oh-my-opencode 4.7.4 → 4.8.0

package/packages/omo-codex/plugin/components/comment-checker/test/codex-hook.test.ts

@@ -94,6 +94,151 @@ describe("extractCodexCommentCheckRequests", () => {
 		]);
 	});
 
+	it("#given apply_patch metadata files #when extracting #then metadata takes priority over raw patch text", () => {
+		const requests = extractCodexCommentCheckRequests(
+			postToolUseInput({
+				tool_input: {
+					command: [
+						"*** Begin Patch",
+						"*** Update File: src/raw.ts",
+						"@@",
+						"-const raw = 1;",
+						"+const raw = 2;",
+						"*** End Patch",
+					].join("\n"),
+				},
+				tool_response: {
+					files: [
+						{
+							filePath: "src/new.ts",
+							before: "",
+							after: "// explains new\nconst value = 1;\n",
+						},
+						{
+							file_path: "src/old.ts",
+							move_path: "src/moved.ts",
+							old: "const value = 1;\n",
+							new: "// explains moved\nconst value = 2;\n",
+						},
+						{
+							path: "src/deleted.ts",
+							before: "const deleted = true;\n",
+							after: "",
+							type: "delete",
+						},
+					],
+				},
+			}),
+		);
+
+		expect(requests).toEqual([
+			{
+				sourceToolName: "apply_patch",
+				toolName: "Write",
+				filePath: "src/new.ts",
+				toolInput: {
+					file_path: "src/new.ts",
+					content: "// explains new\nconst value = 1;\n",
+				},
+			},
+			{
+				sourceToolName: "apply_patch",
+				toolName: "Edit",
+				filePath: "src/moved.ts",
+				toolInput: {
+					file_path: "src/moved.ts",
+					old_string: "const value = 1;\n",
+					new_string: "// explains moved\nconst value = 2;\n",
+				},
+			},
+		]);
+	});
+
+	it("#given nested apply_patch metadata #when extracting #then result and metadata containers are supported", () => {
+		const resultRequests = extractCodexCommentCheckRequests(
+			postToolUseInput({
+				tool_response: {
+					result: {
+						files: [{ filePath: "src/result.ts", before: "", after: "const result = true;\n" }],
+					},
+				},
+			}),
+		);
+		const metadataRequests = extractCodexCommentCheckRequests(
+			postToolUseInput({
+				tool_response: {
+					metadata: {
+						files: [{ filePath: "src/metadata.ts", before: "", after: "const metadata = true;\n" }],
+					},
+				},
+			}),
+		);
+
+		expect(resultRequests[0]?.filePath).toBe("src/result.ts");
+		expect(metadataRequests[0]?.filePath).toBe("src/metadata.ts");
+	});
+
+	it("#given apply_patch add move and delete hunks #when extracting from raw patch #then add and move are checked while delete is ignored", () => {
+		const requests = extractCodexCommentCheckRequests(
+			postToolUseInput({
+				tool_input: {
+					command: [
+						"*** Begin Patch",
+						"*** Add File: src/added.ts",
+						"+// explains add",
+						"+const added = true;",
+						"*** Update File: src/original.ts",
+						"*** Move to: src/renamed.ts",
+						"@@",
+						"-const original = true;",
+						"+// explains rename",
+						"+const renamed = true;",
+						"*** Delete File: src/deleted.ts",
+						"*** End Patch",
+					].join("\n"),
+				},
+			}),
+		);
+
+		expect(requests).toEqual([
+			{
+				sourceToolName: "apply_patch",
+				toolName: "Write",
+				filePath: "src/added.ts",
+				toolInput: {
+					file_path: "src/added.ts",
+					content: "// explains add\nconst added = true;\n",
+				},
+			},
+			{
+				sourceToolName: "apply_patch",
+				toolName: "Edit",
+				filePath: "src/renamed.ts",
+				toolInput: {
+					file_path: "src/renamed.ts",
+					old_string: "const original = true;\n",
+					new_string: "// explains rename\nconst renamed = true;\n",
+				},
+			},
+		]);
+	});
+
+	it("#given failed tool response #when extracting #then no comment-check request is emitted", () => {
+		const textFailureRequests = extractCodexCommentCheckRequests(
+			postToolUseInput({
+				tool_response: "failed to apply patch",
+			}),
+		);
+		const structuredFailureRequests = extractCodexCommentCheckRequests(
+			postToolUseInput({
+				tool_response: { is_error: true, text: "Success. Updated files." },
+			}),
+		);
+
+		expect(textFailureRequests).toEqual([]);
+		expect(structuredFailureRequests).toEqual([]);
+	});
+
 	it("#given unsupported post tool event #when extracting #then returns no requests", () => {
 		const requests = extractCodexCommentCheckRequests(
 			postToolUseInput({

package/packages/omo-codex/plugin/components/comment-checker/test/core.test.ts

@@ -0,0 +1,200 @@
+import { describe, expect, it } from "vitest";
+import type { CheckerEdit, CheckerToolInput, CommentCheckRequest, ToolResultLike } from "../src/core.ts";
+import { extractCommentCheckRequests, parseApplyPatchRequests, toHookInput } from "../src/core.ts";
+
+describe("extractCommentCheckRequests", () => {
+	it("#given apply_patch metadata files #when extracting #then supports direct result and metadata shapes", () => {
+		// given
+		const directEvent = applyPatchEvent({
+			files: [{ filePath: "src/direct.ts", before: "", after: "// explains direct\nconst direct = true;\n" }],
+		});
+		const resultEvent = applyPatchEvent({
+			result: {
+				files: [{ file_path: "src/result.ts", old: "const result = false;\n", new: "const result = true;\n" }],
+			},
+		});
+		const metadataEvent = applyPatchEvent({
+			metadata: {
+				files: [{ path: "src/metadata.ts", before: "", after: "// explains metadata\nconst metadata = true;\n" }],
+			},
+		});
+
+		// when
+		const directRequests = extractCommentCheckRequests(directEvent);
+		const resultRequests = extractCommentCheckRequests(resultEvent);
+		const metadataRequests = extractCommentCheckRequests(metadataEvent);
+
+		// then
+		expect(directRequests[0]?.filePath).toBe("src/direct.ts");
+		expect(resultRequests[0]).toEqual({
+			sourceToolName: "apply_patch",
+			toolName: "Edit",
+			filePath: "src/result.ts",
+			toolInput: {
+				file_path: "src/result.ts",
+				old_string: "const result = false;\n",
+				new_string: "const result = true;\n",
+			},
+		});
+		expect(metadataRequests[0]?.toolName).toBe("Write");
+		expect(metadataRequests[0]?.filePath).toBe("src/metadata.ts");
+	});
+
+	it("#given apply_patch add move and delete hunks #when extracting from raw patch #then add and move are checked while delete is ignored", () => {
+		// given
+		const patch = [
+			"*** Begin Patch",
+			"*** Add File: src/added.ts",
+			"+// explains add",
+			"+const added = true;",
+			"*** Update File: src/original.ts",
+			"*** Move to: src/renamed.ts",
+			"@@",
+			"-const original = true;",
+			"+// explains rename",
+			"+const renamed = true;",
+			"*** Delete File: src/deleted.ts",
+			"*** End Patch",
+		].join("\n");
+
+		// when
+		const requests = parseApplyPatchRequests(patch, "apply_patch");
+
+		// then
+		expect(requests).toEqual([
+			{
+				sourceToolName: "apply_patch",
+				toolName: "Write",
+				filePath: "src/added.ts",
+				toolInput: {
+					file_path: "src/added.ts",
+					content: "// explains add\nconst added = true;\n",
+				},
+			},
+			{
+				sourceToolName: "apply_patch",
+				toolName: "Edit",
+				filePath: "src/renamed.ts",
+				toolInput: {
+					file_path: "src/renamed.ts",
+					old_string: "const original = true;\n",
+					new_string: "// explains rename\nconst renamed = true;\n",
+				},
+			},
+		]);
+	});
+
+	it("#given failed tool output #when extracting #then text and isError failures emit no requests", () => {
+		// given
+		const textFailure = applyPatchEvent(undefined, {
+			content: [{ type: "text", text: "Error: failed to apply patch" }],
+		});
+		const structuredFailure = applyPatchEvent(undefined, {
+			content: [{ type: "text", text: "Success. Updated files." }],
+			isError: true,
+		});
+
+		// when
+		const textRequests = extractCommentCheckRequests(textFailure);
+		const structuredRequests = extractCommentCheckRequests(structuredFailure);
+
+		// then
+		expect(textRequests).toEqual([]);
+		expect(structuredRequests).toEqual([]);
+	});
+});
+
+describe("toHookInput", () => {
+	it("#given comment check request #when converting #then emits stable hook input contract", () => {
+		// given
+		const request: CommentCheckRequest = {
+			sourceToolName: "write",
+			toolName: "Write",
+			filePath: "src/example.ts",
+			toolInput: {
+				file_path: "src/example.ts",
+				content: "// explains value\nconst value = 1;\n",
+			},
+		};
+
+		// when
+		const input = toHookInput(request, {
+			sessionId: "session-1",
+			cwd: "/repo",
+			transcriptPath: "/tmp/transcript.jsonl",
+		});
+
+		// then
+		expect(input).toEqual({
+			session_id: "session-1",
+			tool_name: "Write",
+			transcript_path: "/tmp/transcript.jsonl",
+			cwd: "/repo",
+			hook_event_name: "PostToolUse",
+			tool_input: request.toolInput,
+		});
+	});
+});
+
+describe("public contract mutability", () => {
+	it("#given exported core types #when consumers mutate fields #then the compatibility contract is preserved", () => {
+		// given
+		const edit: CheckerEdit = {
+			old_string: "const value = 1;\n",
+			new_string: "const value = 2;\n",
+		};
+		const toolInput: CheckerToolInput = {
+			file_path: "src/example.ts",
+			edits: [edit],
+		};
+		const request: CommentCheckRequest = {
+			sourceToolName: "multi_edit",
+			toolName: "MultiEdit",
+			filePath: "src/example.ts",
+			toolInput,
+		};
+		const event: ToolResultLike = {
+			toolName: "write",
+			input: {},
+			content: [{ type: "text", text: "ok" }],
+		};
+
+		// when
+		edit.new_string = "const value = 3;\n";
+		toolInput.file_path = "src/renamed.ts";
+		toolInput.edits?.push({
+			old_string: "const other = 1;\n",
+			new_string: "const other = 2;\n",
+		});
+		request.filePath = "src/renamed.ts";
+		event.toolName = "edit";
+		event.content?.push({ type: "text", text: "still ok" });
+
+		// then
+		expect(request.filePath).toBe("src/renamed.ts");
+		expect(request.toolInput.edits).toHaveLength(2);
+		expect(event.toolName).toBe("edit");
+		expect(event.content).toEqual([
+			{ type: "text", text: "ok" },
+			{ type: "text", text: "still ok" },
+		]);
+	});
+});
+
+function applyPatchEvent(details: unknown, overrides: Partial<ToolResultLike> = {}): ToolResultLike {
+	return {
+		toolName: "apply_patch",
+		input: {
+			command: [
+				"*** Begin Patch",
+				"*** Update File: src/raw.ts",
+				"@@",
+				"-const raw = false;",
+				"+const raw = true;",
+				"*** End Patch",
+			].join("\n"),
+		},
+		...(details === undefined ? {} : { details }),
+		...overrides,
+	};
+}

package/packages/omo-codex/plugin/components/lsp/CHANGELOG.md

@@ -7,10 +7,10 @@
 ## 0.2.0
 
 - Extracted the LSP runtime and MCP server into [`@code-yeongyu/lsp-tools-mcp`](https://github.com/code-yeongyu/lsp-tools-mcp).
-- codex-lsp now consumes that runtime as a git submodule at `packages/lsp-tools-mcp`.
+- codex-lsp now consumes that runtime from the repository-level `packages/lsp-tools-mcp` package.
 - Kept the Codex-specific PostToolUse hook in this package and routed MCP serving through the upstream CLI.
 
-- Extract LSP runtime to `lsp-tools-mcp` upstream and consume it via git submodule at `packages/lsp-tools-mcp`.
+- Extract LSP runtime to `lsp-tools-mcp` upstream and consume it via the repository-level `packages/lsp-tools-mcp` package.
 - Renamed the MCP server namespace to `lsp` and exposed shorter tool names such as `lsp.diagnostics`.
 - Use portable Codex hook interpolation and add package smoke coverage for hook/MCP entrypoints.
 - Spawn language servers without shell mode; Windows `.cmd` and `.bat` shims are routed through `cmd.exe` with explicit arguments.

package/packages/omo-codex/plugin/components/rules/bundled-rules/hephaestus.md

@@ -79,14 +79,14 @@ omo-codex bundles three read-only Codex subagent roles in `CODEX_HOME/agents/`:
 
 **Routing:**
 
-- "Where is X?" / "Find code that does Y" -> `spawn_agent(agent_type="explorer", fork_turns="none", ...)`
-- "How does library Z work?" / "What's the API contract?" -> `spawn_agent(agent_type="librarian", fork_turns="none", ...)`
-- 5+ interdependent steps, ambiguous scope, multi-module work -> `spawn_agent(agent_type="plan", fork_turns="none", ...)`
-- Heavy verification of a finished change -> `spawn_agent(agent_type="codex-ultrawork-reviewer", fork_turns="none", ...)`
+- "Where is X?" / "Find code that does Y" -> `spawn_agent({"task_name":"...","message":"TASK: act as an explorer. ...","fork_turns":"none"})`
+- "How does library Z work?" / "What's the API contract?" -> `spawn_agent({"task_name":"...","message":"TASK: act as a librarian. ...","fork_turns":"none"})`
+- 5+ interdependent steps, ambiguous scope, multi-module work -> `spawn_agent({"task_name":"...","message":"TASK: act as a planning agent. ...","fork_turns":"none"})`
+- Heavy verification of a finished change -> `spawn_agent({"task_name":"...","message":"TASK: act as a rigorous reviewer. ...","fork_turns":"none"})`
 
 **Don't duplicate.** Once a subagent is dispatched for a question, do not re-do the same search yourself. Once results return, do not re-verify by repeating their tool calls; integrate and move on.
 
-**Keep parent liveness visible.** While any child is active, keep the parent visibly alive with brief status updates that include active subagent count, agent names, last heartbeat, and whether the parent is waiting for mailbox updates. Do this during long `wait_agent` cycles so the session does not look idle while children are still running.
+**Keep parent liveness visible.** While any child is active, keep the parent visibly alive with brief status updates that include active subagent count, agent names, latest `WORKING:` phase, and whether the parent is waiting for mailbox updates. Do this during long `wait_agent` cycles so the session does not look idle while children are still running.
 
 # Operating Loop
 
@@ -110,6 +110,12 @@ LSP diagnostics catch type errors, not logic bugs; tests cover only what their a
 
 Reading the source and concluding "this should work" does not pass this gate. If usage reveals a defect, that defect is yours to fix in this turn - same turn, not "follow-up".
 
+# Global Review and Debugging Gate
+
+For significant implementation work and every PR handoff, run `review-work` plus a `debugging` runtime audit before declaring completion. Timeout, missing deliverable, ack-only, `BLOCKED:`, and inconclusive review lanes fail the gate. Record at least three debugging hypotheses and the runtime evidence that confirms or refutes each one.
+
+Do not print completion, create a PR, produce a PR handoff, or produce a branch handoff until the gate passes. Always redact secrets, tokens, credentials, auth headers, cookies, env dumps, private logs, and PII from ledgers, PR bodies, and handoffs.
+
 # Failure Recovery
 
 If your first approach fails, try a materially different one - different algorithm, library, or pattern, not a small tweak. Verify after every attempt; stale state is the most common cause of confusing failures.

package/packages/omo-codex/plugin/components/rules/src/hook-output.ts

@@ -1,10 +1,12 @@
 export type ContextInjectionHookEventName = "SessionStart" | "UserPromptSubmit" | "PostToolUse";
 
+const MAX_ADDITIONAL_CONTEXT_CHARS = 32_000;
+
 export function formatAdditionalContextOutput(
 	eventName: ContextInjectionHookEventName,
 	additionalContext: string,
 ): string {
-	const normalizedContext = normalizeAdditionalContext(additionalContext);
+	const normalizedContext = limitAdditionalContext(normalizeAdditionalContext(additionalContext));
 	if (normalizedContext.length === 0) return "";
 	return `${JSON.stringify({
 		hookSpecificOutput: {
@@ -17,3 +19,11 @@ export function formatAdditionalContextOutput(
 function normalizeAdditionalContext(additionalContext: string): string {
 	return additionalContext.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim();
 }
+
+function limitAdditionalContext(additionalContext: string): string {
+	if (additionalContext.length <= MAX_ADDITIONAL_CONTEXT_CHARS) return additionalContext;
+	const marker = `\n\n[Truncated hook additional context to ${MAX_ADDITIONAL_CONTEXT_CHARS} chars to avoid Codex context overflow.]`;
+	if (marker.length >= MAX_ADDITIONAL_CONTEXT_CHARS) return marker.slice(0, MAX_ADDITIONAL_CONTEXT_CHARS);
+	const head = additionalContext.slice(0, MAX_ADDITIONAL_CONTEXT_CHARS - marker.length).replace(/[ \t\r\n]+$/, "");
+	return `${head}${marker}`;
+}

package/packages/omo-codex/plugin/components/rules/src/post-compact-budget.ts

@@ -22,7 +22,6 @@ const POST_COMPACT_MIN_GUIDE_CHARS = 500;
 const FALLBACK_CONTEXT_WINDOW_TOKENS = 200_000;
 const MODEL_CONTEXT_BUDGETS: readonly ModelContextBudget[] = [
 	{ slug: "gpt-5.5", contextWindowTokens: 272_000, effectivePercent: DEFAULT_EFFECTIVE_CONTEXT_WINDOW_PERCENT },
-	{ slug: "gpt-5.4", contextWindowTokens: 272_000, effectivePercent: DEFAULT_EFFECTIVE_CONTEXT_WINDOW_PERCENT },
 	{ slug: "gpt-5.4-mini", contextWindowTokens: 272_000, effectivePercent: DEFAULT_EFFECTIVE_CONTEXT_WINDOW_PERCENT },
 	{
 		slug: "codex-auto-review",

package/packages/omo-codex/plugin/components/rules/src/rules/constants.ts

@@ -28,10 +28,7 @@ export const PROJECT_RULE_SUBDIRS: ReadonlyArray<readonly [string, string]> = [
 /**
  * Single-file project rules (always apply, frontmatter optional).
  */
-export const PROJECT_SINGLE_FILES: readonly string[] = [
-	".github/copilot-instructions.md",
-	"CONTEXT.md",
-];
+export const PROJECT_SINGLE_FILES: readonly string[] = [".github/copilot-instructions.md", "CONTEXT.md"];
 
 /**
  * User-home rule directories.

package/packages/omo-codex/plugin/components/rules/src/rules/engine-dynamic-cache.ts

@@ -0,0 +1,87 @@
+import { dirname, resolve } from "node:path";
+import { pathBasesForTarget, toPosixPath } from "./engine-paths.js";
+import type { CandidateDiscoveryCache, DynamicMatchCache, EngineDeps } from "./engine-types.js";
+import type { matchRule } from "./matcher.js";
+import { sortCandidates } from "./ordering.js";
+import type { LoadedRule, MatchReason, RuleCandidate } from "./types.js";
+
+const MAX_DYNAMIC_MATCH_CACHE_ENTRIES = 4096;
+
+export function matchDynamicRuleCached(
+	cache: DynamicMatchCache,
+	projectRoot: string | null,
+	targetFile: string,
+	candidate: RuleCandidate,
+	loadedRule: LoadedRule,
+	matchRuleImpl: typeof matchRule,
+): MatchReason | null {
+	const cacheKey = dynamicMatchCacheKey(projectRoot, targetFile, candidate, loadedRule.contentHash);
+	if (cache.has(cacheKey)) {
+		const cachedReason = cache.get(cacheKey) ?? null;
+		cache.delete(cacheKey);
+		cache.set(cacheKey, cachedReason);
+		return cachedReason;
+	}
+
+	const matchResult = matchRuleImpl({
+		frontmatter: loadedRule.frontmatter,
+		isSingleFile: candidate.isSingleFile,
+		pathBases: pathBasesForTarget(projectRoot, targetFile, candidate),
+	});
+	const reason = matchResult.matched ? matchResult.reason : null;
+	setDynamicMatchCacheEntry(cache, cacheKey, reason);
+	return reason;
+}
+
+export function findSortedCandidatesCached(
+	cache: CandidateDiscoveryCache,
+	findCandidates: EngineDeps["findCandidates"],
+	options: Parameters<EngineDeps["findCandidates"]>[0],
+): RuleCandidate[] {
+	const cacheKey = candidateDiscoveryCacheKey(options);
+	const cached = cache.get(cacheKey);
+	if (cached !== undefined) {
+		return cached;
+	}
+
+	const candidates = sortCandidates(findCandidates(options));
+	cache.set(cacheKey, candidates);
+	return candidates;
+}
+
+function setDynamicMatchCacheEntry(cache: DynamicMatchCache, cacheKey: string, reason: MatchReason | null): void {
+	if (cache.size >= MAX_DYNAMIC_MATCH_CACHE_ENTRIES) {
+		const oldestCacheKey = cache.keys().next().value;
+		if (oldestCacheKey !== undefined) {
+			cache.delete(oldestCacheKey);
+		}
+	}
+	cache.set(cacheKey, reason);
+}
+
+function dynamicMatchCacheKey(
+	projectRoot: string | null,
+	targetFile: string,
+	candidate: RuleCandidate,
+	contentHash: string,
+): string {
+	return [
+		projectRoot ?? "",
+		toPosixPath(resolve(targetFile)),
+		candidate.realPath,
+		candidate.relativePath,
+		candidate.source,
+		candidate.isGlobal ? "global" : "project",
+		candidate.isSingleFile ? "single" : "multi",
+		String(candidate.distance),
+		contentHash,
+	].join("\0");
+}
+
+function candidateDiscoveryCacheKey(options: Parameters<EngineDeps["findCandidates"]>[0]): string {
+	return [
+		options.projectRoot ?? "",
+		options.targetFile === null ? "" : dirname(resolve(options.targetFile)),
+		...[...(options.disabledSources ?? [])].sort(),
+	].join("\0");
+}

package/packages/omo-codex/plugin/components/rules/src/rules/engine-dynamic-loader.ts

@@ -0,0 +1,94 @@
+import { findSortedCandidatesCached, matchDynamicRuleCached } from "./engine-dynamic-cache.js";
+import { loadCandidate, ruleDedupKey } from "./engine-loader.js";
+import { isSameOrChildPath } from "./engine-paths.js";
+import type { CandidateDiscoveryCache, DynamicMatchCache, EngineDeps, LoadedRuleContent } from "./engine-types.js";
+import { createRuleDiscoveryCache } from "./finder.js";
+import { matchRule } from "./matcher.js";
+import { sortCandidates } from "./ordering.js";
+import { disabledSourcesFromConfig } from "./sources.js";
+import type { LoadedRule, PiRulesConfig, RuleDiagnostic } from "./types.js";
+
+export function loadDynamicCandidates(
+	config: PiRulesConfig,
+	deps: EngineDeps,
+	cwd: string,
+	targetPaths: ReadonlyArray<string>,
+	dynamicMatchCache: DynamicMatchCache,
+): { rules: LoadedRule[]; diagnostics: RuleDiagnostic[] } {
+	const rules: LoadedRule[] = [];
+	const diagnostics: RuleDiagnostic[] = [];
+	const seenRules = new Set<string>();
+	const loadedRuleContent = new Map<string, LoadedRuleContent | null>();
+	const projectMembership = new Map<string, boolean>();
+	const disabledSources = disabledSourcesFromConfig(config);
+	const discoveryCache = createRuleDiscoveryCache();
+	const candidateDiscoveryCache: CandidateDiscoveryCache = new Map();
+	const cwdProjectRoot = deps.findProjectRoot(cwd);
+
+	for (const targetFile of uniqueStrings(targetPaths)) {
+		const projectRoot =
+			cwdProjectRoot !== null && isSameOrChildPath(targetFile, cwdProjectRoot)
+				? cwdProjectRoot
+				: deps.findProjectRoot(targetFile);
+		const findOptions: Parameters<EngineDeps["findCandidates"]>[0] = {
+			projectRoot,
+			targetFile,
+			cache: discoveryCache,
+		};
+		if (disabledSources !== undefined) {
+			findOptions.disabledSources = disabledSources;
+		}
+		const candidates = findSortedCandidatesCached(candidateDiscoveryCache, deps.findCandidates, findOptions);
+
+		for (const candidate of candidates) {
+			const loadedRule = loadCandidate(
+				candidate,
+				deps,
+				diagnostics,
+				projectRoot,
+				loadedRuleContent,
+				projectMembership,
+			);
+			if (loadedRule === null) {
+				continue;
+			}
+
+			const matchReason = matchDynamicRuleCached(
+				dynamicMatchCache,
+				projectRoot,
+				targetFile,
+				candidate,
+				loadedRule,
+				deps.matchRule ?? matchRule,
+			);
+
+			if (matchReason === null) {
+				continue;
+			}
+
+			const dedupKey = ruleDedupKey(loadedRule);
+			if (seenRules.has(dedupKey)) {
+				continue;
+			}
+
+			seenRules.add(dedupKey);
+			rules.push({ ...loadedRule, matchReason });
+		}
+	}
+
+	return { rules: sortCandidates(rules), diagnostics };
+}
+
+function uniqueStrings(values: ReadonlyArray<string>): string[] {
+	const uniqueValues: string[] = [];
+	const seenValues = new Set<string>();
+	for (const value of values) {
+		if (seenValues.has(value)) {
+			continue;
+		}
+
+		seenValues.add(value);
+		uniqueValues.push(value);
+	}
+	return uniqueValues;
+}