4.GROUPS;
         this.parsedAddress = [];
         this.parsedSubnet = "";
         this.subnet = "/32";
@@ -28053,15 +28059,15 @@ var require_ipv4 = __commonJS({
         this.isInSubnet = common.isInSubnet;
         this.isHostInSubnet = common.isHostInSubnet;
         this.address = address;
-        const subnet = constants3.RE_SUBNET_STRING.exec(address);
+        const subnet = constants4.RE_SUBNET_STRING.exec(address);
         if (subnet) {
           this.parsedSubnet = subnet[0].replace("/", "");
           this.subnetMask = parseInt(this.parsedSubnet, 10);
           this.subnet = `/${this.subnetMask}`;
-          if (this.subnetMask < 0 || this.subnetMask > constants3.BITS) {
+          if (this.subnetMask < 0 || this.subnetMask > constants4.BITS) {
             throw new address_error_1.AddressError("Invalid subnet mask.");
           }
-          address = address.replace(constants3.RE_SUBNET_STRING, "");
+          address = address.replace(constants4.RE_SUBNET_STRING, "");
         }
         this.addressMinusSuffix = address;
         this.parsedAddress = this.parse(address);
@@ -28092,7 +28098,7 @@ var require_ipv4 = __commonJS({
         if (groups.some((group) => /^0\d/.test(group))) {
           throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
         }
-        if (!address.match(constants3.RE_ADDRESS)) {
+        if (!address.match(constants4.RE_ADDRESS)) {
           throw new address_error_1.AddressError("Invalid IPv4 address.");
         }
         return groups;
@@ -28115,7 +28121,7 @@ var require_ipv4 = __commonJS({
        * address.subnetMask; // 24
        */
       static fromAddressAndMask(address, mask) {
-        const bits = common.prefixLengthFromMask(new _Address4(mask).bigInt(), constants3.BITS);
+        const bits = common.prefixLengthFromMask(new _Address4(mask).bigInt(), constants4.BITS);
         return new _Address4(`${address}/${bits}`);
       }
       /**
@@ -28129,9 +28135,9 @@ var require_ipv4 = __commonJS({
        */
       static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new _Address4(wildcardMask).bigInt();
-        const allOnes = (BigInt(1) << BigInt(constants3.BITS)) - BigInt(1);
+        const allOnes = (BigInt(1) << BigInt(constants4.BITS)) - BigInt(1);
         const mask = wildcard ^ allOnes;
-        const bits = common.prefixLengthFromMask(mask, constants3.BITS);
+        const bits = common.prefixLengthFromMask(mask, constants4.BITS);
         return new _Address4(`${address}/${bits}`);
       }
       /**
@@ -28149,7 +28155,7 @@ var require_ipv4 = __commonJS({
        */
       static fromWildcard(input2) {
         const groups = input2.split(".");
-        if (groups.length !== constants3.GROUPS) {
+        if (groups.length !== constants4.GROUPS) {
           throw new address_error_1.AddressError("Wildcard pattern must have 4 octets");
         }
         let firstWildcard = -1;
@@ -28164,7 +28170,7 @@ var require_ipv4 = __commonJS({
         }
         const trailing = firstWildcard === -1 ? 0 : groups.length - firstWildcard;
         const replaced = groups.map((g) => g === "*" ? "0" : g);
-        const subnetBits = constants3.BITS - trailing * 8;
+        const subnetBits = constants4.BITS - trailing * 8;
         return new _Address4(`${replaced.join(".")}/${subnetBits}`);
       }
       /**
@@ -28234,7 +28240,7 @@ var require_ipv4 = __commonJS({
       toGroup6() {
         const output = [];
         let i;
-        for (i = 0; i < constants3.GROUPS; i += 2) {
+        for (i = 0; i < constants4.GROUPS; i += 2) {
           output.push(`${common.stringToPaddedHex(this.parsedAddress[i])}${common.stringToPaddedHex(this.parsedAddress[i + 1])}`);
         }
         return output.join(":");
@@ -28251,7 +28257,7 @@ var require_ipv4 = __commonJS({
        * @returns {bigint}
        */
       _startAddress() {
-        return BigInt(`0b${this.mask() + "0".repeat(constants3.BITS - this.subnetMask)}`);
+        return BigInt(`0b${this.mask() + "0".repeat(constants4.BITS - this.subnetMask)}`);
       }
       /**
        * The first address in the range given by this address' subnet.
@@ -28275,7 +28281,7 @@ var require_ipv4 = __commonJS({
        * @returns {bigint}
        */
       _endAddress() {
-        return BigInt(`0b${this.mask() + "1".repeat(constants3.BITS - this.subnetMask)}`);
+        return BigInt(`0b${this.mask() + "1".repeat(constants4.BITS - this.subnetMask)}`);
       }
       /**
        * The last address in the range given by this address' subnet
@@ -28300,7 +28306,7 @@ var require_ipv4 = __commonJS({
        * @returns {Address4}
        */
       subnetMaskAddress() {
-        return _Address4.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(constants3.BITS - this.subnetMask)}`));
+        return _Address4.fromBigInt(BigInt(`0b${"1".repeat(this.subnetMask)}${"0".repeat(constants4.BITS - this.subnetMask)}`));
       }
       /**
        * The Cisco-style wildcard mask, e.g. `0.0.0.255` for a `/24`. This is
@@ -28309,7 +28315,7 @@ var require_ipv4 = __commonJS({
        * @returns {Address4}
        */
       wildcardMask() {
-        return _Address4.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(constants3.BITS - this.subnetMask)}`));
+        return _Address4.fromBigInt(BigInt(`0b${"0".repeat(this.subnetMask)}${"1".repeat(constants4.BITS - this.subnetMask)}`));
       }
       /**
        * The network address in CIDR string form, e.g. `192.168.1.0/24` for
@@ -28444,7 +28450,7 @@ var require_ipv4 = __commonJS({
        */
       binaryZeroPad() {
         if (this._binaryZeroPad === void 0) {
-          this._binaryZeroPad = this.bigInt().toString(2).padStart(constants3.BITS, "0");
+          this._binaryZeroPad = this.bigInt().toString(2).padStart(constants4.BITS, "0");
         }
         return this._binaryZeroPad;
       }
@@ -28454,7 +28460,7 @@ var require_ipv4 = __commonJS({
        */
       groupForV6() {
         const segments = this.parsedAddress;
-        return this.correctForm().replace(constants3.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${segments.slice(2, 4).join(".")}</span>`);
+        return this.correctForm().replace(constants4.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments.slice(0, 2).join(".")}</span>.<span class="hover-group group-v4 group-7">${segments.slice(2, 4).join(".")}</span>`);
       }
     };
     exports.Address4 = Address4;
@@ -31282,31 +31288,31 @@ var init_config2 = __esm({
 });
 
 // packages/server/src/path-guard.ts
-import { resolve as resolve36, relative as relative16, isAbsolute as isAbsolute16, dirname as dirname24, basename as basename18 } from "path";
-import { realpath as realpath5 } from "fs/promises";
+import { resolve as resolve36, relative as relative16, isAbsolute as isAbsolute15, dirname as dirname24, basename as basename18 } from "path";
+import { realpath as realpath6 } from "fs/promises";
 async function resolveSafePath(workspace, requestedPath) {
   const decoded = decodeURIComponent(requestedPath);
-  if (isAbsolute16(decoded)) {
+  if (isAbsolute15(decoded)) {
     throw new PathTraversalError(requestedPath);
   }
   const resolved = resolve36(workspace, decoded);
   const rel = relative16(workspace, resolved);
-  if (rel.startsWith("..") || isAbsolute16(rel)) {
+  if (rel.startsWith("..") || isAbsolute15(rel)) {
     throw new PathTraversalError(requestedPath);
   }
   let realWorkspace;
   try {
-    realWorkspace = await realpath5(workspace);
+    realWorkspace = await realpath6(workspace);
   } catch {
     realWorkspace = workspace;
   }
   let real;
   try {
-    real = await realpath5(resolved);
+    real = await realpath6(resolved);
   } catch (err) {
     if (err instanceof Error && "code" in err && err.code === "ENOENT") {
       try {
-        const realParent = await realpath5(dirname24(resolved));
+        const realParent = await realpath6(dirname24(resolved));
         real = resolve36(realParent, basename18(resolved));
       } catch {
         return resolved;
@@ -31316,7 +31322,7 @@ async function resolveSafePath(workspace, requestedPath) {
     }
   }
   const realRel = relative16(realWorkspace, real);
-  if (realRel.startsWith("..") || isAbsolute16(realRel)) {
+  if (realRel.startsWith("..") || isAbsolute15(realRel)) {
     throw new PathTraversalError(requestedPath);
   }
   return resolved;
@@ -31964,7 +31970,7 @@ import { fileURLToPath as fileURLToPath4, pathToFileURL } from "url";
 import { dirname as dirname27 } from "path";
 
 // packages/cli/src/commands/compile.ts
-import { resolve as resolve19, dirname as dirname15, isAbsolute as isAbsolute13, relative as relative13 } from "path";
+import { resolve as resolve19, dirname as dirname15, isAbsolute as isAbsolute12, relative as relative13 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { chmod, writeFile as writeFile4, mkdir as mkdir5, readFile as readFile15 } from "fs/promises";
 import { existsSync as existsSync13 } from "fs";
@@ -33750,10 +33756,10 @@ var Minimatch = class {
       }
       return filtered.join("/");
     }).join("|");
-    const [open3, close] = set.length > 1 ? ["(?:", ")"] : ["", ""];
-    re = "^" + open3 + re + close + "$";
+    const [open4, close] = set.length > 1 ? ["(?:", ")"] : ["", ""];
+    re = "^" + open4 + re + close + "$";
     if (this.partial) {
-      re = "^(?:\\/|" + open3 + re.slice(1, -1) + close + ")$";
+      re = "^(?:\\/|" + open4 + re.slice(1, -1) + close + ")$";
     }
     if (this.negate)
       re = "^(?!" + re + ").+$";
@@ -38046,8 +38052,9 @@ async function discoverNativeContent(dir) {
 // packages/resolver/src/vendor-manifest.ts
 import { createHash as createHash3 } from "crypto";
 import { execFile, spawn } from "child_process";
-import { lstat as lstat5, readFile as readFile12, readdir as readdir4, realpath as realpath3 } from "fs/promises";
-import { basename as basename10, dirname as dirname9, isAbsolute as isAbsolute8, join as join9, posix as posix2, relative as relative7, sep as sep5 } from "path";
+import { constants as constants2 } from "fs";
+import { lstat as lstat5, open as open2, readFile as readFile12, readdir as readdir4, readlink, realpath as realpath3 } from "fs/promises";
+import { basename as basename10, dirname as dirname9, join as join9, posix as posix2, relative as relative7, sep as sep5 } from "path";
 import { promisify } from "util";
 var VENDOR_MANIFEST_FILE = ".vendor-manifest.json";
 var VENDOR_GIT_DIR = ".promptscript-git";
@@ -38055,6 +38062,55 @@ var execFileAsync = promisify(execFile);
 var NULL_DEVICE = process.platform === "win32" ? "NUL" : "/dev/null";
 var MAX_GIT_STDERR_BYTES = 64 * 1024;
 var MAX_GIT_TREE_RECORD_BYTES = 1024 * 1024;
+var MAX_GIT_CONFIG_BYTES = 1024 * 1024;
+function hashGitBlob(content) {
+  return createHash3("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+}
+async function readBoundedRegularFile(filePath, maxBytes, description) {
+  const flags = constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0) | (constants2.O_NONBLOCK ?? 0);
+  const handle = await open2(filePath, flags);
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile()) {
+      throw new Error(`${description} is not a regular file: ${filePath}`);
+    }
+    const content = Buffer.alloc(maxBytes + 1);
+    let offset = 0;
+    while (offset < content.length) {
+      const { bytesRead } = await handle.read(content, offset, content.length - offset, null);
+      if (bytesRead === 0) {
+        break;
+      }
+      offset += bytesRead;
+    }
+    if (offset > maxBytes) {
+      throw new Error(`${description} exceeds ${maxBytes} bytes: ${filePath}`);
+    }
+    return content.subarray(0, offset);
+  } finally {
+    await handle.close();
+  }
+}
+async function resolveSafeRepositorySymlink(symlinkPath, repositoryRoot, gitMetadataRoot) {
+  let targetPath;
+  try {
+    targetPath = await realpath3(symlinkPath);
+  } catch (error) {
+    throw new Error(`Symbolic links must resolve inside vendor repositories: ${symlinkPath}`, {
+      cause: error
+    });
+  }
+  if (targetPath === repositoryRoot || !isInsideCachePath(targetPath, repositoryRoot) || isInsideCachePath(targetPath, gitMetadataRoot)) {
+    throw new Error(`Symbolic links must resolve inside vendor repositories: ${symlinkPath}`);
+  }
+  const targetMetadata = await lstat5(targetPath);
+  if (!targetMetadata.isFile()) {
+    throw new Error(
+      `Symbolic links must resolve to regular files in vendor repositories: ${symlinkPath}`
+    );
+  }
+  return targetPath;
+}
 function getVendorRepositoryRelativePath(repoUrl) {
   const sshMatch = /^git@([^:]+):(.+)$/.exec(repoUrl);
   const candidate = sshMatch ? `https://${sshMatch[1]}/${sshMatch[2]}` : /^[a-z][a-z\d+.-]*:\/\//i.test(repoUrl) ? repoUrl : `https://${repoUrl}`;
@@ -38092,6 +38148,8 @@ function isValidVendorManifest(value) {
 }
 async function hashVendorRepository(directory) {
   const hash = createHash3("sha256");
+  const repositoryRoot = await realpath3(directory);
+  const gitMetadataRoot = join9(repositoryRoot, VENDOR_GIT_DIR);
   async function visit(currentDirectory, prefix) {
     const entries = await readdir4(currentDirectory, { withFileTypes: true });
     entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
@@ -38107,9 +38165,11 @@ async function hashVendorRepository(directory) {
       const entryPath = join9(currentDirectory, entry.name);
       const relativePath = posix2.join(prefix, entry.name);
       if (entry.isSymbolicLink()) {
-        throw new Error(`Symbolic links are not allowed in vendor repositories: ${entryPath}`);
-      }
-      if (entry.isDirectory()) {
+        await resolveSafeRepositorySymlink(entryPath, repositoryRoot, gitMetadataRoot);
+        hash.update(`symlink:${relativePath}\0`);
+        hash.update(await readlink(entryPath, { encoding: "buffer" }));
+        hash.update("\0");
+      } else if (entry.isDirectory()) {
         hash.update(`directory:${relativePath}\0`);
         await visit(entryPath, relativePath);
       } else if (entry.isFile()) {
@@ -38137,23 +38197,43 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
       }
     }
   }
+  async function rejectMetadataPath(relativePath, message) {
+    try {
+      await lstat5(join9(gitDir, ...relativePath.split("/")));
+      throw new Error(`${message}: ${gitDir}`);
+    } catch (error) {
+      if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")) {
+        throw error;
+      }
+    }
+  }
   const gitMetadata = await lstat5(gitDir);
   if (!gitMetadata.isDirectory() || gitMetadata.isSymbolicLink()) {
     throw new Error(`Invalid vendor Git metadata directory: ${gitDir}`);
   }
   await rejectMetadataSymlinks(gitDir);
-  const localConfig = await readFile12(join9(gitDir, "config"), "utf-8");
-  if (/^\s*\[(?:include|includeif)\b/im.test(localConfig) || /\bpromisor\s*=\s*true\b/i.test(localConfig) || /\bpartialclone/i.test(localConfig)) {
+  const [repositoryRoot, gitMetadataRoot] = await Promise.all([
+    realpath3(directory),
+    realpath3(gitDir)
+  ]);
+  const localConfigContent = await readBoundedRegularFile(
+    join9(gitDir, "config"),
+    MAX_GIT_CONFIG_BYTES,
+    "Vendor Git config"
+  );
+  const localConfig = localConfigContent.toString("utf-8");
+  if (/^[ \t]*\[(?:include|includeif)\b/im.test(localConfig) || /\bpromisor\s*=\s*true\b/i.test(localConfig) || /\bpartialclone/i.test(localConfig) || /\bworktreeconfig\s*=\s*true\b/i.test(localConfig)) {
     throw new Error(`External or partial Git object sources are not allowed: ${gitDir}`);
   }
-  try {
-    await lstat5(join9(gitDir, "objects", "info", "alternates"));
-    throw new Error(`Git object alternates are not allowed in vendor metadata: ${gitDir}`);
-  } catch (error) {
-    if (!(typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")) {
-      throw error;
-    }
-  }
+  await rejectMetadataPath("commondir", "Git common directories are not allowed");
+  await rejectMetadataPath(
+    "objects/info/alternates",
+    "Git object alternates are not allowed in vendor metadata"
+  );
+  await rejectMetadataPath(
+    "objects/info/http-alternates",
+    "Git HTTP alternates are not allowed in vendor metadata"
+  );
   const commonArgs = [`--git-dir=${gitDir}`, `--work-tree=${directory}`];
   const environment = {
     PATH: process.env["PATH"],
@@ -38219,12 +38299,13 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
           if (metadataSeparator < 0 || entryType !== "blob" || extraFields.length > 0 || mode === void 0 || objectId === void 0) {
             throw new Error(`Unsupported Git tree entry in vendored repository: ${path2}`);
           }
-          if (mode !== "100644" && mode !== "100755") {
+          if (mode !== "100644" && mode !== "100755" && mode !== "120000") {
             throw new Error(`Unsupported Git tree mode in vendored repository: ${path2}`);
           }
           trackedFiles.set(path2, {
             objectId,
-            executable: mode === "100755"
+            executable: mode === "100755",
+            symbolicLink: mode === "120000"
           });
         }
         recordStart = separator + 1;
@@ -38257,7 +38338,9 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
   if (pendingRecord.length > 0) {
     throw new Error("Git ls-tree output ended with an unterminated record");
   }
-  const worktreeFiles = [];
+  let worktreeFileCount = 0;
+  const regularFiles = [];
+  const worktreeSymlinks = /* @__PURE__ */ new Map();
   async function collectFiles(currentDirectory, prefix) {
     const entries = await readdir4(currentDirectory, { withFileTypes: true });
     for (const entry of entries) {
@@ -38267,13 +38350,32 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
       const entryPath = join9(currentDirectory, entry.name);
       const relativePath = posix2.join(prefix, entry.name);
       if (entry.isSymbolicLink()) {
-        throw new Error(`Symbolic links are not allowed in vendor repositories: ${entryPath}`);
-      }
-      if (entry.isDirectory()) {
+        const tracked = trackedFiles.get(relativePath);
+        if (!tracked?.symbolicLink) {
+          throw new Error(`Symbolic links are not allowed for regular files: ${entryPath}`);
+        }
+        const targetPath = await resolveSafeRepositorySymlink(
+          entryPath,
+          repositoryRoot,
+          gitMetadataRoot
+        );
+        const targetRelativePath = relative7(repositoryRoot, targetPath).split(sep5).join("/");
+        const trackedTarget = trackedFiles.get(targetRelativePath);
+        if (!trackedTarget || trackedTarget.symbolicLink) {
+          throw new Error(`Symbolic links must target tracked regular files: ${entryPath}`);
+        }
+        worktreeFileCount += 1;
+        worktreeSymlinks.set(relativePath, await readlink(entryPath, { encoding: "buffer" }));
+      } else if (entry.isDirectory()) {
         await collectFiles(entryPath, relativePath);
       } else if (entry.isFile()) {
         if (!allowedUntrackedFiles.has(relativePath)) {
           const tracked = trackedFiles.get(relativePath);
+          if (tracked?.symbolicLink) {
+            throw new Error(
+              `Vendored repository symbolic links do not match commit ${expectedCommit}`
+            );
+          }
           if (tracked && process.platform !== "win32") {
             const metadata = await lstat5(entryPath);
             if (Boolean(metadata.mode & 73) !== tracked.executable) {
@@ -38282,7 +38384,8 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
               );
             }
           }
-          worktreeFiles.push(relativePath);
+          worktreeFileCount += 1;
+          regularFiles.push(relativePath);
         }
       } else {
         throw new Error(`Unsupported vendor repository entry: ${entryPath}`);
@@ -38290,12 +38393,12 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
     }
   }
   await collectFiles(directory, "");
-  if (worktreeFiles.length !== trackedFiles.size || worktreeFiles.some((path2) => !trackedFiles.has(path2))) {
+  if (worktreeFileCount !== trackedFiles.size || regularFiles.some((path2) => !trackedFiles.has(path2))) {
     throw new Error(`Vendored repository contents do not match commit ${expectedCommit}`);
   }
   const batchSize = 100;
-  for (let index = 0; index < worktreeFiles.length; index += batchSize) {
-    const paths = worktreeFiles.slice(index, index + batchSize);
+  for (let index = 0; index < regularFiles.length; index += batchSize) {
+    const paths = regularFiles.slice(index, index + batchSize);
     const filePaths = paths.map((path2) => join9(directory, ...path2.split("/")));
     const objects = await execFileAsync(
       "git",
@@ -38307,6 +38410,12 @@ async function verifyGitRepositoryCheckout(directory, gitDirectoryName, expected
       throw new Error(`Vendored repository contents do not match commit ${expectedCommit}`);
     }
   }
+  for (const [path2, linkTarget] of worktreeSymlinks) {
+    const tracked = trackedFiles.get(path2);
+    if (!tracked || hashGitBlob(linkTarget) !== tracked.objectId) {
+      throw new Error(`Vendored repository contents do not match commit ${expectedCommit}`);
+    }
+  }
 }
 async function verifyVendoredGitRepository(directory, expectedCommit) {
   await verifyGitRepositoryCheckout(directory, VENDOR_GIT_DIR, expectedCommit);
@@ -38372,8 +38481,7 @@ async function resolveVendoredRepository(vendorDir, repoUrl, expectedVersion, ex
       realpath3(fullPath),
       lstat5(fullPath)
     ]);
-    const containment = relative7(vendorRealPath, repositoryRealPath);
-    if (containment === ".." || containment.startsWith(`..${sep5}`) || isAbsolute8(containment) || repositoryRealPath === vendorRealPath) {
+    if (!isInsideCachePath(repositoryRealPath, vendorRealPath) || repositoryRealPath === vendorRealPath) {
       throw new Error(`Vendored dependency escapes the vendor directory: ${repoUrl}`);
     }
     if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
@@ -41114,36 +41222,76 @@ var suspiciousUrls = {
 // packages/validator/src/rules/authority-injection.ts
 var AUTHORITY_PATTERNS = [
   // Mandatory/strict mode indicators
-  /\[?\s{0,10}MANDATORY\s{0,10}(?:POLICY|UPDATE|FOOTER|INSTRUCTION|DIRECTIVE)\s{0,10}\]?/i,
+  /\[?\s{0,10}\bMANDATORY\b\s{0,10}(?:POLICY|UPDATE|FOOTER|INSTRUCTION|DIRECTIVE)\b\s{0,10}\]?/i,
   /\[\s{0,10}OVERRIDE\s{0,10}\]/i,
-  /\[?\s{0,10}STRICT[_\s]{0,10}MODE\s{0,10}[:\s]{1,10}ON\s{0,10}\]?/i,
-  /\[?\s{0,10}SYSTEM\s{0,10}(?:OVERRIDE|UPDATE|DIRECTIVE)\s{0,10}\]?/i,
-  /\[?\s{0,10}ADMIN(?:ISTRATOR)?\s{0,10}(?:MODE|OVERRIDE|ACCESS)\s{0,10}\]?/i,
-  /\[?\s{0,10}ROOT\s{0,10}(?:ACCESS|MODE|OVERRIDE)\s{0,10}\]?/i,
-  /\[?\s{0,10}PRIORITY\s{0,10}(?:OVERRIDE|ONE|ALPHA)\s{0,10}\]?/i,
-  /\[?\s{0,10}EMERGENCY\s{0,10}(?:PROTOCOL|OVERRIDE|MODE)\s{0,10}\]?/i,
+  /\[?\s{0,10}\bSTRICT[_\s]{0,10}MODE\b\s{0,10}[:\s]{1,10}ON\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bSYSTEM\b\s{0,10}(?:OVERRIDE|UPDATE|DIRECTIVE)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bADMIN(?:ISTRATOR)?\b\s{0,10}(?:MODE|OVERRIDE|ACCESS)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bROOT\b\s{0,10}(?:ACCESS|MODE|OVERRIDE)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bPRIORITY\b\s{0,10}(?:OVERRIDE|ONE|ALPHA)\b\s{0,10}\]?/i,
+  /\[?\s{0,10}\bEMERGENCY\b\s{0,10}(?:PROTOCOL|OVERRIDE|MODE)\b\s{0,10}\]?/i,
   // Warning suppression patterns
   // Removed because it triggers false positives on valid agent instructions (e.g., "do not notify user")
   // /(?:DO\s{1,10}NOT|NEVER|DON'?T)\s{1,10}(?:WARN|ALERT|NOTIFY|FLAG|REPORT)/i,
-  /(?:DO\s{1,10}NOT|NEVER|DON'?T)\s{1,10}(?:PROVIDE|SHOW|DISPLAY|INCLUDE)\s{1,10}(?:SECURITY\s{1,10})?WARNINGS?/i,
-  /(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\s{1,10}(?:ALL\s{1,10})?WARNINGS?/i,
-  /(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\s{1,10}(?:ALL\s{1,10})?(?:SECURITY\s{1,10})?(?:ALERTS?|NOTIFICATIONS?)/i,
-  /IGNORE\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?WARNINGS?/i,
-  /(?:SKIP|BYPASS)\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?(?:CHECKS?|VALIDATION)/i,
+  /\b(?:DO\s{1,10}NOT|NEVER|DON'?T)\b\s{1,10}(?:PROVIDE|SHOW|DISPLAY|INCLUDE)\b\s{1,10}(?:SECURITY\s{1,10})?WARNINGS?\b/i,
+  /\b(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\b\s{1,10}(?:ALL\s{1,10})?WARNINGS?\b/i,
+  /\b(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\b\s{1,10}(?:ALL\s{1,10})?(?:SECURITY\s{1,10})?(?:ALERTS?|NOTIFICATIONS?)\b/i,
+  /\bIGNORE\b\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?WARNINGS?\b/i,
+  /(?:^|[.!?:;]\s{0,10})\s{0,10}(?:[-*]\s{1,10})?(?:PLEASE\s{1,10})?\b(?:SKIP|BYPASS)\b\s{1,10}(?:CHECKS?|VALIDATION)\b/im,
+  /\b(?:SKIP|BYPASS)\b\s{1,10}(?:(?:ALL\s{1,10})(?:SAFETY\s{1,10})?|SAFETY\s{1,10})(?:CHECKS?|VALIDATION)\b/i,
   // Execute/follow verbatim patterns
-  /EXECUTE\s{1,10}(?:THIS\s{1,10})?VERBATIM/i,
-  /FOLLOW\s{1,10}(?:THESE?\s{1,10})?INSTRUCTIONS?\s{1,10}(?:EXACTLY|PRECISELY|LITERALLY)/i,
-  /(?:MUST|SHALL|WILL)\s{1,10}(?:ALWAYS\s{1,10})?COMPLY/i,
-  /(?:ABSOLUTE|UNCONDITIONAL)\s{1,10}(?:COMPLIANCE|OBEDIENCE)/i,
-  /NO\s{1,10}(?:EXCEPTIONS?|DEVIATIONS?)\s{1,10}(?:ALLOWED|PERMITTED)/i,
+  /\bEXECUTE\b\s{1,10}(?:THIS\s{1,10})?VERBATIM\b/i,
+  /\bFOLLOW\b\s{1,10}(?:THESE?\s{1,10})?INSTRUCTIONS?\s{1,10}(?:EXACTLY|PRECISELY|LITERALLY)\b/i,
+  /\b(?:MUST|SHALL|WILL)\b\s{1,10}(?:ALWAYS\s{1,10})?COMPLY\b/i,
+  /\b(?:ABSOLUTE|UNCONDITIONAL)\b\s{1,10}(?:COMPLIANCE|OBEDIENCE)\b/i,
+  /\bNO\b\s{1,10}(?:EXCEPTIONS?|DEVIATIONS?)\s{1,10}(?:ALLOWED|PERMITTED)\b/i,
   // Authority assertion patterns
-  /THIS\s{1,10}(?:OVERRIDES?|SUPERSEDES?|REPLACES?)\s{1,10}(?:ALL\s{1,10})?(?:PREVIOUS|PRIOR|OTHER)/i,
-  /(?:HIGHEST|TOP|MAXIMUM)\s{1,10}PRIORITY\s{1,10}(?:INSTRUCTION|DIRECTIVE|ORDER)/i,
-  /(?:CORE|FUNDAMENTAL|BASE)\s{1,10}(?:DIRECTIVE|INSTRUCTION)\s{1,10}(?:UPDATE|OVERRIDE)/i,
-  /NEW\s{1,10}(?:SYSTEM|CORE|BASE)\s{1,10}(?:INSTRUCTIONS?|DIRECTIVES?|RULES?)/i
+  /\bTHIS\b\s{1,10}(?:OVERRIDES?|SUPERSEDES?|REPLACES?)\s{1,10}(?:ALL\s{1,10})?(?:PREVIOUS|PRIOR|OTHER)\b/i,
+  /\b(?:HIGHEST|TOP|MAXIMUM)\b\s{1,10}PRIORITY\s{1,10}(?:INSTRUCTION|DIRECTIVE|ORDER)\b/i,
+  /\b(?:CORE|FUNDAMENTAL|BASE)\b\s{1,10}(?:DIRECTIVE|INSTRUCTION)\s{1,10}(?:UPDATE|OVERRIDE)\b/i,
+  /\bNEW\b\s{1,10}(?:SYSTEM|CORE|BASE)\s{1,10}(?:INSTRUCTIONS?|DIRECTIVES?|RULES?)\b/i
 ];
 function stripFencedCodeBlocks2(text) {
-  return text.replace(/^\s*```[\s\S]*?^\s*```/gm, "");
+  const lines = text.split("\n");
+  const output = [];
+  let pendingFence = [];
+  let insideFence = false;
+  let fenceCharacter = "";
+  let fenceLength = 0;
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    const renderedLine = index < lines.length - 1 ? `${line}
+` : line;
+    const trimmedLine = line.trimStart();
+    const currentCharacter = trimmedLine[0];
+    let currentLength = 0;
+    if (currentCharacter === "`" || currentCharacter === "~") {
+      while (trimmedLine[currentLength] === currentCharacter) {
+        currentLength += 1;
+      }
+    }
+    const closesFence = insideFence && currentCharacter === fenceCharacter && currentLength >= fenceLength && trimmedLine.slice(currentLength).trim() === "";
+    const opensFence = !insideFence && currentLength >= 3;
+    if (closesFence) {
+      insideFence = false;
+      pendingFence = [];
+      fenceCharacter = "";
+      fenceLength = 0;
+    } else if (opensFence) {
+      insideFence = true;
+      fenceCharacter = currentCharacter;
+      fenceLength = currentLength;
+      pendingFence.push(renderedLine);
+    } else if (insideFence) {
+      pendingFence.push(renderedLine);
+    } else {
+      output.push(renderedLine);
+    }
+  }
+  if (insideFence) {
+    output.push(...pendingFence);
+  }
+  return output.join("");
 }
 var authorityInjection = {
   id: "PS011",
@@ -41155,8 +41303,9 @@ var authorityInjection = {
       ctx.ast,
       (text, loc) => {
         const strippedText = stripFencedCodeBlocks2(text);
+        const normalizedText = strippedText.replace(/\s+/g, " ");
         for (const pattern of AUTHORITY_PATTERNS) {
-          if (pattern.test(strippedText)) {
+          if (pattern.test(strippedText) || pattern.test(normalizedText)) {
             ctx.report({
               message: `Authority injection pattern detected: ${pattern.source}`,
               location: loc,
@@ -44253,15 +44402,15 @@ var SECURITY_STRICT_MULTILINGUAL = {
 };
 
 // packages/compiler/src/compiler.ts
-import { dirname as dirname13, isAbsolute as isAbsolute10, join as join13, relative as relative10, resolve as resolve16, sep as sep7 } from "path";
+import { dirname as dirname13, isAbsolute as isAbsolute9, join as join13, relative as relative10, resolve as resolve16, sep as sep7 } from "path";
 
 // packages/compiler/src/hook-script-validator.ts
 init_src4();
 import { lstat as lstat7, realpath as realpath4 } from "fs/promises";
-import { dirname as dirname12, isAbsolute as isAbsolute9, relative as relative9, resolve as resolve15, sep as sep6 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute8, relative as relative9, resolve as resolve15, sep as sep6 } from "path";
 function isInside(root, candidate) {
   const relation = relative9(root, candidate);
-  return relation === "" || !relation.startsWith(`..${sep6}`) && relation !== ".." && !isAbsolute9(relation);
+  return relation === "" || !relation.startsWith(`..${sep6}`) && relation !== ".." && !isAbsolute8(relation);
 }
 function inferProjectRoot(localPath, configuredProjectRoot, entryPath) {
   if (configuredProjectRoot) return resolve15(configuredProjectRoot);
@@ -44406,7 +44555,7 @@ var Compiler = class _Compiler {
       formatTime: 0,
       totalTime: 0
     };
-    const sourceLabel = isAbsolute10(entryPath) ? relative10(process.cwd(), entryPath) : entryPath;
+    const sourceLabel = isAbsolute9(entryPath) ? relative10(process.cwd(), entryPath) : entryPath;
     this.logger.verbose("=== Stage 1: Resolve ===");
     const startResolve = Date.now();
     let resolved;
@@ -44491,7 +44640,7 @@ var Compiler = class _Compiler {
         const sourceFile = block.loc.file;
         const referenceRoot = sourceFile ? referenceRoots.find((root) => {
           const relation = relative10(resolve16(root.path), resolve16(sourceFile));
-          return relation === "" || relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute10(relation);
+          return relation === "" || relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute9(relation);
         }) : void 0;
         for (const [, skillValue] of Object.entries(block.content.properties)) {
           if (typeof skillValue !== "object" || skillValue === null || !("references" in skillValue))
@@ -44504,7 +44653,7 @@ var Compiler = class _Compiler {
             if (sourceFile && referenceRoot) {
               const resolvedReference = resolve16(dirname13(sourceFile), ref);
               const relation = relative10(resolve16(referenceRoot.path), resolvedReference);
-              if (relation !== "" && relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute10(relation)) {
+              if (relation !== "" && relation !== ".." && !relation.startsWith(`..${sep7}`) && !isAbsolute9(relation)) {
                 const sourceReferences = registryReferencePaths.get(sourceFile) ?? /* @__PURE__ */ new Map();
                 const relativePath = relation.replaceAll("\\", "/");
                 const referenceKey = `${referenceRoot.repoUrl}\0${relativePath}\0${referenceRoot.version}`;
@@ -45021,14 +45170,14 @@ init_services();
 
 // packages/cli/src/utils/registry-resolver.ts
 import { existsSync as existsSync12 } from "fs";
-import { isAbsolute as isAbsolute11, join as join14, relative as relative11, resolve as resolve17, sep as sep8 } from "path";
+import { isAbsolute as isAbsolute10, join as join14, relative as relative11, resolve as resolve17, sep as sep8 } from "path";
 async function resolveRegistrySubPath(repositoryPath, subPath) {
   if (!subPath) {
     return repositoryPath;
   }
   const result = resolve17(repositoryPath, subPath);
   const relation = relative11(resolve17(repositoryPath), result);
-  if (relation === ".." || relation.startsWith(`..${sep8}`) || isAbsolute11(relation)) {
+  if (relation === ".." || relation.startsWith(`..${sep8}`) || isAbsolute10(relation)) {
     throw new Error(`Registry path escapes its repository: ${subPath}`);
   }
   if (existsSync12(result) && !await isRealPathInside(result, repositoryPath)) {
@@ -45193,19 +45342,19 @@ function detectOutputConflicts(targets) {
 }
 
 // packages/cli/src/utils/managed-output-cleanup.ts
-import { constants as constants2 } from "node:fs";
+import { constants as constants3 } from "node:fs";
 import { execFile as execFile2, spawn as spawn3 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import {
   lstat as lstat8,
   mkdir as mkdir4,
-  open as open2,
+  open as open3,
   readFile as readFile14,
   readdir as readdir6,
   rmdir,
   unlink as unlink2
 } from "node:fs/promises";
-import { basename as basename13, dirname as dirname14, isAbsolute as isAbsolute12, relative as relative12, resolve as resolve18 } from "node:path";
+import { basename as basename13, dirname as dirname14, isAbsolute as isAbsolute11, relative as relative12, resolve as resolve18 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFileAsync2 = promisify2(execFile2);
 var PROMPTSCRIPT_MARKER_PATTERNS = [
@@ -45533,7 +45682,7 @@ function collectManagedDirectories(outputs, outputRoot) {
   for (const output of outputs.values()) {
     for (const directory of output.managedOutputDirectories ?? []) {
       const normalized = directory.replace(/\\/g, "/");
-      if (!normalized || isAbsolute12(normalized)) continue;
+      if (!normalized || isAbsolute11(normalized)) continue;
       if (normalized.split("/").some((segment) => segment === "..")) continue;
       const absolutePath = resolve18(outputRoot, normalized);
       if (isWithin(outputRoot, absolutePath)) directories.add(absolutePath);
@@ -45554,7 +45703,7 @@ function collectManagedFiles(outputs, outputRoot) {
   for (const output of outputs.values()) {
     for (const file of output.managedOutputFiles ?? []) {
       const normalized = file.replace(/\\/g, "/");
-      if (!normalized || isAbsolute12(normalized)) continue;
+      if (!normalized || isAbsolute11(normalized)) continue;
       if (normalized.split("/").some((segment) => segment === "..")) continue;
       const absolutePath = resolve18(outputRoot, normalized);
       if (isWithin(outputRoot, absolutePath)) files.add(absolutePath);
@@ -45835,7 +45984,7 @@ async function openAncestorDirectories(root, directory) {
 }
 async function openOrCreateAncestorDirectories(root, file) {
   const relativePath = relative12(root, file);
-  if (relativePath.startsWith("..") || isAbsolute12(relativePath)) {
+  if (relativePath.startsWith("..") || isAbsolute11(relativePath)) {
     return void 0;
   }
   await mkdir4(root, { recursive: true });
@@ -45895,7 +46044,7 @@ async function closeDirectoryGuards(guards) {
 }
 async function safeOpenDirectory(path2) {
   try {
-    return await open2(path2, constants2.O_RDONLY | constants2.O_DIRECTORY | constants2.O_NOFOLLOW);
+    return await open3(path2, constants3.O_RDONLY | constants3.O_DIRECTORY | constants3.O_NOFOLLOW);
   } catch (error) {
     if (isNodeError(error) && (error.code === "ENOENT" || error.code === "ENOTDIR" || error.code === "ELOOP")) {
       return void 0;
@@ -46268,7 +46417,7 @@ function scanHookOwnership(value) {
 }
 function isWithin(root, candidate) {
   const relativePath = relative12(root, candidate);
-  return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute12(relativePath);
+  return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute11(relativePath);
 }
 function isNodeError(error) {
   return error instanceof Error && "code" in error;
@@ -46398,10 +46547,10 @@ function getBuildProfile(config, buildName) {
 }
 function resolveOutputBase(projectRoot, output) {
   if (!output) return projectRoot;
-  return isAbsolute13(output) ? output : resolve19(projectRoot, output);
+  return isAbsolute12(output) ? output : resolve19(projectRoot, output);
 }
 function resolveProjectPath(projectRoot, path2) {
-  return isAbsolute13(path2) ? path2 : resolve19(projectRoot, path2);
+  return isAbsolute12(path2) ? path2 : resolve19(projectRoot, path2);
 }
 function resolveCompileConfigPath(projectRoot, options) {
   if (options.config) {
@@ -49349,7 +49498,7 @@ import { resolve as resolve28, join as join22 } from "path";
 
 // packages/cli/src/commands/lock-reference-scanner.ts
 import { readFile as readFile22 } from "fs/promises";
-import { dirname as dirname19, isAbsolute as isAbsolute14, relative as relative15, resolve as resolve27, sep as sep9 } from "path";
+import { dirname as dirname19, isAbsolute as isAbsolute13, relative as relative15, resolve as resolve27, sep as sep9 } from "path";
 async function collectRegistryReferences(ast, roots, existing = {}, lockedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   const references = {};
   const sortedRoots = [...roots].sort(
@@ -49367,7 +49516,7 @@ async function collectRegistryReferences(ast, roots, existing = {}, lockedAt = (
       if (!Array.isArray(refs)) continue;
       for (const ref of refs) {
         if (typeof ref !== "string") continue;
-        const referencePath = isAbsolute14(ref) ? resolve27(ref) : resolve27(dirname19(block.loc.file), ref);
+        const referencePath = isAbsolute13(ref) ? resolve27(ref) : resolve27(dirname19(block.loc.file), ref);
         const root = sortedRoots.find(
           (candidate) => isInsideCachePath(referencePath, candidate.cachePath)
         );
@@ -49697,7 +49846,17 @@ async function updateCommand(packageArg, options) {
 init_loader2();
 init_console();
 init_src();
-import { mkdir as mkdir9, mkdtemp, readFile as readFile24, readdir as readdir7, rename, rm, writeFile as writeFile9 } from "fs/promises";
+import {
+  lstat as lstat9,
+  mkdir as mkdir9,
+  mkdtemp,
+  readFile as readFile24,
+  readdir as readdir7,
+  realpath as realpath5,
+  rename,
+  rm,
+  writeFile as writeFile9
+} from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
 import { basename as basename14, dirname as dirname20, join as join23, resolve as resolve30 } from "path";
 import { parse as parseYaml13 } from "yaml";
@@ -49721,11 +49880,11 @@ async function vendorSyncCommand(options) {
       return;
     }
     const vendorDir = resolve30(VENDOR_DIR);
+    await validateVendorParentDirectory(vendorDir, true);
     const recoveredBackup = await recoverVendorDirectory(vendorDir);
     if (recoveredBackup) {
       ConsoleOutput.warn(`Recovered interrupted vendor update: ${recoveredBackup}`);
     }
-    await mkdir9(dirname20(vendorDir), { recursive: true });
     const stagingDir = await mkdtemp(join23(dirname20(vendorDir), ".vendor-stage-"));
     try {
       const manifest = { version: 1, dependencies: {} };
@@ -49794,6 +49953,7 @@ async function vendorCheckCommand(_options) {
     const deps = getRepositoryDependencies(lockfile);
     validateDependencyPaths(deps);
     const vendorDir = resolve30(VENDOR_DIR);
+    await validateVendorParentDirectory(vendorDir, false);
     const recoveredBackup = await recoverVendorDirectory(vendorDir);
     if (recoveredBackup) {
       ConsoleOutput.warn(`Recovered interrupted vendor update: ${recoveredBackup}`);
@@ -49901,6 +50061,24 @@ function validateDependencyPaths(dependencies) {
 function toCloneUrl(repoUrl) {
   return /^[a-z][a-z\d+.-]*:\/\//i.test(repoUrl) || repoUrl.startsWith("git@") ? repoUrl : `https://${repoUrl}`;
 }
+async function validateVendorParentDirectory(vendorDir, createIfMissing) {
+  const projectRoot = await realpath5(".");
+  const parentDir = dirname20(vendorDir);
+  if (createIfMissing) {
+    await mkdir9(parentDir, { recursive: true });
+  }
+  try {
+    const [metadata, parentRealPath] = await Promise.all([lstat9(parentDir), realpath5(parentDir)]);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory() || parentRealPath === projectRoot || !isInsideCachePath(parentRealPath, projectRoot)) {
+      throw new Error(`Unsafe vendor parent directory: ${parentDir}`);
+    }
+  } catch (error) {
+    if (!createIfMissing && typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+      return;
+    }
+    throw error;
+  }
+}
 async function replaceVendorDirectory(stagingDir, vendorDir) {
   if (!existsSync21(vendorDir)) {
     await rename(stagingDir, vendorDir);
@@ -50843,7 +51021,7 @@ init_console();
 // packages/cli/src/telemetry/config.ts
 import { existsSync as existsSync27 } from "node:fs";
 import { mkdir as mkdir11, readFile as readFile27, rename as rename2, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname21, isAbsolute as isAbsolute15, join as join29, resolve as resolve34 } from "node:path";
+import { dirname as dirname21, isAbsolute as isAbsolute14, join as join29, resolve as resolve34 } from "node:path";
 import { parseDocument } from "yaml";
 
 // packages/telemetry/src/config.ts
@@ -51748,7 +51926,7 @@ function runtimeMetadata(appVersion, input2 = {}) {
 init_loader2();
 init_user_config();
 function resolveFrom(baseDirectory, value) {
-  return isAbsolute15(value) ? value : resolve34(baseDirectory, value);
+  return isAbsolute14(value) ? value : resolve34(baseDirectory, value);
 }
 function findProjectConfig(cwd, customPath) {
   if (customPath !== void 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptscript/cli",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "CLI for PromptScript - standardize AI instructions across GitHub Copilot, Claude, Cursor and other AI tools",
   "keywords": [
     "cli",

package/src/commands/init.d.ts

@@ -9,6 +9,10 @@ import { type PlannedWrite } from '../utils/write-plan.js';
 export declare function initCommand(options: InitOptions, services?: CliServices): Promise<void>;
 export declare function selectMigrationStrategy(services: CliServices): Promise<'static' | 'llm'>;
 export declare function getSkillWrites(targets: AIToolTarget[]): PlannedWrite[];
+/**
+ * Add a PromptScript marker without putting HTML comments after YAML frontmatter.
+ */
+export declare function addPromptScriptMarker(content: string): string;
 /**
  * Format target name for display using the formatter's description.
  */

package/src/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../../packages/cli/src/commands/init.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,WAAW,EAAyB,MAAM,gBAAgB,CAAC;AAoBzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAOL,KAAK,YAAY,EAElB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,YAAY,EAElB,MAAM,wBAAwB,CAAC;AA4DhC;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,QAAQ,GAAE,WAAqC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAQf;AAsUD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,CAU9F;AAoGD,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAkCtE;AAiYD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAM7D"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../../packages/cli/src/commands/init.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,WAAW,EAAyB,MAAM,gBAAgB,CAAC;AAoBzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAOL,KAAK,YAAY,EAElB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAGL,KAAK,YAAY,EAElB,MAAM,wBAAwB,CAAC;AA4DhC;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,QAAQ,GAAE,WAAqC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAQf;AAsUD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,CAU9F;AAoGD,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CA+BtE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM7D;AAiYD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAM7D"}

package/src/commands/vendor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendor.d.ts","sourceRoot":"","sources":["../../../../../packages/cli/src/commands/vendor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAsBzE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmGjF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoFpF"}
+{"version":3,"file":"vendor.d.ts","sourceRoot":"","sources":["../../../../../packages/cli/src/commands/vendor.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuBzE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmGjF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFpF"}