agentsmesh 0.24.0 → 0.25.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { stringify, parse, parseDocument, YAMLSeq, YAMLMap } from 'yaml';
 import { join, resolve, relative, sep, dirname, basename, win32, posix, extname } from 'path';
-import { mkdir, access, readdir, rm, readFile, realpath, stat, writeFile, lstat, unlink, rename, chmod, mkdtemp, cp } from 'fs/promises';
+import { mkdir, access, readdir, rm, readFile, writeFile, stat, lstat, unlink, rename, chmod, realpath, mkdtemp, cp } from 'fs/promises';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, constants, rmSync, renameSync, readdirSync, realpathSync, statSync } from 'fs';
 import { parse as parse$1 } from 'smol-toml';
@@ -1381,7 +1381,7 @@ async function importEmbeddedSkills(projectRoot, skillsDir, fromTool, results, n
       toPath: `${AB_SKILLS}/${entry.name}/SKILL.md`,
       feature: "skills"
     });
-    const sourceFiles = await readDirRecursive(sourceSkillDir);
+    const sourceFiles = await readDirRecursiveNoSymlinks(sourceSkillDir);
     for (const sourcePath of sourceFiles) {
       if (sourcePath === sourceSkillFile) continue;
       const relativePath = relative(sourceSkillDir, sourcePath).replace(/\\/g, "/");
@@ -2329,7 +2329,7 @@ function matchesExtension(path, extensions) {
   return extensions.some((extension) => path.endsWith(extension));
 }
 async function importFileDirectory(opts) {
-  const files = await readDirRecursive(opts.srcDir);
+  const files = await readDirRecursiveNoSymlinks(opts.srcDir);
   const matchedFiles = files.filter((path) => matchesExtension(path, opts.extensions));
   const results = [];
   for (const srcPath of matchedFiles) {
@@ -6748,7 +6748,7 @@ var init_settings_helpers2 = __esm({
 async function importClaudeSkills(projectRoot, results, normalize) {
   const skillsBaseDir = join(projectRoot, CLAUDE_SKILLS_DIR);
   const destBase = join(projectRoot, CLAUDE_CANONICAL_SKILLS_DIR);
-  const allFiles = await readDirRecursive(skillsBaseDir);
+  const allFiles = await readDirRecursiveNoSymlinks(skillsBaseDir);
   const skillMdFiles = allFiles.filter((f) => f.endsWith("SKILL.md"));
   for (const skillMdPath of skillMdFiles) {
     const skillDir = dirname(skillMdPath);
@@ -6767,7 +6767,7 @@ async function importClaudeSkills(projectRoot, results, normalize) {
 `);
       continue;
     }
-    const skillFiles = await readDirRecursive(skillDir);
+    const skillFiles = await readDirRecursiveNoSymlinks(skillDir);
     for (const filePath of skillFiles) {
       const fileContent = await readFileSafe(filePath);
       if (fileContent === null) continue;
@@ -7392,7 +7392,7 @@ async function importClineRules(projectRoot, results, normalize) {
         feature: "rules"
       });
     } else {
-      const ruleFiles = await readDirRecursive(clineRulesPath);
+      const ruleFiles = await readDirRecursiveNoSymlinks(clineRulesPath);
       const mdFiles = ruleFiles.filter((f) => f.endsWith(".md") && !f.includes("/workflows/")).sort();
       const first = mdFiles[0];
       if (first) {
@@ -7456,27 +7456,40 @@ var init_importer_rules = __esm({
     init_constants8();
   }
 });
+function toStringRecord2(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+  return Object.fromEntries(
+    Object.entries(raw).filter((entry) => typeof entry[1] === "string")
+  );
+}
 function mapClineServerToCanonical(raw) {
   if (!raw || typeof raw !== "object") return null;
   const obj = raw;
-  const command = typeof obj.command === "string" ? obj.command : "";
-  if (!command) return null;
-  const type = typeof obj.type === "string" ? obj.type : typeof obj.transportType === "string" ? obj.transportType : "stdio";
-  const args = Array.isArray(obj.args) ? obj.args.filter((x) => typeof x === "string") : [];
-  const envRaw = obj.env;
-  const env = envRaw !== null && typeof envRaw === "object" && !Array.isArray(envRaw) ? Object.fromEntries(
-    Object.entries(envRaw).filter(
-      (entry) => typeof entry[1] === "string"
-    )
-  ) : {};
+  const transport = typeof obj.type === "string" ? obj.type : void 0;
+  const transportType = typeof obj.transportType === "string" ? obj.transportType : void 0;
+  const env = toStringRecord2(obj.env);
   const description = typeof obj.description === "string" ? obj.description : void 0;
-  return {
-    ...description !== void 0 && { description },
-    type,
-    command,
-    args,
-    env
-  };
+  const command = typeof obj.command === "string" ? obj.command : "";
+  if (command) {
+    const args = Array.isArray(obj.args) ? obj.args.filter((x) => typeof x === "string") : [];
+    return {
+      ...description !== void 0 && { description },
+      type: transport ?? transportType ?? "stdio",
+      command,
+      args,
+      env
+    };
+  }
+  if (typeof obj.url === "string") {
+    return {
+      ...description !== void 0 && { description },
+      type: transport ?? transportType ?? "http",
+      url: obj.url,
+      headers: toStringRecord2(obj.headers),
+      env
+    };
+  }
+  return null;
 }
 async function importClineMcp(projectRoot, results) {
   const candidatePaths = [CLINE_MCP_SETTINGS, CLINE_MCP_SETTINGS_LEGACY].map(
@@ -7550,7 +7563,7 @@ var init_reserved = __esm({
   }
 });
 async function readNativeSkill(skillDir) {
-  const allFiles = await readDirRecursive(skillDir).catch(() => []);
+  const allFiles = await readDirRecursiveNoSymlinks(skillDir).catch(() => []);
   const entries = [];
   for (const absPath of allFiles) {
     const relPath = relative(skillDir, absPath).replace(/\\/g, "/");
@@ -7616,7 +7629,7 @@ async function importFlatSkill(skillName, srcPath, content, options) {
 async function findDirectorySkills(skillsDir) {
   const skills = /* @__PURE__ */ new Map();
   try {
-    const allFiles = await readDirRecursive(skillsDir);
+    const allFiles = await readDirRecursiveNoSymlinks(skillsDir);
     const skillMdFiles = allFiles.filter((f) => basename(f) === "SKILL.md");
     for (const skillMdPath of skillMdFiles) {
       const skillDir = dirname(skillMdPath);
@@ -7747,7 +7760,7 @@ function extractMeta(content, key) {
   return match?.[1]?.trim() ?? null;
 }
 async function loadHooksFromDir(dir, hooks) {
-  const files = await readDirRecursive(dir).catch(() => []);
+  const files = await readDirRecursiveNoSymlinks(dir).catch(() => []);
   const shFiles = files.filter((f) => basename(f).endsWith(".sh") && dirname(f) === dir);
   for (const srcPath of shFiles) {
     const content = await readFileSafe(srcPath);
@@ -8482,7 +8495,7 @@ async function importCodexAgentsFromToml(projectRoot, results, normalize) {
   const agentsPath = join(projectRoot, CODEX_AGENTS_DIR);
   const agentsDestDir = join(projectRoot, CODEX_CANONICAL_AGENTS_DIR);
   try {
-    const agentFiles = await readDirRecursive(agentsPath);
+    const agentFiles = await readDirRecursiveNoSymlinks(agentsPath);
     const tomlFiles = agentFiles.filter((f) => f.endsWith(".toml"));
     for (const srcPath of tomlFiles) {
       const content = await readFileSafe(srcPath);
@@ -8578,7 +8591,7 @@ async function importCodexNonRootRuleFiles(projectRoot, destDir, normalize) {
   const results = [];
   const codexRulesPath = join(projectRoot, CODEX_RULES_DIR);
   try {
-    const ruleFiles = await readDirRecursive(codexRulesPath);
+    const ruleFiles = await readDirRecursiveNoSymlinks(codexRulesPath);
     const mdFiles = ruleFiles.filter((f) => f.endsWith(".md"));
     for (const srcPath of mdFiles) {
       const content = await readFileSafe(srcPath);
@@ -8735,7 +8748,7 @@ async function importCodexRules(projectRoot, results, normalize, normalizeWindsu
 }
 async function importInstructionMirrors(projectRoot, destDir, results, normalize) {
   try {
-    const files = await readDirRecursive(join(projectRoot, CODEX_INSTRUCTIONS_DIR));
+    const files = await readDirRecursiveNoSymlinks(join(projectRoot, CODEX_INSTRUCTIONS_DIR));
     const instructionFiles = files.filter((file) => file.endsWith(".md"));
     const instructionsRoot = join(projectRoot, CODEX_INSTRUCTIONS_DIR);
     for (const srcPath of instructionFiles) {
@@ -9181,19 +9194,31 @@ function readMcpServers(content, extension) {
   for (const [name, value] of Object.entries(rawServers)) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
     const server = value;
-    if (typeof server.command !== "string") continue;
-    servers[name] = {
-      type: typeof server.type === "string" ? server.type : "stdio",
-      command: server.command,
-      args: toStringArray5(server.args),
-      env: toStringRecord(server.env),
-      description: typeof server.description === "string" ? server.description : void 0
-    };
+    const description = typeof server.description === "string" ? server.description : void 0;
+    if (typeof server.command === "string") {
+      servers[name] = {
+        type: typeof server.type === "string" ? server.type : "stdio",
+        command: server.command,
+        args: toStringArray5(server.args),
+        env: toStringRecord(server.env),
+        description
+      };
+      continue;
+    }
+    if (typeof server.url === "string") {
+      servers[name] = {
+        type: typeof server.type === "string" ? server.type : "http",
+        url: server.url,
+        headers: toStringRecord(server.headers),
+        env: toStringRecord(server.env),
+        description
+      };
+    }
   }
   return servers;
 }
 async function importMcp2(projectRoot, results) {
-  const files = (await readDirRecursive(join(projectRoot, CONTINUE_MCP_DIR))).filter(
+  const files = (await readDirRecursiveNoSymlinks(join(projectRoot, CONTINUE_MCP_DIR))).filter(
     (file) => [".json", ".yaml", ".yml"].includes(extname(file))
   );
   const merged = {};
@@ -9853,7 +9878,7 @@ function extractWrapperCommand(content) {
 }
 async function importHooks(projectRoot, results) {
   const hooksDir = join(projectRoot, COPILOT_HOOKS_DIR);
-  const allFiles = await readDirRecursive(hooksDir).catch(() => []);
+  const allFiles = await readDirRecursiveNoSymlinks(hooksDir).catch(() => []);
   const jsonFiles = allFiles.filter((file) => file.endsWith(".json"));
   const hooks = {};
   for (const srcPath of jsonFiles) {
@@ -9889,7 +9914,7 @@ async function importHooks(projectRoot, results) {
     }
   }
   const legacyDir = join(projectRoot, COPILOT_LEGACY_HOOKS_DIR);
-  const legacyFiles = await readDirRecursive(legacyDir).catch(() => []);
+  const legacyFiles = await readDirRecursiveNoSymlinks(legacyDir).catch(() => []);
   const shFiles = legacyFiles.filter(
     (file) => dirname(file) === legacyDir && /^[^-]+-\d+\.sh$/i.test(basename(file))
   );
@@ -9966,7 +9991,7 @@ var init_importer10 = __esm({
   }
 });
 async function skillNamesFromNativeSkillDir(scanRoot) {
-  const files = await readDirRecursive(scanRoot);
+  const files = await readDirRecursiveNoSymlinks(scanRoot);
   const names = /* @__PURE__ */ new Set();
   for (const f of files) {
     if (basename(f) === "SKILL.md") {
@@ -9988,7 +10013,7 @@ var init_native_skill_scan = __esm({
 async function inferCopilotPickFromPath(repoRoot, posixPath) {
   const scan = join(repoRoot, ...posixPath.split("/"));
   if (posixPath.startsWith(COPILOT_PROMPTS_DIR)) {
-    const files = await readDirRecursive(scan);
+    const files = await readDirRecursiveNoSymlinks(scan);
     const commands = [
       ...new Set(
         files.filter((f) => f.toLowerCase().endsWith(".prompt.md")).map((f) => basename(f, ".prompt.md"))
@@ -9997,7 +10022,7 @@ async function inferCopilotPickFromPath(repoRoot, posixPath) {
     return commands.length ? { commands } : {};
   }
   if (posixPath.startsWith(".github/copilot") && !posixPath.includes("copilot-instructions.md")) {
-    const files = await readDirRecursive(scan);
+    const files = await readDirRecursiveNoSymlinks(scan);
     const rules = [
       ...new Set(
         files.filter((f) => f.includes(".instructions.md")).map((f) => basename(f).replace(/\.instructions\.md$/i, ""))
@@ -10006,7 +10031,7 @@ async function inferCopilotPickFromPath(repoRoot, posixPath) {
     return rules.length ? { rules } : {};
   }
   if (posixPath.startsWith(".github/instructions")) {
-    const files = await readDirRecursive(scan);
+    const files = await readDirRecursiveNoSymlinks(scan);
     const names = /* @__PURE__ */ new Set();
     for (const f of files) {
       const b = basename(f);
@@ -10022,7 +10047,7 @@ async function inferCopilotPickFromPath(repoRoot, posixPath) {
     return skills.length ? { skills } : {};
   }
   if (posixPath.startsWith(".github/agents")) {
-    const files = await readDirRecursive(scan);
+    const files = await readDirRecursiveNoSymlinks(scan);
     const agents = [
       ...new Set(
         files.filter((f) => f.toLowerCase().endsWith(".agent.md")).map((f) => basename(f, ".agent.md"))
@@ -11571,7 +11596,7 @@ async function importSkills3(projectRoot, results, normalize, skillsRelDir = CUR
   for (const [skillName, skillDir] of directorySkills) {
     await importDirectorySkill(skillName, skillDir, options);
   }
-  const allFiles = await readDirRecursive(skillsDir).catch(() => []);
+  const allFiles = await readDirRecursiveNoSymlinks(skillsDir).catch(() => []);
   const mdFiles = allFiles.filter((f) => f.endsWith(".md"));
   const handledPaths = new Set(
     Array.from(directorySkills.values()).flatMap(
@@ -11609,11 +11634,11 @@ async function hasGlobalCursorArtifacts(projectRoot) {
     const stat9 = await readFileSafe(p);
     if (stat9 !== null && stat9.trim() !== "") return true;
   }
-  const skillFiles = await readDirRecursive(join(projectRoot, CURSOR_SKILLS_DIR));
+  const skillFiles = await readDirRecursiveNoSymlinks(join(projectRoot, CURSOR_SKILLS_DIR));
   if (skillFiles.some((f) => f.endsWith(".md"))) return true;
-  const agentFiles = await readDirRecursive(join(projectRoot, CURSOR_AGENTS_DIR));
+  const agentFiles = await readDirRecursiveNoSymlinks(join(projectRoot, CURSOR_AGENTS_DIR));
   if (agentFiles.some((f) => f.endsWith(".md"))) return true;
-  const commandFiles = await readDirRecursive(join(projectRoot, CURSOR_COMMANDS_DIR));
+  const commandFiles = await readDirRecursiveNoSymlinks(join(projectRoot, CURSOR_COMMANDS_DIR));
   if (commandFiles.some((f) => f.endsWith(".md"))) return true;
   return false;
 }
@@ -13201,7 +13226,7 @@ async function importGeminiPolicies(projectRoot) {
   const policiesDir = join(projectRoot, GEMINI_POLICIES_DIR);
   let policyFiles;
   try {
-    policyFiles = await readDirRecursive(policiesDir);
+    policyFiles = await readDirRecursiveNoSymlinks(policiesDir);
   } catch {
     return results;
   }
@@ -13300,7 +13325,7 @@ var init_importer_strip = __esm({
 });
 async function importGeminiSkillsAndAgents(projectRoot, results, normalize) {
   const geminiSkillsPath = join(projectRoot, GEMINI_SKILLS_DIR);
-  const skillDirs = await readDirRecursive(geminiSkillsPath);
+  const skillDirs = await readDirRecursiveNoSymlinks(geminiSkillsPath);
   const skillMdFiles = skillDirs.filter((f) => basename(f) === "SKILL.md");
   for (const srcPath of skillMdFiles) {
     const content = await readFileSafe(srcPath);
@@ -13339,7 +13364,7 @@ async function importGeminiSkillsAndAgents(projectRoot, results, normalize) {
       toPath: `${GEMINI_CANONICAL_SKILLS_DIR}/${skillName}/SKILL.md`,
       feature: "skills"
     });
-    const allSkillFiles = await readDirRecursive(dirname(srcPath));
+    const allSkillFiles = await readDirRecursiveNoSymlinks(dirname(srcPath));
     for (const absPath of allSkillFiles) {
       if (absPath === srcPath) continue;
       const supportContent = await readFileSafe(absPath);
@@ -13358,7 +13383,7 @@ async function importGeminiSkillsAndAgents(projectRoot, results, normalize) {
   }
   const geminiAgentsPath = join(projectRoot, GEMINI_AGENTS_DIR);
   try {
-    const agentFiles = await readDirRecursive(geminiAgentsPath);
+    const agentFiles = await readDirRecursiveNoSymlinks(geminiAgentsPath);
     const agentMdFiles = agentFiles.filter((f) => f.endsWith(".md"));
     for (const srcPath of agentMdFiles) {
       const content = await readFileSafe(srcPath);
@@ -13491,7 +13516,7 @@ function isUnderGeminiCommands(pathInRepoPosix) {
 async function inferGeminiCommandNamesFromFiles(repoRoot, pathInRepoPosix) {
   const commandsRoot = join(repoRoot, ...GEMINI_COMMANDS_DIR.split("/"));
   const scanDir = join(repoRoot, ...pathInRepoPosix.split("/"));
-  const files = await readDirRecursive(scanDir);
+  const files = await readDirRecursiveNoSymlinks(scanDir);
   const names = [];
   for (const f of files) {
     if (!/\.(toml|md)$/i.test(f)) continue;
@@ -15703,7 +15728,7 @@ async function importNonRootRules(projectRoot, results, normalize) {
 }
 async function importHooks2(projectRoot, results) {
   const hooks = {};
-  for (const absPath of await readDirRecursive(join(projectRoot, KIRO_HOOKS_DIR))) {
+  for (const absPath of await readDirRecursiveNoSymlinks(join(projectRoot, KIRO_HOOKS_DIR))) {
     if (!absPath.endsWith(".kiro.hook")) continue;
     const parsed = parseKiroHookFile(await readFileSafe(absPath) ?? "");
     if (!parsed) continue;
@@ -16055,7 +16080,7 @@ var init_generator24 = __esm({
     init_constants19();
   }
 });
-function toStringRecord2(value) {
+function toStringRecord3(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
   const out2 = {};
   for (const [k, v] of Object.entries(value)) {
@@ -16081,8 +16106,8 @@ function parseOpenCodeMcp(content) {
       out2[name] = {
         type: "url",
         url: entry.url,
-        headers: toStringRecord2(entry.headers),
-        env: toStringRecord2(entry.environment),
+        headers: toStringRecord3(entry.headers),
+        env: toStringRecord3(entry.environment),
         ...typeof entry.description === "string" ? { description: entry.description } : {}
       };
       continue;
@@ -16096,7 +16121,7 @@ function parseOpenCodeMcp(content) {
         type: "stdio",
         command,
         args,
-        env: toStringRecord2(entry.environment),
+        env: toStringRecord3(entry.environment),
         ...typeof entry.description === "string" ? { description: entry.description } : {}
       };
     }
@@ -18918,7 +18943,7 @@ function toStringArray8(value) {
 }
 async function importWorkflows(projectRoot, results, normalize) {
   const workflowsDir = join(projectRoot, WINDSURF_WORKFLOWS_DIR);
-  const workflowFiles = await readDirRecursive(workflowsDir);
+  const workflowFiles = await readDirRecursiveNoSymlinks(workflowsDir);
   const workflowMdFiles = workflowFiles.filter((f) => f.endsWith(".md"));
   const destCommandsDir = join(projectRoot, WINDSURF_CANONICAL_COMMANDS_DIR);
   for (const srcPath of workflowMdFiles) {
@@ -20760,8 +20785,22 @@ function resolveOutputCollisions(results) {
     }
     deduped[existingIdx] = mergeDuplicateMetadata(existing, result);
   }
+  assertNoCaseOnlyPathCollisions(deduped);
   return deduped;
 }
+function assertNoCaseOnlyPathCollisions(results) {
+  const byLower = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    const key = result.path.toLowerCase();
+    const prior = byLower.get(key);
+    if (prior !== void 0 && prior.path !== result.path) {
+      throw new Error(
+        `Case-only path collision: "${prior.path}" (${prior.target}) and "${result.path}" (${result.target}) resolve to the same file on case-insensitive filesystems (Windows/macOS). Rename one canonical source.`
+      );
+    }
+    byLower.set(key, result);
+  }
+}
 function refreshResultStatus(result) {
   const status = result.currentContent === void 0 ? "created" : result.currentContent !== result.content ? "updated" : "unchanged";
   return result.status === status ? result : { ...result, status };
@@ -21316,6 +21355,100 @@ function redactUrlSecrets(message) {
     }
   );
 }
+function gitProtocolOptIns() {
+  const on = (v) => v === "1" || v === "true";
+  return {
+    http: on(process.env.AGENTSMESH_ALLOW_INSECURE_GIT),
+    file: on(process.env.AGENTSMESH_ALLOW_LOCAL_GIT)
+  };
+}
+function isAllowedGitProtocol(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  const { http, file } = gitProtocolOptIns();
+  const allowed = ["https:", "ssh:"];
+  if (http) allowed.push("http:");
+  if (file) allowed.push("file:");
+  return allowed.includes(parsed.protocol);
+}
+function gitAllowProtocolEnv() {
+  const { http, file } = gitProtocolOptIns();
+  const protos = ["https", "ssh"];
+  if (http) protos.push("http");
+  if (file) protos.push("file");
+  return protos.join(":");
+}
+function assertAllowedGitUrl(url) {
+  if (isAllowedGitProtocol(url)) return;
+  throw new Error(
+    `agentsmesh refuses a git remote with a disallowed transport: "${redactUrlSecrets(url)}". Allowed: https, ssh. Set AGENTSMESH_ALLOW_INSECURE_GIT=1 to permit http, AGENTSMESH_ALLOW_LOCAL_GIT=1 to permit file.`
+  );
+}
+function splitSourceRef(source, prefix, defaultRef) {
+  if (!source.startsWith(prefix)) return null;
+  const rest = source.slice(prefix.length).trim();
+  if (!rest) return null;
+  const refIdx = rest.lastIndexOf("@");
+  if (refIdx < 0) return [rest, defaultRef];
+  const slug = rest.slice(0, refIdx).trim();
+  const ref = rest.slice(refIdx + 1).trim();
+  if (!slug || !ref) return null;
+  return [slug, ref];
+}
+function parseGithubSource(source) {
+  const parts = splitSourceRef(source, "github:", "latest");
+  if (!parts) return null;
+  const [slug, tag] = parts;
+  const slash = slug.indexOf("/");
+  if (slash < 0) return null;
+  const org = slug.slice(0, slash).trim();
+  const repo = slug.slice(slash + 1).trim();
+  if (!org || !repo || !tag) return null;
+  return { org, repo, tag };
+}
+function parseGitlabSource(source) {
+  const parts = splitSourceRef(source, "gitlab:");
+  if (!parts) return null;
+  const [slug, ref] = parts;
+  const slash = slug.lastIndexOf("/");
+  if (slash < 0) return null;
+  const namespace = slug.slice(0, slash).trim();
+  const project31 = slug.slice(slash + 1).trim();
+  if (!namespace || !project31) return null;
+  return {
+    namespace,
+    project: project31,
+    ref,
+    cloneUrl: `https://gitlab.com/${namespace}/${project31}.git`
+  };
+}
+function parseGitSource(source) {
+  if (!source.startsWith("git+")) return null;
+  const rest = source.slice(4).trim();
+  if (!rest) return null;
+  const hashIdx = rest.lastIndexOf("#");
+  const url = (hashIdx < 0 ? rest : rest.slice(0, hashIdx)).trim();
+  const ref = hashIdx < 0 ? void 0 : rest.slice(hashIdx + 1).trim();
+  if (!url || hashIdx >= 0 && !ref) return null;
+  if (!isAllowedGitProtocol(url)) return null;
+  return { url, ref };
+}
+function parseRemoteSource(source) {
+  const github = parseGithubSource(source);
+  if (github) return { kind: "github", ...github };
+  const gitlab = parseGitlabSource(source);
+  if (gitlab) return { kind: "gitlab", ...gitlab };
+  const git = parseGitSource(source);
+  if (git) return { kind: "git", ...git };
+  return null;
+}
+function isSupportedRemoteSource(source) {
+  return parseRemoteSource(source) !== null;
+}
 
 // src/config/remote/git-remote.ts
 var execFileAsync = promisify(execFile);
@@ -21386,7 +21519,8 @@ function resolveCloneUrl(parsed) {
 }
 async function cloneRepo(cloneUrl, repoDir) {
   ensureNotFlag(cloneUrl, "clone-url");
-  await runGit(["clone", cloneUrl, repoDir]);
+  assertAllowedGitUrl(cloneUrl);
+  await runGit(["clone", "-c", "core.symlinks=false", cloneUrl, repoDir]);
 }
 async function checkoutRef(repoDir, ref) {
   ensureNotFlag(ref, "ref");
@@ -21400,7 +21534,10 @@ async function runGit(args, cwd) {
     cwd,
     env: {
       ...process.env,
-      GIT_TERMINAL_PROMPT: "0"
+      GIT_TERMINAL_PROMPT: "0",
+      // Constrain transports git may use (incl. mid-clone redirects/insteadOf)
+      // to the same allowlist the clone URL itself passed.
+      GIT_ALLOW_PROTOCOL: gitAllowProtocolEnv()
     }
   });
   return stdout.trim();
@@ -21588,80 +21725,6 @@ async function fetchGithubDefaultBranch(parsed, extendName, options, cacheDir, b
   }
   throw lastError instanceof Error ? lastError : new Error("Failed to clone GitHub default branch");
 }
-function splitSourceRef(source, prefix, defaultRef) {
-  if (!source.startsWith(prefix)) return null;
-  const rest = source.slice(prefix.length).trim();
-  if (!rest) return null;
-  const refIdx = rest.lastIndexOf("@");
-  if (refIdx < 0) return [rest, defaultRef];
-  const slug = rest.slice(0, refIdx).trim();
-  const ref = rest.slice(refIdx + 1).trim();
-  if (!slug || !ref) return null;
-  return [slug, ref];
-}
-function parseGithubSource(source) {
-  const parts = splitSourceRef(source, "github:", "latest");
-  if (!parts) return null;
-  const [slug, tag] = parts;
-  const slash = slug.indexOf("/");
-  if (slash < 0) return null;
-  const org = slug.slice(0, slash).trim();
-  const repo = slug.slice(slash + 1).trim();
-  if (!org || !repo || !tag) return null;
-  return { org, repo, tag };
-}
-function parseGitlabSource(source) {
-  const parts = splitSourceRef(source, "gitlab:");
-  if (!parts) return null;
-  const [slug, ref] = parts;
-  const slash = slug.lastIndexOf("/");
-  if (slash < 0) return null;
-  const namespace = slug.slice(0, slash).trim();
-  const project31 = slug.slice(slash + 1).trim();
-  if (!namespace || !project31) return null;
-  return {
-    namespace,
-    project: project31,
-    ref,
-    cloneUrl: `https://gitlab.com/${namespace}/${project31}.git`
-  };
-}
-function parseGitSource(source) {
-  if (!source.startsWith("git+")) return null;
-  const rest = source.slice(4).trim();
-  if (!rest) return null;
-  const hashIdx = rest.lastIndexOf("#");
-  const url = (hashIdx < 0 ? rest : rest.slice(0, hashIdx)).trim();
-  const ref = hashIdx < 0 ? void 0 : rest.slice(hashIdx + 1).trim();
-  if (!url || hashIdx >= 0 && !ref) return null;
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(url);
-  } catch {
-    return null;
-  }
-  const allowInsecure = process.env.AGENTSMESH_ALLOW_INSECURE_GIT === "1" || process.env.AGENTSMESH_ALLOW_INSECURE_GIT === "true";
-  const allowLocalGit = process.env.AGENTSMESH_ALLOW_LOCAL_GIT === "1" || process.env.AGENTSMESH_ALLOW_LOCAL_GIT === "true";
-  const allowed = ["https:", "ssh:"];
-  if (allowInsecure) allowed.push("http:");
-  if (allowLocalGit) allowed.push("file:");
-  if (!allowed.includes(parsedUrl.protocol)) {
-    return null;
-  }
-  return { url, ref };
-}
-function parseRemoteSource(source) {
-  const github = parseGithubSource(source);
-  if (github) return { kind: "github", ...github };
-  const gitlab = parseGitlabSource(source);
-  if (gitlab) return { kind: "gitlab", ...gitlab };
-  const git = parseGitSource(source);
-  if (git) return { kind: "git", ...git };
-  return null;
-}
-function isSupportedRemoteSource(source) {
-  return parseRemoteSource(source) !== null;
-}
 async function sweepStaleCache(cacheDir, maxAgeMs) {
   const dir = cacheDir ?? getCacheDir();
   const threshold = Number(process.env.AGENTSMESH_CACHE_MAX_AGE_DAYS ?? 30) * 864e5;
@@ -21895,15 +21958,17 @@ function assertNoBasenameCollisions(feature, paths, stripExt) {
     const idx = Math.max(fwdIdx, bckIdx);
     const base = idx === -1 ? p : p.slice(idx + 1);
     const slug = base.endsWith(stripExt) ? base.slice(0, -stripExt.length) : base;
-    const prior = seen.get(slug);
-    if (prior !== void 0 && prior !== p) {
+    const key = slug.toLowerCase();
+    const prior = seen.get(key);
+    if (prior !== void 0 && prior.path !== p) {
+      const detail = prior.slug === slug ? `"${slug}"` : `"${prior.slug}" vs "${slug}" (case-insensitive)`;
       throw new CanonicalNameError(
         feature,
         slug,
-        `canonical ${feature} files collide on slug "${slug}": ${prior} vs ${p}. Rename one.`
+        `canonical ${feature} files collide on slug ${detail}: ${prior.path} vs ${p}. Rename one.`
       );
     }
-    seen.set(slug, p);
+    seen.set(key, { path: p, slug });
   }
 }
 var ALTERNATE_RESOURCE_FORMATS = /* @__PURE__ */ new Set([".toml", ".yaml", ".yml", ".json"]);
@@ -21937,7 +22002,7 @@ function toStrArray(v) {
   return [];
 }
 async function parseRules(rulesDir, opts = {}) {
-  const files = await readDirRecursive(rulesDir);
+  const files = await readDirRecursiveNoSymlinks(rulesDir);
   const mdFiles = files.filter((f) => {
     if (!f.endsWith(".md")) return false;
     const name = basename(f, ".md");
@@ -21946,6 +22011,7 @@ async function parseRules(rulesDir, opts = {}) {
   warnIfUnrecognizedResourceFormats("rules", rulesDir, files, mdFiles, {
     handledByOtherReader: opts.handledByOtherReader
   });
+  assertNoBasenameCollisions("rule", mdFiles, ".md");
   const rules = [];
   for (const path of mdFiles) {
     const content = await readFileSafe(path);
@@ -21994,7 +22060,7 @@ function toToolsArray2(v) {
   return [];
 }
 async function parseCommands(commandsDir, opts = {}) {
-  const files = await readDirRecursive(commandsDir);
+  const files = await readDirRecursiveNoSymlinks(commandsDir);
   const mdFiles = files.filter((f) => f.endsWith(".md") && !basename(f).startsWith("_"));
   warnIfUnrecognizedResourceFormats("commands", commandsDir, files, mdFiles, {
     handledByOtherReader: opts.handledByOtherReader
@@ -22054,7 +22120,7 @@ function toHooks2(v) {
   return {};
 }
 async function parseAgents(agentsDir, opts = {}) {
-  const files = await readDirRecursive(agentsDir);
+  const files = await readDirRecursiveNoSymlinks(agentsDir);
   const mdFiles = files.filter((f) => f.endsWith(".md") && !basename(f).startsWith("_"));
   warnIfUnrecognizedResourceFormats("agents", agentsDir, files, mdFiles, {
     handledByOtherReader: opts.handledByOtherReader
@@ -22638,7 +22704,7 @@ async function importEntities(kind, dir, opts) {
 }
 async function readToolNativeEntities(srcDir, targetId, kind, parseOpts = {}) {
   const specs = directorySpecsFor(getDescriptor(targetId)?.importer, kind);
-  const allFiles = await readDirRecursive(srcDir);
+  const allFiles = await readDirRecursiveNoSymlinks(srcDir);
   const nonMdExtensions = /* @__PURE__ */ new Set();
   for (const spec of specs) {
     for (const ext of spec.extensions) {
@@ -22995,7 +23061,7 @@ async function stageSingleFile(sourcePath, destinationDir, acceptMdc) {
 async function stageMarkdownCollection(sourceRoot, destinationDir, acceptMdc) {
   const info = await stat(sourceRoot);
   if (info.isFile()) return stageSingleFile(sourceRoot, destinationDir, acceptMdc);
-  const files = (await readDirRecursive(sourceRoot)).filter(
+  const files = (await readDirRecursiveNoSymlinks(sourceRoot)).filter(
     (file) => isAcceptedFile(file, acceptMdc) && !isBoilerplate(basename(file))
   );
   if (files.length === 0) {
@@ -23042,7 +23108,7 @@ async function stagePreferredSkills(sourceRoot, destinationDir, preferredSkillNa
   }
   const wanted = new Set(preferredSkillNames);
   const matches = /* @__PURE__ */ new Map();
-  for (const file of await readDirRecursive(sourceRoot)) {
+  for (const file of await readDirRecursiveNoSymlinks(sourceRoot)) {
     if (!file.endsWith("/SKILL.md") && !file.endsWith("\\SKILL.md")) continue;
     const skillDir = dirname(file);
     const skillName = basename(skillDir);
@@ -23090,7 +23156,7 @@ async function stageSkills(sourceRoot, destinationDir, options = {}) {
       return;
     }
     await mkdirp(destinationDir);
-    const entries = await readDirRecursive(sourceRoot);
+    const entries = await readDirRecursiveNoSymlinks(sourceRoot);
     const roots = /* @__PURE__ */ new Set();
     for (const file of entries.filter(
       (entry) => entry.endsWith("/SKILL.md") || entry.endsWith("\\SKILL.md")
@@ -23784,15 +23850,15 @@ function lessonsPaths(projectRoot) {
 function toRelPath(projectRoot, absolute) {
   return relative(projectRoot, absolute).split(sep).join("/");
 }
-var LESSONS_PROCEDURAL_RULE = `## Lessons (BLOCKING REQUIREMENT \u2014 MUST run both, no exceptions; the user will check)
+var LESSONS_PROCEDURAL_RULE = `## Lessons (BLOCKING)
 
-Graph \`.agentsmesh/lessons/lessons.json\` is canonical \u2014 never hand-edit. Manual: the \`lessons\` skill.
+Graph \`.agentsmesh/lessons/lessons.json\` is canonical; never hand-edit it. Manual: \`lessons\` skill.
 
-**Recall \u2014 MUST run before every file edit and every state-changing command** (build/test/install/migrate/git-write): \`agentsmesh lessons query --file <path> --cmd <command>\`, then apply every rule. Pure-read commands (cat/ls/grep/git-log) and the recall query itself are exempt.
+**Recall:** before every file edit or state-changing command, MUST run \`agentsmesh lessons query --file <path> --cmd <command>\` and obey matches. Pure-read commands and recall itself are exempt.
 
-**Capture \u2014 MUST run immediately after any failure** (a failing test/CI/lint/typecheck, a code review, a user correction, a regression, or a wrong assumption \u2014 yours or anyone's): \`agentsmesh lessons add "<rule>" --topic <id> --trigger-file <glob> --evidence <sha|lesson-id>\`.
+**Capture:** after any failure, user correction, regression, wrong assumption, useful surprise, repeated friction, or non-obvious fix, MUST self-critique and run \`agentsmesh lessons add "<imperative rule>" --topic <id> --trigger-file <glob> --evidence <sha|lesson-id>\`.
 
-No shell? Use the \`lessons_query\` / \`lessons_add\` MCP tools. Skip either and the system does not exist.`;
+**Before final:** report \`Lesson: captured <id>\` or \`Lesson: none\`. No recall/capture gate = task incomplete. No shell: use \`lessons_query\` / \`lessons_add\`.`;
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var MAX_FILES = 2e5;
 function listProjectFiles(projectRoot) {
@@ -25741,15 +25807,27 @@ async function acquireLessonsLock(projectRoot, opts = {}) {
 function emptyGraph() {
   return { version: 1, lessons: {}, topics: {}, triggers: {} };
 }
+function findingKey(f) {
+  return `${f.code}|${f.triggerId ?? ""}|${f.lessonId ?? ""}`;
+}
+function errorSignatures(report) {
+  return new Set(report.findings.filter((f) => f.level === "error").map(findingKey));
+}
 async function mutateLessonsGraphLocked(projectRoot, mutator, options = {}) {
   const release = await acquireLessonsLock(projectRoot, { retries: options.retries });
   try {
     const graph = tryLoadLessonsGraph(projectRoot) ?? emptyGraph();
+    const baseline = errorSignatures(validateLessonsGraph(graph));
     const result = await mutator(graph);
     const report = validateLessonsGraph(graph);
-    if (!report.ok) {
-      const errors = report.findings.filter((f) => f.level === "error").map((f) => `${f.code}: ${f.message}`).join("; ");
-      throw new Error(`mutateLessonsGraph: refusing to write an invalid graph \u2014 ${errors}`);
+    const introduced = report.findings.filter(
+      (f) => f.level === "error" && !baseline.has(findingKey(f))
+    );
+    if (introduced.length > 0) {
+      const errors = introduced.map((f) => `${f.code}: ${f.message}`).join("; ");
+      throw new Error(
+        `mutateLessonsGraph: refusing to write \u2014 this change introduces ${errors}. (Pre-existing graph issues are not blocking; run \`agentsmesh lessons validate\` to review and \`lessons untrigger\`/\`prune\` to repair them.)`
+      );
     }
     saveLessonsGraph(projectRoot, graph);
     return result;
@@ -26220,6 +26298,17 @@ function isCoveredByExisting(candidate, existing) {
 
 // src/targets/projection/lessons-paragraph.ts
 init_managed_blocks();
+var LEGACY_RAW_FORMS = [
+  `## Lessons (BLOCKING REQUIREMENT \u2014 MUST run both, no exceptions; the user will check)
+
+Graph \`.agentsmesh/lessons/lessons.json\` is canonical \u2014 never hand-edit. Manual: the \`lessons\` skill.
+
+**Recall \u2014 MUST run before every file edit and every state-changing command** (build/test/install/migrate/git-write): \`agentsmesh lessons query --file <path> --cmd <command>\`, then apply every rule. Pure-read commands (cat/ls/grep/git-log) and the recall query itself are exempt.
+
+**Capture \u2014 MUST run immediately after any failure** (a failing test/CI/lint/typecheck, a code review, a user correction, a regression, or a wrong assumption \u2014 yours or anyone's): \`agentsmesh lessons add "<rule>" --topic <id> --trigger-file <glob> --evidence <sha|lesson-id>\`.
+
+No shell? Use the \`lessons_query\` / \`lessons_add\` MCP tools. Skip either and the system does not exist.`
+];
 var LESSONS_PARAGRAPH_BLOCK = `${LESSONS_CONTRACT_START}
 ${LESSONS_PROCEDURAL_RULE}
 ${LESSONS_CONTRACT_END}`;
@@ -26232,76 +26321,66 @@ function stripLessonsParagraph(content) {
   return stripRawProceduralRule(withoutBlock).trim();
 }
 function stripRawProceduralRule(content) {
-  return content.replace(`
+  return [LESSONS_PROCEDURAL_RULE, ...LEGACY_RAW_FORMS].reduce(
+    (next, rule) => next.replace(`
 
-${LESSONS_PROCEDURAL_RULE}`, "").replace(LESSONS_PROCEDURAL_RULE, "");
+${rule}`, "").replace(rule, ""),
+    content
+  );
 }
 
 // src/lessons/skill.ts
 init_markdown();
 var LESSONS_SKILL_NAME = "lessons";
-var LESSONS_SKILL_DESCRIPTION = "Full operating manual for the agentsmesh lessons system (recall + capture). Consult when running any `agentsmesh lessons` subcommand (query, add, topics, show, deprecate, merge, untrigger, strip-markers, journal, validate, stats, prune, import-md), choosing a topic or trigger flags, using the lessons MCP tools, or when unsure how to phrase or capture a lesson.";
-var LESSONS_SKILL_BODY = `# Lessons \u2014 operating manual
+var LESSONS_SKILL_DESCRIPTION = "Use when about to edit a file or run a state-changing command, or after any failure, correction, or surprising result.";
+var LESSONS_SKILL_BODY = `# Lessons \u2014 operating manual (Iron Law)
 
-Two commands: **Recall** before you act, **Capture** after any failure. The graph
-\`.agentsmesh/lessons/lessons.json\` is canonical \u2014 never hand-edit.
+## The Iron Law
 
-## Recall \u2014 before each file edit and each state-changing command
-
-\`agentsmesh lessons query --file <path> --cmd <command>\` (add \`--keyword <text>\` to
-match by task), then apply every rule returned. Scope is MUTATING actions: file edits
-and state-changing commands (build/test/install/migrate/git-write). Pure-read commands
-(cat/ls/grep/git-log; read-only) and the recall query itself are **exempt** \u2014 no
-infinite regress. A predicate-less query is rejected; **keyword-only recall is the
-anti-pattern** \u2014 most lessons are keyed to a \`file_glob\`/\`command_pattern\` and won't
-surface (the CLI warns). Excuses ("small edit", "I already know this", "later") all
-mean: query first \u2014 skipping recall on a mutating action is a process violation, and
-the user will check.
-
-## Capture \u2014 immediately after any failure
+**NO MUTATION WITHOUT RECALL. NO COMPLETION WITHOUT A CAPTURE DECISION.**
 
-Any failure counts, not just red tests: a failing test/CI/lint/typecheck, a code
-review, a user correction, a regression, or a wrong assumption \u2014 yours or anyone's.
-
-\`agentsmesh lessons add "<imperative rule>" --topic <id> --trigger-file <glob> --evidence <sha|lesson-id>\`
+Violating the letter is violating the spirit. Edited a file or ran a state-changing
+command without recall? Process violation. Did the turn hit a failure / correction /
+regression / wrong assumption / surprise and you have not captured (nor stated
+\`Lesson: none\`)? The task is INCOMPLETE \u2014 and the user will check. The graph
+\`.agentsmesh/lessons/lessons.json\` is canonical \u2014 never hand-edit.
 
-- **At least one _effective_ trigger is required.** A capture is rejected
-  (\`UNRECALLABLE_LESSON\`) when EVERY trigger is dead on the mandatory \`--file\`/\`--cmd\`
-  recall path \u2014 a stopword-only keyword ("state of the art"), or an invalid/ReDoS
-  command regex \u2014 because the lesson could never be recalled there. Prefer
-  \`--trigger-file\`: the most reliable trigger, it fires on \`--file\` recall. A keyword
-  alone is discouraged (\`KEYWORD_ONLY_LESSON\`); paraphrasing an existing rule warns
-  (\`NEAR_DUPLICATE_LESSON\` \u2014 update that lesson instead).
-- **One imperative sentence.** A rule over 2000 chars is rejected (\`OVERSIZED_RULE\`) \u2014
-  trim it or split into separate lessons; don't paste a log/diff.
-- Widen with \`--trigger-cmd <regex>\` / \`--trigger-kw <text>\`. New area:
-  \`--new-topic --topic-summary "<line>"\` (list ids with \`agentsmesh lessons topics\`).
+## Recall \u2014 before each file edit and each state-changing command
 
-## No shell? \u2014 MCP tools
+\`agentsmesh lessons query --file <path> --cmd <command>\`, then apply every rule.
+Pure-read commands (read-only) and the query itself are exempt. **keyword-only recall
+is the anti-pattern** \u2014 lessons are keyed to a \`file_glob\`/\`command_pattern\`.
 
-\`lessons_query\`, \`lessons_add\`, \`lessons_topics\`, \`lessons_show\` (inspect a topic),
-\`lessons_deprecate\` (retire). validate / prune / merge / import-md are CLI-only.
+## Capture \u2014 Gate Function (before any completion claim)
 
-## Other subcommands
+1. **SELF-CRITIQUE**: any failure, correction, regression, wrong assumption,
+   useful surprise, repeated friction, or non-obvious fix? Failing
+   tests/lint/typecheck and user/review corrections \u2014 yours or anyone's \u2014 all count.
+2. **CAPTURE** a reusable imperative rule with an effective trigger (else say so):
+   \`agentsmesh lessons add "<rule>" --topic <id> --trigger-file <glob>\`
+3. **RECEIPT**: emit \`Lesson: captured <id>\` or \`Lesson: none\`.
 
-\`agentsmesh lessons <cmd>\`: \`show\` \xB7 \`deprecate\` (\`--superseded-by\`) \xB7 \`merge\` \xB7
-\`untrigger\` \xB7 \`strip-markers\` \xB7 \`prune\` (\`--apply\`; trims over-cap triggers, GCs
-orphan triggers/topics) \xB7 \`journal\` \xB7 \`validate\` \xB7 \`stats\` \xB7 \`import-md\`. Full
-help: \`agentsmesh lessons --help\`.
+At least one _effective_ trigger is required or the capture is rejected
+(\`UNRECALLABLE_LESSON\`); prefer \`--trigger-file\`. No shell \u2192 MCP \`lessons_query\`,
+\`lessons_add\`, \`lessons_topics\`, \`lessons_show\`, \`lessons_deprecate\`. Run
+\`agentsmesh lessons --help\` for every subcommand and flag: query, add, topics, show,
+deprecate, merge, untrigger, strip-markers, prune, journal, validate, stats, import-md.
 
-## Config (\`.agentsmesh/lessons/config.json\`)
+### Rationalization Prevention \u2014 these excuses mean STOP
 
-\`recallLimit\` / \`recallMaxTokens\` (canonical recall caps; per-call overrides
-\`--top\` / \`--max-tokens\`). \`recallMaxTokens\` is approximate \u2014 \`rule.length / 4\`,
-not a real tokenizer. \`autoPrune: true\` (default off) auto-GCs structural cruft
-after each capture \u2014 orphan triggers/topics + non-stranding dead globs, the safe
-half of \`prune\`; never trims/strands an active lesson, git-reversible.
+| Excuse | Reality |
+| --- | --- |
+| "Small edit / I already know this / later" | Query first \u2014 skipping recall is a process violation |
+| "Nothing reusable here" | You hit a failure/surprise \u2014 name it or capture it |
+| "My own TDD red, not a real failure" | A red you did not predict IS a lesson |
+| "I fixed one site; the twin is obvious" | Capture it \u2014 the unfixed twin is what gets missed |
+| "Different words, so the rule doesn't apply" | Spirit over letter |
 
-## Dedup (opt-in)
+## Lesson gate \u2014 before final response
 
-Set \`--session <id>\` (or \`AGENTSMESH_SESSION_ID\`) and lessons already delivered this
-session are suppressed, so each recall carries only what is new (\`--no-dedup\` opts
-out). With no session id, recall is fully stateless \u2014 unchanged.`;
+The final response MUST carry the receipt: \`Lesson: captured <id>\` or \`Lesson: none\`.
+No receipt = task incomplete. Do not capture one-off facts, task summaries, or project
+context \u2014 only reusable imperative rules with an effective trigger.`;
 var LESSONS_SKILL_FILE = serializeFrontmatter(
   { name: LESSONS_SKILL_NAME, description: LESSONS_SKILL_DESCRIPTION },
   LESSONS_SKILL_BODY