agentsmesh 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.25.0
+
+### Minor Changes
+
+- d2d175b: Security hardening and silent-data-loss fixes across the install, import, and generate pipelines, plus a tightened lessons skill.
+
+  **Security**
+  - The `install` / `extends` git fetch now enforces a transport allowlist (`https`/`ssh` only) on **both** the ref-resolution (`git ls-remote`) and the actual clone, before any git process is spawned — closing an SSRF / local-repo-probe primitive and a clone-time redirect-to-`ext::`/`file://` (RCE/local-read) vector. `git+http://`, `git+file://`, and `git+git://` sources are refused by default; opt in with `AGENTSMESH_ALLOW_INSECURE_GIT=1` (http) or `AGENTSMESH_ALLOW_LOCAL_GIT=1` (file). Clones now also run with `core.symlinks=false`.
+  - The canonical parsers (`rules`/`commands`/`agents`/`skills`) and **every** native-import directory reader no longer follow symlinks. This prevents a malicious pack or an imported tool config from exfiltrating host files (e.g. `~/.ssh/id_rsa`) into canonical content or a redistributed pack.
+
+  **Fixed**
+  - `agentsmesh import --from cline` and `--from continue` now preserve URL/HTTP/SSE MCP servers instead of dropping every remote server on a generate → re-import round-trip.
+  - The shared Markdown link scanner no longer corrupts content when a link label contains `(` or a link carries a `"title"` — the rewrite span now covers only the path.
+  - The MCP `update_hooks` tool normalizes the nested native hook form to the flat canonical shape instead of silently discarding it.
+  - A single unparseable lessons trigger (from a merge or hand-edit) no longer permanently blocks all future `lessons add`/`merge` captures — the write barrier now blocks only on errors the current mutation introduces.
+  - `parseRules` now errors on duplicate-slug rule files that previously vanished silently.
+
+  **Changed (breaking)**
+  - Git transports other than `https`/`ssh` are refused by default on `install`/`extends`; re-enable `http`/`file` with the env vars above.
+  - `agentsmesh import --from <tool>` no longer follows symlinks in a tool's config directories — symlinked rule/command/agent/skill files and directories are skipped. Share content via real files, `extends:`, or packs instead.
+  - Case-only canonical name collisions (e.g. `commands/Build.md` + `commands/build.md`) are now a hard error at parse and generate time instead of a silent last-write-wins on case-insensitive filesystems.
+
+  **Docs**
+  - `agentsmesh.local.yaml` docs now describe the real replace/append/merge behavior (the previous "narrowing-only" guarantee was never enforced).
+  - The `lessons` skill is now an Iron-Law gate (binding recall/capture, gate function, rationalization table) with a short trigger-first description; fetch-hardening and git-transport env vars are documented.
+
+## 0.24.0
+
+### Minor Changes
+
+- 352f4a0: feat: close 23 target capability gaps and make new MCP capabilities round-trip
+
+  Audited every supported target and implemented native or partial support for
+  capabilities the underlying tools already offer but agentsmesh did not expose:
+  - **MCP**: Goose (global, `~/.config/goose/config.yaml` extensions) and Copilot
+    (project, `.vscode/mcp.json`) now both generate **and import** MCP servers, so
+    the new native MCP capabilities round-trip back to canonical.
+  - **Agents**: Augment Code, Amazon Q, and Cline gain native agent definitions.
+  - **Skills / Commands**: Zed emits shared native skills; Trae gains native
+    commands (`.trae/commands/`).
+  - **Permissions**: Junie (global allowlist) and Kilo Code (`kilo.jsonc`) gain
+    native permissions; Warp, Roo Code, and Antigravity declare `partial` support
+    with lint guidance pointing at their UI / settings.
+  - **Hooks**: Factory Droid, Deep Agents CLI, Antigravity, Qwen Code, Amp, and
+    Codex CLI gain native lifecycle hooks.
+  - **Combined settings sidecars**: Qwen Code and Amp write hooks + permissions
+    into their settings files; Rovo Dev writes hooks + permissions to its global
+    `config.yml`; Amazon Q gains agents + hooks + permissions.
+
+  The shared `mcpJson` import mode gains an optional, data-driven `mcpServersKey`
+  (defaults to `mcpServers`) so VS Code-style files keyed on `servers` import
+  correctly — with no target-name hardcoding in core. The support matrix in the
+  README and docs site is updated to match.
+
 ## 0.23.0
 
 ### Minor Changes

package/README.md

@@ -222,7 +222,7 @@ AgentsMesh generates native config for every major AI coding assistant — plus
 - **Bidirectional sync** — `import` reads existing tool configs into `.agentsmesh/`; `generate` projects them back out. Round-trips are loss-free, so adopting AgentsMesh in an existing repo never throws away data.
 - **Agents that learn** — the optional [lessons memory](#teach-your-agents-lessons) recalls past-mistake rules before each edit and captures new ones after each failure, shared across every tool and every teammate.
 - **Automatic link rebasing** — references like `.agentsmesh/skills/foo/SKILL.md` are rewritten to target-relative paths in every generated artifact, so cross-file links stay valid from `.claude/`, `.cursor/`, `.github/`, `.codex/`, and the rest.
-- **Managed embedding with round-trip metadata** — when a target has no native slot for a feature (e.g. commands in Codex CLI, agents in Cline), AgentsMesh embeds it with frontmatter that survives the next `import`. No silent data loss; the full feature-by-feature breakdown lives in the [supported tools matrix](https://samplexbro.github.io/agentsmesh/reference/supported-tools/).
+- **Managed embedding with round-trip metadata** — when a target has no native slot for a feature (e.g. commands in Codex CLI), AgentsMesh embeds it with frontmatter that survives the next `import`. No silent data loss; the full feature-by-feature breakdown lives in the [supported tools matrix](https://samplexbro.github.io/agentsmesh/reference/supported-tools/).
 - **Team-safe collaboration** — `agentsmesh check` is a CI drift gate against `.agentsmesh/.lock`, `agentsmesh diff` previews changes, `agentsmesh merge` rebuilds the lock after three-way Git conflicts, and `lock_features` + per-feature `strategy` prevent accidental overrides.
 - **Global mode** — `~/.agentsmesh/` syncs personal AI config to `~/.claude/`, `~/.cursor/`, `~/.codex/`, `~/.windsurf/`, and other user-level folders. Every CLI command accepts `--global`.
 - **Extensible** — community packs (`agentsmesh install ...`), remote `extends`, runtime plugins (`agentsmesh plugin add`), schema-validated config files, and a typed programmatic API for scripts, IDE extensions, and CI.
@@ -240,7 +240,7 @@ The reason `AGENTS.md` alone is not enough: most AI coding assistants expose con
 - **Claude Code** has `CLAUDE.md`, `.claude/agents/`, `.claude/skills/`, `.claude/commands/`, `.claude/settings.json`, hooks, and permissions.
 - **GitHub Copilot** has `.github/copilot-instructions.md`, `.github/instructions/*.instructions.md`, agents, prompts, and (partial) hooks.
 - **Gemini CLI** has `GEMINI.md`, `.gemini/settings.json` (MCP + hooks), `.gemini/commands/*.toml`, and agents.
-- **Codex CLI** has `AGENTS.md` plus `.codex/config.toml`, `.codex/agents/*.toml`, and `.codex/rules/`.
+- **Codex CLI** has `AGENTS.md` plus `.codex/config.toml`, `.codex/agents/*.toml`, `.codex/hooks.json`, and `.codex/rules/`.
 - **Windsurf**, **Continue**, **Cline**, **Kiro**, **Junie**, **Roo Code**, **Antigravity**, **Amp**, **Zed**, **Warp** each have their own native rules, workflows, MCP servers, skills, and ignore files.
 
 AgentsMesh canonicalizes all of these — rules, commands, agents, skills, MCP servers, hooks, ignore patterns, permissions — so you don't pick one tool's surface as the lowest common denominator. When a tool has no native slot for a feature, AgentsMesh embeds it with round-trip metadata instead of dropping it.
@@ -445,6 +445,7 @@ Every config file ships with a generated JSON Schema, so VS Code, JetBrains, and
 | `AGENTSMESH_CACHE` | `~/.agentsmesh/cache` | Override the remote-extends / tarball cache directory (the gitignored `.agentsmeshcache` in the project is a symlink to it). Must be an absolute path. |
 | `AGENTSMESH_MAX_TARBALL_MB` | `500` | Maximum GitHub tarball size in MiB the install command will accept. Allowed range: `1`–`4096`. Increase this when installing from large monorepos. |
 | `AGENTSMESH_STRICT_PLUGINS` | `0` | When set to `1`, a failed plugin descriptor import fails the build instead of warning-and-skip. Useful in CI where a missing plugin target is a regression. |
+| `AGENTSMESH_ALLOW_INSECURE_GIT` | `0` | When set to `1`, enables insecure `git+http://` transports in `extends` and `install`. Disabled by default because `http` strips transport security (a MITM can swap cloned bytes before the SHA is pinned). The transport allowlist (`https`/`ssh` only, plus opt-ins) is enforced before any `git ls-remote`/clone. |
 | `AGENTSMESH_ALLOW_LOCAL_GIT` | `0` | When set to `1`, enables `git+file://` sources in `extends` and `install`. Disabled by default because on shared hosts a world-writable repo could be planted by another user and combined with elevated-artifact emission for local privilege escalation. |
 
 ---
@@ -516,13 +517,13 @@ Every public symbol resolves to a real `.d.ts` under strict TypeScript. Full ref
 |---|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|
 | Rules | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native |
 | Additional Rules | Embedded | — | Embedded | Native | Native | Native | Native | Native | Native | Native | Embedded | Embedded | Embedded | Embedded | Embedded | Embedded | Embedded | Native | Native | Native | Native | Embedded | Native | Embedded | Native | Embedded | Native | Embedded | Native | Embedded |
-| Commands | — | — | — | Partial (workflows) | Native | Native | Native (workflows) | Embedded | Embedded | Native | — | Native | — | — | Native | — | — | Native | Native | — | Native | — | Native | — | Native | — | — | — | Native (workflows) | — |
-| Agents | — | — | — | — | — | Native | Embedded | Native | — | Native | — | Native | — | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Partial | — | — | — | Embedded | — |
-| Skills | Native | — | Native | Native | Native | Native | Native | Native | Embedded | Native | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | — |
-| MCP Servers | — | Native | Native | — | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Native | Native | Native | Native | Partial | Native |
-| Hooks | — | — | — | — | Native | Native | Native | — | — | Partial | Native | Native | — | — | Partial | — | — | — | — | Native | — | — | — | — | — | — | — | — | Native | — |
+| Commands | — | — | Native | Partial (workflows) | Native | Native | Native (workflows) | Embedded | Native | Native | — | Native | — | — | Native | — | — | Native | Native | Embedded | Native | — | Native | — | Native | — | Native | — | Native (workflows) | — |
+| Agents | — | Native | — | — | Native | Native | Native | Native | — | Native | — | Native | — | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Partial | — | — | — | Embedded | — |
+| Skills | Native | — | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native |
+| MCP Servers | — | Native | Native | — | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Native | Native | Native | Native | Partial | Native |
+| Hooks | — | — | Native | Native | Native | Native | Native | Partial | — | Partial | Native | Native | Native | Native | Partial | — | — | — | — | Native | — | — | Native | — | — | — | — | — | Native | — |
 | Ignore | Native | — | — | — | Native | Native | Native | — | — | — | Native | Native | — | — | Native (settings-embedded) | Native | — | Native | Native | Native | — | — | Native | — | Native | — | Native | — | Native | — |
-| Permissions | — | — | — | — | — | Native | — | — | — | — | Partial | Partial | — | — | Partial | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |
+| Permissions | — | — | Native | Partial | — | Native | — | — | — | — | Partial | Partial | — | — | Partial | — | — | — | Native | — | Native | — | Native | — | Partial | — | — | Partial | — | — |
 <!-- /agentsmesh:support-matrix:project -->
 
 ### Global scope (`agentsmesh generate --global`)
@@ -532,13 +533,13 @@ Every public symbol resolves to a real `.d.ts` under strict TypeScript. Full ref
 |---|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|:-----------:|
 | Rules | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | — | Native | — |
 | Additional Rules | Embedded | — | Embedded | Embedded | Native | Native | Native | Embedded | Native | Native | Embedded | Embedded | Embedded | Embedded | Embedded | Embedded | — | Embedded | Native | Native | Native | Embedded | Embedded | — | Native | Embedded | Native | — | Partial | — |
-| Commands | — | — | — | Partial (workflows) | Native | Native | Native (workflows) | Embedded | Native | Native | — | Native | — | — | Native | — | — | Native | Native | — | Native | — | Native | — | Native | — | — | — | Native (workflows) | — |
-| Agents | — | — | — | — | — | Native | Embedded | Native | — | Native | — | Native | — | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Partial | — | — | — | Embedded | — |
+| Commands | — | — | Native | Partial (workflows) | Native | Native | Native (workflows) | Embedded | Native | Native | — | Native | — | — | Native | — | — | Native | Native | Embedded | Native | — | Native | — | Native | — | Native | — | Native (workflows) | — |
+| Agents | — | Native | — | — | Native | Native | Native | Native | — | Native | — | Native | — | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Partial | — | — | — | Embedded | — |
 | Skills | Native | — | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | — |
-| MCP Servers | — | Native | Native | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | — | — | Native | Native | Native | Native | — | Native | — | Native | Native | Native | — | Partial | Native |
-| Hooks | — | — | — | — | — | Native | Native | — | — | — | Native | Native | — | — | Partial | — | — | — | — | — | — | — | — | — | — | — | — | — | Native | — |
+| MCP Servers | — | Native | Native | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | Native | Native | — | Native | Native | Native | Native | — | Native | — | Native | Native | Native | — | Native | Native |
+| Hooks | — | — | Native | Native | — | Native | Native | Partial | — | — | Native | Native | Native | Native | Partial | — | — | — | — | — | — | — | Native | — | — | Native | — | — | Native | — |
 | Ignore | Native | — | — | — | — | Native | Native | — | — | — | — | Native | — | — | — | Native | — | — | Native | Native | — | — | — | — | Native | — | — | — | Native | — |
-| Permissions | — | — | — | — | — | Native | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — |
+| Permissions | — | — | Native | Partial | — | Native | — | — | — | — | — | — | — | — | — | — | — | Native | Native | — | Native | — | Native | — | Partial | Native | — | Partial | — | — |
 <!-- /agentsmesh:support-matrix:global -->
 
 See the [full feature matrix docs](https://samplexbro.github.io/agentsmesh/reference/supported-tools/) for native vs. embedded support details and per-tool global paths.