agentsmesh 0.28.0 → 0.30.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.30.0
+
+### Minor Changes
+
+- 7b795b8: Lessons: measure effectiveness and sharpen recall
+
+  The lessons subsystem now tracks whether a recalled rule actually prevented the repeat, and improves recall precision — all opt-in and backward-compatible (no change to the CLI, MCP, or `lessons.json` surface):
+  - **Effectiveness signal (opt-in via `AGENTSMESH_LESSONS_TELEMETRY=1`).** An append-only outcome log records deliveries and failures; effectiveness is derived at read time — did a delivered lesson prevent the repeat? Recall **down-ranks** a lesson that fired but never helped, `lessons validate` gains advisory `INEFFECTIVE_LESSON` and `UNCOVERED_FAILURE` findings, and `lessons stats` gains a coarse **effectiveness block** (deliveries, held rate, ineffective count). The signal is deliberately coarse and labeled as such — never presented as proof of prevention.
+  - **Diff-aware recall.** The recall hook binds on the content being written, not just the file path, so a keyword lesson can fire on the change itself.
+  - **camelCase keyword reach.** Keyword recall now also splits camelCase/acronym identifier sub-words while retaining the whole token (fully backward compatible), so a keyword like `guard` reaches `useLeaveGuard.ts`.
+  - **Quieter injection.** Automatic recall caps the injected set to the most relevant few and stays silent on no match.
+  - **Recurrence-driven capture nudge.** A failure recurring on the same action with no covering lesson escalates the capture reminder, pre-filled from the real file/command.
+  - **Portable failure detection.** The recall hook records a failure from any tool event carrying an error payload, not only Claude Code's dedicated `PostToolUseFailure` event — so effectiveness can accumulate on more harnesses.
+  - **New capture warning `WIDE_GLOB_MATCH`** flags a `file_glob` that matches a large share of the working tree, complementing the existing structural broad-glob check.
+  - **`agentsmesh init --lessons`** now commits the `.gitattributes` binding for the `lessons.json` union merge driver and prints the per-clone `git config` setup, so a team's concurrent captures merge cleanly instead of conflicting.
+
+- 7b795b8: Lessons: `--scope always` for universal always-on rules
+
+  A lesson can now be captured with `--scope always` (MCP: `scope: "always"`) for a universal standard that applies to every task — a comment/test/style convention that no single file or command names. Always-on lessons need no trigger and are delivered on every task automatically, alongside triggered recall, deduplicated once per session.
+
+### Patch Changes
+
+- 13730ca: Lint no longer warns about agentsmesh-injected best-effort hook events
+
+  `agentsmesh lint` previously flagged the recall/capture hook events agentsmesh itself injects (`UserPromptSubmit`, `PostToolUseFailure`, `SessionStart`) as "unsupported" on targets whose hook model can't represent them — an unactionable warning, since agentsmesh injects those events and degrades them gracefully. They are now excluded from the unsupported-hook warning across every whitelist-style target.
+
+## 0.29.0
+
+### Minor Changes
+
+- 663f0e6: Strip elevated artifacts from remote `extends` sources by default
+
+  `hooks`, `permissions`, and `mcp` contributed by a **remote** `extends` source (`github:`, `gitlab:`, `git+…`, including `git+file://`) are now stripped during config load unless the entry opts in with `accept: [hooks, permissions, mcp]`. This closes a gap where a remote `extends` could inject shell-executing config (settings hooks, MCP launch specs) without the per-artifact consent that `agentsmesh install` already requires. Local `extends` remain trusted as-is, and a warning reports anything that was stripped.
+
+### Patch Changes
+
+- 11f90bc: Harden plugin source containment against intermediate-symlink escapes
+
+  The plugin loader now canonicalizes an unresolvable source path against its nearest existing ancestor instead of falling back to the raw path. This closes a gap where a local plugin `source` routed through a symlinked directory that resolves outside the project root could slip past the trust-boundary check when its entry file did not exist yet. Legitimate in-project plugins are unaffected.
+
+- c647c9b: Docs: the README now leads with lessons (the shared agent memory), adds a head-to-head comparison with Ruler and rulesync, embeds demo GIFs, leads the quickstart with the import-first path for existing repos, and documents the new `extends` `accept:` consent. Documentation-only — no behavior change.
+
 ## 0.28.0
 
 ### Minor Changes

package/README.md

@@ -1,8 +1,10 @@
 <div align="center">
 
-# AgentsMesh — One `.agentsmesh/` Directory for Every AI Coding Tool
+# AgentsMesh
 
-<img src="https://raw.githubusercontent.com/sampleXbro/agentsmesh/master/assets/agentsmesh-banner.jpeg" alt="AgentsMesh — One source. Every AI coding tool. Always in sync." width="100%" />
+### One source for every AI coding tool — with a shared agent memory that learns from your repo.
+
+<img src="https://raw.githubusercontent.com/sampleXbro/agentsmesh/master/assets/agentsmesh-banner.jpeg" alt="AgentsMesh — One source. Every AI coding tool. Agents that learn." width="100%" />
 
 [![CI](https://github.com/sampleXbro/agentsmesh/actions/workflows/ci.yml/badge.svg)](https://github.com/sampleXbro/agentsmesh/actions/workflows/ci.yml)
 [![npm version](https://img.shields.io/npm/v/agentsmesh.svg)](https://www.npmjs.com/package/agentsmesh)
@@ -23,6 +25,28 @@ Every AI coding assistant has its own config format — `CLAUDE.md`, `AGENTS.md`
 > [!NOTE]
 > Full documentation, guides, and the per-tool reference live at **[samplexbro.github.io/agentsmesh](https://samplexbro.github.io/agentsmesh/)**.
 
+## How AgentsMesh compares
+
+Most config tools stop at copying rule files into each assistant's folder. AgentsMesh is the only one that also gives your agents a **shared memory that learns**, round-trips **losslessly** in both directions, and lets anyone **add a new tool as a plugin** — no release required.
+
+| Capability | AgentsMesh | [Ruler](https://github.com/intellectronica/ruler) | [rulesync](https://github.com/dyoshikawa/rulesync) |
+|---|:---:|:---:|:---:|
+| Generate native config for many tools | ✅ | ✅ | ✅ |
+| Import existing tool config back to source | ✅ | — | ✅ |
+| **Lossless round-trip** (re-import restores originals) | ✅ | — | partial |
+| Convert one tool's config directly to another | ✅ | — | ✅ |
+| **Automatic cross-tool link rebasing** | ✅ | — | — |
+| **Lessons — a shared agent memory that learns** | ✅ | — | — |
+| **Plugins — add a target without a release** | ✅ | — | — |
+| Cross-target lint (warn before silent data loss) | ✅ | — | — |
+| CI drift gate + git-merge recovery | ✅ | partial | partial |
+| Self-serve MCP server (agent-operable config) | ✅ | — | — |
+| `--json` everywhere + typed programmatic API | ✅ | — | partial |
+
+<sub>Reflects the public projects as of June 2026 — see the [alternatives guide](https://samplexbro.github.io/agentsmesh/reference/alternatives/) for sources and detail. Corrections welcome.</sub>
+
+Built to be depended on: **8,000+ tests** run on Linux, macOS, and Windows CI (Node 22 & 24), configs are JSON-Schema-validated, npm releases ship with [provenance](https://docs.npmjs.com/generating-provenance-statements), and standalone binaries are published with SHA-256 checksums.
+
 ## Install
 
 Every install method ships the same CLI (`agentsmesh`, plus the shorter `amsh` alias) and the same TypeScript library.
@@ -45,11 +69,14 @@ Standalone binaries are also on [GitHub Releases](https://github.com/sampleXbro/
 
 ## 60-second quickstart
 
-Works on Linux, macOS, and Windows. After [installing](#install):
+Works on Linux, macOS, and Windows. After [installing](#install), `agentsmesh init` adapts to your repo:
+
+- **Already using AI tools?** It detects your existing `.cursor/`, `.claude/`, `.github/copilot-instructions.md`, and more, and offers to import them all into one `.agentsmesh/` source — nothing rewritten by hand. (`agentsmesh init --yes` does it non-interactively.)
+- **Starting fresh?** It scaffolds a minimal `.agentsmesh/` to grow from.
 
 ```bash
-agentsmesh init       # scaffold .agentsmesh/ + agentsmesh.yaml
-agentsmesh generate   # write native configs for every enabled tool
+agentsmesh init       # detect & import existing configs, or scaffold fresh
+agentsmesh generate   # write each tool's native config from the one source
 agentsmesh check      # CI-friendly drift gate against .agentsmesh/.lock
 ```
 
@@ -99,20 +126,44 @@ AGENTS.md
 
 Edit canonical sources, run `agentsmesh generate`, and every native file above is (re)written for you — always in sync. Alongside the directory, `agentsmesh.yaml` selects which targets and features are enabled, `agentsmesh.local.yaml` holds per-developer overrides (gitignored), and `.agentsmesh/.lock` records the checksums that `agentsmesh check` enforces.
 
+<div align="center">
+  <img src="https://raw.githubusercontent.com/sampleXbro/agentsmesh/master/assets/generate-demo.gif" alt="agentsmesh detects existing tool configs, imports them into one source, and generates native config for every tool" width="100%" />
+</div>
+
 ## Teach your agents: lessons
 
-Lessons give your AI agents a **memory of past mistakes** — read *before* they touch anything, written *after* something goes wrong, so the same mistake doesn't happen twice in any tool.
+This is the part no other config-sync tool has. Lessons give your AI agents a **memory of past mistakes** — read *before* they touch anything, written *after* something goes wrong, so the same mistake doesn't happen twice in any tool. It's what turns a static pile of rules into an agent that gets better at *your* codebase over time.
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/sampleXbro/agentsmesh/master/assets/lessons-demo.gif" alt="an AI agent captures a lesson after a failure, then recalls it before editing the same file — triggered by file, command, or keyword" width="100%" />
+</div>
 
 The memory is one git-tracked file, `.agentsmesh/lessons/lessons.json`, and every agent talks to it through two commands:
 
 - **Recall** — before an edit or a state-changing command, the agent runs `agentsmesh lessons query --file <path> --cmd <command>` and follows the rules that match.
 - **Capture** — right after a failure (red test, lint error, review comment, wrong assumption), it saves the rule with `agentsmesh lessons add "<rule>" --topic <id> --trigger-file <glob>`.
 
+Rules can be **scoped** (fire only on a matching file, command, or keyword) or **always-on** (`--scope always`) for universal standards that apply to every task — delivered on each task automatically, no trigger needed.
+
+Opt in with `AGENTSMESH_LESSONS_TELEMETRY=1` and agentsmesh goes a step further — it tracks whether a recalled lesson actually **prevented** the repeat, quietly down-ranks rules that never help, and flags them in `agentsmesh lessons validate`. Off by default and per-machine; the shared graph is your rules, the effectiveness is your own history.
+
+In practice:
+
+```bash
+# An agent breaks the Windows build, finds the cause, and writes the lesson down:
+agentsmesh lessons add "Normalize CLI display paths to forward slashes" \
+  --topic windows-paths --trigger-file "src/cli/**/*.ts"
+
+# Days later, any agent — in any tool — about to touch that path recalls it first:
+agentsmesh lessons query --file src/cli/output.ts
+# → "Normalize CLI display paths to forward slashes"
+```
+
 ```bash
 agentsmesh init --lessons && agentsmesh generate   # wire the recall/capture loop once
 ```
 
-`init --lessons` drops a small always-on rule into `.agentsmesh/rules/_root.md` (so every target gets the habit), seeds the full operating manual as a `lessons` skill where supported, and wires a recall hook (a `PreToolUse` first-touch guard plus a `PostToolUse` fallback) on hook-capable tools; agents without shell access use the matching MCP tools (`lessons_query` / `lessons_add`). Because the graph is a normal git-tracked file, a lesson one agent learns today helps every teammate's agent tomorrow, and every change is reviewable like any other diff.
+`init --lessons` drops a small always-on rule into `.agentsmesh/rules/_root.md` (so every target gets the habit), seeds the full operating manual as a `lessons` skill where supported, and wires a recall hook on hook-capable tools — a `PreToolUse` first-touch guard plus a `PostToolUse` fallback for file/command scope, a `UserPromptSubmit` pass so conceptual (`keyword`) and always-on lessons recall against the **task text**, a `PostToolUseFailure` advisory nudge to capture at the moment something breaks, and a `SessionStart` reset so recall re-surfaces lessons a long chat has summarized away. Agents without shell access use the matching MCP tools (`lessons_query` / `lessons_add`). Because the graph is a normal git-tracked file, a lesson one agent learns today helps every teammate's agent tomorrow, and every change is reviewable like any other diff.
 
 Full walkthrough: [Teach your AI agents with lessons](https://samplexbro.github.io/agentsmesh/guides/lessons/) · [`agentsmesh lessons` reference](https://samplexbro.github.io/agentsmesh/cli/lessons/).
 
@@ -125,8 +176,8 @@ Full walkthrough: [Teach your AI agents with lessons](https://samplexbro.github.
 - **Migrate between tools** — `convert --from <a> --to <b>` rewrites one tool's config directly into another's native format. [convert →](https://samplexbro.github.io/agentsmesh/cli/convert/)
 - **Global mode** — `~/.agentsmesh/` syncs your personal config to `~/.claude/`, `~/.cursor/`, `~/.codex/`, and more. Every command accepts `--global`. [Global paths →](https://samplexbro.github.io/agentsmesh/reference/supported-tools/#global-mode)
 - **Team-safe and CI-ready** — `check` is a drift gate against `.agentsmesh/.lock`, `diff` previews changes, `merge` rebuilds the lock after a 3-way Git conflict, and `lock_features` + per-feature `strategy` prevent accidental overrides. `lint` adds cross-target warnings (`silent-drop-guard`, `hook-script-references`, `rule-scope-inversion`) for content a tool would silently mishandle. [check →](https://samplexbro.github.io/agentsmesh/cli/check/) · [lint →](https://samplexbro.github.io/agentsmesh/cli/lint/)
-- **Community packs and `extends`** — install shared rules, skills, agents, and commands from any git repo (`install`, `--sync`, `refresh`, remote `extends`); a multi-signal classifier auto-detects Anthropic-style skill packs. Elevated artifacts (hooks, permissions, MCP) from remote sources are stripped unless you opt in with `--accept-*`. [Install reference →](https://samplexbro.github.io/agentsmesh/cli/install/)
-- **Plugins** — ship support for a new tool as a standalone npm package, with full parity to built-in targets (project + global, conversions, lint hooks, hook post-processing). [Build a plugin →](https://samplexbro.github.io/agentsmesh/guides/building-plugins/)
+- **Community packs and `extends`** — install shared rules, skills, agents, and commands from any git repo (`install`, `--sync`, `refresh`, remote `extends`); a multi-signal classifier auto-detects Anthropic-style skill packs. Elevated artifacts (hooks, permissions, MCP) from remote sources are stripped unless you opt in — with `--accept-*` on `install`, or `accept:` on a remote `extends` entry. [Install reference →](https://samplexbro.github.io/agentsmesh/cli/install/)
+- **Plugins — add a tool without waiting for a release** — ship support for a new AI tool as a standalone npm package, with full parity to built-in targets (project + global, conversions, lint hooks, hook post-processing). When a tool ships or changes its format, you don't file an issue and wait on the maintainer — you publish a plugin. [Build a plugin →](https://samplexbro.github.io/agentsmesh/guides/building-plugins/)
 - **Schema-validated configs** — each config ships a JSON Schema, so editors give you autocomplete and validation out of the box. [JSON schemas →](https://samplexbro.github.io/agentsmesh/reference/json-schemas/)
 - **Typed programmatic API** — drive `generate` / `import` / `lint` / `diff` / `check` from scripts or CI via `agentsmesh`, `/engine`, `/canonical`, `/targets`, `/lessons`. [API reference →](https://samplexbro.github.io/agentsmesh/reference/programmatic-api/)
 - **Self-serve MCP server** — `agentsmesh mcp` (seeded by `init`) exposes canonical config as MCP tools so agents can introspect rules, commands, and skills and trigger `generate` in-conversation. [MCP server →](https://samplexbro.github.io/agentsmesh/reference/mcp-server/)
@@ -135,9 +186,11 @@ Full walkthrough: [Teach your AI agents with lessons](https://samplexbro.github.
 > [!TIP]
 > Commit **both** `.agentsmesh/` and the generated tool files, the same way you commit `package-lock.json`: they're deterministic build output that the AI tools read directly, and `agentsmesh check` guards the two from drifting.
 
-## Why not just `AGENTS.md`?
+## Why not Ruler, rulesync, or just `AGENTS.md`?
+
+**vs. `AGENTS.md`** — [`AGENTS.md`](https://agents.md) is a great shared instruction file, and AgentsMesh emits it natively wherever a tool supports it. But a single markdown file isn't enough on its own: most assistants expose configuration *beyond* it — Cursor's `.cursor/rules/*.mdc` and MCP config, Claude Code's agents/skills/commands/hooks/permissions, Copilot's `.github/instructions/`, Gemini's `.gemini/settings.json`, and so on — and those surfaces don't overlap. AgentsMesh canonicalizes all of them so you never have to pick one tool's surface as the lowest common denominator.
 
-[`AGENTS.md`](https://agents.md) is a great shared instruction file, and AgentsMesh emits it natively wherever a tool supports it. But a single markdown file isn't enough on its own: most assistants expose configuration *beyond* it — Cursor's `.cursor/rules/*.mdc` and MCP config, Claude Code's agents/skills/commands/hooks/permissions, Copilot's `.github/instructions/`, Gemini's `.gemini/settings.json`, and so on — and those surfaces don't overlap. AgentsMesh canonicalizes all of them so you never have to pick one tool's surface as the lowest common denominator.
+**vs. other sync tools** — [Ruler](https://github.com/intellectronica/ruler) and [rulesync](https://github.com/dyoshikawa/rulesync) solve the rules-distribution half well. AgentsMesh goes further on the parts that are hardest to keep in sync: a shared [lessons](#teach-your-agents-lessons) memory your agents learn from, lossless two-way [import](https://samplexbro.github.io/agentsmesh/cli/import/), automatic cross-tool [link rebasing](https://samplexbro.github.io/agentsmesh/reference/generation-pipeline/), [plugins](https://samplexbro.github.io/agentsmesh/guides/building-plugins/) so a new tool ships without a release, and [lint](https://samplexbro.github.io/agentsmesh/cli/lint/) that warns before a tool would silently drop content. See the [full comparison](#how-agentsmesh-compares) and the [alternatives guide](https://samplexbro.github.io/agentsmesh/reference/alternatives/).
 
 ## Commands
 

package/dist/canonical.d.ts

@@ -1,5 +1,5 @@
-import { b as CanonicalFiles, V as ValidatedConfig } from './schema-CzaoYJlG.js';
-export { C as CanonicalAgent, a as CanonicalCommand, c as CanonicalRule, d as CanonicalSkill, H as HookEntry, e as Hooks, I as IgnorePatterns, M as McpConfig, f as McpServer, P as Permissions, S as SkillSupportingFile, g as StdioMcpServer, U as UrlMcpServer } from './schema-CzaoYJlG.js';
+import { b as CanonicalFiles, V as ValidatedConfig } from './schema-CH_JJep8.js';
+export { C as CanonicalAgent, a as CanonicalCommand, c as CanonicalRule, d as CanonicalSkill, H as HookEntry, e as Hooks, I as IgnorePatterns, M as McpConfig, f as McpServer, P as Permissions, S as SkillSupportingFile, g as StdioMcpServer, U as UrlMcpServer } from './schema-CH_JJep8.js';
 import 'zod';
 
 interface UnrecognizedFormatsWarningOptions {

package/dist/canonical.js

@@ -2874,6 +2874,18 @@ var init_linter = __esm({
   }
 });
 
+// src/core/hook-types.ts
+var BEST_EFFORT_HOOK_EVENTS;
+var init_hook_types = __esm({
+  "src/core/hook-types.ts"() {
+    BEST_EFFORT_HOOK_EVENTS = /* @__PURE__ */ new Set([
+      "UserPromptSubmit",
+      "PostToolUseFailure",
+      "SessionStart"
+    ]);
+  }
+});
+
 // src/core/lint/shared/helpers.ts
 function createWarning(file, target31, message) {
   return {
@@ -2889,6 +2901,13 @@ function formatOxfordComma(items) {
   if (items.length === 2) return `${items[0]} and ${items[1]}`;
   return `${items.slice(0, -1).join(", ")}, and ${items[items.length - 1]}`;
 }
+function unsupportedHookEventNames(hooks, supportedEvents) {
+  if (!hooks) return [];
+  const supported = new Set(supportedEvents);
+  return Object.keys(hooks).filter(
+    (event) => !supported.has(event) && !BEST_EFFORT_HOOK_EVENTS.has(event)
+  );
+}
 function createUnsupportedHookWarning(event, target31, supportedEvents, options) {
   const by = options?.unsupportedBy ?? target31;
   const supported = formatOxfordComma(supportedEvents);
@@ -2900,6 +2919,7 @@ function createUnsupportedHookWarning(event, target31, supportedEvents, options)
 }
 var init_helpers = __esm({
   "src/core/lint/shared/helpers.ts"() {
+    init_hook_types();
   }
 });
 
@@ -6217,8 +6237,7 @@ var init_linter5 = __esm({
 // src/targets/augment-code/lint.ts
 function lintHooks3(canonical) {
   if (!canonical.hooks || Object.keys(canonical.hooks).length === 0) return [];
-  const supportedSet = new Set(SUPPORTED_HOOK_EVENTS);
-  return Object.keys(canonical.hooks).filter((event) => !supportedSet.has(event)).map(
+  return unsupportedHookEventNames(canonical.hooks, SUPPORTED_HOOK_EVENTS).map(
     (event) => createUnsupportedHookWarning(event, "augment-code", SUPPORTED_HOOK_EVENTS, {
       unsupportedBy: "AugmentCode hooks"
     })
@@ -10223,8 +10242,7 @@ function lintCommands3(canonical) {
 function lintHooks5(canonical) {
   if (!canonical.hooks || Object.keys(canonical.hooks).length === 0) return [];
   const supported = ["PreToolUse", "PostToolUse", "Notification", "UserPromptSubmit"];
-  const supportedSet = new Set(supported);
-  const diagnostics = Object.keys(canonical.hooks).filter((event) => !supportedSet.has(event)).map(
+  const diagnostics = unsupportedHookEventNames(canonical.hooks, supported).map(
     (event) => createUnsupportedHookWarning(event, "copilot", supported, {
       unsupportedBy: "Copilot hooks"
     })
@@ -11341,7 +11359,7 @@ var init_permissions2 = __esm({
 // src/targets/cursor/hook-format.ts
 function unmappedCursorHookEvents(hooks) {
   return Object.keys(hooks).filter(
-    (event) => Array.isArray(hooks[event]) && hooks[event].length > 0 && !(event in CANONICAL_TO_CURSOR)
+    (event) => Array.isArray(hooks[event]) && hooks[event].length > 0 && !(event in CANONICAL_TO_CURSOR) && !BEST_EFFORT_HOOK_EVENTS.has(event)
   );
 }
 function toCursorHooks(hooks) {
@@ -11389,6 +11407,7 @@ function cursorHooksToCanonical(hooks) {
 var CANONICAL_TO_CURSOR, CURSOR_TO_CANONICAL;
 var init_hook_format = __esm({
   "src/targets/cursor/hook-format.ts"() {
+    init_hook_types();
     init_hook_command();
     CANONICAL_TO_CURSOR = {
       PreToolUse: "preToolUse",
@@ -13839,8 +13858,9 @@ function lintCommands6(canonical) {
 function lintHooks7(canonical) {
   if (!canonical.hooks || Object.keys(canonical.hooks).length === 0) return [];
   const supported = ["PreToolUse", "PostToolUse", "Notification"];
-  const supportedSet = new Set(supported);
-  return Object.keys(canonical.hooks).filter((event) => !supportedSet.has(event)).map((event) => createUnsupportedHookWarning(event, "gemini-cli", supported));
+  return unsupportedHookEventNames(canonical.hooks, supported).map(
+    (event) => createUnsupportedHookWarning(event, "gemini-cli", supported)
+  );
 }
 var init_lint14 = __esm({
   "src/targets/gemini-cli/lint.ts"() {
@@ -16092,8 +16112,7 @@ var init_linter20 = __esm({
 function lintHooks10(canonical) {
   if (!canonical.hooks || Object.keys(canonical.hooks).length === 0) return [];
   const supported = ["PreToolUse", "PostToolUse", "UserPromptSubmit", "SubagentStop"];
-  const supportedSet = new Set(supported);
-  return Object.keys(canonical.hooks).filter((event) => !supportedSet.has(event)).map(
+  return unsupportedHookEventNames(canonical.hooks, supported).map(
     (event) => createUnsupportedHookWarning(event, "kiro", supported, { unsupportedBy: "Kiro hooks" })
   );
 }
@@ -20874,7 +20893,9 @@ async function resolveExtendPaths(config, configDir, options = {}) {
         as: ext.as,
         version: fetched.version,
         path: ext.path,
-        pick: ext.pick
+        pick: ext.pick,
+        isRemote: true,
+        accept: ext.accept
       });
       continue;
     }
@@ -20891,7 +20912,9 @@ async function resolveExtendPaths(config, configDir, options = {}) {
       target: ext.target,
       as: ext.as,
       path: ext.path,
-      pick: ext.pick
+      pick: ext.pick,
+      isRemote: false,
+      accept: ext.accept
     });
   }
   return result;
@@ -22421,6 +22444,47 @@ function applyExtendPick(canonical, features, pick, extendName) {
   return next;
 }
 
+// src/install/core/elevated-artifacts.ts
+function stripUntrustedElevatedArtifacts(canonical, options) {
+  if (options.sourceKind === "local") {
+    return { canonical, stripped: [] };
+  }
+  const stripped = [];
+  let hooks = canonical.hooks;
+  let permissions = canonical.permissions;
+  let mcp = canonical.mcp;
+  if (hooks !== null && !options.acceptHooks) {
+    hooks = null;
+    stripped.push("hooks");
+  }
+  if (permissions !== null && !options.acceptPermissions) {
+    permissions = null;
+    stripped.push("permissions");
+  }
+  if (mcp !== null && !options.acceptMcp) {
+    mcp = null;
+    stripped.push("mcp");
+  }
+  if (stripped.length === 0) {
+    return { canonical, stripped: [] };
+  }
+  return {
+    canonical: { ...canonical, hooks, permissions, mcp },
+    stripped
+  };
+}
+
+// src/canonical/extends/extend-elevated.ts
+function gateExtendElevatedArtifacts(canonical, ext) {
+  const accept = ext.accept ?? [];
+  return stripUntrustedElevatedArtifacts(canonical, {
+    sourceKind: ext.isRemote ? "git" : "local",
+    acceptHooks: accept.includes("hooks"),
+    acceptPermissions: accept.includes("permissions"),
+    acceptMcp: accept.includes("mcp")
+  });
+}
+
 // src/install/pack/pack-reader.ts
 init_fs();
 
@@ -22454,7 +22518,14 @@ var extendSourceSchema = z.object({
   features: z.array(featureSchema),
   /** Repo-relative POSIX path for discovery (skill packs, nested .agentsmesh). */
   path: z.string().optional(),
-  pick: extendPickSchema.optional()
+  pick: extendPickSchema.optional(),
+  /**
+   * Per-entry consent for "elevated" artifacts (`hooks`, `permissions`, `mcp`)
+   * from a remote source. These control local code execution at generate time,
+   * so for non-local extends they are stripped by default and only merged for
+   * the artifacts listed here. Local extends are trusted and ignore this field.
+   */
+  accept: z.array(z.enum(["hooks", "permissions", "mcp"])).optional()
 });
 var collaborationSchema = z.object({
   strategy: z.enum(["merge", "lock", "last-wins"]).default("merge"),
@@ -22646,7 +22717,14 @@ async function loadCanonicalWithExtends(config, configDir, options = {}, canonic
   for (const ext of resolvedExtends) {
     const extCanonical = await loadCanonicalForExtend(ext);
     const filtered = filterCanonicalByFeatures(extCanonical, ext.features);
-    const picked = applyExtendPick(filtered, ext.features, ext.pick, ext.name);
+    const gated = gateExtendElevatedArtifacts(filtered, ext);
+    if (gated.stripped.length > 0) {
+      const list = gated.stripped.join(", ");
+      logger.warn(
+        `[agentsmesh] Extend "${ext.name}": stripped elevated artifacts from a remote source: ${list}. Add \`accept: [${list}]\` to this extends entry in agentsmesh.yaml to keep them.`
+      );
+    }
+    const picked = applyExtendPick(gated.canonical, ext.features, ext.pick, ext.name);
     merged = mergeCanonicalFiles(merged, picked);
   }
   const packsCanonical = await loadPacksCanonical(canonicalDir);