agentsmesh 0.35.0 → 0.37.0

package/dist/index.js

@@ -1,13 +1,13 @@
 import { z } from 'zod';
 import { stringify, parse, parseDocument, YAMLSeq, YAMLMap, isMap, Document, isSeq, isScalar, Scalar, Pair } from 'yaml';
 import { readFileSync, existsSync, mkdirSync, writeFileSync, constants, rmSync, renameSync, readdirSync, realpathSync, statSync } from 'fs';
-import { join, resolve, relative, sep, dirname, basename, win32, posix, extname } from 'path';
-import { mkdir, access, readdir, rm, readFile, writeFile, stat, lstat, unlink, rename, chmod, realpath, mkdtemp, cp } from 'fs/promises';
+import { join, resolve, relative, sep, dirname, basename, extname, win32, posix } from 'path';
+import { mkdir, access, readdir, rm, readFile, writeFile, stat, lstat, open, realpath, rename, mkdtemp, cp } from 'fs/promises';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
+import { createHash, randomUUID } from 'crypto';
 import { parse as parse$1, stringify as stringify$1 } from 'smol-toml';
 import { Buffer } from 'buffer';
 import { homedir, hostname, tmpdir } from 'os';
-import { createHash } from 'crypto';
 import { execFile } from 'child_process';
 import { fileURLToPath, pathToFileURL, URL as URL$1 } from 'url';
 import { promisify } from 'util';
@@ -894,6 +894,12 @@ function shouldNormalizeLineEndings(path) {
   const base = basename(path).toLowerCase();
   return TEXT_DOTFILES.has(base);
 }
+function isBinaryPayloadPath(path) {
+  return BINARY_EXTENSIONS.has(extname(path).toLowerCase());
+}
+function payloadEncodingFor(path) {
+  return isBinaryPayloadPath(path) ? "latin1" : "utf-8";
+}
 function normalizeLineEndings(content) {
   return content.replace(/\r\n?/g, "\n");
 }
@@ -905,7 +911,7 @@ function normalizeTextPayload(path, content) {
   const withoutBom = content.startsWith(UTF8_BOM) ? content.slice(UTF8_BOM.length) : content;
   return normalizeLineEndings(withoutBom);
 }
-var UTF8_BOM, TEXT_EXTENSIONS, TEXT_DOTFILES, EXECUTABLE_SCRIPT_EXTENSIONS;
+var UTF8_BOM, TEXT_EXTENSIONS, TEXT_DOTFILES, BINARY_EXTENSIONS, EXECUTABLE_SCRIPT_EXTENSIONS;
 var init_fs_text_encoding = __esm({
   "src/utils/filesystem/fs-text-encoding.ts"() {
     UTF8_BOM = "\uFEFF";
@@ -950,9 +956,109 @@ var init_fs_text_encoding = __esm({
       ".rooignore",
       ".antigravityignore"
     ]);
+    BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+      ".png",
+      ".jpg",
+      ".jpeg",
+      ".gif",
+      ".bmp",
+      ".ico",
+      ".webp",
+      ".avif",
+      ".tiff",
+      ".pdf",
+      ".zip",
+      ".gz",
+      ".tgz",
+      ".bz2",
+      ".xz",
+      ".7z",
+      ".rar",
+      ".jar",
+      ".woff",
+      ".woff2",
+      ".ttf",
+      ".otf",
+      ".eot",
+      ".mp3",
+      ".mp4",
+      ".wav",
+      ".ogg",
+      ".webm",
+      ".mov",
+      ".wasm",
+      ".bin",
+      ".dat",
+      ".db",
+      ".sqlite",
+      ".so",
+      ".dylib",
+      ".dll",
+      ".exe",
+      ".class",
+      ".pyc",
+      // Office and design documents are zip or proprietary containers.
+      ".xlsx",
+      ".xls",
+      ".docx",
+      ".doc",
+      ".pptx",
+      ".ppt",
+      ".odt",
+      ".ods",
+      ".psd",
+      ".ai",
+      ".sketch",
+      ".fig",
+      ".heic",
+      ".heif",
+      // Archives, columnar data, models and compressed payloads.
+      ".tar",
+      ".zst",
+      ".br",
+      ".lz4",
+      ".parquet",
+      ".avro",
+      ".orc",
+      ".pkl",
+      ".npy",
+      ".npz",
+      ".onnx",
+      ".pt",
+      ".safetensors",
+      ".gguf",
+      ".sqlite3",
+      ".avi",
+      ".mkv",
+      ".flac",
+      ".aac",
+      ".m4a",
+      ".ttc"
+    ]);
     EXECUTABLE_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([".sh", ".bash", ".zsh"]);
   }
 });
+async function renameWithRetry(from, to, options = {}) {
+  const attempts = options.attempts ?? 5;
+  const delayMs = options.delayMs ?? 50;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await rename(from, to);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const transient = code !== void 0 && TRANSIENT_RENAME_CODES.has(code);
+      if (!transient || attempt >= attempts - 1) throw err;
+      await setTimeout$1(delayMs * 2 ** attempt);
+    }
+  }
+}
+var TRANSIENT_RENAME_CODES;
+var init_rename_retry = __esm({
+  "src/utils/filesystem/rename-retry.ts"() {
+    TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY", "ENOTEMPTY", "EEXIST"]);
+  }
+});
 function shouldSkipRecursiveBranch(segments) {
   if (segments.length > MAX_RECURSIVE_DEPTH) return true;
   const counts = /* @__PURE__ */ new Map();
@@ -1043,30 +1149,10 @@ var init_fs_traverse = __esm({
     MAX_SEGMENT_REPETITIONS = 3;
   }
 });
-async function renameWithRetry(from, to, options = {}) {
-  const attempts = options.attempts ?? 5;
-  const delayMs = options.delayMs ?? 50;
-  for (let attempt = 0; ; attempt++) {
-    try {
-      await rename(from, to);
-      return;
-    } catch (err) {
-      const code = err.code;
-      const transient = code !== void 0 && TRANSIENT_RENAME_CODES.has(code);
-      if (!transient || attempt >= attempts - 1) throw err;
-      await setTimeout$1(delayMs * 2 ** attempt);
-    }
-  }
-}
-var TRANSIENT_RENAME_CODES;
-var init_rename_retry = __esm({
-  "src/utils/filesystem/rename-retry.ts"() {
-    TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY", "ENOTEMPTY", "EEXIST"]);
-  }
-});
 async function readFileSafe(path) {
   try {
-    const data = await readFile(path, "utf-8");
+    const data = await readFile(path, payloadEncodingFor(path));
+    if (isBinaryPayloadPath(path)) return data;
     return data.startsWith(UTF8_BOM) ? data.slice(UTF8_BOM.length) : data;
   } catch (err) {
     const e = err;
@@ -1090,40 +1176,28 @@ async function writeFileAtomic(path, content, options) {
         { errnoCode: "EISDIR" }
       );
     }
-    if (info.isSymbolicLink()) {
-      await unlink(path).catch((e) => {
-        if (e.code !== "ENOENT") throw e;
-      });
-    }
   } catch (err) {
     if (err instanceof FileSystemError) throw err;
     const e = err;
     if (e.code !== "ENOENT") throw err;
   }
-  const tmpPath = `${path}.tmp`;
+  const tmpPath = `${path}.tmp-${randomUUID()}`;
   const payload = shouldNormalizeLineEndings(path) ? normalizeLineEndings(content) : content;
   const mode = executableModeFor(path);
+  let handle;
+  let ownsTemporaryFile = false;
   try {
-    try {
-      const tmpInfo = await lstat(tmpPath);
-      if (tmpInfo.isSymbolicLink()) {
-        await unlink(tmpPath);
-      }
-    } catch (tmpErr) {
-      if (tmpErr.code !== "ENOENT") throw tmpErr;
-    }
-    const writeOpts = {
-      encoding: "utf-8",
-      flag: "w"
-    };
-    if (mode !== void 0) writeOpts.mode = mode;
-    await writeFile(tmpPath, payload, writeOpts);
-    await rename(tmpPath, path);
-    if (mode !== void 0) {
-      await chmod(path, mode);
-    }
+    handle = await open(tmpPath, "wx", mode);
+    ownsTemporaryFile = true;
+    await handle.writeFile(payload, payloadEncodingFor(path));
+    if (mode !== void 0) await handle.chmod(mode);
+    await handle.close();
+    handle = void 0;
+    await renameWithRetry(tmpPath, path);
   } catch (err) {
-    await rm(tmpPath, { force: true }).catch(() => {
+    await handle?.close().catch(() => {
+    });
+    if (ownsTemporaryFile) await rm(tmpPath, { force: true }).catch(() => {
     });
     const e = err;
     throw new FileSystemError(
@@ -1148,6 +1222,7 @@ var init_fs = __esm({
   "src/utils/filesystem/fs.ts"() {
     init_errors();
     init_fs_text_encoding();
+    init_rename_retry();
     init_fs_traverse();
     init_fs_text_encoding();
     init_rename_retry();
@@ -2302,43 +2377,92 @@ function isGlobAdjacent(content, start, end) {
   const next = end < content.length ? content.at(end) : "";
   return prev === "*" || next === "*";
 }
+var NON_REWRITABLE_BARE_FILES, PATH_TOKEN, LINE_NUMBER_SUFFIX;
+var init_link_rebaser_helpers = __esm({
+  "src/core/reference/link-rebaser-helpers.ts"() {
+    init_path_helpers();
+    init_link_format_registry();
+    NON_REWRITABLE_BARE_FILES = /* @__PURE__ */ new Set([
+      "AGENTS.md",
+      "CLAUDE.md",
+      "GEMINI.md",
+      "codex.md",
+      ".windsurfrules",
+      ".cursorrules"
+    ]);
+    PATH_TOKEN = /(?:\.\.[\\/]|\.\/|\.\\|\/[A-Za-z0-9._-]|[A-Za-z]:[\\/][A-Za-z0-9._-]|\.agentsmesh[\\/]|\.claude[\\/]|\.cursor[\\/]|\.github[\\/]|\.continue[\\/]|\.junie[\\/]|\.kiro[\\/]|\.gemini[\\/]|\.clinerules[\\/]|\.cline[\\/]|\.codex[\\/]|\.agents[\\/]|\.windsurf[\\/]|\.roo[\\/]|(?:[A-Za-z0-9._-]+[\\/])+|[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+)[A-Za-z0-9._@%+~:\\/-]*/g;
+    LINE_NUMBER_SUFFIX = /(?::(\d+)){1,2}$/;
+  }
+});
+
+// src/core/reference/protected-ranges.ts
+function inlineCodeRanges(content) {
+  const ranges = [];
+  let openStart = -1;
+  let openLength = 0;
+  for (const match of content.matchAll(/`+/g)) {
+    const start = match.index;
+    const length = match[0].length;
+    if (openStart === -1) {
+      openStart = start;
+      openLength = length;
+      continue;
+    }
+    if (length === openLength) {
+      ranges.push([openStart, start + length]);
+      openStart = -1;
+      openLength = 0;
+    }
+  }
+  return ranges;
+}
+function extendAcrossBalancedParens(content, end) {
+  let cursor = end;
+  while (content[cursor] === "(") {
+    let depth = 0;
+    let scan = cursor;
+    while (scan < content.length) {
+      const ch = content[scan];
+      if (ch === "(") depth += 1;
+      else if (ch === ")") {
+        depth -= 1;
+        if (depth === 0) break;
+      } else if (ch === void 0 || /\s/.test(ch)) return cursor;
+      scan += 1;
+    }
+    if (depth !== 0) return cursor;
+    cursor = scan + 1;
+    while (cursor < content.length && !/[\s<>()\]]/.test(content.charAt(cursor))) cursor += 1;
+  }
+  return cursor;
+}
 function protectedRanges(content) {
   const ranges = [];
   for (const pattern of getLinkFormatRegistry().protectedSchemes) {
     const globalPattern = pattern.flags.includes("g") ? pattern : new RegExp(pattern.source, `${pattern.flags}g`);
     for (const match of content.matchAll(globalPattern)) {
-      ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+      const start = match.index;
+      ranges.push([start, extendAcrossBalancedParens(content, start + match[0].length)]);
     }
   }
   for (const match of content.matchAll(FENCED_CODE_BLOCK)) {
-    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    ranges.push([match.index, match.index + match[0].length]);
   }
   for (const match of content.matchAll(ROOT_GENERATION_CONTRACT_BLOCK)) {
-    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    ranges.push([match.index, match.index + match[0].length]);
   }
   for (const match of content.matchAll(EMBEDDED_RULES_BLOCK)) {
-    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    ranges.push([match.index, match.index + match[0].length]);
   }
   return ranges;
 }
-var NON_REWRITABLE_BARE_FILES, FENCED_CODE_BLOCK, ROOT_GENERATION_CONTRACT_BLOCK, EMBEDDED_RULES_BLOCK, PATH_TOKEN, LINE_NUMBER_SUFFIX;
-var init_link_rebaser_helpers = __esm({
-  "src/core/reference/link-rebaser-helpers.ts"() {
-    init_path_helpers();
+var FENCED_CODE_BLOCK, ROOT_GENERATION_CONTRACT_BLOCK, EMBEDDED_RULES_BLOCK;
+var init_protected_ranges = __esm({
+  "src/core/reference/protected-ranges.ts"() {
     init_link_format_registry();
-    NON_REWRITABLE_BARE_FILES = /* @__PURE__ */ new Set([
-      "AGENTS.md",
-      "CLAUDE.md",
-      "GEMINI.md",
-      "codex.md",
-      ".windsurfrules",
-      ".cursorrules"
-    ]);
     FENCED_CODE_BLOCK = /^(?:```|~~~)[^\n]*\n[\s\S]*?^(?:```|~~~)/gm;
     ROOT_GENERATION_CONTRACT_BLOCK = /<!-- agentsmesh:root-generation-contract:start -->[\s\S]*?<!-- agentsmesh:root-generation-contract:end -->/g;
     EMBEDDED_RULES_BLOCK = /<!-- agentsmesh:embedded-rules:start -->[\s\S]*?<!-- agentsmesh:embedded-rules:end -->/g;
-    PATH_TOKEN = /(?:\.\.[\\/]|\.\/|\.\\|\/[A-Za-z0-9._-]|[A-Za-z]:[\\/][A-Za-z0-9._-]|\.agentsmesh[\\/]|\.claude[\\/]|\.cursor[\\/]|\.github[\\/]|\.continue[\\/]|\.junie[\\/]|\.kiro[\\/]|\.gemini[\\/]|\.clinerules[\\/]|\.cline[\\/]|\.codex[\\/]|\.agents[\\/]|\.windsurf[\\/]|\.roo[\\/]|(?:[A-Za-z0-9._-]+[\\/])+|[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+)[A-Za-z0-9._@%+~:\\/-]*/g;
-    LINE_NUMBER_SUFFIX = /(?::(\d+)){1,2}$/;
   }
 });
 
@@ -2831,6 +2955,7 @@ var init_link_rebaser = __esm({
   "src/core/reference/link-rebaser.ts"() {
     init_path_helpers();
     init_link_rebaser_helpers();
+    init_protected_ranges();
     init_link_rebaser_output();
     init_link_rebaser_resolution();
     init_link_uri_encoding();
@@ -7254,6 +7379,60 @@ var init_embedded_rules = __esm({
   }
 });
 
+// src/utils/text/json-comments.ts
+function stripJsonComments(text) {
+  let result2 = "";
+  let i = 0;
+  const len = text.length;
+  while (i < len) {
+    const ch = text[i];
+    if (ch === '"') {
+      result2 += ch;
+      i++;
+      while (i < len) {
+        const sc = text[i];
+        result2 += sc;
+        if (sc === "\\") {
+          i++;
+          if (i < len) {
+            result2 += text[i];
+          }
+        } else if (sc === '"') {
+          break;
+        }
+        i++;
+      }
+      i++;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < len) {
+        if (text[i] === "*" && text[i + 1] === "/") {
+          i += 2;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      i += 2;
+      while (i < len && text[i] !== "\n") {
+        i++;
+      }
+      continue;
+    }
+    result2 += ch;
+    i++;
+  }
+  return result2;
+}
+var init_json_comments = __esm({
+  "src/utils/text/json-comments.ts"() {
+  }
+});
+
 // src/canonical/features/syntax-error.ts
 function failSyntax(filePath2, cause, onParseError) {
   const error = new CanonicalParseError(filePath2, cause);
@@ -7303,54 +7482,6 @@ function parseServer(raw) {
     env
   };
 }
-function stripJsonComments(text) {
-  let result2 = "";
-  let i = 0;
-  const len = text.length;
-  while (i < len) {
-    const ch = text[i];
-    if (ch === '"') {
-      result2 += ch;
-      i++;
-      while (i < len) {
-        const sc = text[i];
-        result2 += sc;
-        if (sc === "\\") {
-          i++;
-          if (i < len) {
-            result2 += text[i];
-          }
-        } else if (sc === '"') {
-          break;
-        }
-        i++;
-      }
-      i++;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "*") {
-      i += 2;
-      while (i < len) {
-        if (text[i] === "*" && text[i + 1] === "/") {
-          i += 2;
-          break;
-        }
-        i++;
-      }
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      i += 2;
-      while (i < len && text[i] !== "\n") {
-        i++;
-      }
-      continue;
-    }
-    result2 += ch;
-    i++;
-  }
-  return result2;
-}
 async function parseMcp(mcpPath, onParseError) {
   const content = await readFileSafe(mcpPath);
   if (!content) return null;
@@ -7373,6 +7504,7 @@ async function parseMcp(mcpPath, onParseError) {
 }
 var init_mcp = __esm({
   "src/canonical/features/mcp.ts"() {
+    init_json_comments();
     init_syntax_error();
     init_fs();
   }
@@ -8704,7 +8836,7 @@ ${rawBody}`;
   });
 }
 function generateMcp3(canonical) {
-  if (!canonical.mcp || Object.keys(canonical.mcp.mcpServers).length === 0) return [];
+  if (!canonical.mcp) return [];
   const content = JSON.stringify({ mcpServers: canonical.mcp.mcpServers }, null, 2);
   return [{ path: CLAUDE_MCP_JSON, content }];
 }
@@ -8739,14 +8871,12 @@ function generatePermissions4(canonical) {
   if (!canonical.permissions) return [];
   const { allow, deny } = canonical.permissions;
   const ask = canonical.permissions.ask ?? [];
-  if (allow.length === 0 && deny.length === 0 && ask.length === 0) return [];
   const content = JSON.stringify({ permissions: { allow, deny, ask } }, null, 2);
   return [{ path: CLAUDE_SETTINGS, content }];
 }
 function generateHooks3(canonical) {
-  if (!canonical.hooks || Object.keys(canonical.hooks).length === 0) return [];
+  if (!canonical.hooks) return [];
   const claudeHooks = buildClaudeHooksObjectFromCanonical(canonical);
-  if (Object.keys(claudeHooks).length === 0) return [];
   const content = JSON.stringify({ hooks: claudeHooks }, null, 2);
   return [{ path: CLAUDE_SETTINGS, content }];
 }
@@ -20564,9 +20694,9 @@ var init_config_toml = __esm({
 function isValidKimiPermissionPattern(pattern) {
   const trimmed = pattern.trim();
   if (trimmed.length === 0) return false;
-  const open = trimmed.indexOf("(");
-  if (open === -1) return true;
-  return trimmed.endsWith(")") && open > 0;
+  const open2 = trimmed.indexOf("(");
+  if (open2 === -1) return true;
+  return trimmed.endsWith(")") && open2 > 0;
 }
 function listOf(permissions, key) {
   return permissions[key] ?? [];
@@ -29756,6 +29886,7 @@ function rewriteGeneratedReferences(results, canonical, config, projectRoot, sco
 // src/core/reference/validate-generated-markdown-links.ts
 init_path_helpers();
 init_link_rebaser_helpers();
+init_protected_ranges();
 
 // src/utils/output/color.ts
 function noColorRequested() {
@@ -29838,7 +29969,7 @@ var logger = {
 
 // src/core/reference/validate-generated-markdown-links.ts
 var INLINE_MD_LINK = /!?\[[^\]]*\]\(([^)]+)\)/g;
-var REF_LINK_DEF = /^\s*\[[^\]\n]+\]:\s*(?:<([^>\n]*)>|(\S+))/gm;
+var REF_LINK_DEF = /^\s*\[(?!\^)[^\]\n]+\]:\s*(?:<([^>\n]*)>|(\S+))/gm;
 function isMarkdownLikeOutput(relativePath) {
   return relativePath.endsWith(".md") || relativePath.endsWith(".mdc");
 }
@@ -29971,7 +30102,7 @@ function findBrokenMarkdownLinks(results, projectRoot) {
       projectRoot,
       pathApi(projectRoot).join(projectRoot, result2.path)
     );
-    const protectedR = protectedRanges(result2.content);
+    const protectedR = [...protectedRanges(result2.content), ...inlineCodeRanges(result2.content)];
     const visitDestination = (raw, matchIndex) => {
       if (isOffsetInRanges(matchIndex, protectedR)) return;
       const checked = resolveMarkdownLinkTargets(raw, projectRoot, destinationAbs);
@@ -30065,28 +30196,10 @@ function ruleNameFromSource(source) {
 
 // src/core/generate/collision.ts
 init_fs_text_encoding();
+
+// src/core/generate/collision-agents.ts
 init_target_ids();
 var AGENTS_SUFFIX = "AGENTS.md";
-function statusRank(status) {
-  switch (status) {
-    case "created":
-      return 3;
-    case "updated":
-      return 2;
-    case "unchanged":
-      return 1;
-    case "skipped":
-      return 0;
-  }
-}
-function mergeDuplicateMetadata(preferred, other) {
-  if (statusRank(other.status) <= statusRank(preferred.status)) return preferred;
-  return {
-    ...preferred,
-    status: other.status,
-    currentContent: other.currentContent ?? preferred.currentContent
-  };
-}
 function trimmedContent(content) {
   return content.trim();
 }
@@ -30120,15 +30233,82 @@ function richerAgentsResult(left, right) {
   }
   return null;
 }
+function contentLines(content) {
+  const lines = /* @__PURE__ */ new Set();
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed !== "") lines.add(trimmed);
+  }
+  return lines;
+}
+function covers(outer, inner) {
+  for (const line of inner) {
+    if (!outer.has(line)) return false;
+  }
+  return true;
+}
+var EMBEDDED_RULES_BLOCK2 = /(<!-- agentsmesh:embedded-rules:start -->)([\s\S]*?)(<!-- agentsmesh:embedded-rules:end -->)/;
+var EMBEDDED_RULE_UNIT = /<!-- agentsmesh:embedded-rule:start [\s\S]*?<!-- agentsmesh:embedded-rule:end -->/g;
+function embeddedRuleUnits(block) {
+  return [...block.matchAll(EMBEDDED_RULE_UNIT)].map((m) => m[0]);
+}
+function mergedEmbeddedRulesResult(left, right) {
+  if (!left.path.endsWith(AGENTS_SUFFIX) || left.path !== right.path) return null;
+  if (normalizeAgentsContent(left.content) !== normalizeAgentsContent(right.content)) return null;
+  const leftBlock = EMBEDDED_RULES_BLOCK2.exec(left.content);
+  const rightBlock = EMBEDDED_RULES_BLOCK2.exec(right.content);
+  if (!leftBlock?.[2] || !rightBlock?.[2]) return null;
+  const leftUnits = embeddedRuleUnits(leftBlock[2]);
+  const rightUnits = embeddedRuleUnits(rightBlock[2]);
+  if (leftUnits.length === 0 && rightUnits.length === 0) return null;
+  const added = rightUnits.filter((unit) => !leftUnits.includes(unit));
+  if (added.length === 0) return left;
+  const merged = [...leftUnits, ...added].join("\n\n");
+  const content = left.content.replace(
+    EMBEDDED_RULES_BLOCK2,
+    (_full, start, _inner, end) => `${start}
+
+${merged}
+
+${end}`
+  );
+  logger.warn(
+    `${left.path} is shared by ${left.target} and ${right.target}, so their target-scoped rules were combined into one file \u2014 every target reading it sees all of them.`
+  );
+  return { ...left, content };
+}
 function richerCodexAgentsResult(left, right) {
   if (!left.path.endsWith(AGENTS_SUFFIX) || left.path !== right.path) return null;
   const codex = left.target === CODEX_CLI_TARGET_ID ? left : right.target === CODEX_CLI_TARGET_ID ? right : null;
   const other = codex === left ? right : left;
   if (!codex) return null;
-  const codexLen = trimmedContent(codex.content).length;
-  const otherLen = trimmedContent(other.content).length;
-  if (codexLen === otherLen) return null;
-  return codexLen > otherLen ? codex : other;
+  const codexLines = contentLines(codex.content);
+  const otherLines = contentLines(other.content);
+  if (covers(codexLines, otherLines)) return codex;
+  if (covers(otherLines, codexLines)) return other;
+  return null;
+}
+
+// src/core/generate/collision.ts
+function statusRank(status) {
+  switch (status) {
+    case "created":
+      return 3;
+    case "updated":
+      return 2;
+    case "unchanged":
+      return 1;
+    case "skipped":
+      return 0;
+  }
+}
+function mergeDuplicateMetadata(preferred, other) {
+  if (statusRank(other.status) <= statusRank(preferred.status)) return preferred;
+  return {
+    ...preferred,
+    status: other.status,
+    currentContent: other.currentContent ?? preferred.currentContent
+  };
 }
 function resolveOutputCollisions(results) {
   const deduped = [];
@@ -30145,6 +30325,11 @@ function resolveOutputCollisions(results) {
         deduped[existingIdx] = richer;
         continue;
       }
+      const mergedRules = mergedEmbeddedRulesResult(existing, result2);
+      if (mergedRules) {
+        deduped[existingIdx] = refreshResultStatus(mergedRules);
+        continue;
+      }
       const richerCodex = richerCodexAgentsResult(existing, result2);
       if (richerCodex) {
         deduped[existingIdx] = richerCodex;
@@ -30710,6 +30895,14 @@ function redactUrlSecrets(message) {
     }
   );
 }
+function stripUrlCredentials(url) {
+  return url.replace(
+    URL_WITH_CREDENTIALS,
+    (_full, scheme, _userinfo, rest) => {
+      return `${scheme}${rest}`;
+    }
+  );
+}
 function gitProtocolOptIns() {
   const on = (v) => v === "1" || v === "true";
   return {
@@ -31108,6 +31301,7 @@ async function sweepStaleCache(cacheDir, maxAgeMs) {
 var MAX_CACHE_KEY_LENGTH = 80;
 var CACHE_KEY_HASH_LENGTH = 12;
 function buildCacheKey(provider, identifier, ref) {
+  identifier = stripUrlCredentials(identifier);
   const safe = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_").replace(/^\.+/, "_");
   const [org, repo] = provider === "github" ? identifier.split("/", 2) : [];
   const readable = org && repo ? `${safe(org)}--${safe(repo)}--${safe(ref)}` : `${safe(provider)}__${safe(identifier)}__${safe(ref)}`;
@@ -34466,8 +34660,59 @@ async function diffOutputChecksums(rootBase, lockOutputs) {
 
 // src/core/generate/stale-cleanup.ts
 init_fs();
+async function canonicalizePath(path) {
+  try {
+    return await realpath(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = dirname(path);
+    if (parent === path) return resolve(path);
+    return join(await canonicalizePath(parent), basename(path));
+  }
+}
+function isPathInside(target34, root) {
+  return target34 === root || target34.startsWith(root.endsWith(sep) ? root : `${root}${sep}`);
+}
+var display = (path) => path.replaceAll("\\", "/");
+async function assertPathInsideRoot(root, target34) {
+  const rootAbs = resolve(root);
+  const targetAbs = resolve(target34);
+  if (!isPathInside(targetAbs, rootAbs)) {
+    throw new Error(`Unsafe filesystem path: ${display(target34)} is outside ${display(rootAbs)}`);
+  }
+  let realTarget;
+  let realRoot;
+  try {
+    [realTarget, realRoot] = await Promise.all([
+      canonicalizePath(targetAbs),
+      canonicalizePath(rootAbs)
+    ]);
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new Error(
+      `Unsafe filesystem path: ${display(target34)} could not be resolved (${detail})`,
+      { cause }
+    );
+  }
+  if (isPathInside(realTarget, realRoot)) return;
+  throw new Error(
+    `Unsafe filesystem path: ${display(target34)} resolves to ${display(realTarget)} outside ${display(realRoot)}`
+  );
+}
+
+// src/core/generate/stale-cleanup.ts
 init_builtin_targets();
 init_registry();
+init_builtin_targets();
+function retainedDirs(inactiveTargets, scope) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const target34 of inactiveTargets) {
+    for (const dir of getTargetManagedOutputs(target34, scope)?.dirs ?? []) dirs.add(dir);
+  }
+  return dirs;
+}
+
+// src/core/generate/stale-cleanup.ts
 async function listFiles2(root, base = root) {
   const entries = await readdir(root, { withFileTypes: true });
   const files = [];
@@ -34481,13 +34726,6 @@ async function listFiles2(root, base = root) {
   }
   return files;
 }
-function retainedDirs(inactiveTargets, scope) {
-  const dirs = /* @__PURE__ */ new Set();
-  for (const target34 of inactiveTargets) {
-    for (const dir of getTargetManagedOutputs(target34, scope)?.dirs ?? []) dirs.add(dir);
-  }
-  return dirs;
-}
 function primaryEmitted(target34, scope, expected) {
   const descriptor34 = getBuiltinTargetDefinition(target34) ?? getDescriptor(target34);
   const primary = getTargetLayout(target34, scope)?.rootInstructionPath ?? descriptor34?.generators.primaryRootInstructionPath;
@@ -34514,6 +34752,7 @@ async function findStaleGeneratedOutputs(args) {
     for (const dir of managed.dirs) {
       if (retained.has(dir)) continue;
       const absDir = join(args.projectRoot, dir);
+      await assertPathInsideRoot(args.projectRoot, absDir);
       if (!await exists(absDir)) continue;
       for (const file of await listFiles2(absDir)) {
         const relPath = `${dir}/${file}`.replace(/\/+/g, "/");
@@ -34525,6 +34764,7 @@ async function findStaleGeneratedOutputs(args) {
   const found = [];
   for (const relPath of stale) {
     if (expected.has(relPath) || coOwned.has(relPath)) continue;
+    await assertPathInsideRoot(args.projectRoot, dirname(join(args.projectRoot, relPath)));
     if (await exists(join(args.projectRoot, relPath))) found.push(relPath);
   }
   return found.sort();
@@ -34538,6 +34778,7 @@ async function findUntrackedManagedDirFiles(args) {
     for (const dir of getTargetManagedOutputs(target34, scope)?.dirs ?? []) {
       if (retained.has(dir)) continue;
       const absDir = join(args.projectRoot, dir);
+      await assertPathInsideRoot(args.projectRoot, absDir);
       if (!await exists(absDir)) continue;
       for (const file of await listFiles2(absDir)) {
         const relPath = `${dir}/${file}`.replace(/\/+/g, "/");
@@ -35084,8 +35325,8 @@ function isBroadGlob(pattern) {
   const p = pattern.trim();
   if (p === "*" || p === "**") return true;
   if (!p.includes("**")) return false;
-  const basename77 = p.slice(p.lastIndexOf("/") + 1);
-  return basename77.startsWith("*");
+  const basename78 = p.slice(p.lastIndexOf("/") + 1);
+  return basename78.startsWith("*");
 }
 function inspectCapturedLesson(graph, lessonId, knownPaths) {
   const lesson = graph.lessons[lessonId];
@@ -35191,8 +35432,7 @@ async function acquireProcessLock(lockPath, opts = {}) {
     if (acquired) return acquired;
     const existing = await inspectLock(lockPath);
     if (existing !== "young" && isStale(existing, stale)) {
-      await rm(lockPath, { recursive: true, force: true }).catch(() => {
-      });
+      await rm(lockPath, { recursive: true, force: true });
       continue;
     }
     if (attempt >= retries) {
@@ -35216,7 +35456,13 @@ async function tryAcquire(lockPath) {
     started: Date.now(),
     hostname: getHostname()
   };
-  await writeFile(metadataPath, JSON.stringify(metadata), "utf-8");
+  try {
+    await writeFile(metadataPath, JSON.stringify(metadata), "utf-8");
+  } catch (error) {
+    await rm(lockPath, { recursive: true, force: true }).catch(() => {
+    });
+    throw error;
+  }
   let released = false;
   const cleanup = () => {
     if (released) return;
@@ -35288,7 +35534,7 @@ function getHostname() {
   return hostname();
 }
 function sleep2(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 
 // src/lessons/lessons-lock.ts
@@ -35641,6 +35887,11 @@ function recallLogPath(projectRoot) {
   return join(lessonsPaths(projectRoot).base, "recall-log.jsonl");
 }
 
+// src/lessons/lexical-retrieval.ts
+new Set(
+  "top left right bottom before after first last next new old use used using run make keep set get add all any each every not no never always only one two more less same other than then into from over under out up down off via per so if else when where which what who how why do does did done can could should would will may might has have had are was were been being also still just even very both either such these those they them their we you your our he she his her my me our us own same here there now then again once about above below between during through until while because but by need needs needed way ways thing things".split(" ")
+);
+
 // src/lessons/ranking-signals.ts
 function buildFanout(graph) {
   const fanout = /* @__PURE__ */ new Map();
@@ -35707,7 +35958,7 @@ function rankLessons(graph, query, matches, options = {}) {
   const narrowness = buildNarrowness(graph);
   const coherence = buildTopicCoherence(matches);
   const matchedTriggerIds = collectMatchedTriggerIds(graph, query);
-  const scored = matches.map(({ id, lesson }) => {
+  const scored = matches.map(({ id, lesson, lexical }) => {
     const hitTriggers = lesson.triggers.filter((t) => matchedTriggerIds.has(t));
     let specificity = 0;
     for (const t of hitTriggers) {
@@ -35723,7 +35974,8 @@ function rankLessons(graph, query, matches, options = {}) {
       matchedTriggers: hitTriggers,
       // Absent from the log ⇒ neutral 1, so a lesson with no outcome data never
       // sinks below one that has merely been recorded.
-      effectiveness: options.effectiveness?.get(id) ?? 1
+      effectiveness: options.effectiveness?.get(id) ?? 1,
+      lexical
     };
   });
   const bm25Ranks = rankMap(scored.map((s) => ({ id: s.id, value: s.bm25 })));
@@ -35738,7 +35990,8 @@ function rankLessons(graph, query, matches, options = {}) {
       matchedTriggers: s.matchedTriggers,
       bm25: s.bm25,
       specificity: s.specificity,
-      topicCoherence: s.topicCoherence
+      topicCoherence: s.topicCoherence,
+      ...s.lexical === true ? { lexical: true } : {}
     }
   })).sort((a, b) => {
     if (b.score !== a.score) return b.score - a.score;