everything-dev 1.12.3 → 1.13.1

package/src/cli/init.ts

@@ -5,6 +5,7 @@ import {
   existsSync,
   lstatSync,
   mkdirSync,
+  mkdtempSync,
   readFileSync,
   rmSync,
   writeFileSync,
@@ -20,40 +21,12 @@ import {
   normalizePackageManifestsInTree,
 } from "../internal/manifest-normalizer";
 import type { BosConfig } from "../types";
+import { isPathExcluded } from "../utils/path-match";
+import { saveBosConfig } from "../utils/save-config";
 import { writeSnapshot } from "./snapshot";
 
 const require = createRequire(import.meta.url);
 
-const BOS_CONFIG_ORDER = [
-  "extends",
-  "account",
-  "domain",
-  "testnet",
-  "staging",
-  "repository",
-  "app",
-  "plugins",
-  "shared",
-];
-
-function rebuildOrderedConfig(config: Record<string, unknown>): Record<string, unknown> {
-  const ordered: Record<string, unknown> = {};
-
-  for (const key of BOS_CONFIG_ORDER) {
-    if (key in config) {
-      ordered[key] = config[key];
-    }
-  }
-
-  for (const key of Object.keys(config)) {
-    if (!BOS_CONFIG_ORDER.includes(key)) {
-      ordered[key] = config[key];
-    }
-  }
-
-  return ordered;
-}
-
 interface SourceResult {
   sourceDir: string;
   parentConfig: BosConfig;
@@ -86,6 +59,19 @@ export async function resolveSourceDir(opts: {
   return { sourceDir, parentConfig, cleanup };
 }
 
+export async function readTemplatekeep(sourceDir: string): Promise<string[]> {
+  const keepFile = join(sourceDir, ".templatekeep");
+  if (!existsSync(keepFile)) {
+    return [];
+  }
+
+  const content = readFileSync(keepFile, "utf-8");
+  return content
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+
 export async function fetchParentConfig(
   extendsAccount: string,
   extendsGateway: string,
@@ -161,19 +147,6 @@ function parseGitHubUrl(url: string): { owner: string; repo: string; branch: str
   return null;
 }
 
-export async function readTemplatekeep(sourceDir: string): Promise<string[]> {
-  const keepFile = join(sourceDir, ".templatekeep");
-  if (!existsSync(keepFile)) {
-    return [];
-  }
-
-  const content = readFileSync(keepFile, "utf-8");
-  return content
-    .split("\n")
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0 && !line.startsWith("#"));
-}
-
 export async function copyFilteredFiles(
   sourceDir: string,
   destination: string,
@@ -218,7 +191,7 @@ export async function copyFilteredFiles(
         const pluginName = pluginMatch[1];
         if (!(options.plugins?.includes(pluginName) ?? true)) continue;
       }
-      if (isRouteExcluded(match, excludedRoutePatterns)) continue;
+      if (isPathExcluded(match, excludedRoutePatterns)) continue;
       allFiles.add(match);
     }
   }
@@ -235,7 +208,7 @@ export async function copyFilteredFiles(
           absolute: false,
         });
         for (const match of matches) {
-          if (!isRouteExcluded(match, excludedRoutePatterns)) {
+          if (!isPathExcluded(match, excludedRoutePatterns)) {
             routeFiles.add(match);
           }
         }
@@ -266,19 +239,6 @@ export async function copyFilteredFiles(
   return count;
 }
 
-function isRouteExcluded(filePath: string, excludedPatterns: string[]): boolean {
-  if (excludedPatterns.length === 0) return false;
-  for (const pattern of excludedPatterns) {
-    if (pattern.endsWith("/**")) {
-      const prefix = pattern.slice(0, -3);
-      if (filePath.startsWith(`${prefix}/`) || filePath === prefix) return true;
-    } else if (filePath === pattern || filePath.startsWith(`${pattern}/`)) {
-      return true;
-    }
-  }
-  return false;
-}
-
 export async function personalizeConfig(
   destination: string,
   opts: {
@@ -334,13 +294,124 @@ export async function personalizeConfig(
       }
 
       if (isInit) {
+        const parentDomain = opts.extendsGateway;
+
         for (const pluginKey of Object.keys(plugins)) {
           const plugin = plugins[pluginKey];
-          if (plugin && typeof plugin === "object") {
-            const p = plugin as Record<string, unknown>;
-            delete p.production;
-            delete p.integrity;
+          let pluginObj: Record<string, unknown>;
+
+          if (typeof plugin === "string") {
+            pluginObj = { extends: plugin };
+            plugins[pluginKey] = pluginObj;
+          } else if (plugin && typeof plugin === "object") {
+            pluginObj = { ...(plugin as Record<string, unknown>) };
+          } else {
+            continue;
           }
+
+          if (
+            pluginObj.development &&
+            typeof pluginObj.development === "string" &&
+            pluginObj.development.startsWith("local:")
+          ) {
+            const pluginDir = join(destination, pluginObj.development.slice("local:".length));
+            const pluginConfigPath = join(pluginDir, "bos.config.json");
+
+            if (existsSync(pluginConfigPath)) {
+              try {
+                const pluginConfig = JSON.parse(readFileSync(pluginConfigPath, "utf-8")) as Record<
+                  string,
+                  unknown
+                >;
+                delete pluginConfig.extends;
+                if (pluginConfig.app && typeof pluginConfig.app === "object") {
+                  const app = pluginConfig.app as Record<string, unknown>;
+                  for (const entryKey of Object.keys(app)) {
+                    const entry = app[entryKey];
+                    if (entry && typeof entry === "object") {
+                      const e = entry as Record<string, unknown>;
+                      delete e.production;
+                      delete e.integrity;
+                    }
+                  }
+                }
+                writeFileSync(pluginConfigPath, `${JSON.stringify(pluginConfig, null, 2)}\n`);
+              } catch {}
+            } else if (existsSync(pluginDir)) {
+              const pluginConfig: Record<string, unknown> = {};
+              pluginConfig.domain = `${pluginKey}.${opts.domain ?? parentDomain}`;
+              pluginConfig.app = { api: { development: "local:." } };
+
+              if (opts.pluginRoutes?.[pluginKey]) {
+                pluginConfig.routes = opts.pluginRoutes[pluginKey];
+              }
+              if (pluginObj.sidebar) {
+                pluginConfig.sidebar = pluginObj.sidebar;
+              }
+
+              mkdirSync(pluginDir, { recursive: true });
+              writeFileSync(pluginConfigPath, `${JSON.stringify(pluginConfig, null, 2)}\n`);
+            }
+
+            const cleanEntry: Record<string, unknown> = { development: pluginObj.development };
+            if (pluginObj.extends) {
+              cleanEntry.extends = pluginObj.extends;
+            }
+            if (pluginObj.secrets) {
+              cleanEntry.secrets = pluginObj.secrets;
+            }
+            if (pluginObj.variables) {
+              cleanEntry.variables = pluginObj.variables;
+            }
+            plugins[pluginKey] = cleanEntry;
+          } else {
+            delete pluginObj.production;
+            delete pluginObj.integrity;
+            delete pluginObj.sidebar;
+            delete pluginObj.routes;
+          }
+        }
+      } else {
+        for (const pluginKey of Object.keys(plugins)) {
+          const pluginDir = resolve(
+            destination,
+            (plugins[pluginKey] as Record<string, unknown>)?.development
+              ?.toString()
+              ?.slice("local:".length) ?? "",
+          );
+          const pluginConfigPath = join(pluginDir, "bos.config.json");
+          if (!existsSync(pluginConfigPath)) continue;
+
+          try {
+            const pluginConfig = JSON.parse(readFileSync(pluginConfigPath, "utf-8")) as Record<
+              string,
+              unknown
+            >;
+            let changed = false;
+
+            if ("extends" in pluginConfig) {
+              delete pluginConfig.extends;
+              changed = true;
+            }
+            if (pluginConfig.app && typeof pluginConfig.app === "object") {
+              const app = pluginConfig.app as Record<string, unknown>;
+              for (const entryKey of Object.keys(app)) {
+                const entry = app[entryKey];
+                if (entry && typeof entry === "object") {
+                  const e = entry as Record<string, unknown>;
+                  if ("production" in e || "integrity" in e) {
+                    delete e.production;
+                    delete e.integrity;
+                    changed = true;
+                  }
+                }
+              }
+            }
+
+            if (changed) {
+              writeFileSync(pluginConfigPath, `${JSON.stringify(pluginConfig, null, 2)}\n`);
+            }
+          } catch {}
         }
       }
 
@@ -349,7 +420,7 @@ export async function personalizeConfig(
       }
     }
 
-    writeFileSync(configPath, `${JSON.stringify(rebuildOrderedConfig(config), null, 2)}\n`);
+    await saveBosConfig(destination, config);
   }
 
   const pkgPath = join(destination, "package.json");
@@ -463,32 +534,71 @@ export async function personalizeConfig(
     );
   }
 
-  const authTypesGenPath = join(destination, "ui", "src", "lib", "auth-types.gen.ts");
-  if (!existsSync(authTypesGenPath)) {
-    mkdirSync(dirname(authTypesGenPath), { recursive: true });
-    writeFileSync(
-      authTypesGenPath,
-      `import type { Auth } from "better-auth";\nexport type { Auth } from "better-auth";\nexport type AuthSessionUser = NonNullable<Auth["$Infer"]["Session"]["user"]> & {\n  role?: string | null;\n  isAnonymous?: boolean | null;\n  walletAddress?: string | null;\n  banned?: boolean | null;\n};\nexport type AuthSessionData = NonNullable<Auth["$Infer"]["Session"]["session"]> & {\n  activeOrganizationId?: string | null;\n};\nexport type AuthSession = {\n  user: AuthSessionUser | null;\n  session: AuthSessionData | null;\n};\nexport interface AuthOrganizationContext {\n  activeOrganizationId: string | null;\n  organization: { id: string; name: string; slug: string; logo?: string | null; metadata?: Record<string, unknown> } | null;\n  member: { id: string; role: string } | null;\n  isPersonal: boolean;\n  hasOrganization: boolean;\n}\nexport interface AuthRequestContext {\n  user: AuthSessionUser | null;\n  userId: string | null;\n  isAuthenticated: boolean;\n  authMethod: "session" | "apiKey" | "anonymous" | "none";\n  near: {\n    primaryAccountId: string | null;\n    linkedAccounts: Array<{ accountId: string; network: string; publicKey: string; isPrimary: boolean }>;\n    hasNearAccount: boolean;\n  };\n  organization: AuthOrganizationContext;\n  organizations?: Array<{ id: string; role: string; name?: string; slug?: string }>;\n}\nexport type AuthActiveMember = { id: string | null; role: string | null; organizationId: string | null };\nexport type AuthOrganization = NonNullable<AuthOrganizationContext["organization"]>;\nexport type AuthOrganizationMember = NonNullable<AuthOrganizationContext["member"]>;\nexport type AuthOrganizationSummary = NonNullable<AuthRequestContext["organizations"]>[number];\nexport type AuthBaseSession = Auth["$Infer"]["Session"];\nexport type createAuthInstance = never;\nexport interface AuthServices {\n  auth: Auth;\n  db: unknown;\n  driver: { close(): Promise<void> };\n  handler: (req: Request) => Promise<Response>;\n}\n`,
-    );
+  const authTypesContent = generateAuthTypesTemplate();
+  const authTypesPaths = [
+    join(destination, "ui", "src", "lib", "auth-types.gen.ts"),
+    join(destination, "api", "src", "lib", "auth-types.gen.ts"),
+  ];
+  if (existsSync(join(destination, "host", "src"))) {
+    authTypesPaths.push(join(destination, "host", "src", "lib", "auth-types.gen.ts"));
   }
-
-  const apiAuthTypesGenPath = join(destination, "api", "src", "lib", "auth-types.gen.ts");
-  if (!existsSync(apiAuthTypesGenPath)) {
-    mkdirSync(dirname(apiAuthTypesGenPath), { recursive: true });
-    writeFileSync(
-      apiAuthTypesGenPath,
-      `import type { Auth } from "better-auth";\nexport type { Auth } from "better-auth";\nexport type AuthSessionUser = NonNullable<Auth["$Infer"]["Session"]["user"]> & {\n  role?: string | null;\n  isAnonymous?: boolean | null;\n  walletAddress?: string | null;\n  banned?: boolean | null;\n};\nexport type AuthSessionData = NonNullable<Auth["$Infer"]["Session"]["session"]> & {\n  activeOrganizationId?: string | null;\n};\nexport type AuthSession = {\n  user: AuthSessionUser | null;\n  session: AuthSessionData | null;\n};\nexport interface AuthOrganizationContext {\n  activeOrganizationId: string | null;\n  organization: { id: string; name: string; slug: string; logo?: string | null; metadata?: Record<string, unknown> } | null;\n  member: { id: string; role: string } | null;\n  isPersonal: boolean;\n  hasOrganization: boolean;\n}\nexport interface AuthRequestContext {\n  user: AuthSessionUser | null;\n  userId: string | null;\n  isAuthenticated: boolean;\n  authMethod: "session" | "apiKey" | "anonymous" | "none";\n  near: {\n    primaryAccountId: string | null;\n    linkedAccounts: Array<{ accountId: string; network: string; publicKey: string; isPrimary: boolean }>;\n    hasNearAccount: boolean;\n  };\n  organization: AuthOrganizationContext;\n  organizations?: Array<{ id: string; role: string; name?: string; slug?: string }>;\n}\nexport type AuthActiveMember = { id: string | null; role: string | null; organizationId: string | null };\nexport type AuthOrganization = NonNullable<AuthOrganizationContext["organization"]>;\nexport type AuthOrganizationMember = NonNullable<AuthOrganizationContext["member"]>;\nexport type AuthOrganizationSummary = NonNullable<AuthRequestContext["organizations"]>[number];\nexport type AuthBaseSession = Auth["$Infer"]["Session"];\nexport type createAuthInstance = never;\nexport interface AuthServices {\n  auth: Auth;\n  db: unknown;\n  driver: { close(): Promise<void> };\n  handler: (req: Request) => Promise<Response>;\n}\n`,
-    );
+  for (const authTypesGenPath of authTypesPaths) {
+    if (!existsSync(authTypesGenPath)) {
+      mkdirSync(dirname(authTypesGenPath), { recursive: true });
+      writeFileSync(authTypesGenPath, authTypesContent);
+    }
   }
+}
 
-  const hostAuthTypesGenPath = join(destination, "host", "src", "lib", "auth-types.gen.ts");
-  if (existsSync(join(destination, "host", "src")) && !existsSync(hostAuthTypesGenPath)) {
-    mkdirSync(dirname(hostAuthTypesGenPath), { recursive: true });
-    writeFileSync(
-      hostAuthTypesGenPath,
-      `import type { Auth } from "better-auth";\nexport type { Auth } from "better-auth";\nexport type AuthSessionUser = NonNullable<Auth["$Infer"]["Session"]["user"]> & {\n  role?: string | null;\n  isAnonymous?: boolean | null;\n  walletAddress?: string | null;\n  banned?: boolean | null;\n};\nexport type AuthSessionData = NonNullable<Auth["$Infer"]["Session"]["session"]> & {\n  activeOrganizationId?: string | null;\n};\nexport type AuthSession = {\n  user: AuthSessionUser | null;\n  session: AuthSessionData | null;\n};\nexport interface AuthOrganizationContext {\n  activeOrganizationId: string | null;\n  organization: { id: string; name: string; slug: string; logo?: string | null; metadata?: Record<string, unknown> } | null;\n  member: { id: string; role: string } | null;\n  isPersonal: boolean;\n  hasOrganization: boolean;\n}\nexport interface AuthRequestContext {\n  user: AuthSessionUser | null;\n  userId: string | null;\n  isAuthenticated: boolean;\n  authMethod: "session" | "apiKey" | "anonymous" | "none";\n  near: {\n    primaryAccountId: string | null;\n    linkedAccounts: Array<{ accountId: string; network: string; publicKey: string; isPrimary: boolean }>;\n    hasNearAccount: boolean;\n  };\n  organization: AuthOrganizationContext;\n  organizations?: Array<{ id: string; role: string; name?: string; slug?: string }>;\n}\nexport type AuthActiveMember = { id: string | null; role: string | null; organizationId: string | null };\nexport type AuthOrganization = NonNullable<AuthOrganizationContext["organization"]>;\nexport type AuthOrganizationMember = NonNullable<AuthOrganizationContext["member"]>;\nexport type AuthOrganizationSummary = NonNullable<AuthRequestContext["organizations"]>[number];\nexport type AuthBaseSession = Auth["$Infer"]["Session"];\nexport type createAuthInstance = never;\nexport interface AuthServices {\n  auth: Auth;\n  db: unknown;\n  driver: { close(): Promise<void> };\n  handler: (req: Request) => Promise<Response>;\n}\n`,
-    );
-  }
+function generateAuthTypesTemplate(): string {
+  return `import type { Auth } from "better-auth";
+export type { Auth } from "better-auth";
+export type AuthSessionUser = NonNullable<Auth["$Infer"]["Session"]["user"]> & {
+  role?: string | null;
+  isAnonymous?: boolean | null;
+  walletAddress?: string | null;
+  banned?: boolean | null;
+};
+export type AuthSessionData = NonNullable<Auth["$Infer"]["Session"]["session"]> & {
+  activeOrganizationId?: string | null;
+};
+export type AuthSession = {
+  user: AuthSessionUser | null;
+  session: AuthSessionData | null;
+};
+export interface AuthOrganizationContext {
+  activeOrganizationId: string | null;
+  organization: { id: string; name: string; slug: string; logo?: string | null; metadata?: Record<string, unknown> } | null;
+  member: { id: string; role: string } | null;
+  isPersonal: boolean;
+  hasOrganization: boolean;
+}
+export interface AuthRequestContext {
+  user: AuthSessionUser | null;
+  userId: string | null;
+  isAuthenticated: boolean;
+  authMethod: "session" | "apiKey" | "anonymous" | "none";
+  near: {
+    primaryAccountId: string | null;
+    linkedAccounts: Array<{ accountId: string; network: string; publicKey: string; isPrimary: boolean }>;
+    hasNearAccount: boolean;
+  };
+  organization: AuthOrganizationContext;
+  organizations?: Array<{ id: string; role: string; name?: string; slug?: string }>;
+}
+export type AuthActiveMember = { id: string | null; role: string | null; organizationId: string | null };
+export type AuthOrganization = NonNullable<AuthOrganizationContext["organization"]>;
+export type AuthOrganizationMember = NonNullable<AuthOrganizationContext["member"]>;
+export type AuthOrganizationSummary = NonNullable<AuthRequestContext["organizations"]>[number];
+export type AuthBaseSession = Auth["$Infer"]["Session"];
+export type createAuthInstance = never;
+export interface AuthServices {
+  auth: Auth;
+  db: unknown;
+  driver: { close(): Promise<void> };
+  handler: (req: Request) => Promise<Response>;
+}
+`;
 }
 
 export async function runBunInstall(destination: string): Promise<void> {
@@ -579,7 +689,7 @@ export async function writeInitSnapshot(
     for (const match of matches) {
       const pluginMatch = match.match(/^plugins\/([^/]+)/);
       if (pluginMatch && !(options.plugins?.includes(pluginMatch[1]) ?? true)) continue;
-      if (isRouteExcluded(match, excludedRoutePatterns)) continue;
+      if (isPathExcluded(match, excludedRoutePatterns)) continue;
       allFiles.add(match);
     }
   }
@@ -595,7 +705,7 @@ export async function writeInitSnapshot(
           absolute: false,
         });
         for (const match of matches) {
-          if (!isRouteExcluded(match, excludedRoutePatterns)) {
+          if (!isPathExcluded(match, excludedRoutePatterns)) {
             allFiles.add(match);
           }
         }
@@ -626,18 +736,7 @@ function computeHash(data: Uint8Array): string {
 }
 
 function mkTmpDir(prefix: string): string {
-  const base = join(tmpdir(), prefix);
-  let attempt = 0;
-  while (true) {
-    const dir = `${base}-${Date.now()}-${attempt}`;
-    try {
-      mkdirSync(dir, { recursive: true });
-      return dir;
-    } catch {
-      attempt++;
-      if (attempt > 10) throw new Error("Failed to create temp directory");
-    }
-  }
+  return mkdtempSync(join(tmpdir(), `${prefix}-`));
 }
 
 export async function generateDatabaseMigrations(destination: string): Promise<void> {

package/src/cli/prompts.ts

@@ -16,7 +16,7 @@ function deriveAccountFromDomain(domain: string, extendsAccount: string): string
   return `${firstSegment}.${suffix}`;
 }
 
-const AVAILABLE_PLUGINS = [{ value: "_template", label: "template" }];
+const AVAILABLE_PLUGINS = [{ value: "settings", label: "settings" }];
 
 export async function promptInitOptions(input: {
   extendsAccount?: string;
@@ -89,7 +89,7 @@ export async function promptInitOptions(input: {
     ((await p.multiselect({
       message: "Select plugins:",
       options: AVAILABLE_PLUGINS,
-      initialValues: ["_template"],
+      initialValues: ["settings"],
       required: false,
     })) as string[]);
 

package/src/cli/sync.ts

@@ -10,6 +10,13 @@ import {
 import { dirname, join } from "node:path";
 import { glob } from "glob";
 import type { SyncOptions, SyncResult } from "../contract";
+import {
+  isPlainObject as isPlainObjectFromMerge,
+  mergeBosConfigWithTemplate,
+  resolveExtendsRef,
+} from "../merge";
+import type { BosPluginRef } from "../types";
+import { isPathExcluded } from "../utils/path-match";
 import {
   personalizeConfig,
   readTemplatekeep,
@@ -24,6 +31,8 @@ const FRAMEWORK_OWNED_SYNC_FILES = new Set([
   "biome.json",
   "bos.config.json",
   "package.json",
+  ".github/renovate.json",
+  ".github/workflows/ci.yml",
   ".github/workflows/release-sync.yml",
   "ui/package.json",
   "ui/postcss.config.mjs",
@@ -67,22 +76,6 @@ export function readLocalSyncExcludes(projectDir: string): string[] {
   return readExcludeFile(join(projectDir, ".bos", "sync-local-exclude"));
 }
 
-function isExcluded(filePath: string, excludePatterns: string[]): boolean {
-  for (const pattern of excludePatterns) {
-    if (pattern.endsWith("/**")) {
-      const prefix = pattern.slice(0, -3);
-      if (filePath.startsWith(`${prefix}/`) || filePath === prefix) return true;
-    } else if (pattern.endsWith("/*")) {
-      const prefix = pattern.slice(0, -2);
-      const slashIdx = filePath.indexOf("/", prefix.length + 1);
-      if (filePath.startsWith(`${prefix}/`) && slashIdx === -1) return true;
-    } else if (filePath === pattern || filePath.startsWith(`${pattern}/`)) {
-      return true;
-    }
-  }
-  return false;
-}
-
 function computeLocalHash(projectDir: string, filePath: string): string | null {
   const fullPath = join(projectDir, filePath);
   if (!existsSync(fullPath)) return null;
@@ -111,78 +104,6 @@ function backupFiles(projectDir: string, filePaths: string[]): string | null {
   return backupDir;
 }
 
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
-function mergeJsonValues(local: unknown, template: unknown): unknown {
-  if (isPlainObject(local) && isPlainObject(template)) {
-    const merged: Record<string, unknown> = {};
-    // Preserve local key order first
-    for (const key of Object.keys(local)) {
-      merged[key] = mergeJsonValues(local[key], template[key]);
-    }
-    // Append any new template keys at the end
-    for (const key of Object.keys(template)) {
-      if (!(key in merged)) {
-        merged[key] = template[key];
-      }
-    }
-    return merged;
-  }
-  // For arrays and primitives, local always wins
-  return local ?? template;
-}
-
-function mergeBosConfig(
-  local: Record<string, unknown>,
-  template: Record<string, unknown>,
-): Record<string, unknown> {
-  const merged: Record<string, unknown> = {};
-
-  // 1. extends always first
-  if (local.extends !== undefined) merged.extends = local.extends;
-  else if (template.extends !== undefined) merged.extends = template.extends;
-
-  // 2. Fixed trailing group: app, plugins, shared
-  const TRAIL_GROUP = ["app", "plugins", "shared"];
-
-  const localKeys = Object.keys(local).filter((k) => k !== "extends");
-  const templateKeys = Object.keys(template).filter(
-    (k) => k !== "extends" && !localKeys.includes(k),
-  );
-
-  // Find the first trailing-group key present locally ("app" comes first in the group)
-  const firstTrailIndex = localKeys.findIndex((k) => TRAIL_GROUP.includes(k));
-
-  const orderedKeys: string[] = [];
-
-  if (firstTrailIndex >= 0) {
-    // Keys before the trail group stay in local order
-    orderedKeys.push(...localKeys.slice(0, firstTrailIndex));
-    // New template keys inserted right before the trail group
-    orderedKeys.push(...templateKeys);
-    // Trail group keys (app, plugins, shared) in canonical order, preserving local if present
-    for (const trailKey of TRAIL_GROUP) {
-      if (localKeys.includes(trailKey)) orderedKeys.push(trailKey);
-    }
-  } else {
-    // No trail group found locally — keep local order then append new keys and trail group
-    orderedKeys.push(...localKeys);
-    orderedKeys.push(...templateKeys);
-    for (const trailKey of TRAIL_GROUP) {
-      if (templateKeys.includes(trailKey)) orderedKeys.push(trailKey);
-    }
-  }
-
-  // 3. Merge values for each key
-  for (const key of orderedKeys) {
-    merged[key] = mergeJsonValues(local[key], template[key]);
-  }
-
-  return merged;
-}
-
 function mergeStringMaps(
   local: Record<string, string> | undefined,
   template: Record<string, string> | undefined,
@@ -328,7 +249,7 @@ function writeSyncedFile(sourceDir: string, projectDir: string, filePath: string
     if (localContent) {
       const local = JSON.parse(localContent) as Record<string, unknown>;
       const template = JSON.parse(templateContent) as Record<string, unknown>;
-      const merged = mergeBosConfig(local, template);
+      const merged = mergeBosConfigWithTemplate(local, template);
       writeFileSync(dest, `${JSON.stringify(merged, null, 2)}\n`);
       return;
     }
@@ -351,11 +272,20 @@ function writeSyncedFile(sourceDir: string, projectDir: string, filePath: string
 }
 
 export async function syncTemplate(projectDir: string, options: SyncOptions): Promise<SyncResult> {
+  // Sync reads the raw bos.config.json (not the resolved config) because it needs
+  // the user's explicit local settings: their extends ref, selected plugins, etc.
+  // The resolved config is the merged result and would include inherited parent
+  // values that the user didn't explicitly choose, which would break sync filtering.
   const localConfig = JSON.parse(
     readFileSync(join(projectDir, "bos.config.json"), "utf-8"),
   ) as Record<string, unknown>;
 
-  const extendsRef = localConfig.extends as string | undefined;
+  let extendsRef: string | undefined;
+  if (typeof localConfig.extends === "string") {
+    extendsRef = localConfig.extends;
+  } else if (isPlainObjectFromMerge(localConfig.extends)) {
+    extendsRef = resolveExtendsRef(localConfig.extends as Record<string, string>, "production");
+  }
   if (!extendsRef?.startsWith("bos://")) {
     return {
       status: "error",
@@ -421,8 +351,9 @@ export async function syncTemplate(projectDir: string, options: SyncOptions): Pr
 
     const pluginRoutes: Record<string, string[]> = {};
     if (parentConfig.plugins) {
-      for (const [key, ref] of Object.entries(parentConfig.plugins)) {
-        if (ref.routes && ref.routes.length > 0) {
+      for (const [key, entry] of Object.entries(parentConfig.plugins)) {
+        const ref: BosPluginRef | null = entry && typeof entry !== "string" ? entry : null;
+        if (ref?.routes && ref.routes.length > 0) {
           pluginRoutes[key] = ref.routes;
         }
       }
@@ -439,7 +370,7 @@ export async function syncTemplate(projectDir: string, options: SyncOptions): Pr
     for (const filePath of allTemplateFiles) {
       const pluginMatch = filePath.match(/^plugins\/([^/]+)/);
       if (pluginMatch && !childPlugins.includes(pluginMatch[1])) continue;
-      if (isExcluded(filePath, excludedRoutePatterns)) continue;
+      if (isPathExcluded(filePath, excludedRoutePatterns)) continue;
       filteredFiles.add(filePath);
     }
 
@@ -453,7 +384,7 @@ export async function syncTemplate(projectDir: string, options: SyncOptions): Pr
           absolute: false,
         });
         for (const match of matches) {
-          if (!isExcluded(match, excludedRoutePatterns)) {
+          if (!isPathExcluded(match, excludedRoutePatterns)) {
             filteredFiles.add(match);
           }
         }
@@ -469,7 +400,7 @@ export async function syncTemplate(projectDir: string, options: SyncOptions): Pr
     for (const filePath of filteredFiles) {
       const destPath = toDestPath(filePath);
       const frameworkOwned = isFrameworkOwnedSyncFile(destPath);
-      if (isExcluded(destPath, excludePatterns) && !frameworkOwned) continue;
+      if (isPathExcluded(destPath, excludePatterns) && !frameworkOwned) continue;
 
       const localHash = computeLocalHash(projectDir, destPath);
       const sourceContent = readFileSync(join(sourceDir, filePath));
@@ -515,7 +446,7 @@ export async function syncTemplate(projectDir: string, options: SyncOptions): Pr
     }
 
     const filesToWrite = [...updated, ...added].filter(
-      (f) => isFrameworkOwnedSyncFile(f) || !isExcluded(f, excludePatterns),
+      (f) => isFrameworkOwnedSyncFile(f) || !isPathExcluded(f, excludePatterns),
     );
 
     const destToSource = new Map<string, string>();

package/src/cli/upgrade.ts

@@ -25,6 +25,8 @@ const OBSOLETE_FILES = [
   "ui/src/lib/auth-client.ts",
   "ui/src/lib/session.ts",
   "ui/scripts/generate-metadata.ts",
+  ".github/dependabot.yml",
+  ".github/templates/dependabot.yml",
 ];
 
 interface NpmPackageInfo {