agentsmesh 0.41.0 → 0.42.0

package/dist/index.js

@@ -1,8 +1,8 @@
-import { readFileSync, existsSync, mkdirSync, writeFileSync, constants, rmSync, readdirSync, statSync, chmodSync, renameSync, accessSync, realpathSync, rmdirSync, unlinkSync } from 'fs';
-import { join, resolve, relative, sep, dirname, basename, extname, win32, posix } from 'path';
+import { readFileSync, existsSync, mkdirSync, writeFileSync, constants, rmSync, realpathSync, readdirSync, statSync, chmodSync, renameSync, accessSync, lstatSync, rmdirSync, unlinkSync } from 'fs';
+import { join, relative, sep, resolve, dirname, basename, extname, win32, posix } from 'path';
 import { stringify, parse, parseDocument, YAMLSeq, isMap, Document, isSeq, YAMLMap, isScalar, Scalar, Pair } from 'yaml';
 import { z } from 'zod';
-import { access, readdir, mkdir, readFile, rm, writeFile, lstat, open, stat, realpath, rmdir, unlink, rename, mkdtemp, cp } from 'fs/promises';
+import { access, readdir, mkdir, readFile, lstat, rm, writeFile, open, stat, realpath, rmdir, unlink, rename, mkdtemp, cp } from 'fs/promises';
 import { setTimeout } from 'timers/promises';
 import { createHash, randomUUID } from 'crypto';
 import picomatch from 'picomatch';
@@ -1579,25 +1579,6 @@ var init_no_outputs = __esm({
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function managedBlockPattern(start, end) {
-  return new RegExp(`${escapeRegExp(start)}[\\s\\S]*?${escapeRegExp(end)}`, "g");
-}
-function stripManagedBlock(content, start, end) {
-  return content.replace(managedBlockPattern(start, end), "").trim();
-}
-function splitFrontmatterPrefix(content) {
-  const split = splitFrontmatter(content);
-  return split === null ? { prefix: "", body: content.trim() } : { prefix: split.prefix, body: split.body };
-}
-function insertAtBodyTop(content, block) {
-  const { prefix, body } = splitFrontmatterPrefix(content);
-  const placed = body ? `${block}
-
-${body}` : block;
-  return prefix ? `${prefix}
-
-${placed}` : placed;
-}
 function ruleSource(source) {
   const normalized = source.replace(/\\/g, "/");
   const meshIndex = normalized.lastIndexOf(".agentsmesh/");
@@ -1605,36 +1586,22 @@ function ruleSource(source) {
   if (normalized.startsWith("rules/")) return normalized;
   return join("rules", basename(normalized)).replace(/\\/g, "/");
 }
-function markerForRule(rule) {
-  return {
+function renderEmbeddedRule(rule) {
+  const marker = {
     source: ruleSource(rule.source),
     description: rule.description,
     globs: rule.globs,
     targets: rule.targets
   };
-}
-function embeddedRuleStart(rule) {
-  return `${EMBEDDED_RULE_START_PREFIX}${JSON.stringify(markerForRule(rule))}${EMBEDDED_RULE_START_SUFFIX}`;
-}
-function renderRule(rule) {
-  const parts = [embeddedRuleStart(rule)];
+  const parts = [`${START_PREFIX}${JSON.stringify(marker)}${START_SUFFIX}`];
   if (rule.description.trim()) {
     parts.push(`## ${rule.description.trim()}`, "");
   }
   parts.push(rule.body.trim(), EMBEDDED_RULE_END);
   return parts.filter((part) => part.length > 0).join("\n");
 }
-function renderEmbeddedRulesBlock(rules) {
-  if (rules.length === 0) return "";
-  return [EMBEDDED_RULES_START, ...rules.map(renderRule), EMBEDDED_RULES_END].join("\n");
-}
-function appendEmbeddedRulesBlock(content, rules) {
-  const block = renderEmbeddedRulesBlock(rules);
-  const withoutExisting = stripManagedBlock(content, EMBEDDED_RULES_START, EMBEDDED_RULES_END);
-  if (!block) return withoutExisting;
-  return withoutExisting ? `${withoutExisting}
-
-${block}` : block;
+function renderEmbeddedRuleEntries(rules) {
+  return rules.map(renderEmbeddedRule).join("\n\n");
 }
 function toStringArray2(value) {
   return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
@@ -1661,26 +1628,67 @@ function stripGeneratedHeading(body, description) {
   const heading = `## ${description.trim()}`;
   return trimmed.startsWith(heading) ? trimmed.slice(heading.length).trim() : trimmed;
 }
+function takeEmbeddedRuleEntries(text) {
+  const rules = [];
+  const entry = new RegExp(
+    `${escapeRegExp(START_PREFIX)}([\\s\\S]*?)${escapeRegExp(START_SUFFIX)}([\\s\\S]*?)${escapeRegExp(EMBEDDED_RULE_END)}`,
+    "g"
+  );
+  const rest = text.replace(entry, (whole, markerText, body) => {
+    const marker = parseMarker(markerText);
+    if (!marker) return whole;
+    rules.push({ ...marker, body: stripGeneratedHeading(body, marker.description) });
+    return "";
+  });
+  return { rest: rest.trim(), rules };
+}
+var EMBEDDED_RULE_END, START_PREFIX, START_SUFFIX;
+var init_embedded_rule_entries = __esm({
+  "src/targets/projection/embedded-rule-entries.ts"() {
+    EMBEDDED_RULE_END = "<!-- agentsmesh:embedded-rule:end -->";
+    START_PREFIX = "<!-- agentsmesh:embedded-rule:start ";
+    START_SUFFIX = " -->";
+  }
+});
+
+// src/targets/projection/managed-blocks.ts
+function managedBlockPattern(start, end) {
+  return new RegExp(`${escapeRegExp(start)}[\\s\\S]*?${escapeRegExp(end)}`, "g");
+}
+function stripManagedBlock(content, start, end) {
+  return content.replace(managedBlockPattern(start, end), "").trim();
+}
+function splitFrontmatterPrefix(content) {
+  const split = splitFrontmatter(content);
+  return split === null ? { prefix: "", body: content.trim() } : { prefix: split.prefix, body: split.body };
+}
+function insertAtBodyTop(content, block) {
+  const { prefix, body } = splitFrontmatterPrefix(content);
+  const placed = body ? `${block}
+
+${body}` : block;
+  return prefix ? `${prefix}
+
+${placed}` : placed;
+}
+function renderEmbeddedRulesBlock(rules) {
+  if (rules.length === 0) return "";
+  return [EMBEDDED_RULES_START, ...rules.map(renderEmbeddedRule), EMBEDDED_RULES_END].join("\n");
+}
+function appendEmbeddedRulesBlock(content, rules) {
+  const block = renderEmbeddedRulesBlock(rules);
+  const withoutExisting = stripManagedBlock(content, EMBEDDED_RULES_START, EMBEDDED_RULES_END);
+  if (!block) return withoutExisting;
+  return withoutExisting ? `${withoutExisting}
+
+${block}` : block;
+}
 function extractEmbeddedRules(content) {
   const rules = [];
   const outerPattern = managedBlockPattern(EMBEDDED_RULES_START, EMBEDDED_RULES_END);
   const rootContent = content.replace(outerPattern, (block) => {
-    const inner = block.replace(EMBEDDED_RULES_START, "").replace(EMBEDDED_RULES_END, "").trim();
-    const entryPattern = new RegExp(
-      `${escapeRegExp(EMBEDDED_RULE_START_PREFIX)}([\\s\\S]*?)${escapeRegExp(EMBEDDED_RULE_START_SUFFIX)}([\\s\\S]*?)${escapeRegExp(EMBEDDED_RULE_END)}`,
-      "g"
-    );
-    for (const match of inner.matchAll(entryPattern)) {
-      const markerText = match[1];
-      const body = match[2];
-      if (markerText === void 0 || body === void 0) continue;
-      const marker = parseMarker(markerText);
-      if (!marker) continue;
-      rules.push({
-        ...marker,
-        body: stripGeneratedHeading(body, marker.description)
-      });
-    }
+    const inner = block.replace(EMBEDDED_RULES_START, "").replace(EMBEDDED_RULES_END, "");
+    rules.push(...takeEmbeddedRuleEntries(inner).rules);
     return "";
   });
   return { rootContent: rootContent.trim(), rules };
@@ -1693,19 +1701,18 @@ function embeddedRootRule(canonical, target34, rootFile) {
   const content = appendEmbeddedRulesBlock(rootBody, nonRootRules);
   return content ? [{ path: rootFile, content }] : [];
 }
-var ROOT_CONTRACT_START, ROOT_CONTRACT_END, LESSONS_CONTRACT_START, LESSONS_CONTRACT_END, EMBEDDED_RULES_START, EMBEDDED_RULES_END, EMBEDDED_RULE_END, EMBEDDED_RULE_START_PREFIX, EMBEDDED_RULE_START_SUFFIX;
+var ROOT_CONTRACT_START, ROOT_CONTRACT_END, LESSONS_CONTRACT_START, LESSONS_CONTRACT_END, EMBEDDED_RULES_START, EMBEDDED_RULES_END;
 var init_managed_blocks = __esm({
   "src/targets/projection/managed-blocks.ts"() {
     init_markdown();
+    init_embedded_rule_entries();
+    init_embedded_rule_entries();
     ROOT_CONTRACT_START = "<!-- agentsmesh:root-generation-contract:start -->";
     ROOT_CONTRACT_END = "<!-- agentsmesh:root-generation-contract:end -->";
     LESSONS_CONTRACT_START = "<!-- agentsmesh:lessons-contract:start -->";
     LESSONS_CONTRACT_END = "<!-- agentsmesh:lessons-contract:end -->";
     EMBEDDED_RULES_START = "<!-- agentsmesh:embedded-rules:start -->";
     EMBEDDED_RULES_END = "<!-- agentsmesh:embedded-rules:end -->";
-    EMBEDDED_RULE_END = "<!-- agentsmesh:embedded-rule:end -->";
-    EMBEDDED_RULE_START_PREFIX = "<!-- agentsmesh:embedded-rule:start ";
-    EMBEDDED_RULE_START_SUFFIX = " -->";
   }
 });
 
@@ -2997,6 +3004,8 @@ function rewriteFileLinks(input) {
     const lineNumSuffix = lineNumMatch ? lineNumMatch[0] : "";
     if (!rawCandidate) return match;
     const tokenContext = getTokenContext(fullContent, offset, offset + rawCandidate.length);
+    if (input.markdownLinksOnly === true && tokenContext.role !== "markdown-link-dest")
+      return match;
     const candidate = decodeLinkPath(rawCandidate, tokenContext.role);
     if (tokenContext.role !== "markdown-link-dest" && WINDOWS_ABSOLUTE_PATH.test(candidate)) {
       return match;
@@ -3171,13 +3180,12 @@ var init_import_rewriter = __esm({
 });
 async function writeMcpWithMerge(projectRoot, canonicalPath, imported) {
   const destPath = join(projectRoot, canonicalPath);
-  const existing = await readExistingServers(destPath);
+  const existing = parseMcpServers(await readFileSafe(destPath));
   const merged = { ...existing, ...imported };
   await mkdirp(dirname(destPath));
   await writeFileAtomic(destPath, JSON.stringify({ mcpServers: merged }, null, 2));
 }
-async function readExistingServers(path) {
-  const content = await readFileSafe(path);
+function parseMcpServers(content) {
   if (content === null) return {};
   let parsed;
   try {
@@ -7215,12 +7223,14 @@ function canonicalRulePath(source) {
 }
 async function splitEmbeddedRulesToCanonical(input) {
   const extracted = extractEmbeddedRules(input.content);
+  const results = await writeEmbeddedRules(extracted.rules, input);
+  return { rootContent: extracted.rootContent, results };
+}
+async function writeEmbeddedRules(rules, input) {
   const results = [];
-  if (extracted.rules.length === 0) {
-    return { rootContent: extracted.rootContent, results };
-  }
+  if (rules.length === 0) return results;
   await mkdirp(join(input.projectRoot, input.rulesDir));
-  for (const rule of extracted.rules) {
+  for (const rule of rules) {
     const canonicalSource = canonicalRulePath(rule.source);
     if (canonicalSource === null || canonicalSource === "rules/_root.md") continue;
     const destPath = join(input.projectRoot, ".agentsmesh", canonicalSource);
@@ -7230,6 +7240,7 @@ async function splitEmbeddedRulesToCanonical(input) {
       destPath,
       {
         ...frontmatter,
+        ...input.frontmatter,
         root: false,
         description: rule.description || void 0,
         globs: rule.globs.length > 0 ? rule.globs : void 0,
@@ -7245,13 +7256,19 @@ async function splitEmbeddedRulesToCanonical(input) {
       feature: "rules"
     });
   }
-  return { rootContent: extracted.rootContent, results };
+  return results;
+}
+async function splitNestedAgentsFile(input, into) {
+  const { rest, rules } = takeEmbeddedRuleEntries(input.content);
+  into.push(...await writeEmbeddedRules(rules, input));
+  return rest.length > 0 ? rest : null;
 }
 var init_embedded_rules = __esm({
   "src/targets/import/embedded-rules.ts"() {
     init_fs();
     init_markdown();
     init_managed_blocks();
+    init_embedded_rule_entries();
     init_import_metadata();
   }
 });
@@ -8679,7 +8696,7 @@ function generateRules6(canonical) {
     const slug = basename(rule.source, ".md");
     const frontmatter = {};
     if (rule.description) frontmatter.description = rule.description;
-    if (rule.globs.length > 0) frontmatter.globs = rule.globs;
+    if (rule.globs.length > 0) frontmatter.paths = rule.globs;
     const content = serializeFrontmatter(frontmatter, rule.body.trim() || "");
     outputs.push({ path: `${CLAUDE_RULES_DIR}/${slug}.md`, content });
   }
@@ -9061,12 +9078,14 @@ var init_import_mappers2 = __esm({
     }) => {
       const destPath = join(destDir, relativePath);
       const { frontmatter, body } = parseFrontmatter(normalizeTo(destPath));
+      const { paths: paths2, ...rest } = frontmatter;
+      const scoped = paths2 === void 0 ? {} : { globs: toToolsArray(paths2) };
       return {
         destPath,
         toPath: `${AB_RULES}/${relativePath}`,
         content: await serializeImportedRuleWithFallback(
           destPath,
-          { ...frontmatter, root: false },
+          { ...rest, ...scoped, root: false },
           body
         )
       };
@@ -10571,7 +10590,7 @@ function generateRules8(canonical) {
   const rootBody = canonical.rules.find((rule) => rule.root)?.body.trim() ?? "";
   if (rootBody) outputs.push({ path: CODEBUFF_ROOT_FILE, content: rootBody });
   for (const [path, rules] of groupByNestedPath(eligibleRules(canonical))) {
-    const content = rules.map((rule) => rule.body.trim()).filter((body) => body.length > 0).join("\n\n");
+    const content = renderEmbeddedRuleEntries(rules.filter((rule) => rule.body.trim().length > 0));
     if (content) outputs.push({ path, content });
   }
   return outputs;
@@ -10599,6 +10618,7 @@ var init_generator8 = __esm({
     init_no_outputs();
     init_embedded_skill();
     init_managed_blocks();
+    init_embedded_rule_entries();
     init_command_skill();
     init_nested_rules();
     init_mcp_format2();
@@ -10648,33 +10668,47 @@ function isVendored(relDir) {
 }
 async function importNestedRules(projectRoot, normalize) {
   const destDir = join(projectRoot, AB_RULES);
-  return importFileDirectory({
+  const embedded = [];
+  const results = await importFileDirectory({
     srcDir: projectRoot,
     destDir,
     extensions: [CODEBUFF_ROOT_FILE],
     fromTool: CODEBUFF_TARGET,
     normalize,
-    mapEntry: ({ srcPath, normalizeTo }) => {
+    mapEntry: async ({ srcPath, content, normalizeTo }) => {
       if (basename(srcPath) !== CODEBUFF_ROOT_FILE) return null;
       const relDir = relative(projectRoot, dirname(srcPath)).replace(/\\/g, "/");
       if (!relDir || relDir === ".") return null;
       if (!shouldImportScopedAgentsRule(relDir)) return null;
       if (isVendored(relDir)) return null;
+      const ownText = await splitNestedAgentsFile(
+        {
+          content,
+          projectRoot,
+          rulesDir: AB_RULES,
+          sourcePath: srcPath,
+          fromTool: CODEBUFF_TARGET,
+          normalize
+        },
+        embedded
+      );
+      if (ownText === null) return null;
       const ruleName2 = relDir.replace(/\//g, "-");
       const destPath = join(destDir, `${ruleName2}.md`);
-      const { frontmatter, body } = parseFrontmatter(normalizeTo(destPath));
-      return serializeImportedRuleWithFallback(
-        destPath,
-        { ...frontmatter, root: false, globs: [`${relDir}/**`] },
-        body
-      ).then((content) => ({
+      const { frontmatter, body } = parseFrontmatter(normalizeTo(destPath, ownText));
+      return {
         destPath,
         toPath: `${AB_RULES}/${ruleName2}.md`,
         feature: "rules",
-        content
-      }));
+        content: await serializeImportedRuleWithFallback(
+          destPath,
+          { ...frontmatter, root: false, globs: [`${relDir}/**`] },
+          body
+        )
+      };
     }
   });
+  return [...results, ...embedded];
 }
 async function importCodebuffRules(projectRoot, scope, normalize) {
   const results = await importRootRule2(projectRoot, scope, normalize);
@@ -11107,7 +11141,7 @@ function generateRules9(canonical) {
   }
   const nested = advisory.filter((rule) => !isRootEmbedded(rule));
   for (const [path, rules] of groupByNestedPath2(nested)) {
-    const content = rules.map((rule) => rule.body.trim()).filter((body) => body.length > 0).join("\n\n");
+    const content = renderEmbeddedRuleEntries(rules.filter((rule) => rule.body.trim().length > 0));
     outputs.push({ path, content });
   }
   return outputs;
@@ -11120,6 +11154,7 @@ function renderCodexGlobalInstructions(canonical) {
 var init_rules = __esm({
   "src/targets/codex-cli/generator/rules.ts"() {
     init_managed_blocks();
+    init_embedded_rule_entries();
     init_constants10();
     init_codex_rule_paths();
   }
@@ -11749,6 +11784,7 @@ async function importCodexRules(projectRoot, results, normalize, normalizeWindsu
   await importInstructionMirrors(projectRoot, destDir, results, normalize);
   results.push(...await importCodexNonRootRuleFiles(projectRoot, destDir, normalize));
   if (layoutScope !== "global") {
+    const embedded = [];
     results.push(
       ...await importFileDirectory({
         srcDir: projectRoot,
@@ -11756,7 +11792,7 @@ async function importCodexRules(projectRoot, results, normalize, normalizeWindsu
         extensions: ["AGENTS.md", "AGENTS.override.md"],
         fromTool: "codex-cli",
         normalize,
-        mapEntry: async ({ srcPath, normalizeTo }) => {
+        mapEntry: async ({ srcPath, content: content2, normalizeTo }) => {
           const relDir = relative(projectRoot, dirname(srcPath)).replace(/\\/g, "/");
           const fileName = basename(srcPath);
           const isOverride = fileName === "AGENTS.override.md";
@@ -11767,26 +11803,36 @@ async function importCodexRules(projectRoot, results, normalize, normalizeWindsu
             await removePathIfExists(join(destDir, `${ruleName2}.md`));
             return null;
           }
+          const variant = isOverride ? { codex_instruction: "override" } : {};
+          const ownText = await splitNestedAgentsFile(
+            {
+              content: content2,
+              projectRoot,
+              rulesDir: AB_RULES,
+              sourcePath: srcPath,
+              fromTool: "codex-cli",
+              normalize,
+              frontmatter: variant
+            },
+            embedded
+          );
+          if (ownText === null) return null;
           const destPath = join(destDir, `${ruleName2}.md`);
-          const { frontmatter, body } = parseFrontmatter(normalizeTo(destPath));
+          const { frontmatter, body } = parseFrontmatter(normalizeTo(destPath, ownText));
           return {
             destPath,
             toPath: `${AB_RULES}/${ruleName2}.md`,
             feature: "rules",
             content: await serializeImportedRuleWithFallback(
               destPath,
-              {
-                ...frontmatter,
-                root: false,
-                globs: [`${relDir}/**`],
-                ...isOverride ? { codex_instruction: "override" } : {}
-              },
+              { ...frontmatter, root: false, globs: [`${relDir}/**`], ...variant },
               body
             )
           };
         }
       })
     );
+    results.push(...embedded);
   }
 }
 async function importInstructionMirrors(projectRoot, destDir, results, normalize) {
@@ -18410,7 +18456,7 @@ function parseExtensions(content) {
   }
   return out2;
 }
-async function readExistingServers2(destPath) {
+async function readExistingServers(destPath) {
   const content = await readFileSafe(destPath);
   if (content === null) return {};
   let parsed;
@@ -18433,7 +18479,7 @@ async function gooseMcpMap(ctx) {
   const imported = ctx.relativePath.endsWith(".mcp.json") ? parsePluginMcpJson(ctx.content) : parseExtensions(ctx.content);
   if (Object.keys(imported).length === 0) return null;
   const destPath = join(ctx.destDir, "mcp.json");
-  const existing = await readExistingServers2(destPath);
+  const existing = await readExistingServers(destPath);
   const merged = { ...existing, ...imported };
   return {
     destPath,
@@ -26988,12 +27034,6 @@ function ruleSlug3(source) {
   const name = basename(source, ".md");
   return name === "_root" ? "root" : name;
 }
-function directoryScopedRuleDir(globs) {
-  if (globs.length === 0) return null;
-  const dirs = globs.map((glob) => glob.split("/")[0] ?? "").filter((segment) => /^[A-Za-z0-9._-]+$/.test(segment));
-  if (dirs.length !== globs.length) return null;
-  return dirs.every((dir) => dir === dirs[0]) ? dirs[0] : null;
-}
 function generateRules32(canonical) {
   const outputs = [];
   const root = canonical.rules.find((r) => r.root);
@@ -27010,21 +27050,14 @@ function generateRules32(canonical) {
     const frontmatter = {
       description: rule.description || void 0,
       trigger: normalizedTrigger,
-      glob: rule.globs.length === 1 ? rule.globs[0] : void 0,
-      globs: rule.globs.length > 1 ? rule.globs : void 0
+      // Windsurf reads `globs` as one comma-joined string; it ignores `glob`.
+      globs: rule.globs.length > 0 ? rule.globs.join(",") : void 0
     };
     Object.keys(frontmatter).forEach((k) => {
       if (frontmatter[k] === void 0) delete frontmatter[k];
     });
     const content = Object.keys(frontmatter).length > 0 ? serializeFrontmatter(frontmatter, rule.body.trim() || "") : rule.body.trim() || "";
     outputs.push({ path: `${WINDSURF_RULES_DIR}/${slug}.md`, content });
-    const dir = directoryScopedRuleDir(rule.globs);
-    if (dir) {
-      if (dir !== slug) {
-        outputs.push({ path: `${WINDSURF_RULES_DIR}/${dir}.md`, content });
-      }
-      outputs.push({ path: `${dir}/AGENTS.md`, content: rule.body.trim() || "" });
-    }
   }
   return outputs;
 }
@@ -27224,6 +27257,185 @@ var init_generator36 = __esm({
     init_generator35();
   }
 });
+
+// src/utils/output/color.ts
+function noColorRequested() {
+  const value = process.env.NO_COLOR;
+  return value !== void 0 && value !== "";
+}
+function forceColorRequested() {
+  const value = process.env.FORCE_COLOR;
+  if (value === void 0) return void 0;
+  return value !== "0" && value !== "false";
+}
+function colorEnabled(stream = process.stdout) {
+  const forced = forceColorRequested();
+  if (forced !== void 0) return forced;
+  if (noColorRequested()) return false;
+  return stream.isTTY === true;
+}
+var init_color = __esm({
+  "src/utils/output/color.ts"() {
+  }
+});
+
+// src/utils/output/logger.ts
+function outStream() {
+  return stdoutRedirectedToStderr ? process.stderr : process.stdout;
+}
+function out(text) {
+  outStream().write(text);
+}
+function c(code, text, stream) {
+  return colorEnabled(stream) ? `${code}${text}${C.reset}` : text;
+}
+var C, muted, stdoutRedirectedToStderr, logger;
+var init_logger = __esm({
+  "src/utils/output/logger.ts"() {
+    init_color();
+    C = {
+      green: "\x1B[32m",
+      red: "\x1B[31m",
+      yellow: "\x1B[33m",
+      cyan: "\x1B[36m",
+      reset: "\x1B[0m"
+    };
+    muted = false;
+    stdoutRedirectedToStderr = false;
+    logger = {
+      info(msg) {
+        if (muted) return;
+        out(c(C.cyan, msg, outStream()) + "\n");
+      },
+      warn(msg) {
+        if (muted) return;
+        process.stderr.write(c(C.yellow, "\u26A0 ", process.stderr) + msg + "\n");
+      },
+      error(msg) {
+        if (muted) return;
+        process.stderr.write(c(C.red, "\u2717 ", process.stderr) + msg + "\n");
+      },
+      success(msg) {
+        if (muted) return;
+        out(c(C.green, "\u2713 ", outStream()) + msg + "\n");
+      },
+      debug(msg) {
+        if (muted) return;
+        if (process.env.AGENTSMESH_DEBUG === "1") {
+          out(c(C.cyan, "[debug] ", outStream()) + msg + "\n");
+        }
+      }
+    };
+  }
+});
+
+// src/targets/windsurf/rule-globs.ts
+function splitTopLevelCommas(value) {
+  const parts = [];
+  let depth = 0;
+  let current = "";
+  for (const char of value) {
+    if (char === "{") depth++;
+    else if (char === "}") depth = Math.max(0, depth - 1);
+    if (char === "," && depth === 0) {
+      parts.push(current);
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  parts.push(current);
+  return parts.map((part) => part.trim()).filter(Boolean);
+}
+function parseWindsurfGlobs(value) {
+  if (typeof value === "string") return splitTopLevelCommas(value);
+  return Array.isArray(value) ? toToolsArray(value) : [];
+}
+function quoteWindsurfGlobValues(content) {
+  const lines = content.split("\n");
+  if (lines[0]?.trim() !== "---") return content;
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i].trim() === "---") break;
+    const match = UNQUOTED_GLOBS_LINE.exec(lines[i]);
+    if (match !== null) lines[i] = `${match[1]}${JSON.stringify(match[2])}${match[3]}`;
+  }
+  return lines.join("\n");
+}
+var UNQUOTED_GLOBS_LINE;
+var init_rule_globs = __esm({
+  "src/targets/windsurf/rule-globs.ts"() {
+    init_shared_import_helpers();
+    UNQUOTED_GLOBS_LINE = /^(\s*globs?\s*:[ \t]*)([^\s"'[{|>#][^\r\n]*?)[ \t]*(\r?)$/;
+  }
+});
+async function windsurfRuleBodies(projectRoot) {
+  const files = await readDirRecursiveNoSymlinks(join(projectRoot, WINDSURF_RULES_DIR));
+  const bodies = /* @__PURE__ */ new Set();
+  for (const file of files.filter((path) => path.endsWith(".md"))) {
+    const content = await readFileSafe(file);
+    if (content !== null) bodies.add(bodyKey(splitFrontmatter(content)?.body ?? content));
+  }
+  return bodies;
+}
+async function importWindsurfNestedAgents(projectRoot, normalize) {
+  const destRulesDir = join(projectRoot, AB_RULES);
+  const embedded = [];
+  const ruleBodies = await windsurfRuleBodies(projectRoot);
+  const results = await importFileDirectory({
+    srcDir: projectRoot,
+    destDir: destRulesDir,
+    extensions: ["AGENTS.md"],
+    fromTool: "windsurf",
+    normalize,
+    mapEntry: async ({ srcPath, content, normalizeTo }) => {
+      const relDir = relative(projectRoot, dirname(srcPath)).replace(/\\/g, "/");
+      if (!relDir || relDir === "." || basename(srcPath) !== "AGENTS.md") return null;
+      const ruleName2 = relDir.replace(/\//g, "-");
+      if (!shouldImportScopedAgentsRule(relDir)) {
+        await removePathIfExists(join(destRulesDir, `${ruleName2}.md`));
+        return null;
+      }
+      const ownText = await splitNestedAgentsFile(
+        {
+          content,
+          projectRoot,
+          rulesDir: AB_RULES,
+          sourcePath: srcPath,
+          fromTool: "windsurf",
+          normalize
+        },
+        embedded
+      );
+      if (ownText === null || ruleBodies.has(bodyKey(ownText))) return null;
+      const destPath = join(destRulesDir, `${ruleName2}.md`);
+      return {
+        destPath,
+        toPath: `${AB_RULES}/${ruleName2}.md`,
+        feature: "rules",
+        content: await serializeImportedRuleWithFallback(
+          destPath,
+          { root: false, globs: [`${relDir}/**`] },
+          normalizeTo(destPath, ownText)
+        )
+      };
+    }
+  });
+  return [...results, ...embedded];
+}
+var bodyKey;
+var init_import_nested_agents = __esm({
+  "src/targets/windsurf/import-nested-agents.ts"() {
+    init_canonical_paths();
+    init_embedded_rules();
+    init_import_metadata();
+    init_import_orchestrator();
+    init_scoped_agents_import();
+    init_fs();
+    init_markdown();
+    init_constants34();
+    bodyKey = (text) => text.replace(/\r\n?/g, "\n").trim();
+  }
+});
 function toStringArray3(value) {
   if (Array.isArray(value)) {
     return value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter(Boolean);
@@ -27492,35 +27704,7 @@ async function importFromWindsurf(projectRoot, options) {
     }
   }
   if (layoutScope !== "global") {
-    results.push(
-      ...await importFileDirectory({
-        srcDir: projectRoot,
-        destDir: destRulesDir,
-        extensions: ["AGENTS.md"],
-        fromTool: "windsurf",
-        normalize,
-        mapEntry: async ({ srcPath, normalizeTo }) => {
-          const relDir = relative(projectRoot, dirname(srcPath)).replace(/\\/g, "/");
-          if (!relDir || relDir === "." || basename(srcPath) !== "AGENTS.md") return null;
-          const ruleName2 = relDir.replace(/\//g, "-");
-          if (!shouldImportScopedAgentsRule(relDir)) {
-            await removePathIfExists(join(destRulesDir, `${ruleName2}.md`));
-            return null;
-          }
-          const destPath = join(destRulesDir, `${ruleName2}.md`);
-          return {
-            destPath,
-            toPath: `${AB_RULES}/${ruleName2}.md`,
-            feature: "rules",
-            content: await serializeImportedRuleWithFallback(
-              destPath,
-              { root: false, globs: [`${relDir}/**`] },
-              normalizeTo(destPath)
-            )
-          };
-        }
-      })
-    );
+    results.push(...await importWindsurfNestedAgents(projectRoot, normalize));
   }
   const rulesDir = join(projectRoot, WINDSURF_RULES_DIR);
   results.push(
@@ -27530,15 +27714,22 @@ async function importFromWindsurf(projectRoot, options) {
       extensions: [".md"],
       fromTool: "windsurf",
       normalize,
-      mapEntry: async ({ relativePath, normalizeTo }) => {
+      mapEntry: async ({ relativePath, content, normalizeTo }) => {
         if (relativePath === "_root.md" && rootContent !== null) return null;
         const destPath = join(destRulesDir, relativePath);
-        const { frontmatter, body } = parseFrontmatter(normalizeTo(destPath));
-        const normalizedFrontmatter = { ...frontmatter };
-        if (typeof normalizedFrontmatter.glob === "string" && normalizedFrontmatter.glob.trim()) {
-          normalizedFrontmatter.globs = [normalizedFrontmatter.glob];
-          delete normalizedFrontmatter.glob;
+        const sourceLabel = `${WINDSURF_RULES_DIR}/${relativePath}`;
+        const parsed = tryParseFrontmatter(
+          normalizeTo(destPath, quoteWindsurfGlobValues(content)),
+          sourceLabel
+        );
+        if (!parsed.ok) {
+          logger.warn(`Skipping ${sourceLabel}: ${parsed.error.message}`);
+          return null;
         }
+        const { frontmatter, body } = parsed.value;
+        const { glob, ...normalizedFrontmatter } = frontmatter;
+        const globs = parseWindsurfGlobs(frontmatter.globs ?? glob);
+        if (globs.length > 0) normalizedFrontmatter.globs = globs;
         return {
           destPath,
           toPath: `${AB_RULES}/${relativePath}`,
@@ -27589,9 +27780,11 @@ var init_importer32 = __esm({
     init_import_rewriter();
     init_fs();
     init_markdown();
+    init_logger();
+    init_rule_globs();
     init_import_metadata();
     init_import_orchestrator();
-    init_scoped_agents_import();
+    init_import_nested_agents();
     init_constants34();
     init_importer_workflows();
     init_skills_adapter5();
@@ -27696,12 +27889,6 @@ var init_lint31 = __esm({
 });
 
 // src/targets/windsurf/index.ts
-function directoryScopedRuleDir2(globs) {
-  if (globs.length === 0) return null;
-  const dirs = globs.map((glob) => glob.split("/")[0] ?? "").filter((segment) => /^[A-Za-z0-9._-]+$/.test(segment));
-  if (dirs.length !== globs.length) return null;
-  return dirs.every((dir) => dir === dirs[0]) ? dirs[0] : null;
-}
 var target32, project24, globalLayout30, globalCapabilities25, descriptor32;
 var init_windsurf2 = __esm({
   "src/targets/windsurf/index.ts"() {
@@ -27733,9 +27920,7 @@ var init_windsurf2 = __esm({
     project24 = {
       rootInstructionPath: WINDSURF_AGENTS_MD,
       extraRuleOutputPaths(rule) {
-        if (rule.root) return [WINDSURF_AGENTS_MD];
-        const dir = directoryScopedRuleDir2(rule.globs);
-        return dir !== null ? [`${dir}/AGENTS.md`] : [];
+        return rule.root ? [WINDSURF_AGENTS_MD] : [];
       },
       skillDir: WINDSURF_SKILLS_DIR,
       managedOutputs: {
@@ -29344,7 +29529,6 @@ function rewriteGeneratedReferences(results, canonical, config, projectRoot, sco
   const artifactCache = /* @__PURE__ */ new Map();
   const sourceCache = /* @__PURE__ */ new Map();
   return results.map((result2) => {
-    if (skipPaths?.has(result2.path)) return result2;
     const smKey = sourceMapCacheKey(result2.target, activeTargets);
     const sourceMap = sourceCache.get(smKey) ?? (() => {
       const built = buildOutputSourceMap(result2.target, canonical, config, scope, activeTargets);
@@ -29353,9 +29537,10 @@ function rewriteGeneratedReferences(results, canonical, config, projectRoot, sco
     })();
     const sourceFile = sourceMap.get(result2.path);
     if (!sourceFile) return result2;
+    const shared = skipPaths?.has(result2.path) === true;
     const artifactMapTarget = artifactMapTargetForResult(result2, scope, activeTargets);
     const cacheKey = artifactCacheKey(result2, scope, activeTargets);
-    const artifactMap = artifactCache.get(cacheKey) ?? (() => {
+    const artifactMap = shared ? /* @__PURE__ */ new Map() : artifactCache.get(cacheKey) ?? (() => {
       const built = buildArtifactPathMap(
         artifactMapTarget,
         canonical,
@@ -29376,6 +29561,7 @@ function rewriteGeneratedReferences(results, canonical, config, projectRoot, sco
       pathExists: (absolutePath) => plannedPaths.has(absolutePath) || existsSync(absolutePath),
       explicitCurrentDirLinks: true,
       rewriteBarePathTokens: true,
+      markdownLinksOnly: shared,
       scope,
       pathIsDirectory: (absolutePath) => {
         try {
@@ -29393,62 +29579,7 @@ function rewriteGeneratedReferences(results, canonical, config, projectRoot, sco
 init_path_helpers();
 init_link_rebaser_helpers();
 init_protected_ranges();
-
-// src/utils/output/color.ts
-function noColorRequested() {
-  const value = process.env.NO_COLOR;
-  return value !== void 0 && value !== "";
-}
-function forceColorRequested() {
-  const value = process.env.FORCE_COLOR;
-  if (value === void 0) return void 0;
-  return value !== "0" && value !== "false";
-}
-function colorEnabled(stream = process.stdout) {
-  const forced = forceColorRequested();
-  if (forced !== void 0) return forced;
-  if (noColorRequested()) return false;
-  return stream.isTTY === true;
-}
-
-// src/utils/output/logger.ts
-var C = {
-  green: "\x1B[32m",
-  red: "\x1B[31m",
-  yellow: "\x1B[33m",
-  cyan: "\x1B[36m",
-  reset: "\x1B[0m"
-};
-function outStream() {
-  return process.stdout;
-}
-function out(text) {
-  outStream().write(text);
-}
-function c(code, text, stream) {
-  return colorEnabled(stream) ? `${code}${text}${C.reset}` : text;
-}
-var logger = {
-  info(msg) {
-    out(c(C.cyan, msg, outStream()) + "\n");
-  },
-  warn(msg) {
-    process.stderr.write(c(C.yellow, "\u26A0 ", process.stderr) + msg + "\n");
-  },
-  error(msg) {
-    process.stderr.write(c(C.red, "\u2717 ", process.stderr) + msg + "\n");
-  },
-  success(msg) {
-    out(c(C.green, "\u2713 ", outStream()) + msg + "\n");
-  },
-  debug(msg) {
-    if (process.env.AGENTSMESH_DEBUG === "1") {
-      out(c(C.cyan, "[debug] ", outStream()) + msg + "\n");
-    }
-  }
-};
-
-// src/core/reference/validate-generated-markdown-links.ts
+init_logger();
 var INLINE_MD_LINK = /!?\[[^\]]*\]\(([^)]+)\)/g;
 var REF_LINK_DEF = /^\s*\[(?!\^)[^\]\n]+\]:\s*(?:<([^>\n]*)>|(\S+))/gm;
 function isMarkdownLikeOutput(relativePath) {
@@ -29680,6 +29811,7 @@ init_fs_text_encoding();
 
 // src/core/generate/collision-agents.ts
 init_target_ids();
+init_logger();
 var AGENTS_SUFFIX = "AGENTS.md";
 var OPTIONAL_AGENTS_BLOCKS = [
   /<!-- agentsmesh:embedded-rules:start -->[\s\S]*?<!-- agentsmesh:embedded-rules:end -->\n*/g
@@ -30040,6 +30172,7 @@ init_errors();
 
 // src/config/core/loader.ts
 init_fs();
+init_logger();
 init_errors();
 
 // src/config/core/schema.ts
@@ -30867,6 +31000,7 @@ async function resolveExtendPaths(config, configDir, options = {}) {
 }
 
 // src/canonical/features/empty-file.ts
+init_logger();
 function isEmptyCanonicalFile(content, path) {
   if (content.trim() !== "") return false;
   logger.warn(`Skipping empty canonical file ${path.replaceAll("\\", "/")}`);
@@ -30968,6 +31102,9 @@ function assertNoBasenameCollisions(feature, paths2, stripExt) {
     seen.set(key, { path: p, slug });
   }
 }
+
+// src/canonical/features/unrecognized-files-warning.ts
+init_logger();
 var ALTERNATE_RESOURCE_FORMATS = /* @__PURE__ */ new Set([".toml", ".yaml", ".yml", ".json"]);
 function warnIfUnrecognizedResourceFormats(featureLabel, dir, allFiles, parsedFiles, opts = {}) {
   if (allFiles.length === 0) return;
@@ -31176,6 +31313,14 @@ async function readContent(path) {
   return c2 ?? "";
 }
 var SKILL_FILE = "SKILL.md";
+async function readSkillFile(skillPath) {
+  try {
+    if ((await lstat(skillPath)).isSymbolicLink()) return null;
+  } catch {
+    return null;
+  }
+  return readFileSafe(skillPath);
+}
 var DOC_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".mdx", ".rst", ".txt"]);
 function isMarkdownLikeDoc(name) {
   const dot = name.lastIndexOf(".");
@@ -31205,7 +31350,7 @@ async function listSupportingFiles(skillDir) {
 }
 async function parseSkillDirectory(skillDir, opts = {}) {
   const skillPath = join(skillDir, SKILL_FILE);
-  const content = await readFileSafe(skillPath);
+  const content = await readSkillFile(skillPath);
   if (!content) return null;
   const parsed = parseOrSkipFrontmatter(content, skillPath, opts.onParseError);
   if (!parsed) return null;
@@ -31236,7 +31381,7 @@ async function parseSkills(skillsDir, opts = {}) {
     assertCanonicalName("skill", ent.name);
     const skillDir = join(skillsDir, ent.name);
     const skillPath = join(skillDir, SKILL_FILE);
-    const content = await readFileSafe(skillPath);
+    const content = await readSkillFile(skillPath);
     if (!content) continue;
     const parsed = parseOrSkipFrontmatter(content, skillPath, opts.onParseError);
     if (!parsed) continue;
@@ -31266,6 +31411,9 @@ function ensureStringArray(val) {
 async function parsePermissions(permissionsPath, onParseError) {
   const content = await readFileSafe(permissionsPath);
   if (content === null) return null;
+  return parsePermissionsContent(content, permissionsPath, onParseError);
+}
+function parsePermissionsContent(content, permissionsPath, onParseError) {
   if (!content.trim()) return { allow: [], deny: [], ask: [] };
   let parsed;
   try {
@@ -31398,6 +31546,20 @@ function hookEvents(a, b) {
 function hookKey(entry) {
   return JSON.stringify([entry.type ?? "command", entry.matcher, entry.command]);
 }
+function settleRootRule(merged, local, packs) {
+  const roots = merged.filter((rule) => rule.root);
+  const root = roots.find((rule) => local.includes(rule)) ?? roots.find((rule) => packs.includes(rule)) ?? roots[0];
+  const demoted = roots.filter((rule) => rule !== root);
+  return {
+    rules: merged.map((rule) => demoted.includes(rule) ? { ...rule, root: false } : rule),
+    root,
+    demoted
+  };
+}
+function demotedRootMessage(rule, root, baseDir) {
+  const shown = (r) => relative(baseDir, r.source).replaceAll("\\", "/");
+  return `[agentsmesh] Rule "${shown(rule)}" also says root: true, but "${shown(root)}" is the root rule (the project's own root wins over installed packs, and packs over extends), so it is used as a normal rule.`;
+}
 
 // src/config/resolve/native-format-detector.ts
 init_fs();
@@ -31443,6 +31605,7 @@ var KNOWN_NATIVE_PATHS = BUILTIN_TARGETS.map(
 
 // src/canonical/extends/extend-load.ts
 init_fs();
+init_logger();
 
 // src/canonical/extends/native-extends-importer.ts
 init_registry();
@@ -32069,6 +32232,9 @@ Expected one of: .agentsmesh/, ${KNOWN_NATIVE_PATHS.join(", ")}.`
     throw wrapped;
   }
 }
+
+// src/canonical/extends/extend-pick.ts
+init_logger();
 function applyExtendPick(canonical, features, pick, extendName) {
   if (!pick) return canonical;
   let next = { ...canonical };
@@ -32261,6 +32427,7 @@ async function loadPacksCanonical(abDir) {
 }
 
 // src/canonical/extends/extends.ts
+init_logger();
 var FEATURE_TO_KEYS = {
   rules: ["rules"],
   commands: ["commands"],
@@ -32309,6 +32476,15 @@ async function loadCanonicalWithExtends(config, configDir, options = {}, canonic
   merged = mergeCanonicalFiles(merged, packsCanonical, { hooks: "combine" });
   const localCanonical = await loadCanonicalFiles(canonicalDir);
   merged = mergeCanonicalFiles(merged, localCanonical);
+  const { rules, root, demoted } = settleRootRule(
+    merged.rules,
+    localCanonical.rules,
+    packsCanonical.rules
+  );
+  if (root !== void 0) {
+    for (const rule of demoted) logger.warn(demotedRootMessage(rule, root, configDir));
+  }
+  merged = { ...merged, rules };
   merged = { ...merged, hooks: combineHooks(merged.hooks, packsCanonical.hooks) };
   return { canonical: merged, resolvedExtends };
 }
@@ -32316,6 +32492,7 @@ async function loadCanonicalWithExtends(config, configDir, options = {}, canonic
 // src/plugins/load-plugin.ts
 init_target_descriptor_schema();
 init_registry();
+init_logger();
 function resolveNpmSpecifier(source, projectRoot) {
   const pkgDir = join(projectRoot, "node_modules", source);
   const pkgJsonPath = join(pkgDir, "package.json");
@@ -32637,6 +32814,113 @@ function parseGraph(raw) {
 function emptyGraph() {
   return { version: CURRENT_GRAPH_VERSION, lessons: {}, topics: {}, triggers: {} };
 }
+async function canonicalizePath(path) {
+  try {
+    return await realpath(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    const parent = dirname(path);
+    if (parent === path) return resolve(path);
+    return join(await canonicalizePath(parent), basename(path));
+  }
+}
+function canonicalizePathSync(path) {
+  try {
+    return realpathSync(path);
+  } catch (error) {
+    if (error.code !== "ENOENT") return null;
+  }
+  try {
+    lstatSync(path);
+    return null;
+  } catch {
+    const parent = dirname(path);
+    if (parent === path) return resolve(path);
+    const realParent = canonicalizePathSync(parent);
+    return realParent === null ? null : join(realParent, basename(path));
+  }
+}
+function resolvesInsideRootSync(root, target34) {
+  const realRoot = canonicalizePathSync(resolve(root));
+  const realTarget = canonicalizePathSync(resolve(target34));
+  return realRoot !== null && realTarget !== null && isPathInside(realTarget, realRoot);
+}
+function isPathInside(target34, root) {
+  return target34 === root || target34.startsWith(root.endsWith(sep) ? root : `${root}${sep}`);
+}
+var display = (path) => path.replaceAll("\\", "/");
+async function assertPathInsideRoot(root, target34) {
+  const rootAbs = resolve(root);
+  const targetAbs = resolve(target34);
+  if (!isPathInside(targetAbs, rootAbs)) {
+    throw new Error(`Unsafe filesystem path: ${display(target34)} is outside ${display(rootAbs)}`);
+  }
+  let realTarget;
+  let realRoot;
+  try {
+    [realTarget, realRoot] = await Promise.all([
+      canonicalizePath(targetAbs),
+      canonicalizePath(rootAbs)
+    ]);
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new Error(
+      `Unsafe filesystem path: ${display(target34)} could not be resolved (${detail})`,
+      { cause }
+    );
+  }
+  if (isPathInside(realTarget, realRoot)) return;
+  throw new Error(
+    `Unsafe filesystem path: ${display(target34)} resolves to ${display(realTarget)} outside ${display(realRoot)}`
+  );
+}
+var BASE_REL = ".agentsmesh/lessons";
+function lessonsPaths(projectRoot) {
+  const base = join(projectRoot, BASE_REL);
+  return {
+    base,
+    graph: join(base, "lessons.json"),
+    config: join(base, "config.json"),
+    journal: join(base, "journal.md"),
+    index: join(base, "index.yaml"),
+    topicsDir: join(base, "topics")
+  };
+}
+function toRelPath(projectRoot, absolute) {
+  return relative(projectRoot, absolute).split(sep).join("/");
+}
+var LESSONS_PROCEDURAL_RULE = `## Lessons (BLOCKING)
+
+Graph \`.agentsmesh/lessons/lessons.json\` is canonical; never hand-edit it. Manual: \`lessons\` skill.
+
+**Recall:** before every file edit or state-changing command, MUST run \`agentsmesh lessons query --file <path> --cmd <command> --session auto\` and obey matches; at task start, ALSO run \`agentsmesh lessons query --keyword "<task terms>" --always --session auto\` for conceptual + universal rules no path/command names. Pure-read commands and recall itself are exempt.
+
+**Capture:** after any failure, user correction, regression, wrong assumption, useful surprise, repeated friction, or non-obvious fix, MUST self-critique and run \`agentsmesh lessons add "<imperative rule>" --topic <id> --trigger-file <glob> --evidence <sha|lesson-id>\`.
+
+**Before final:** report \`Lesson: captured <id>\` or \`Lesson: none\`. No recall/capture gate = task incomplete. No shell: use \`lessons_query\` / \`lessons_add\`.`;
+
+// src/lessons/lessons-dir-guard.ts
+function lessonsDirInsideProject(projectRoot) {
+  return resolvesInsideRootSync(projectRoot, lessonsPaths(projectRoot).base);
+}
+var LessonsDirOutsideProjectError = class extends Error {
+  code = "LESSONS_DIR_OUTSIDE_PROJECT";
+  constructor(projectRoot) {
+    const base = lessonsPaths(projectRoot).base;
+    let where = "a path that does not exist";
+    try {
+      where = realpathSync(base).replaceAll("\\", "/");
+    } catch {
+    }
+    super(
+      `${base.replaceAll("\\", "/")} resolves to ${where}, outside the project ${projectRoot.replaceAll("\\", "/")}. agentsmesh only writes lessons inside the project; replace the link with a real folder.`
+    );
+    this.name = "LessonsDirOutsideProjectError";
+  }
+};
+function assertLessonsDirInsideProject(projectRoot) {
+  if (!lessonsDirInsideProject(projectRoot)) throw new LessonsDirOutsideProjectError(projectRoot);
+}
 
 // src/lessons/graph-store.ts
 var LESSONS_GRAPH_PATH = ".agentsmesh/lessons/lessons.json";
@@ -32675,6 +32959,7 @@ function isWritable(path) {
   }
 }
 function saveLessonsGraph(projectRoot, graph) {
+  assertLessonsDirInsideProject(projectRoot);
   const path = graphFilePath(projectRoot);
   mkdirSync(dirname(path), { recursive: true });
   const mode = fileMode(path);
@@ -32701,30 +32986,6 @@ function canonicalize2(value) {
   }
   return value;
 }
-var BASE_REL = ".agentsmesh/lessons";
-function lessonsPaths(projectRoot) {
-  const base = join(projectRoot, BASE_REL);
-  return {
-    base,
-    graph: join(base, "lessons.json"),
-    config: join(base, "config.json"),
-    journal: join(base, "journal.md"),
-    index: join(base, "index.yaml"),
-    topicsDir: join(base, "topics")
-  };
-}
-function toRelPath(projectRoot, absolute) {
-  return relative(projectRoot, absolute).split(sep).join("/");
-}
-var LESSONS_PROCEDURAL_RULE = `## Lessons (BLOCKING)
-
-Graph \`.agentsmesh/lessons/lessons.json\` is canonical; never hand-edit it. Manual: \`lessons\` skill.
-
-**Recall:** before every file edit or state-changing command, MUST run \`agentsmesh lessons query --file <path> --cmd <command> --session auto\` and obey matches; at task start, ALSO run \`agentsmesh lessons query --keyword "<task terms>" --always --session auto\` for conceptual + universal rules no path/command names. Pure-read commands and recall itself are exempt.
-
-**Capture:** after any failure, user correction, regression, wrong assumption, useful surprise, repeated friction, or non-obvious fix, MUST self-critique and run \`agentsmesh lessons add "<imperative rule>" --topic <id> --trigger-file <glob> --evidence <sha|lesson-id>\`.
-
-**Before final:** report \`Lesson: captured <id>\` or \`Lesson: none\`. No recall/capture gate = task incomplete. No shell: use \`lessons_query\` / \`lessons_add\`.`;
 var MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
 function runGit2(cwd, args, timeoutMs) {
   const r = spawnSync("git", [...args], {
@@ -34541,6 +34802,13 @@ async function hashFileForManifest(path) {
   }
 }
 
+// src/config/core/lock-stale-targets.ts
+function parseStaleTargets(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  const targets = raw.filter((target34) => typeof target34 === "string");
+  return targets.length > 0 ? targets : void 0;
+}
+
 // src/config/core/lock.ts
 var LOCK_FILENAME = ".lock";
 var CANONICAL_PATTERNS = [
@@ -34582,7 +34850,8 @@ async function readLock(abDir) {
       extends: raw.extends && typeof raw.extends === "object" ? raw.extends : {},
       packs: raw.packs && typeof raw.packs === "object" ? raw.packs : {},
       // undefined (not {}) when absent → old-format lock; skips output check.
-      outputs: raw.outputs && typeof raw.outputs === "object" ? raw.outputs : void 0
+      outputs: raw.outputs && typeof raw.outputs === "object" ? raw.outputs : void 0,
+      staleTargets: parseStaleTargets(raw.stale_targets)
     };
   } catch {
     return null;
@@ -34651,47 +34920,6 @@ async function diffOutputChecksums(rootBase, lockOutputs) {
 
 // src/core/generate/stale-cleanup.ts
 init_fs();
-async function canonicalizePath(path) {
-  try {
-    return await realpath(path);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-    const parent = dirname(path);
-    if (parent === path) return resolve(path);
-    return join(await canonicalizePath(parent), basename(path));
-  }
-}
-function isPathInside(target34, root) {
-  return target34 === root || target34.startsWith(root.endsWith(sep) ? root : `${root}${sep}`);
-}
-var display = (path) => path.replaceAll("\\", "/");
-async function assertPathInsideRoot(root, target34) {
-  const rootAbs = resolve(root);
-  const targetAbs = resolve(target34);
-  if (!isPathInside(targetAbs, rootAbs)) {
-    throw new Error(`Unsafe filesystem path: ${display(target34)} is outside ${display(rootAbs)}`);
-  }
-  let realTarget;
-  let realRoot;
-  try {
-    [realTarget, realRoot] = await Promise.all([
-      canonicalizePath(targetAbs),
-      canonicalizePath(rootAbs)
-    ]);
-  } catch (cause) {
-    const detail = cause instanceof Error ? cause.message : String(cause);
-    throw new Error(
-      `Unsafe filesystem path: ${display(target34)} could not be resolved (${detail})`,
-      { cause }
-    );
-  }
-  if (isPathInside(realTarget, realRoot)) return;
-  throw new Error(
-    `Unsafe filesystem path: ${display(target34)} resolves to ${display(realTarget)} outside ${display(realRoot)}`
-  );
-}
-
-// src/core/generate/stale-cleanup.ts
 init_builtin_targets();
 init_registry();
 init_builtin_targets();
@@ -34806,6 +35034,7 @@ async function checkLockSync(opts) {
       outputsModified: [],
       outputsRemoved: [],
       outputsStale: [],
+      staleTargets: [],
       outputsUntracked: [],
       outputsChecked: false
     };
@@ -34859,8 +35088,10 @@ async function checkLockSync(opts) {
     generatedOutputs: Object.keys(lock.outputs),
     scope
   }) : [];
+  const configured = [...config.targets, ...config.pluginTargets ?? []];
+  const staleTargets = (lock.staleTargets ?? []).filter((target34) => configured.includes(target34));
   const canonicalDrift = modified.length > 0 || added.length > 0 || removed.length > 0 || extendsModified.length > 0;
-  const outputDrift = outputsModified.length > 0 || outputsRemoved.length > 0 || outputsStale.length > 0;
+  const outputDrift = outputsModified.length > 0 || outputsRemoved.length > 0 || outputsStale.length > 0 || staleTargets.length > 0;
   const inSync = !canonicalDrift && !outputDrift;
   return {
     inSync,
@@ -34876,6 +35107,7 @@ async function checkLockSync(opts) {
     outputsModified,
     outputsRemoved,
     outputsStale,
+    staleTargets,
     outputsUntracked,
     outputsChecked
   };
@@ -34884,6 +35116,62 @@ async function checkLockSync(opts) {
 // src/public/engine.ts
 init_registry();
 init_target_ids();
+init_canonical_paths();
+init_fs();
+init_mcp_merge();
+var PERMISSION_LISTS = ["allow", "deny", "ask"];
+async function keepPermissions(path, before) {
+  const after = await readFileSafe(path) ?? "";
+  const skipBroken = () => void 0;
+  const earlier = parsePermissionsContent(before, path, skipBroken);
+  const now = parsePermissionsContent(after, path, skipBroken);
+  if (earlier === null || now === null) return;
+  const doc = parseDocument(after);
+  let changed = false;
+  for (const list of PERMISSION_LISTS) {
+    const old = earlier[list];
+    const cur = now[list];
+    if (old.every((entry) => cur.includes(entry))) continue;
+    doc.set(list, [...old, ...cur.filter((entry) => !old.includes(entry))]);
+    changed = true;
+  }
+  if (changed) await writeFileAtomic(path, doc.toString());
+}
+async function keepIgnorePatterns(path, before) {
+  const lines = (text) => text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  const earlier = lines(before);
+  const now = lines(await readFileSafe(path) ?? "");
+  if (earlier.every((line) => now.includes(line))) return;
+  const added = now.filter((line) => !earlier.includes(line));
+  await writeFileAtomic(path, `${[before.trimEnd(), ...added].join("\n")}
+`);
+}
+async function keepMcpServers(path, before) {
+  const earlier = parseMcpServers(before);
+  const now = parseMcpServers(await readFileSafe(path));
+  if (Object.keys(earlier).every((name) => Object.hasOwn(now, name))) return;
+  await writeFileAtomic(path, JSON.stringify({ mcpServers: { ...earlier, ...now } }, null, 2));
+}
+var KEEPERS = [
+  [AB_PERMISSIONS, keepPermissions],
+  [AB_IGNORE, keepIgnorePatterns],
+  [AB_MCP, keepMcpServers]
+];
+async function runTargetImport(descriptor34, rootBase, scope) {
+  const snapshots = await Promise.all(
+    KEEPERS.map(async ([rel2, keep]) => {
+      const path = join(rootBase, rel2);
+      return { path, keep, before: await readFileSafe(path) };
+    })
+  );
+  const results = await descriptor34.generators.importFrom(rootBase, { scope });
+  for (const { path, keep, before } of snapshots) {
+    if (before !== null) await keep(path, before);
+  }
+  return results;
+}
+
+// src/public/engine.ts
 async function importFrom(target34, opts) {
   const descriptor34 = getDescriptor(target34);
   if (!descriptor34) {
@@ -34891,7 +35179,7 @@ async function importFrom(target34, opts) {
       supported: [...TARGET_IDS, ...getAllDescriptors().map((d) => d.id)]
     });
   }
-  return descriptor34.generators.importFrom(opts.root, { scope: opts.scope ?? "project" });
+  return runTargetImport(descriptor34, opts.root, opts.scope ?? "project");
 }
 async function loadConfig2(projectRoot) {
   return loadConfigFromDir(projectRoot);
@@ -35064,42 +35352,8 @@ function makeTriggerId2(spec) {
   const hash = createHash("sha1").update(`${spec.kind}|${spec.pattern}`).digest("hex").slice(0, 8);
   return `t-${TRIGGER_PREFIX2[spec.kind]}-${hash}`;
 }
-var RULE_HEADING_RE = /^##\s+Rules\b.*$/i;
-var NEXT_HEADING_RE = /^##\s+/;
-var RULE_LINE_RE = /^(\d+)\.\s+(.+?)\s*$/;
-var EVIDENCE_TAIL_RE = /\s*\(Evidence:?\s+([^)]+)\)\s*$/;
-var EVIDENCE_REF_RE = /L\d+/g;
-function parseRulesSection(markdown) {
-  const lines = markdown.split(/\r?\n/);
-  let inRules = false;
-  const rules = [];
-  for (const line of lines) {
-    if (!inRules) {
-      if (RULE_HEADING_RE.test(line)) inRules = true;
-      continue;
-    }
-    if (NEXT_HEADING_RE.test(line)) break;
-    const m = RULE_LINE_RE.exec(line);
-    if (m === null) continue;
-    const ruleIndex = Number(m[1]);
-    let body = m[2];
-    const evidence = [];
-    let tail = EVIDENCE_TAIL_RE.exec(body);
-    while (tail !== null) {
-      const refs = tail[1];
-      const matches = refs.match(EVIDENCE_REF_RE);
-      if (matches !== null) evidence.unshift(...matches);
-      body = body.slice(0, tail.index).trimEnd();
-      tail = EVIDENCE_TAIL_RE.exec(body);
-    }
-    rules.push({ index: ruleIndex, body, evidence });
-  }
-  return rules;
-}
 var LEGACY_ARTIFACT_REL = [
   "index.yaml",
-  "journal.md",
-  "journal.legacy.md",
   "topics",
   "distill-ledger.yaml",
   "distill-proposal.md"
@@ -35794,6 +36048,7 @@ function holdLock(lockPath, token) {
 }
 
 // src/lessons/lessons-lock.ts
+init_logger();
 var LESSONS_LOCK_FILENAME = ".lessons.lock";
 var LESSONS_LOCK_OPTIONS = Object.freeze({
   retries: 500,
@@ -35806,6 +36061,7 @@ function lessonsLockPath(projectRoot) {
   return resolve(projectRoot, ".agentsmesh/lessons", LESSONS_LOCK_FILENAME);
 }
 async function acquireLessonsLock(projectRoot, opts = {}) {
+  assertLessonsDirInsideProject(projectRoot);
   return acquireProcessLock(lessonsLockPath(projectRoot), {
     retries: opts.retries ?? LESSONS_LOCK_OPTIONS.retries,
     retryDelayMs: opts.retryDelayMs ?? LESSONS_LOCK_OPTIONS.retryDelayMs,
@@ -35972,6 +36228,50 @@ async function mergeLegacy(projectRoot, paths2, specs, summaryByTopic, options)
     triggerCount: addedTriggers.size
   };
 }
+
+// src/lessons/import-legacy-rules.ts
+var HEADING = /^#{1,6}\s/;
+var SECTION_HEADING = /^#{1,2}\s/;
+var RULES_HEADING = /^##\s+(?:Rules|Lessons)\b/i;
+var ITEM = /^\s{0,3}(?:\d+[.)]|[-*+])\s+(.+?)\s*$/;
+var EVIDENCE_TAIL = /\s*\(Evidence:?\s+([^)]+)\)\s*$/;
+var EVIDENCE_REF = /L\d+/g;
+function withEvidence(index, text) {
+  let body = text;
+  const evidence = [];
+  let tail = EVIDENCE_TAIL.exec(body);
+  while (tail !== null) {
+    evidence.unshift(...tail[1].match(EVIDENCE_REF) ?? []);
+    body = body.slice(0, tail.index).trimEnd();
+    tail = EVIDENCE_TAIL.exec(body);
+  }
+  return { index, body, evidence };
+}
+function parseRulesSection(markdown) {
+  const items = [];
+  let inRules = false;
+  let open2 = false;
+  let strayLine = null;
+  markdown.split(/\r?\n/).forEach((line, i) => {
+    if (HEADING.test(line)) {
+      if (SECTION_HEADING.test(line)) inRules = RULES_HEADING.test(line);
+      open2 = false;
+      return;
+    }
+    const item = ITEM.exec(line);
+    if (item !== null) {
+      if (inRules) items.push(item[1]);
+      else strayLine ??= i + 1;
+      open2 = inRules;
+      return;
+    }
+    if (line.trim() === "") open2 = false;
+    else if (open2) items[items.length - 1] += ` ${line.trim()}`;
+  });
+  return { rules: items.map((text, i) => withEvidence(i + 1, text)), strayLine };
+}
+
+// src/lessons/import-legacy-read.ts
 var LESSONS_DIR = ".agentsmesh/lessons";
 var LegacyTopicPathError = class extends Error {
   code = "LEGACY_TOPIC_PATH_OUTSIDE";
@@ -35985,8 +36285,8 @@ var LegacyTopicPathError = class extends Error {
 async function resolveLegacyTopicPath(projectRoot, file) {
   const forward = file.replaceAll("\\", "/");
   const normalized = posix.normalize(forward);
-  const relative27 = !/^[A-Za-z]:/.test(forward) && !forward.startsWith("/") && normalized.startsWith(`${LESSONS_DIR}/`);
-  if (!relative27) throw new LegacyTopicPathError(file);
+  const relative28 = !/^[A-Za-z]:/.test(forward) && !forward.startsWith("/") && normalized.startsWith(`${LESSONS_DIR}/`);
+  if (!relative28) throw new LegacyTopicPathError(file);
   const target34 = join(projectRoot, normalized);
   try {
     await assertPathInsideRoot(join(projectRoot, LESSONS_DIR), target34);
@@ -36015,9 +36315,13 @@ async function readLegacySource(projectRoot, migratedAt) {
         `Legacy topic file is missing: ${cluster.file}. Refusing to migrate (legacy artifacts left intact).`
       );
     }
-    for (const { index: ruleIndex, body, evidence } of parseRulesSection(
-      readFileSync(topicFile, "utf8")
-    )) {
+    const parsed = parseRulesSection(readFileSync(topicFile, "utf8"));
+    if (parsed.strayLine !== null) {
+      throw new Error(
+        `Legacy lessons were not migrated: ${cluster.file} line ${parsed.strayLine} is a list item outside a "## Rules" or "## Lessons" section. Move it under one of them or delete it, then run \`agentsmesh lessons import-md\`. Nothing was changed.`
+      );
+    }
+    for (const { index: ruleIndex, body, evidence } of parsed.rules) {
       const lessonEvidence = [
         `legacy:${cluster.file}#rule-${ruleIndex}`,
         ...evidence.map((e) => `legacy:${e}`)
@@ -36718,6 +37022,7 @@ async function scaffoldLessons(projectRoot) {
   const created = [];
   const updated = [];
   const skipped = [];
+  assertLessonsDirInsideProject(projectRoot);
   mkdirSync(paths2.base, { recursive: true });
   await maybeAutoMigrateLessons(projectRoot);
   if (existsSync(paths2.graph)) {