agentsmesh 0.36.0 → 0.37.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.37.0
+
+### Minor Changes
+
+- f5ab3d1: **Changed — writes are atomic and stay inside the project.** Every generated file is written through an exclusively created temporary file and renamed into place, so a concurrent run or a crash never leaves a half-written file, and a symlink at the destination is replaced rather than followed. `generate` and `convert` reject an output directory that resolves outside the project (or the home directory with `--global`) through a symlink; symlinks that stay inside the boundary keep working. A stale `.generate.lock` left by a dead process is evicted, and one that cannot be removed fails fast with the error instead of retrying forever.
+
+  **Changed — Claude Code.** An explicitly empty canonical file now clears the entries agentsmesh generated: `allow: []`, `deny: []` and `ask: []` remove permission rules, `hooks.yaml` containing `{}` removes hooks, and `mcp.json` containing `{"mcpServers": {}}` removes servers, while every other key in `.claude/settings.json` and `.mcp.json` stays as it was. A missing canonical file still leaves the tool's settings alone.
+
+  **Fixed — MCP server and installs.** `add_mcp_server`, `update_mcp_server` and `remove_mcp_server` keep unrelated servers, unknown server fields and top-level keys of `.agentsmesh/mcp.json`, and refuse to overwrite a malformed file. `create_skill` and `update_skill` validate every supporting path and file size before writing anything, and `SKILL.md` can no longer be replaced through `supportingFiles`. Files written by the MCP server get the same line-ending normalization and executable bit as generated files. `install` stages a pack in a private transaction directory, so a sibling `<pack>.tmp` or `<pack>.old` directory is never touched and a failed swap restores the previous pack. `watch` ignores the new temporary files and no longer re-triggers on its own writes.
+
+### Patch Changes
+
+- 87486d2: **Fixed — output boundary check runs before any write, and under `--dry-run`.** `generate` and `convert` now check every output path and every managed directory of the active targets against the project (or home) boundary before writing anything. Previously a managed directory that produced no output this run — `.cursor/agents` with agents disabled, say — was first checked during stale cleanup, after every file had been written and before the lock was saved, so a symlink escaping the boundary left a half-generated project with no lock and `check` reporting "not initialized" on every rerun. `--dry-run` now runs the same check, so a preview no longer reports OK for a layout the real run rejects. The error names the path, where it resolves to, and the boundary it escapes.
+- f0668ac: Bumped the `smol-toml` production dependency to 1.8.0, clearing GHSA-7w5x-hrqm-74c2 (high) which affects every version up to 1.7.0. `smol-toml` parses `.codex/config.toml`, so the advisory shipped to anyone installing agentsmesh.
+- ce9647d: **Fixed — a token in an install source is no longer written to files you commit.** Installing from `git+https://user:token@host/org/repo.git` recorded the URL verbatim in `installs.yaml`, `pack.yaml` and the install manifest, and used it to name a directory in the remote cache. The credential is now stripped from everything persisted and from cache keys; only the fetch itself sees it, and the same repository resolves to one cache entry whether or not a token was supplied. Authentication for a later `refresh` comes from git's own credential mechanism (a helper, or SSH) rather than from a secret committed alongside the manifest.
+
+  **Fixed — `agentsmesh.yaml` keeps its comments.** Adding an extends entry with `install --extends`, or removing one with `uninstall`, rewrote the file by re-serializing a parsed object, which silently discarded every comment and any key this version does not model. Both paths now edit the document in place.
+
+  **Fixed — `install --name` will not adopt an extends entry you wrote by hand.** A name already used by an entry pointing at a different source is refused with a message naming that source, because `uninstall` removes the row by name — so adopting it meant your entry disappeared along with the pack. Reusing the name of an earlier install of the same source still works.
+
+  **Changed — more skill file types are carried as bytes.** The binary allowlist added Office and design documents (`.xlsx`, `.docx`, `.pptx`, `.psd`, `.ai`, `.sketch`, `.fig`), uncompressed and modern archives (`.tar`, `.zst`, `.br`, `.lz4`), columnar data and model formats (`.parquet`, `.avro`, `.onnx`, `.safetensors`, `.gguf`), and further media and database extensions. A skill shipping a spreadsheet template is no longer corrupted on generate.
+
+- 0ea6be3: **Fixed — `--json` output is complete when you pipe it.** Node writes to a pipe asynchronously, and `process.exit` discards whatever is still queued, so any envelope larger than the pipe buffer reached the consumer as an unparseable fragment: `agentsmesh diff --json | jq` received 64 KiB of a 7 MB document, while the same command redirected to a file was whole. Redirect and pipe now agree at any payload size. Human-readable output on a failing command is covered by the same change.
+
+  **Fixed — seeding the self-serve MCP entry no longer costs you the rest of `mcp.json`.** `init` and `import` add an `agentsmesh` server entry to `.agentsmesh/mcp.json`; that write went through the canonical parser, which models only the fields AgentsMesh itself uses. Every other top-level key and every per-server field it does not model — `cwd`, `disabled`, `timeout` — was dropped on the way back out, and a file that failed to parse was replaced by a document containing nothing but the new entry. The write now patches the raw document, so unknown keys survive verbatim. A file that cannot be rewritten safely (invalid JSON, or JSON with comments a rewrite would discard) is left untouched with a warning naming the reason, matching how the generated-output mergers already treat a file they cannot parse.
+
+- 0b91ded: **Fixed — a rule scoped to one target is no longer dropped when targets share `AGENTS.md`.** Several tools read the same root instruction file, so two rules each scoped with `targets:` to a different one of them produced two different bodies for one path. The resolver kept whichever body was byte-longer and discarded the other silently, so one target's rule simply never appeared. Bodies that differ only inside the embedded-rules block — which is exactly what scoped rules produce — are now combined, keeping every rule and warning that the scoping was widened, because one file cannot differ per target. Where bodies differ outside that block, the run fails with the usual conflict error instead of guessing. The related Codex preference now compares substance rather than byte length: it applies only when one body carries every line of the other.
+
+  **Fixed — ordinary Markdown no longer fails generation.** Three shapes were read as broken local links and aborted the run: link syntax quoted inside inline code (`` `[label](path/to/file.md)` ``, which is how a rule documents the syntax), GFM footnote definitions (`[^1]: prose`), and — for URLs — a path containing parentheses. A Next.js route group such as `apps/(marketing)/package.json` was also truncated to `apps/(marketing)package.json` when the tail matched a real project file, because the protected span stopped at the first parenthesis. URLs now keep balanced parenthesised segments, and the broken-link check skips footnotes and inline code. A path written inside backticks is still rebased as before; only the check treats it as prose.
+
+- 5374565: **Fixed — binary files a skill ships are no longer corrupted.** Supporting files under `.agentsmesh/skills/<name>/` were read as UTF-8 text, so an image, font, archive or PDF had every invalid byte replaced before any generator saw it, and the broken copy was written to every target. Binary payloads now travel as bytes through read, write and checksum, so a skill's diagram or icon arrives intact and `agentsmesh check` no longer reports drift on it the moment it is generated. Text files are unchanged: line-ending normalization and BOM handling still apply to them, and only a fixed list of binary extensions takes the byte path.
+
+  **Fixed — `agentsmesh init` no longer replaces canonical files.** When `agentsmesh.yaml` was missing but `.agentsmesh/` already held real content — deleted by hand, lost in a merge, or never committed — `init` overwrote `rules/_root.md`, `mcp.json`, `hooks.yaml`, `permissions.yaml` and `ignore` with templates and exited 0. The already-initialized error also told users to remove the config file and re-run, which was exactly the sequence that destroyed their work. The scaffold now only fills gaps, and the message explains that re-running `init` is not a reset.
+
+  **Fixed — the lessons merge driver no longer discards the other branch's lessons.** A failing driver does not make git re-merge the file with conflict markers: git leaves your side exactly as it was and marks the path unmerged, so `git add` silently threw away every rule the other branch captured. Three ordinary situations hit that path — both branches creating the graph for the first time (git supplies an empty ancestor), the same rule captured under two ids, and any validation error that already existed in the ancestor. The driver now treats an empty ancestor as an empty graph, ignores errors that predate the merge, and writes the union of both branches whenever it can build one, reserving a non-zero exit for "a human should look at this" instead of "throw work away".
+
+  **Fixed — `agentsmesh install --extends` no longer copies private extends into the shared config.** The entry was merged into the config as loaded, which already included the gitignored `agentsmesh.local.yaml`, so every local-only `extends` entry was written into the committed `agentsmesh.yaml`. The write is now scoped to what the shared file itself declares.
+
 ## 0.36.0
 
 ### Minor Changes

package/README.md

@@ -142,6 +142,8 @@ Built to be depended on: 12,000+ tests on Linux, macOS, and Windows CI, JSON-Sch
 - **Lossless two-way sync.** When a tool has no native slot for a feature, it is embedded with round-trip metadata instead of dropped. [Managed embedding](https://samplexbro.github.io/agentsmesh/reference/managed-embedding/)
 - **Automatic link rebasing.** `.agentsmesh/skills/api-gen/template.hbs` becomes `.claude/skills/...` or `.cursor/skills/...` in each generated file. [Generation pipeline](https://samplexbro.github.io/agentsmesh/reference/generation-pipeline/)
 - **Safe adoption.** `import`, then `diff`, then `generate`, then `check`; nothing is overwritten blind. [Existing-project guide](https://samplexbro.github.io/agentsmesh/guides/existing-project/)
+- **Output directory safety.** `generate` and `convert` reject output directories that resolve outside the project (or home directory with `--global`), checked before any write and under `--dry-run` too. Stale-file cleanup enforces the same boundary.
+- **Safe updates.** Explicitly empty Claude permission, hook, and MCP configurations clear their generated entries. MCP edits preserve untouched server fields and reject malformed files; skill updates validate supporting files before writing.
 - **Migrate between tools.** `convert --from <a> --to <b>` rewrites one tool's config directly into another's. [convert](https://samplexbro.github.io/agentsmesh/cli/convert/)
 - **Global mode.** `~/.agentsmesh/` syncs personal config to `~/.claude/`, `~/.cursor/`, `~/.codex/`, and more; config commands accept `--global`. [Global paths](https://samplexbro.github.io/agentsmesh/reference/supported-tools/#global-mode)
 - **CI-ready.** `check` gates drift, `diff` previews, `merge` rebuilds the lock after a Git conflict, and `lint` warns about content a tool would mishandle. [check](https://samplexbro.github.io/agentsmesh/cli/check/) · [lint](https://samplexbro.github.io/agentsmesh/cli/lint/)

package/dist/canonical.js

@@ -1,13 +1,13 @@
 import { join, basename, dirname, relative, extname, resolve, posix, win32 } from 'path';
-import { access, readdir, readFile, rm, mkdir, lstat, unlink, writeFile, rename, chmod, stat, realpath, mkdtemp, cp } from 'fs/promises';
+import { access, readdir, readFile, rm, mkdir, lstat, open, stat, realpath, rename, writeFile, mkdtemp, cp } from 'fs/promises';
 import { setTimeout } from 'timers/promises';
+import { randomUUID, createHash } from 'crypto';
 import { constants, existsSync, readFileSync, realpathSync, statSync } from 'fs';
 import { parse, stringify, parseDocument, isMap, Document, isSeq, isScalar, Scalar, Pair, YAMLSeq } from 'yaml';
 import { z } from 'zod';
 import { parse as parse$1, stringify as stringify$1 } from 'smol-toml';
 import { Buffer } from 'buffer';
 import { homedir, tmpdir } from 'os';
-import { createHash } from 'crypto';
 import { execFile } from 'child_process';
 import { URL as URL$1 } from 'url';
 import { promisify } from 'util';
@@ -92,13 +92,19 @@ function shouldNormalizeLineEndings(path) {
   const base = basename(path).toLowerCase();
   return TEXT_DOTFILES.has(base);
 }
+function isBinaryPayloadPath(path) {
+  return BINARY_EXTENSIONS.has(extname(path).toLowerCase());
+}
+function payloadEncodingFor(path) {
+  return isBinaryPayloadPath(path) ? "latin1" : "utf-8";
+}
 function normalizeLineEndings(content) {
   return content.replace(/\r\n?/g, "\n");
 }
 function executableModeFor(path) {
   return EXECUTABLE_SCRIPT_EXTENSIONS.has(extname(path).toLowerCase()) ? 493 : void 0;
 }
-var UTF8_BOM, TEXT_EXTENSIONS, TEXT_DOTFILES, EXECUTABLE_SCRIPT_EXTENSIONS;
+var UTF8_BOM, TEXT_EXTENSIONS, TEXT_DOTFILES, BINARY_EXTENSIONS, EXECUTABLE_SCRIPT_EXTENSIONS;
 var init_fs_text_encoding = __esm({
   "src/utils/filesystem/fs-text-encoding.ts"() {
     UTF8_BOM = "\uFEFF";
@@ -143,9 +149,109 @@ var init_fs_text_encoding = __esm({
       ".rooignore",
       ".antigravityignore"
     ]);
+    BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+      ".png",
+      ".jpg",
+      ".jpeg",
+      ".gif",
+      ".bmp",
+      ".ico",
+      ".webp",
+      ".avif",
+      ".tiff",
+      ".pdf",
+      ".zip",
+      ".gz",
+      ".tgz",
+      ".bz2",
+      ".xz",
+      ".7z",
+      ".rar",
+      ".jar",
+      ".woff",
+      ".woff2",
+      ".ttf",
+      ".otf",
+      ".eot",
+      ".mp3",
+      ".mp4",
+      ".wav",
+      ".ogg",
+      ".webm",
+      ".mov",
+      ".wasm",
+      ".bin",
+      ".dat",
+      ".db",
+      ".sqlite",
+      ".so",
+      ".dylib",
+      ".dll",
+      ".exe",
+      ".class",
+      ".pyc",
+      // Office and design documents are zip or proprietary containers.
+      ".xlsx",
+      ".xls",
+      ".docx",
+      ".doc",
+      ".pptx",
+      ".ppt",
+      ".odt",
+      ".ods",
+      ".psd",
+      ".ai",
+      ".sketch",
+      ".fig",
+      ".heic",
+      ".heif",
+      // Archives, columnar data, models and compressed payloads.
+      ".tar",
+      ".zst",
+      ".br",
+      ".lz4",
+      ".parquet",
+      ".avro",
+      ".orc",
+      ".pkl",
+      ".npy",
+      ".npz",
+      ".onnx",
+      ".pt",
+      ".safetensors",
+      ".gguf",
+      ".sqlite3",
+      ".avi",
+      ".mkv",
+      ".flac",
+      ".aac",
+      ".m4a",
+      ".ttc"
+    ]);
     EXECUTABLE_SCRIPT_EXTENSIONS = /* @__PURE__ */ new Set([".sh", ".bash", ".zsh"]);
   }
 });
+async function renameWithRetry(from, to, options = {}) {
+  const attempts = options.attempts ?? 5;
+  const delayMs = options.delayMs ?? 50;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await rename(from, to);
+      return;
+    } catch (err) {
+      const code = err.code;
+      const transient = code !== void 0 && TRANSIENT_RENAME_CODES.has(code);
+      if (!transient || attempt >= attempts - 1) throw err;
+      await setTimeout(delayMs * 2 ** attempt);
+    }
+  }
+}
+var TRANSIENT_RENAME_CODES;
+var init_rename_retry = __esm({
+  "src/utils/filesystem/rename-retry.ts"() {
+    TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY", "ENOTEMPTY", "EEXIST"]);
+  }
+});
 function shouldSkipRecursiveBranch(segments) {
   if (segments.length > MAX_RECURSIVE_DEPTH) return true;
   const counts = /* @__PURE__ */ new Map();
@@ -236,30 +342,10 @@ var init_fs_traverse = __esm({
     MAX_SEGMENT_REPETITIONS = 3;
   }
 });
-async function renameWithRetry(from, to, options = {}) {
-  const attempts = options.attempts ?? 5;
-  const delayMs = options.delayMs ?? 50;
-  for (let attempt = 0; ; attempt++) {
-    try {
-      await rename(from, to);
-      return;
-    } catch (err) {
-      const code = err.code;
-      const transient = code !== void 0 && TRANSIENT_RENAME_CODES.has(code);
-      if (!transient || attempt >= attempts - 1) throw err;
-      await setTimeout(delayMs * 2 ** attempt);
-    }
-  }
-}
-var TRANSIENT_RENAME_CODES;
-var init_rename_retry = __esm({
-  "src/utils/filesystem/rename-retry.ts"() {
-    TRANSIENT_RENAME_CODES = /* @__PURE__ */ new Set(["EPERM", "EACCES", "EBUSY", "ENOTEMPTY", "EEXIST"]);
-  }
-});
 async function readFileSafe(path) {
   try {
-    const data = await readFile(path, "utf-8");
+    const data = await readFile(path, payloadEncodingFor(path));
+    if (isBinaryPayloadPath(path)) return data;
     return data.startsWith(UTF8_BOM) ? data.slice(UTF8_BOM.length) : data;
   } catch (err) {
     const e = err;
@@ -283,40 +369,28 @@ async function writeFileAtomic(path, content, options) {
         { errnoCode: "EISDIR" }
       );
     }
-    if (info.isSymbolicLink()) {
-      await unlink(path).catch((e) => {
-        if (e.code !== "ENOENT") throw e;
-      });
-    }
   } catch (err) {
     if (err instanceof FileSystemError) throw err;
     const e = err;
     if (e.code !== "ENOENT") throw err;
   }
-  const tmpPath = `${path}.tmp`;
+  const tmpPath = `${path}.tmp-${randomUUID()}`;
   const payload = shouldNormalizeLineEndings(path) ? normalizeLineEndings(content) : content;
   const mode = executableModeFor(path);
+  let handle;
+  let ownsTemporaryFile = false;
   try {
-    try {
-      const tmpInfo = await lstat(tmpPath);
-      if (tmpInfo.isSymbolicLink()) {
-        await unlink(tmpPath);
-      }
-    } catch (tmpErr) {
-      if (tmpErr.code !== "ENOENT") throw tmpErr;
-    }
-    const writeOpts = {
-      encoding: "utf-8",
-      flag: "w"
-    };
-    if (mode !== void 0) writeOpts.mode = mode;
-    await writeFile(tmpPath, payload, writeOpts);
-    await rename(tmpPath, path);
-    if (mode !== void 0) {
-      await chmod(path, mode);
-    }
+    handle = await open(tmpPath, "wx", mode);
+    ownsTemporaryFile = true;
+    await handle.writeFile(payload, payloadEncodingFor(path));
+    if (mode !== void 0) await handle.chmod(mode);
+    await handle.close();
+    handle = void 0;
+    await renameWithRetry(tmpPath, path);
   } catch (err) {
-    await rm(tmpPath, { force: true }).catch(() => {
+    await handle?.close().catch(() => {
+    });
+    if (ownsTemporaryFile) await rm(tmpPath, { force: true }).catch(() => {
     });
     const e = err;
     throw new FileSystemError(
@@ -341,6 +415,7 @@ var init_fs = __esm({
   "src/utils/filesystem/fs.ts"() {
     init_errors();
     init_fs_text_encoding();
+    init_rename_retry();
     init_fs_traverse();
     init_fs_text_encoding();
     init_rename_retry();
@@ -487,6 +562,60 @@ var init_boilerplate_filter = __esm({
   }
 });
 
+// src/utils/text/json-comments.ts
+function stripJsonComments(text) {
+  let result2 = "";
+  let i = 0;
+  const len = text.length;
+  while (i < len) {
+    const ch = text[i];
+    if (ch === '"') {
+      result2 += ch;
+      i++;
+      while (i < len) {
+        const sc = text[i];
+        result2 += sc;
+        if (sc === "\\") {
+          i++;
+          if (i < len) {
+            result2 += text[i];
+          }
+        } else if (sc === '"') {
+          break;
+        }
+        i++;
+      }
+      i++;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < len) {
+        if (text[i] === "*" && text[i + 1] === "/") {
+          i += 2;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      i += 2;
+      while (i < len && text[i] !== "\n") {
+        i++;
+      }
+      continue;
+    }
+    result2 += ch;
+    i++;
+  }
+  return result2;
+}
+var init_json_comments = __esm({
+  "src/utils/text/json-comments.ts"() {
+  }
+});
+
 // src/canonical/features/syntax-error.ts
 function failSyntax(filePath2, cause, onParseError) {
   const error = new CanonicalParseError(filePath2, cause);
@@ -536,54 +665,6 @@ function parseServer(raw) {
     env
   };
 }
-function stripJsonComments(text) {
-  let result2 = "";
-  let i = 0;
-  const len = text.length;
-  while (i < len) {
-    const ch = text[i];
-    if (ch === '"') {
-      result2 += ch;
-      i++;
-      while (i < len) {
-        const sc = text[i];
-        result2 += sc;
-        if (sc === "\\") {
-          i++;
-          if (i < len) {
-            result2 += text[i];
-          }
-        } else if (sc === '"') {
-          break;
-        }
-        i++;
-      }
-      i++;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "*") {
-      i += 2;
-      while (i < len) {
-        if (text[i] === "*" && text[i + 1] === "/") {
-          i += 2;
-          break;
-        }
-        i++;
-      }
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      i += 2;
-      while (i < len && text[i] !== "\n") {
-        i++;
-      }
-      continue;
-    }
-    result2 += ch;
-    i++;
-  }
-  return result2;
-}
 async function parseMcp(mcpPath, onParseError) {
   const content = await readFileSafe(mcpPath);
   if (!content) return null;
@@ -606,6 +687,7 @@ async function parseMcp(mcpPath, onParseError) {
 }
 var init_mcp = __esm({
   "src/canonical/features/mcp.ts"() {
+    init_json_comments();
     init_syntax_error();
     init_fs();
   }
@@ -2310,43 +2392,72 @@ function isGlobAdjacent(content, start, end) {
   const next = end < content.length ? content.at(end) : "";
   return prev === "*" || next === "*";
 }
+var NON_REWRITABLE_BARE_FILES, PATH_TOKEN, LINE_NUMBER_SUFFIX;
+var init_link_rebaser_helpers = __esm({
+  "src/core/reference/link-rebaser-helpers.ts"() {
+    init_path_helpers();
+    init_link_format_registry();
+    NON_REWRITABLE_BARE_FILES = /* @__PURE__ */ new Set([
+      "AGENTS.md",
+      "CLAUDE.md",
+      "GEMINI.md",
+      "codex.md",
+      ".windsurfrules",
+      ".cursorrules"
+    ]);
+    PATH_TOKEN = /(?:\.\.[\\/]|\.\/|\.\\|\/[A-Za-z0-9._-]|[A-Za-z]:[\\/][A-Za-z0-9._-]|\.agentsmesh[\\/]|\.claude[\\/]|\.cursor[\\/]|\.github[\\/]|\.continue[\\/]|\.junie[\\/]|\.kiro[\\/]|\.gemini[\\/]|\.clinerules[\\/]|\.cline[\\/]|\.codex[\\/]|\.agents[\\/]|\.windsurf[\\/]|\.roo[\\/]|(?:[A-Za-z0-9._-]+[\\/])+|[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+)[A-Za-z0-9._@%+~:\\/-]*/g;
+    LINE_NUMBER_SUFFIX = /(?::(\d+)){1,2}$/;
+  }
+});
+
+// src/core/reference/protected-ranges.ts
+function extendAcrossBalancedParens(content, end) {
+  let cursor = end;
+  while (content[cursor] === "(") {
+    let depth = 0;
+    let scan = cursor;
+    while (scan < content.length) {
+      const ch = content[scan];
+      if (ch === "(") depth += 1;
+      else if (ch === ")") {
+        depth -= 1;
+        if (depth === 0) break;
+      } else if (ch === void 0 || /\s/.test(ch)) return cursor;
+      scan += 1;
+    }
+    if (depth !== 0) return cursor;
+    cursor = scan + 1;
+    while (cursor < content.length && !/[\s<>()\]]/.test(content.charAt(cursor))) cursor += 1;
+  }
+  return cursor;
+}
 function protectedRanges(content) {
   const ranges = [];
   for (const pattern of getLinkFormatRegistry().protectedSchemes) {
     const globalPattern = pattern.flags.includes("g") ? pattern : new RegExp(pattern.source, `${pattern.flags}g`);
     for (const match of content.matchAll(globalPattern)) {
-      ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+      const start = match.index;
+      ranges.push([start, extendAcrossBalancedParens(content, start + match[0].length)]);
     }
   }
   for (const match of content.matchAll(FENCED_CODE_BLOCK)) {
-    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    ranges.push([match.index, match.index + match[0].length]);
   }
   for (const match of content.matchAll(ROOT_GENERATION_CONTRACT_BLOCK)) {
-    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    ranges.push([match.index, match.index + match[0].length]);
   }
   for (const match of content.matchAll(EMBEDDED_RULES_BLOCK)) {
-    ranges.push([match.index ?? 0, (match.index ?? 0) + match[0].length]);
+    ranges.push([match.index, match.index + match[0].length]);
   }
   return ranges;
 }
-var NON_REWRITABLE_BARE_FILES, FENCED_CODE_BLOCK, ROOT_GENERATION_CONTRACT_BLOCK, EMBEDDED_RULES_BLOCK, PATH_TOKEN, LINE_NUMBER_SUFFIX;
-var init_link_rebaser_helpers = __esm({
-  "src/core/reference/link-rebaser-helpers.ts"() {
-    init_path_helpers();
+var FENCED_CODE_BLOCK, ROOT_GENERATION_CONTRACT_BLOCK, EMBEDDED_RULES_BLOCK;
+var init_protected_ranges = __esm({
+  "src/core/reference/protected-ranges.ts"() {
     init_link_format_registry();
-    NON_REWRITABLE_BARE_FILES = /* @__PURE__ */ new Set([
-      "AGENTS.md",
-      "CLAUDE.md",
-      "GEMINI.md",
-      "codex.md",
-      ".windsurfrules",
-      ".cursorrules"
-    ]);
     FENCED_CODE_BLOCK = /^(?:```|~~~)[^\n]*\n[\s\S]*?^(?:```|~~~)/gm;
     ROOT_GENERATION_CONTRACT_BLOCK = /<!-- agentsmesh:root-generation-contract:start -->[\s\S]*?<!-- agentsmesh:root-generation-contract:end -->/g;
     EMBEDDED_RULES_BLOCK = /<!-- agentsmesh:embedded-rules:start -->[\s\S]*?<!-- agentsmesh:embedded-rules:end -->/g;
-    PATH_TOKEN = /(?:\.\.[\\/]|\.\/|\.\\|\/[A-Za-z0-9._-]|[A-Za-z]:[\\/][A-Za-z0-9._-]|\.agentsmesh[\\/]|\.claude[\\/]|\.cursor[\\/]|\.github[\\/]|\.continue[\\/]|\.junie[\\/]|\.kiro[\\/]|\.gemini[\\/]|\.clinerules[\\/]|\.cline[\\/]|\.codex[\\/]|\.agents[\\/]|\.windsurf[\\/]|\.roo[\\/]|(?:[A-Za-z0-9._-]+[\\/])+|[A-Za-z0-9._-]+\.[A-Za-z0-9._-]+)[A-Za-z0-9._@%+~:\\/-]*/g;
-    LINE_NUMBER_SUFFIX = /(?::(\d+)){1,2}$/;
   }
 });
 
@@ -2839,6 +2950,7 @@ var init_link_rebaser = __esm({
   "src/core/reference/link-rebaser.ts"() {
     init_path_helpers();
     init_link_rebaser_helpers();
+    init_protected_ranges();
     init_link_rebaser_output();
     init_link_rebaser_resolution();
     init_link_uri_encoding();
@@ -8509,7 +8621,7 @@ ${rawBody}`;
   });
 }
 function generateMcp3(canonical) {
-  if (!canonical.mcp || Object.keys(canonical.mcp.mcpServers).length === 0) return [];
+  if (!canonical.mcp) return [];
   const content = JSON.stringify({ mcpServers: canonical.mcp.mcpServers }, null, 2);
   return [{ path: CLAUDE_MCP_JSON, content }];
 }
@@ -8544,14 +8656,12 @@ function generatePermissions4(canonical) {
   if (!canonical.permissions) return [];
   const { allow, deny } = canonical.permissions;
   const ask = canonical.permissions.ask ?? [];
-  if (allow.length === 0 && deny.length === 0 && ask.length === 0) return [];
   const content = JSON.stringify({ permissions: { allow, deny, ask } }, null, 2);
   return [{ path: CLAUDE_SETTINGS, content }];
 }
 function generateHooks3(canonical) {
-  if (!canonical.hooks || Object.keys(canonical.hooks).length === 0) return [];
+  if (!canonical.hooks) return [];
   const claudeHooks = buildClaudeHooksObjectFromCanonical(canonical);
-  if (Object.keys(claudeHooks).length === 0) return [];
   const content = JSON.stringify({ hooks: claudeHooks }, null, 2);
   return [{ path: CLAUDE_SETTINGS, content }];
 }
@@ -20369,9 +20479,9 @@ var init_config_toml = __esm({
 function isValidKimiPermissionPattern(pattern) {
   const trimmed = pattern.trim();
   if (trimmed.length === 0) return false;
-  const open = trimmed.indexOf("(");
-  if (open === -1) return true;
-  return trimmed.endsWith(")") && open > 0;
+  const open2 = trimmed.indexOf("(");
+  if (open2 === -1) return true;
+  return trimmed.endsWith(")") && open2 > 0;
 }
 function listOf(permissions, key) {
   return permissions[key] ?? [];
@@ -29130,6 +29240,14 @@ function redactUrlSecrets(message) {
     }
   );
 }
+function stripUrlCredentials(url) {
+  return url.replace(
+    URL_WITH_CREDENTIALS,
+    (_full, scheme, _userinfo, rest) => {
+      return `${scheme}${rest}`;
+    }
+  );
+}
 function gitProtocolOptIns() {
   const on = (v) => v === "1" || v === "true";
   return {
@@ -29528,6 +29646,7 @@ async function sweepStaleCache(cacheDir, maxAgeMs) {
 var MAX_CACHE_KEY_LENGTH = 80;
 var CACHE_KEY_HASH_LENGTH = 12;
 function buildCacheKey(provider, identifier, ref) {
+  identifier = stripUrlCredentials(identifier);
   const safe = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_").replace(/^\.+/, "_");
   const [org, repo] = provider === "github" ? identifier.split("/", 2) : [];
   const readable = org && repo ? `${safe(org)}--${safe(repo)}--${safe(ref)}` : `${safe(provider)}__${safe(identifier)}__${safe(ref)}`;