rulesync 16.15.0 → 16.17.0

package/dist/{import-nfDFI5X1.cjs → import-DDPTPxOX.cjs}

@@ -34,6 +34,7 @@ let gray_matter = require("gray-matter");
 gray_matter = __toESM(gray_matter, 1);
 let js_yaml = require("js-yaml");
 let es_toolkit_object = require("es-toolkit/object");
+let node_fs = require("node:fs");
 let node_crypto = require("node:crypto");
 let node_util = require("node:util");
 let smol_toml = require("smol-toml");
@@ -134,27 +135,34 @@ const isFeatureValueEnabled = (value) => {
 };
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$290 } = node_path.posix;
+const { join: join$291 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$290(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "checks");
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$290(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULES_FEATURE_SUBDIR = "rules";
+const CURATED_RULES_FEATURE_SUBDIR = join$291(RULES_FEATURE_SUBDIR, ".curated");
+const COMMANDS_FEATURE_SUBDIR = "commands";
+const SUBAGENTS_FEATURE_SUBDIR = "subagents";
+const CHECKS_FEATURE_SUBDIR = "checks";
+const SKILLS_FEATURE_SUBDIR = "skills";
+const CURATED_SKILLS_FEATURE_SUBDIR = join$291(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$291(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$290(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$291(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -488,9 +496,22 @@ function isEnvTest() {
 }
 //#endregion
 //#region src/utils/file.ts
+/**
+* Whether a relative path leads out of the root it is relative to. Matching
+* whole segments matters: a directory really named `..cache` relatively
+* resolves to `..cache/file`, which a prefix test would report as an escape.
+*/
 function pathEscapesRoot(relativePath) {
 	return relativePath === ".." || relativePath.startsWith(`..${node_path.sep}`) || (0, node_path.isAbsolute)(relativePath);
 }
+/** Whether a single path segment is a hidden (dot-prefixed) name. */
+function isHiddenPathSegment(segment) {
+	return segment.startsWith(".") && segment !== "." && segment !== "..";
+}
+/** Split a path on both separators, so one predicate serves either platform. */
+function splitPathSegments(filePath) {
+	return filePath.split(/[/\\]/);
+}
 async function assertWritablePathInsideRoot(params) {
 	const { rootPath, targetPath } = params;
 	let existingPath = targetPath;
@@ -721,8 +742,45 @@ async function listDirectoryFiles(dir) {
 		return [];
 	}
 }
+/** How many dot-prefixed segments a path has, used to prefer a named alias over a hidden one. */
+function countHiddenSegments(filePath) {
+	return splitPathSegments(filePath).filter(isHiddenPathSegment).length;
+}
+/**
+* The real file a path denotes, posix-separated so it compares against the globby results
+* that produce it. Two paths share an identity when they resolve to the very same file --
+* a link beside its target, a link into a shared tree, or a cycle that walks back into an
+* ancestor and yields the same file forty levels down.
+*/
+async function realFileIdentity(filePath) {
+	try {
+		return toPosixPath(await (0, node_fs_promises.realpath)(filePath));
+	} catch {
+		return toPosixPath(filePath);
+	}
+}
+/**
+* Pick the one path that represents a file among the paths that resolve to it.
+*
+* The path that walked through no link at all wins outright: it is already the real one,
+* so it equals the file's identity. That keeps the real location of a file as the path
+* callers see, rather than an alias that happens to sort first -- a directory link named
+* `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a cycle must not replace
+* `sub/note.md` with the same file reached back through the cycle.
+* Failing that, the fewest dot-prefixed segments wins: when only links are on offer, the
+* named one represents the entry rather than a hidden alias that a hidden-entry rule may
+* then drop, taking the named path's content with it. `candidates` arrives in sorted
+* order, so ties keep the first one deterministically.
+*/
+function chooseRepresentative(candidates, identity) {
+	return candidates.reduce((best, candidate) => {
+		if (toPosixPath(best) === identity) return best;
+		if (toPosixPath(candidate) === identity) return candidate;
+		return countHiddenSegments(candidate) < countHiddenSegments(best) ? candidate : best;
+	});
+}
 async function findFilesByGlobs(globs, options = {}) {
-	const { type = "all", followSymbolicLinks = true, ignore } = options;
+	const { type = "all", followSymbolicLinks = true, ignore, dot = false } = options;
 	const globbyOptions = type === "file" ? {
 		onlyFiles: true,
 		onlyDirectories: false
@@ -737,23 +795,18 @@ async function findFilesByGlobs(globs, options = {}) {
 	const results = (0, globby.globbySync)(normalizedGlobs, {
 		absolute: true,
 		followSymbolicLinks,
+		dot,
 		...ignore ? { ignore: ignore.map((pattern) => pattern.replaceAll("\\", "/")) } : {},
 		...globbyOptions
 	});
-	const seenRealPaths = /* @__PURE__ */ new Set();
-	const deduped = [];
+	const candidatesByFile = /* @__PURE__ */ new Map();
 	for (const result of results.toSorted()) {
-		let realResult;
-		try {
-			realResult = await (0, node_fs_promises.realpath)(result);
-		} catch {
-			realResult = result;
-		}
-		if (seenRealPaths.has(realResult)) continue;
-		seenRealPaths.add(realResult);
-		deduped.push(result);
+		const identity = await realFileIdentity(result);
+		const candidates = candidatesByFile.get(identity);
+		if (candidates === void 0) candidatesByFile.set(identity, [result]);
+		else candidates.push(result);
 	}
-	return deduped;
+	return [...candidatesByFile.entries()].map(([identity, candidates]) => chooseRepresentative(candidates, identity)).toSorted();
 }
 async function removeDirectory(dirPath) {
 	if ([
@@ -912,6 +965,25 @@ var CLIError = class extends Error {
 	}
 };
 //#endregion
+//#region src/utils/warned-once.ts
+/**
+* The messages a once-per-run warning has already emitted in this process.
+* This lives in its own module, free of imports, so the vitest setup file can
+* clear it between tests without pulling `logger.js` into every test's module
+* graph (which would defeat the module mocks some of those tests install).
+*/
+const warnedOnceMessages = /* @__PURE__ */ new Set();
+/** Whether `message` has not been emitted yet; records it when it has not. */
+function claimWarnOnce(message) {
+	if (warnedOnceMessages.has(message)) return false;
+	warnedOnceMessages.add(message);
+	return true;
+}
+/** Forget which warnings were already emitted, so each test starts silent. */
+function resetWarnedOnceMessages() {
+	warnedOnceMessages.clear();
+}
+//#endregion
 //#region src/utils/logger.ts
 /**
 * Base class for shared verbose/silent state and configuration logic
@@ -1064,6 +1136,17 @@ const fallbackLogger = new ConsoleLogger();
 function warnWithFallback(logger, message) {
 	(logger ?? fallbackLogger).warn(message);
 }
+/**
+* Emit a warning at most once per run. A single `generate` reads the same source
+* file once per enabled tool target, so a warning that describes the source
+* rather than the target would otherwise be printed a dozen identical times.
+* Diagnostics that name the file they are about qualify; anything whose text
+* varies with what the user should do next does not.
+*/
+function warnOnceWithFallback(logger, message) {
+	if (!claimWarnOnce(message)) return;
+	warnWithFallback(logger, message);
+}
 //#endregion
 //#region src/utils/validation.ts
 /**
@@ -1142,6 +1225,7 @@ const ConfigParamsSchema = zod_mini.z.object({
 	dryRun: (0, zod_mini.optional)(zod_mini.z.boolean()),
 	check: (0, zod_mini.optional)(zod_mini.z.boolean()),
 	inputRoot: (0, zod_mini.optional)(zod_mini.z.string()),
+	inputRoots: (0, zod_mini.optional)(zod_mini.z.array(zod_mini.z.string()).check((0, zod_mini.minLength)(1, "inputRoots must be non-empty"))),
 	sources: (0, zod_mini.optional)(zod_mini.z.array(SourceEntrySchema))
 });
 zod_mini.z.partial(ConfigParamsSchema);
@@ -1154,14 +1238,39 @@ zod_mini.z.required(ConfigParamsSchema);
 * Normalizes the configuration file location to an absolute path.
 *
 * `ConfigResolver` always supplies the path it actually loaded; the fallback
-* only covers direct programmatic construction, where the conventional
-* location next to the input root is the best guess.
+* only covers direct programmatic construction. `anchorDir` is the directory
+* the config file lives next to — for the default `.rulesync/` layout this
+* is the parent of the primary source tree.
 */
-function normalizeConfigFilePath({ configFilePath, inputRoot }) {
-	if (configFilePath === void 0) return (0, node_path.join)(inputRoot, RULESYNC_CONFIG_RELATIVE_FILE_PATH);
+function normalizeConfigFilePath({ configFilePath, anchorDir }) {
+	if (configFilePath === void 0) return (0, node_path.join)(anchorDir, RULESYNC_CONFIG_RELATIVE_FILE_PATH);
 	return (0, node_path.isAbsolute)(configFilePath) ? configFilePath : (0, node_path.resolve)(configFilePath);
 }
 /**
+* Resolves any accepted input-root shape (`inputRoot`, `inputRoots`, or
+* neither) to the canonical non-empty tuple of absolute paths that
+* `Config` stores. Relative entries are resolved against the current
+* working directory at call time.
+*
+* Semantics (post-refactor):
+* - Each entry in `inputRoots` is a rulesync **source tree** (the directory
+*   that directly holds `rules/`, `skills/`, `mcp.jsonc`, etc.). No implicit
+*   `.rulesync/` join is applied.
+* - The legacy singular `inputRoot` is a shorthand for "parent of the
+*   default `.rulesync/` source tree", and is expanded to
+*   `[join(inputRoot, ".rulesync")]` before hitting any consumer. This is
+*   the ONLY place `.rulesync` is appended by convention.
+* - The "nothing configured" default expands to `[join(cwd, ".rulesync")]`
+*   so existing projects with a single `.rulesync/` tree keep working
+*   unchanged.
+*
+* Callers must have already run `assertInputRootFieldsExclusive`.
+*/
+function normalizeInputRoots({ inputRoot, inputRoots }) {
+	const resolved = (inputRoots !== void 0 && inputRoots.length > 0 ? inputRoots : inputRoot !== void 0 ? [(0, node_path.join)(inputRoot, RULESYNC_RELATIVE_DIR_PATH)] : [(0, node_path.join)(process.cwd(), RULESYNC_RELATIVE_DIR_PATH)]).map((entry) => (0, node_path.isAbsolute)(entry) ? entry : (0, node_path.resolve)(entry));
+	return [resolved[0], ...resolved.slice(1)];
+}
+/**
 * Conflicting target pairs that cannot be used together.
 * Exported so `rulesync doctor` can report the same conflicts as diagnostics
 * without duplicating the list.
@@ -1198,6 +1307,28 @@ const assertTargetsFeaturesExclusive = ({ targets, features }) => {
 	if (targets !== void 0 && !Array.isArray(targets) && features !== void 0) throw new Error("Invalid config: when 'targets' is in object form, 'features' must be omitted. Declare per-target features inside the 'targets' object instead.");
 };
 /**
+* Rejects a single user-authored config file (or a single programmatic
+* construction) that defines both `inputRoot` and `inputRoots` — the two
+* fields express the same setting at singular vs. list level and cannot
+* be combined within one file without ambiguity.
+*
+* The check is intentionally per-file: base and local config files can each
+* be valid in isolation and merge into a state where both survive, and the
+* resolver picks `inputRoots` in that case (see `resolveEffectiveInputRoots`).
+* Only a single file declaring both is a genuine authoring error.
+*/
+const assertInputRootFieldsExclusive = ({ inputRoot, inputRoots }) => {
+	if (inputRoot !== void 0 && inputRoots !== void 0) throw new Error("Invalid config: 'inputRoot' and 'inputRoots' cannot be combined. Remove 'inputRoot' and keep 'inputRoots', or reduce 'inputRoots' to a single-element 'inputRoot' string.");
+};
+/**
+* Rejects an explicitly supplied empty `inputRoots` list. Omitting the field
+* selects the conventional default, while an empty list has no meaningful
+* source-tree semantics and must not be treated as an absent override.
+*/
+const assertInputRootsNonEmpty = ({ inputRoots }) => {
+	if (inputRoots !== void 0 && inputRoots.length === 0) throw new Error("Invalid config: 'inputRoots' must be non-empty.");
+};
+/**
 * Normalizes a post-resolution `ConfigParams` input by rejecting the case
 * where both `targets` and `features` are undefined — a degenerate state
 * that would silently produce a no-op config (no targets, no features).
@@ -1233,14 +1364,35 @@ var Config = class Config {
 	gitignoreDestination;
 	dryRun;
 	check;
-	inputRoot;
+	/**
+	* Ordered, absolute-path list of rulesync source trees. Each entry is a
+	* source tree itself — the directory that directly contains `rules/`,
+	* `skills/`, `mcp.jsonc`, etc. No implicit `.rulesync/` join is applied.
+	*
+	* Always non-empty by construction — the constructor either normalizes
+	* an `inputRoot`/`inputRoots` input or falls back to a single-element
+	* list containing `join(<cwd>, ".rulesync")`.
+	*
+	* `inputRoot` (singular) is a deprecated backward-compatibility alias
+	* that expands to `[join(inputRoot, ".rulesync")]`.
+	*
+	* Typed as a non-empty tuple so the one internal caller that legitimately
+	* needs "the primary root" (`normalizeConfigFilePath` fallback) can index
+	* `[0]` without a runtime null-check.
+	*/
+	inputRoots;
 	configFilePath;
 	sources;
-	constructor({ outputRoots, targets, features, verbose, delete: isDelete, global, silent, simulateCommands, simulateSubagents, simulateSkills, flattenedCommandNaming, gitignoreTargetsOnly, gitignoreDestination, dryRun, check, inputRoot, configFilePath, sources, configFileTargets }) {
+	constructor({ outputRoots, targets, features, verbose, delete: isDelete, global, silent, simulateCommands, simulateSubagents, simulateSkills, flattenedCommandNaming, gitignoreTargetsOnly, gitignoreDestination, dryRun, check, inputRoot, inputRoots, configFilePath, sources, configFileTargets }) {
 		assertTargetsFeaturesExclusive({
 			targets,
 			features
 		});
+		assertInputRootFieldsExclusive({
+			inputRoot,
+			inputRoots
+		});
+		assertInputRootsNonEmpty({ inputRoots });
 		assertTargetsOrFeaturesProvided({
 			targets,
 			features
@@ -1268,10 +1420,13 @@ var Config = class Config {
 		this.gitignoreDestination = gitignoreDestination ?? "gitignore";
 		this.dryRun = dryRun ?? false;
 		this.check = check ?? false;
-		this.inputRoot = inputRoot === void 0 ? process.cwd() : (0, node_path.isAbsolute)(inputRoot) ? inputRoot : (0, node_path.resolve)(inputRoot);
+		this.inputRoots = normalizeInputRoots({
+			inputRoot,
+			inputRoots
+		});
 		this.configFilePath = normalizeConfigFilePath({
 			configFilePath,
-			inputRoot: this.inputRoot
+			anchorDir: (0, node_path.dirname)(this.inputRoots[0])
 		});
 		this.sources = sources ?? [];
 	}
@@ -1455,16 +1610,22 @@ var Config = class Config {
 		return this.check;
 	}
 	/**
-	* Returns the directory containing the `.rulesync/` source files. The value
-	* is always an absolute path captured at config-construction time, so this
-	* accessor is pure and never depends on a live `process.cwd()` read.
+	* Returns the ordered list of rulesync source trees. Each entry is the
+	* source tree itself — the directory that directly contains `rules/`,
+	* `skills/`, `mcp.jsonc`, etc. Values are absolute paths captured at
+	* config-construction time, so this accessor is pure and never depends on
+	* a live `process.cwd()` read.
 	*
-	* When no `inputRoot` was supplied to the constructor, `process.cwd()` is
-	* snapshotted once during construction. When a relative `inputRoot` is
-	* supplied, it is resolved to absolute against the construction-time cwd.
+	* The returned tuple is always non-empty: when no `inputRoot`/`inputRoots`
+	* was supplied, `[join(process.cwd(), ".rulesync")]` is snapshotted once
+	* during construction. The first entry is the required base source tree.
+	* Later entries are optional overlays and may be absent; when present, they
+	* take precedence when the same relative source path exists in more than
+	* one root (see per-feature merge policies in the processor
+	* `loadRulesync*` methods).
 	*/
-	getInputRoot() {
-		return this.inputRoot;
+	getInputRoots() {
+		return this.inputRoots;
 	}
 	/**
 	* Returns the absolute path of the configuration file this config was
@@ -1505,6 +1666,7 @@ const getDefaults = () => ({
 	dryRun: false,
 	check: false,
 	inputRoot: void 0,
+	inputRoots: void 0,
 	sources: []
 });
 const loadConfigFromFile = async (filePath) => {
@@ -1516,8 +1678,23 @@ const loadConfigFromFile = async (filePath) => {
 		targets: configParams.targets,
 		features: configParams.features
 	});
+	try {
+		assertInputRootFieldsExclusive({
+			inputRoot: configParams.inputRoot,
+			inputRoots: configParams.inputRoots
+		});
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(`${detail} (in ${JSON.stringify(filePath)})`, { cause: error });
+	}
 	return configParams;
 };
+function mergeInputRootConfigs({ baseConfig, localConfig }) {
+	return {
+		inputRoot: localConfig.inputRoot ?? baseConfig.inputRoot,
+		inputRoots: localConfig.inputRoots ?? baseConfig.inputRoots
+	};
+}
 const mergeConfigs = (baseConfig, localConfig) => {
 	return {
 		targets: localConfig.targets ?? baseConfig.targets,
@@ -1535,7 +1712,10 @@ const mergeConfigs = (baseConfig, localConfig) => {
 		gitignoreDestination: localConfig.gitignoreDestination ?? baseConfig.gitignoreDestination,
 		dryRun: localConfig.dryRun ?? baseConfig.dryRun,
 		check: localConfig.check ?? baseConfig.check,
-		inputRoot: localConfig.inputRoot ?? baseConfig.inputRoot,
+		...mergeInputRootConfigs({
+			baseConfig,
+			localConfig
+		}),
 		sources: localConfig.sources ?? baseConfig.sources
 	};
 };
@@ -1564,13 +1744,14 @@ function assertMergedTargetsFeaturesExclusive({ configByFile, validatedConfigPat
 	}
 }
 /**
-* Resolve the effective `global` flag. When an `inputRoot` is in play the user
-* is decoupling source from output, so a config-file `global: true` is dropped
-* (unless the caller also explicitly passes `global`); a warning is emitted in
+* Resolve the effective `global` flag. When an input root (singular
+* `inputRoot` or plural `inputRoots`) is in play the user is decoupling
+* source from output, so a config-file `global: true` is dropped (unless
+* the caller also explicitly passes `global`); a warning is emitted in
 * that case. Returns the resolved boolean `global`.
 */
 function resolveGlobal({ logger, resolvedInputRoot, global, configByFile, validatedConfigPath }) {
-	if (resolvedInputRoot !== void 0 && global === void 0 && configByFile.global === true) warnWithFallback(logger, `Ignoring "global: true" from ${JSON.stringify(validatedConfigPath)} because an inputRoot was configured; pass global=true (CLI: --global) to keep user-scope output. Output will be project-scope (global=false).`);
+	if (resolvedInputRoot !== void 0 && global === void 0 && configByFile.global === true) warnWithFallback(logger, `Ignoring "global: true" from ${JSON.stringify(validatedConfigPath)} because an input root was configured; pass global=true (CLI: --global) to keep user-scope output. Output will be project-scope (global=false).`);
 	return pick({
 		cli: global,
 		file: resolvedInputRoot !== void 0 ? false : configByFile.global,
@@ -1594,17 +1775,81 @@ function resolveFeaturesAndTargets({ features, targets, configByFile }) {
 		resolvedTargets: userProvidedTargets ?? getDefaults().targets
 	};
 }
+/**
+* Resolve the effective, non-empty, absolute-path list of source-tree roots
+* by applying CLI > file > default precedence and preferring `inputRoots`
+* over `inputRoot` when both survive the base+local merge. Duplicates (after
+* normalization to absolute paths) are removed silently so overlapping
+* base/local declarations do not double-count the same tree.
+*
+* Semantics (post-refactor):
+* - `inputRoots` entries are the source trees themselves (each holds
+*   `rules/`, `skills/`, `mcp.jsonc`, etc.); they are passed through
+*   unchanged.
+* - `inputRoot` (legacy singular) is a shorthand for "parent of the
+*   `.rulesync/` source tree" and is expanded to `join(inputRoot,
+*   ".rulesync")` before it hits any consumer.
+* - The "nothing configured" default expands to `[join(cwd, ".rulesync")]`
+*   so existing projects keep working unchanged.
+*
+* When both the merged file config has `inputRoots` and the CLI supplied
+* `inputRoot` (or vice versa), CLI wins outright — matching how every
+* other field is resolved. When only the file config supplies both, the
+* plural wins over the singular and the drop is logged at debug level.
+*/
+function resolveEffectiveInputRoots({ cliInputRoot, cliInputRoots, configByFile, cwd, logger }) {
+	let source;
+	let field;
+	if (cliInputRoots !== void 0 && cliInputRoots.length > 0) {
+		source = cliInputRoots;
+		field = "inputRoots";
+	} else if (cliInputRoot !== void 0) {
+		source = [(0, node_path.join)(cliInputRoot, RULESYNC_RELATIVE_DIR_PATH)];
+		field = "inputRoot";
+	} else if (configByFile.inputRoots !== void 0 && configByFile.inputRoots.length > 0) {
+		source = configByFile.inputRoots;
+		field = "inputRoots";
+		if (configByFile.inputRoot !== void 0) logger?.debug(`Both 'inputRoot' and 'inputRoots' were set after merging base and local configs; 'inputRoots' wins and 'inputRoot' was dropped.`);
+	} else if (configByFile.inputRoot !== void 0) {
+		source = [(0, node_path.join)(configByFile.inputRoot, RULESYNC_RELATIVE_DIR_PATH)];
+		field = "inputRoot";
+	} else source = [(0, node_path.join)(cwd, RULESYNC_RELATIVE_DIR_PATH)];
+	const candidates = source.map((entry) => (0, node_path.resolve)(cwd, entry));
+	const seen = /* @__PURE__ */ new Set();
+	const resolved = [];
+	for (const absolute of candidates) {
+		if (seen.has(absolute)) continue;
+		seen.add(absolute);
+		resolved.push(absolute);
+	}
+	return {
+		inputRoots: [resolved[0], ...resolved.slice(1)],
+		candidates,
+		field
+	};
+}
 var ConfigResolver = class {
-	static async resolve({ targets, features, verbose, delete: isDelete, outputRoots, configPath = getDefaults().configPath, global, silent, simulateCommands, simulateSubagents, simulateSkills, gitignoreTargetsOnly, dryRun, check, gitignoreDestination, inputRoot }, { logger } = {}) {
+	static async resolve({ targets, features, verbose, delete: isDelete, outputRoots, configPath = getDefaults().configPath, global, silent, simulateCommands, simulateSubagents, simulateSkills, gitignoreTargetsOnly, dryRun, check, gitignoreDestination, inputRoot, inputRoots }, { logger } = {}) {
 		const cwd = (0, node_path.resolve)(process.cwd());
+		assertInputRootFieldsExclusive({
+			inputRoot,
+			inputRoots
+		});
+		assertInputRootsNonEmpty({ inputRoots });
 		if (inputRoot !== void 0) validateOutputRoot(inputRoot);
-		const validatedConfigPath = resolvePath(configPath, (0, node_path.resolve)(inputRoot ?? cwd));
+		if (inputRoots !== void 0) for (const entry of inputRoots) validateOutputRoot(entry);
+		const cliConfigAnchor = inputRoot;
+		const hasCliInputRootOverride = inputRoot !== void 0 || inputRoots !== void 0;
+		const validatedConfigPath = resolvePath(configPath, (0, node_path.resolve)(cliConfigAnchor ?? cwd));
 		const baseConfig = await loadConfigFromFile(validatedConfigPath);
 		const configDir = (0, node_path.dirname)(validatedConfigPath);
 		const localConfigPath = (0, node_path.join)(configDir, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH);
 		const localConfig = await loadConfigFromFile(localConfigPath);
 		const configByFile = mergeConfigs(baseConfig, localConfig);
-		if (inputRoot === void 0 && configByFile.inputRoot !== void 0) validateOutputRoot(configByFile.inputRoot);
+		if (!hasCliInputRootOverride) {
+			if (configByFile.inputRoot !== void 0) validateOutputRoot(configByFile.inputRoot);
+			if (configByFile.inputRoots !== void 0) for (const entry of configByFile.inputRoots) validateOutputRoot(entry);
+		}
 		assertMergedTargetsFeaturesExclusive({
 			configByFile,
 			validatedConfigPath,
@@ -1630,10 +1875,16 @@ var ConfigResolver = class {
 				silent: resolvedSilent
 			});
 		}
-		const resolvedInputRoot = inputRoot ?? configByFile.inputRoot;
+		const resolvedInputRoots = resolveEffectiveInputRoots({
+			cliInputRoot: inputRoot,
+			cliInputRoots: inputRoots,
+			configByFile,
+			cwd,
+			logger
+		}).inputRoots;
 		const resolvedGlobal = resolveGlobal({
 			logger,
-			resolvedInputRoot,
+			resolvedInputRoot: inputRoot !== void 0 || inputRoots !== void 0 || configByFile.inputRoot !== void 0 || configByFile.inputRoots !== void 0 ? resolvedInputRoots[0] : void 0,
 			global,
 			configByFile,
 			validatedConfigPath
@@ -1697,7 +1948,7 @@ var ConfigResolver = class {
 				file: configByFile.check,
 				fallback: getDefaults().check
 			}),
-			inputRoot: resolvedInputRoot !== void 0 ? (0, node_path.resolve)(resolvedInputRoot) : cwd,
+			inputRoots: resolvedInputRoots,
 			configFilePath: validatedConfigPath,
 			sources: configByFile.sources ?? getDefaults().sources,
 			flattenedCommandNaming: configByFile.flattenedCommandNaming ?? getDefaults().flattenedCommandNaming,
@@ -1840,8 +2091,7 @@ var AiFile = class {
 		const fullPath = node_path.default.join(this.outputRoot, this.relativeDirPath, this.relativeFilePath);
 		const resolvedFull = (0, node_path.resolve)(fullPath);
 		const resolvedBase = (0, node_path.resolve)(this.outputRoot);
-		const rel = (0, node_path.relative)(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || node_path.default.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", relativeFilePath="${this.relativeFilePath}"`);
+		if (pathEscapesRoot((0, node_path.relative)(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", relativeFilePath="${this.relativeFilePath}"`);
 		return fullPath;
 	}
 	getFileContent() {
@@ -1903,6 +2153,27 @@ var RulesyncFile = class extends AiFile {
 	}
 };
 //#endregion
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
+* line and paragraph separators, and the plain LRM/RLM marks. A name or value
+* copied out of an untrusted config file, a fetched repository, or a tool's own
+* settings file must never reach the terminal with these intact: they let the
+* text forge log lines, reorder what is printed around them, or inject escape
+* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
+* neutral characters beside them, so they go too — a diagnostic line is not the
+* place to preserve the typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+//#endregion
 //#region src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -2026,7 +2297,7 @@ function parseFrontmatter(content, filePath) {
 	let body;
 	let hasFrontmatter;
 	try {
-		const result = (0, gray_matter.default)(content);
+		const result = (0, gray_matter.default)(content, {});
 		frontmatter = result.data;
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
@@ -2040,6 +2311,104 @@ function parseFrontmatter(content, filePath) {
 		hasFrontmatter
 	};
 }
+/**
+* A top-level `key: value` entry. Nested entries are left alone deliberately:
+* the repair below rewrites a value's meaning, and the failure it exists for —
+* an unquoted sentence with a colon in it — is a `description`, which is always
+* top-level.
+*/
+const TOP_LEVEL_ENTRY_PATTERN = /^([A-Za-z_][\w.-]*):[^\S\r\n]+(\S.*)$/;
+/** A plain scalar that already starts as some other YAML construct. */
+const YAML_CONSTRUCT_PREFIX_PATTERN = /^["'|>&*![{#]/;
+/**
+* Cut a plain scalar at its inline comment — whitespace followed by `#`.
+*
+* This has to happen before anything else looks at the value, or a line such as
+* `allowed-tools: Read # TODO: add Bash later` reads as needing repair and comes
+* back quoted with the comment inside it, which for a list of tool permissions
+* would grant what the comment had disabled. Scanning by hand rather than with
+* `/\s+#.*$/`: that pattern is unanchored, so a long run of spaces with no `#`
+* after it backtracks from every starting position, and a value padded with a
+* megabyte of spaces takes minutes to reject. This is linear in the value.
+*/
+function stripInlineComment(rawValue) {
+	for (let index = 1; index < rawValue.length; index++) if (rawValue[index] === "#" && /\s/.test(rawValue[index - 1] ?? "")) return rawValue.slice(0, index).trimEnd();
+	return rawValue.trimEnd();
+}
+function repairFrontmatterLine(line) {
+	const unchanged = {
+		line,
+		droppedComment: false
+	};
+	const carriageReturn = line.endsWith("\r") ? "\r" : "";
+	const bareLine = carriageReturn === "" ? line : line.slice(0, -1);
+	const match = TOP_LEVEL_ENTRY_PATTERN.exec(bareLine);
+	if (!match) return unchanged;
+	const [, key = "", rawValue = ""] = match;
+	const value = stripInlineComment(rawValue);
+	if (value === "") return unchanged;
+	if (!/:(?:\s|$)/.test(value)) return unchanged;
+	if (YAML_CONSTRUCT_PREFIX_PATTERN.test(value)) return unchanged;
+	return {
+		line: `${key}: ${JSON.stringify(value)}${carriageReturn}`,
+		droppedComment: value !== rawValue.trimEnd()
+	};
+}
+/**
+* Quote the unquoted scalars that make a frontmatter block unparseable, or
+* return `undefined` when there is nothing to repair. Only the frontmatter
+* block is rewritten; the body is passed through untouched.
+*/
+function repairMalformedFrontmatterYaml(content) {
+	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
+	if (!opening) return;
+	const blockStart = opening[0].length;
+	const closing = /\r?\n---/.exec(content.slice(blockStart));
+	if (!closing) return;
+	const blockEnd = blockStart + closing.index;
+	const block = content.slice(blockStart, blockEnd);
+	const repairedLines = block.split("\n").map(repairFrontmatterLine);
+	const repairedBlock = repairedLines.map(({ line }) => line).join("\n");
+	if (repairedBlock === block) return;
+	return {
+		content: content.slice(0, blockStart) + repairedBlock + content.slice(blockEnd),
+		droppedComment: repairedLines.some(({ droppedComment }) => droppedComment)
+	};
+}
+/**
+* Parse frontmatter, retrying once with unquoted colon-bearing values quoted.
+*
+* Files authored for another client routinely carry YAML that only that
+* client's parser accepts — `description: Use this skill when: the user asks
+* about PDFs` is the case the Agent Skills client guide names. Without a retry
+* such a file is not merely reported, it is dropped: the lenient skill import
+* catches the parse error and skips the whole skill. The retry is deliberately
+* narrow — one pass, top-level entries only, and the original error is what
+* surfaces if it does not help, so a genuinely broken file still fails with the
+* message that describes what is actually wrong with it. A file with no closing
+* `---`, or one whose opening fence carries a language tag, is not repaired at
+* all: neither is a frontmatter block gray-matter would have read.
+*
+* @see https://agentskills.io/client-implementation/adding-skills-support
+*/
+function parseFrontmatterWithYamlRepair(content, filePath, options = {}) {
+	try {
+		return parseFrontmatter(content, filePath);
+	} catch (error) {
+		const repaired = repairMalformedFrontmatterYaml(content);
+		if (repaired === void 0) throw error;
+		let result;
+		try {
+			result = parseFrontmatter(repaired.content, filePath);
+		} catch {
+			throw error;
+		}
+		if (options.quiet === true) return result;
+		const commentNote = repaired.droppedComment ? " Text following a space and `#` was read as a YAML comment and left out of the value." : "";
+		warnOnceWithFallback(void 0, `Recovered malformed YAML frontmatter in ${filePath === void 0 ? "the input" : stripControlCharacters(toPosixPath(filePath))} by quoting values that contain a colon.${commentNote} Quote them in the file itself so other tools can read it too.`);
+		return result;
+	}
+}
 //#endregion
 //#region src/features/checks/rulesync-check.ts
 const RulesyncCheckFrontmatterSchema = zod_mini.z.looseObject({
@@ -2097,8 +2466,9 @@ var RulesyncCheck = class RulesyncCheck extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath }) {
-		const filePath = (0, node_path.join)(outputRoot, RULESYNC_CHECKS_RELATIVE_DIR_PATH, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths().relativeDirPath;
+		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncCheckFrontmatterSchema.safeParse(frontmatter);
@@ -2106,7 +2476,7 @@ var RulesyncCheck = class RulesyncCheck extends RulesyncFile {
 		const filename = (0, node_path.basename)(relativeFilePath);
 		return new RulesyncCheck({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath: filename,
 			frontmatter: result.data,
 			body: content.trim()
@@ -2177,8 +2547,9 @@ var RulesyncCommand = class RulesyncCommand extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath }) {
-		const filePath = (0, node_path.join)(outputRoot, RulesyncCommand.getSettablePaths().relativeDirPath, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const dirPath = relativeDirPath ?? RulesyncCommand.getSettablePaths().relativeDirPath;
+		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(fileContent, filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
@@ -2186,7 +2557,7 @@ var RulesyncCommand = class RulesyncCommand extends RulesyncFile {
 		if (!result.success) throw new Error(`Invalid frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
 		return new RulesyncCommand({
 			outputRoot,
-			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath,
 			frontmatter: result.data,
 			body: content.trim(),
@@ -3575,8 +3946,19 @@ const CANONICAL_TO_VIBE_EVENT_NAMES = {
 };
 /**
 * Map Mistral Vibe snake_case event names to canonical camelCase.
+*
+* The pre-2.21.0 spellings are accepted alongside the current ones. Vibe's
+* strict `HookType` enum rejects a file that still uses them, so such a file is
+* already dead on disk; reading it here and emitting the renamed spelling is
+* what repairs it, whereas leaving the old name unmapped would route the hook
+* into a tool override block and lose the event.
 */
-const VIBE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_VIBE_EVENT_NAMES).map(([k, v]) => [v, k]));
+const VIBE_TO_CANONICAL_EVENT_NAMES = {
+	...Object.fromEntries(Object.entries(CANONICAL_TO_VIBE_EVENT_NAMES).map(([k, v]) => [v, k])),
+	before_tool: "preToolUse",
+	after_tool: "postToolUse",
+	post_agent_turn: "stop"
+};
 /**
 * Map canonical camelCase event names to Qwen Code PascalCase.
 *
@@ -3797,15 +4179,17 @@ var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 			error: null
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, validate = true }) {
 		const paths = RulesyncHooks.getSettablePaths();
+		const overrideDirPath = relativeDirPath;
 		for (const candidate of getRulesyncSourceCandidates({ paths })) {
-			const filePath = (0, node_path.join)(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+			const filePath = (0, node_path.join)(outputRoot, candidateDirPath, candidate.relativeFilePath);
 			if (!await fileExists(filePath)) continue;
 			const fileContent = await readFileContent(filePath);
 			return new RulesyncHooks({
 				outputRoot,
-				relativeDirPath: candidate.relativeDirPath,
+				relativeDirPath: candidateDirPath,
 				relativeFilePath: candidate.relativeFilePath,
 				fileContent,
 				validate
@@ -3832,21 +4216,23 @@ var RulesyncIgnore = class RulesyncIgnore extends RulesyncFile {
 				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
 				relativeFilePath: RULESYNC_AIIGNORE_FILE_NAME
 			},
-			legacy: {
+			legacy: [{
 				relativeDirPath: ".",
 				relativeFilePath: RULESYNC_IGNORE_RELATIVE_FILE_PATH
-			}
+			}]
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd() } = {}) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath } = {}) {
 		const paths = this.getSettablePaths();
-		const recommendedPath = (0, node_path.join)(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
-		const legacyPath = (0, node_path.join)(outputRoot, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
+		const recommendedDirPath = relativeDirPath ?? paths.recommended.relativeDirPath;
+		const recommendedPath = (0, node_path.join)(outputRoot, recommendedDirPath, paths.recommended.relativeFilePath);
+		const [legacy] = paths.legacy;
+		const legacyPath = (0, node_path.join)(outputRoot, legacy.relativeDirPath, legacy.relativeFilePath);
 		if (await fileExists(recommendedPath)) {
 			const fileContent = await readFileContent(recommendedPath);
 			return new RulesyncIgnore({
 				outputRoot,
-				relativeDirPath: paths.recommended.relativeDirPath,
+				relativeDirPath: recommendedDirPath,
 				relativeFilePath: paths.recommended.relativeFilePath,
 				fileContent
 			});
@@ -3855,15 +4241,15 @@ var RulesyncIgnore = class RulesyncIgnore extends RulesyncFile {
 			const fileContent = await readFileContent(legacyPath);
 			return new RulesyncIgnore({
 				outputRoot,
-				relativeDirPath: paths.legacy.relativeDirPath,
-				relativeFilePath: paths.legacy.relativeFilePath,
+				relativeDirPath: legacy.relativeDirPath,
+				relativeFilePath: legacy.relativeFilePath,
 				fileContent
 			});
 		}
 		const fileContent = await readFileContent(recommendedPath);
 		return new RulesyncIgnore({
 			outputRoot,
-			relativeDirPath: paths.recommended.relativeDirPath,
+			relativeDirPath: recommendedDirPath,
 			relativeFilePath: paths.recommended.relativeFilePath,
 			fileContent
 		});
@@ -4019,6 +4405,118 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	warp: zod_mini.z.optional(toolScopedMcpSchema),
 	zed: zod_mini.z.optional(toolScopedMcpSchema)
 });
+/**
+* The tool-scoped block keys that carry a `{toolname}.mcpServers` sub-map.
+* Derived from `RulesyncMcpFileSchema`'s own shape so this set can never drift
+* from the schema — every tool-scoped block declared above is treated as a
+* "merge servers by name" site by `mergeMcpJsonOverlays`, and everything else
+* (including `$schema` and top-level Kimi Code timeout fields) is replaced
+* atomically.
+*/
+const TOOL_SCOPED_MCP_KEYS = new Set(Object.keys(RulesyncMcpFileSchema.def.shape).filter((key) => key !== "$schema" && key !== "mcpServers"));
+/**
+* Return the first candidate path (recommended, then legacy variants) that
+* exists under `outputRoot`, or `undefined` when none is present. Shared
+* between `fromFile` (single-root) and `fromRoots` (multi-root) so both
+* paths honour the same intra-root resolution order.
+*
+* When `overrideDirPath` is provided it replaces the candidates'
+* class-level `relativeDirPath` (which defaults to `.rulesync/`) so the
+* caller can point at a non-default source tree (e.g. `.rulesync.local/`).
+* Also returned is the effective `relativeDirPath` for the winning
+* candidate so the caller can reconstruct a `RulesyncMcp` with matching
+* anchor fields.
+*/
+async function findFirstExistingCandidate({ paths, outputRoot, overrideDirPath }) {
+	for (const candidate of getRulesyncSourceCandidates({ paths })) {
+		const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+		const filePath = (0, node_path.join)(outputRoot, candidateDirPath, candidate.relativeFilePath);
+		if (await fileExists(filePath)) return {
+			filePath,
+			candidate: {
+				relativeDirPath: candidateDirPath,
+				relativeFilePath: candidate.relativeFilePath
+			}
+		};
+	}
+}
+/**
+* Merge two parsed MCP JSON objects with the one-level policy from the
+* inputRoots plan: the top-level `mcpServers` map and each
+* `<toolname>.mcpServers` sub-map are merged by server name (later wins per
+* key). Every other value — individual server configs, other top-level keys
+* — is replaced atomically. This keeps the merge predictable: an overlay can
+* add or replace whole shared servers, but a partial patch of one server's
+* `args`/`env` is deliberately not supported.
+*/
+function getRecordField({ value, path }) {
+	if (value === void 0) return {};
+	if (!isRecord$1(value)) throw new Error(`Invalid MCP overlay: '${path}' must be an object.`);
+	return value;
+}
+/**
+* Overlay one record onto another, dropping any overlay key that could reach
+* `Object.prototype`. Every overlay merge goes through this so a `__proto__`
+* entry cannot enter the merged config from any depth — top-level
+* `mcpServers`, a tool-scoped block, or that block's own `mcpServers`.
+*/
+function mergeRecordsSkippingPollutionKeys({ base, overlay }) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(overlay)) {
+		if (isPrototypePollutionKey(key)) continue;
+		merged[key] = value;
+	}
+	return merged;
+}
+function mergeMcpJsonOverlays({ base, overlay }) {
+	const merged = { ...base };
+	for (const [key, overlayValue] of Object.entries(overlay)) {
+		if (isPrototypePollutionKey(key)) continue;
+		if (key === "mcpServers") {
+			merged.mcpServers = mergeRecordsSkippingPollutionKeys({
+				base: getRecordField({
+					value: base.mcpServers,
+					path: "mcpServers"
+				}),
+				overlay: getRecordField({
+					value: overlayValue,
+					path: "mcpServers"
+				})
+			});
+			continue;
+		}
+		if (TOOL_SCOPED_MCP_KEYS.has(key)) {
+			const baseBlock = getRecordField({
+				value: base[key],
+				path: key
+			});
+			const overlayBlock = getRecordField({
+				value: overlayValue,
+				path: key
+			});
+			const mergedBlock = mergeRecordsSkippingPollutionKeys({
+				base: baseBlock,
+				overlay: overlayBlock
+			});
+			const baseServers = getRecordField({
+				value: baseBlock.mcpServers,
+				path: `${key}.mcpServers`
+			});
+			const overlayServers = getRecordField({
+				value: overlayBlock.mcpServers,
+				path: `${key}.mcpServers`
+			});
+			if (Object.keys(baseServers).length > 0 || Object.keys(overlayServers).length > 0) mergedBlock.mcpServers = mergeRecordsSkippingPollutionKeys({
+				base: baseServers,
+				overlay: overlayServers
+			});
+			merged[key] = mergedBlock;
+			continue;
+		}
+		merged[key] = overlayValue;
+	}
+	return merged;
+}
 var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	json;
 	constructor(params) {
@@ -4055,28 +4553,136 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 			error: null
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, logger }) {
+	/**
+	* Load and merge MCP source files across the configured input roots.
+	*
+	* `inputRoots` entries are the source trees themselves (e.g.
+	* `/repo/.rulesync`, `/repo/.rulesync.local`). Per-root behavior mirrors
+	* `fromFile`: each root's own candidate paths (recommended `mcp.jsonc`,
+	* legacy `mcp.json`, deprecated `.mcp.json`) are checked INSIDE that
+	* source tree and the first hit is loaded. Roots that have no candidate
+	* contribute nothing.
+	*
+	* Cross-root behavior: the parsed JSON objects are folded left-to-right
+	* with `mergeMcpJsonOverlays`, so later roots overlay earlier ones by
+	* server name (one level deep) and replace every other value atomically.
+	* With one root, this delegates to `fromFile` so JSONC formatting and the
+	* actual candidate path are preserved. With multiple roots, each source is
+	* parsed and schema-validated before merging so failures name the originating
+	* file. The merged object is necessarily synthetic, serialized JSON anchored
+	* to the first root's recommended path.
+	*
+	* A multi-root configuration where only one root actually supplies a file is
+	* treated as the single-root case: nothing is merged, so the original file
+	* content is kept verbatim (preserving JSONC comments) and the instance is
+	* anchored at the root that supplied it rather than at the primary root's
+	* recommended path.
+	*
+	* When no root supplies any candidate, this falls back to reading the
+	* primary root's recommended path so the underlying file-not-found error
+	* matches the single-root behavior of `fromFile`.
+	*/
+	static async fromRoots({ inputRoots, validate = true, logger }) {
+		if (inputRoots.length === 1) {
+			const [primary] = inputRoots;
+			return this.fromFile({
+				outputRoot: (0, node_path.dirname)(primary),
+				relativeDirPath: (0, node_path.basename)(primary),
+				validate,
+				logger
+			});
+		}
 		const paths = this.getSettablePaths();
+		const rootSources = [];
+		for (const root of inputRoots) {
+			const parent = (0, node_path.dirname)(root);
+			const treeName = (0, node_path.basename)(root);
+			const found = await findFirstExistingCandidate({
+				paths,
+				outputRoot: parent,
+				overrideDirPath: treeName
+			});
+			if (found === void 0) continue;
+			const { filePath, candidate } = found;
+			if (filePath.endsWith(".mcp.json")) {
+				const recommendedPath = (0, node_path.join)(parent, treeName, paths.recommended.relativeFilePath);
+				logger?.warn(`⚠️  Using deprecated path "${filePath}". Please migrate to "${recommendedPath}"`);
+			}
+			const fileContent = await readFileContent(filePath);
+			let parsed;
+			try {
+				parsed = parseJsonc$8(fileContent);
+				if (!isRecord$1(parsed)) throw new Error("Expected a JSON object.");
+				if (validate) {
+					const result = RulesyncMcpFileSchema.safeParse(parsed);
+					if (!result.success) throw result.error;
+				}
+			} catch (error) {
+				throw new Error(`Invalid MCP source file '${filePath}': ${formatError(error)}`, { cause: error });
+			}
+			rootSources.push({
+				record: parsed,
+				outputRoot: parent,
+				relativeDirPath: candidate.relativeDirPath,
+				relativeFilePath: candidate.relativeFilePath,
+				fileContent
+			});
+		}
+		if (rootSources.length === 0) {
+			const primary = inputRoots[0];
+			return this.fromFile({
+				outputRoot: (0, node_path.dirname)(primary),
+				relativeDirPath: (0, node_path.basename)(primary),
+				validate,
+				logger
+			});
+		}
+		const onlySource = rootSources.length === 1 ? rootSources[0] : void 0;
+		if (onlySource !== void 0) return new RulesyncMcp({
+			outputRoot: onlySource.outputRoot,
+			relativeDirPath: onlySource.relativeDirPath,
+			relativeFilePath: onlySource.relativeFilePath,
+			fileContent: onlySource.fileContent,
+			validate
+		});
+		const merged = rootSources.reduce((acc, next) => mergeMcpJsonOverlays({
+			base: acc,
+			overlay: next.record
+		}), {});
+		const primary = inputRoots[0];
+		return new RulesyncMcp({
+			outputRoot: (0, node_path.dirname)(primary),
+			relativeDirPath: (0, node_path.basename)(primary),
+			relativeFilePath: paths.recommended.relativeFilePath,
+			fileContent: JSON.stringify(merged, null, 2),
+			validate
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, validate = true, logger }) {
+		const paths = this.getSettablePaths();
+		const overrideDirPath = relativeDirPath;
 		for (const candidate of getRulesyncSourceCandidates({ paths })) {
-			const filePath = (0, node_path.join)(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+			const filePath = (0, node_path.join)(outputRoot, candidateDirPath, candidate.relativeFilePath);
 			if (!await fileExists(filePath)) continue;
 			if (candidate.relativeFilePath === ".mcp.json") {
-				const recommendedPath = (0, node_path.join)(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
+				const recommendedPath = (0, node_path.join)(outputRoot, candidateDirPath, paths.recommended.relativeFilePath);
 				logger?.warn(`⚠️  Using deprecated path "${filePath}". Please migrate to "${recommendedPath}"`);
 			}
 			const fileContent = await readFileContent(filePath);
 			return new RulesyncMcp({
 				outputRoot,
-				relativeDirPath: candidate.relativeDirPath,
+				relativeDirPath: candidateDirPath,
 				relativeFilePath: candidate.relativeFilePath,
 				fileContent,
 				validate
 			});
 		}
-		const fileContent = await readFileContent((0, node_path.join)(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath));
+		const fallbackDirPath = overrideDirPath ?? paths.recommended.relativeDirPath;
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, fallbackDirPath, paths.recommended.relativeFilePath));
 		return new RulesyncMcp({
 			outputRoot,
-			relativeDirPath: paths.recommended.relativeDirPath,
+			relativeDirPath: fallbackDirPath,
 			relativeFilePath: paths.recommended.relativeFilePath,
 			fileContent,
 			validate
@@ -5271,15 +5877,17 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 			error: null
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, validate = true }) {
 		const paths = RulesyncPermissions.getSettablePaths();
+		const overrideDirPath = relativeDirPath;
 		for (const candidate of getRulesyncSourceCandidates({ paths })) {
-			const filePath = (0, node_path.join)(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+			const filePath = (0, node_path.join)(outputRoot, candidateDirPath, candidate.relativeFilePath);
 			if (!await fileExists(filePath)) continue;
 			const fileContent = await readFileContent(filePath);
 			return new RulesyncPermissions({
 				outputRoot,
-				relativeDirPath: candidate.relativeDirPath,
+				relativeDirPath: candidateDirPath,
 				relativeFilePath: candidate.relativeFilePath,
 				fileContent,
 				validate
@@ -5443,8 +6051,9 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
-		const filePath = (0, node_path.join)(outputRoot, this.getSettablePaths().recommended.relativeDirPath, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths().recommended.relativeDirPath;
+		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncRuleFrontmatterSchema.safeParse(frontmatter);
@@ -5457,7 +6066,7 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 		};
 		return new RulesyncRule({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().recommended.relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath,
 			frontmatter: validatedFrontmatter,
 			body: content.trim(),
@@ -5469,8 +6078,474 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 	}
 };
 //#endregion
+//#region src/utils/concurrency.ts
+/**
+* Map over items with a bounded number of operations in flight.
+*
+* `Promise.all(items.map(...))` starts every operation at once, which is fine
+* for a handful of paths and not fine for a directory tree of unknown size: a
+* few thousand concurrent `realpath` calls queue on the libuv thread pool and
+* hold their closures alive while they wait. Results keep the input order.
+*
+* `withSemaphore` in `src/lib/github-utils.ts` bounds concurrency too, but it
+* wraps one call at a time: the caller still writes `Promise.all(items.map(…))`
+* around it, so every item's promise chain is allocated up front. This walks a
+* shared cursor with `limit` workers instead, so a list of unknown size costs
+* `limit` pending operations rather than one per item.
+*/
+async function mapWithConcurrency({ items, limit, mapper }) {
+	const results = Array.from({ length: items.length });
+	let nextIndex = 0;
+	const runWorker = async () => {
+		while (nextIndex < items.length) {
+			const index = nextIndex;
+			nextIndex += 1;
+			const item = items[index];
+			if (item === void 0) continue;
+			results[index] = await mapper(item);
+		}
+	};
+	const workerCount = Math.max(1, Math.min(limit, items.length));
+	await Promise.all(Array.from({ length: workerCount }, () => runWorker()));
+	return results;
+}
+//#endregion
 //#region src/types/ai-dir.ts
-var AiDir = class {
+/**
+* Directories that hold credentials. Excluding these protects something, so
+* their exclusion is reported rather than silent.
+*/
+const NEVER_CARRIED_CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
+	".ssh",
+	".aws",
+	".gnupg"
+]);
+/**
+* Directories that are refused only when the path leaves the skill directory to
+* reach them. These are the per-application trees of a home directory, where
+* naming every credential file is a list always one release behind -- `gcloud`
+* alone writes `credentials.db` and `application_default_credentials.json`, and
+* `.config/anthropic/` holds an API key. A skill that ships a `.config/` of its
+* own still carries it: what is refused is a link that reaches the *user's*.
+*
+* A tool home is deliberately absent. `~/.claude/skills/` and `~/.codex/` hold
+* the global skills this feature exists to share, so refusing a link that
+* reaches one would refuse the ordinary case along with the bad one.
+*/
+const NEVER_CARRIED_ESCAPING_DIR_NAMES = /* @__PURE__ */ new Set([
+	".config",
+	".local",
+	".azure",
+	".m2",
+	".terraform.d",
+	".docker",
+	".kube",
+	"keychains"
+]);
+/**
+* Whether an escaping real path passes through a directory only reachable by
+* escaping.
+*
+* Only the segments *past* the skill directory count. A global skill lives at
+* `~/.config/agents/skills/<name>` for Amp, Devin and Muse alike, so judging
+* the whole real path would refuse a link that never left the skills tree it
+* was already in -- the shared-directory case, reported as a credential.
+*/
+function escapesIntoCredentialDir({ realDirPath, realFilePath }) {
+	const normalize = (segment) => normalizePathSegment(segment.toLowerCase());
+	const dirSegments = splitPathSegments(realDirPath).map(normalize);
+	const fileSegments = splitPathSegments(realFilePath).map(normalize);
+	let shared = 0;
+	while (shared < dirSegments.length && shared < fileSegments.length && dirSegments[shared] === fileSegments[shared]) shared += 1;
+	return (dirSegments.length - shared > 1 ? fileSegments : fileSegments.slice(shared)).some((segment) => NEVER_CARRIED_ESCAPING_DIR_NAMES.has(segment));
+}
+/**
+* Directories that are never part of a skill for the ordinary reasons: a
+* nested repository, or a build/cache tree. Leaving these out is what a user
+* expects, so it happens quietly.
+*/
+const NEVER_CARRIED_NOISE_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".cache",
+	".venv",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".next",
+	".nuxt",
+	".turbo",
+	".parcel-cache",
+	".nyc_output",
+	".terraform"
+]);
+/** Files that hold credentials. Compared lower-cased. */
+const NEVER_CARRIED_CREDENTIAL_FILE_NAMES = /* @__PURE__ */ new Set([
+	".npmrc",
+	".netrc",
+	".git-credentials",
+	".pgpass",
+	".pypirc",
+	".htpasswd",
+	".dockercfg",
+	".envrc"
+]);
+/** Files that are local noise. Compared lower-cased. */
+const NEVER_CARRIED_NOISE_FILE_NAMES = /* @__PURE__ */ new Set([".ds_store"]);
+/** Credential files whose parent directory is otherwise ordinary content. */
+const NEVER_CARRIED_PATH_SUFFIXES = [
+	".docker/config.json",
+	".kube/config",
+	".config/gh/hosts.yml",
+	".config/gcloud/credentials.db",
+	".gem/credentials",
+	"gcloud/application_default_credentials.json",
+	".codex/auth.json",
+	".gemini/oauth_creds.json"
+];
+/** Whether a path ends in one of the credential files named above. */
+function endsWithNeverCarriedSuffix(filePath) {
+	const posixPath = toPosixPath(filePath).toLowerCase();
+	return NEVER_CARRIED_PATH_SUFFIXES.some((suffix) => posixPath === suffix || posixPath.endsWith(`/${suffix}`));
+}
+/**
+* `.env.<suffix>` spellings that are templates rather than real values.
+* Everything else matching `.env*` is treated as holding secrets, because
+* `.env.production` is no less sensitive than `.env` itself.
+*/
+const ENV_TEMPLATE_SUFFIXES = /* @__PURE__ */ new Set([
+	"example",
+	"sample",
+	"template",
+	"dist",
+	"defaults"
+]);
+/**
+* Kernel pseudo-filesystems, matched against the resolved real path. A link
+* into one of these does not reach a file at all: `/proc/self/environ` reads
+* back the entire environment of the running process, API keys included, and
+* `stat` reports it as an ordinary file. Nothing a skill carries lives here.
+*/
+const NEVER_CARRIED_REAL_PATH_ROOTS = [
+	"/proc",
+	"/sys",
+	"/dev"
+];
+/**
+* Whether a directory of this name is pruned during the walk, so it is never
+* descended into at all. Derived from the directory names above so the pruning
+* and the path check below cannot drift apart.
+*/
+function isNeverCarriedDirName(dirName) {
+	const normalized = normalizePathSegment(dirName.toLowerCase());
+	return NEVER_CARRIED_CREDENTIAL_DIR_NAMES.has(normalized) || NEVER_CARRIED_NOISE_DIR_NAMES.has(normalized) || isCredentialFileName(normalized);
+}
+/**
+* Windows drops trailing dots and spaces from a name, so a file called `.env `
+* is written as `.env` once it lands in a tool directory there. Normalizing
+* before every comparison means the name is judged as what it becomes.
+*/
+function normalizePathSegment(segment) {
+	const normalized = segment.replace(/[\s.]+$/, "");
+	return normalized === "" ? segment : normalized;
+}
+/**
+* Why a path reaches something that is never skill content, or `undefined`
+* when it does not.
+*
+* Carrying hidden entries means a secret sitting in a skill directory would be
+* copied into every enabled tool root, multiplying the places it can be
+* committed from, and a `.venv` would be copied file by file into each of them.
+* None of these names is ever skill content, so excluding them costs nothing.
+*
+* The check is applied to the resolved real path as well as the literal one:
+* the names are what makes an entry dangerous, and a symbolic link named
+* `vendor` pointing at `~/.aws` is exactly as dangerous as a directory called
+* `.aws`. Comparison is lower-cased because macOS and Windows resolve `.SSH`
+* and `.ssh` to the same file.
+*/
+function classifyNeverCarried(relativePath) {
+	const segments = toPosixPath(relativePath).toLowerCase().split("/").filter((segment) => segment !== "" && segment !== ".").map(normalizePathSegment);
+	const fileName = segments.at(-1) ?? "";
+	const posixPath = segments.join("/");
+	if (segments.slice(0, -1).some((segment) => isCredentialFileName(segment))) return "credential";
+	if (segments.some((segment) => NEVER_CARRIED_CREDENTIAL_DIR_NAMES.has(segment))) return "credential";
+	if (segments.some((segment) => NEVER_CARRIED_NOISE_DIR_NAMES.has(segment))) return "noise";
+	if (isCredentialFileName(fileName)) return "credential";
+	if (NEVER_CARRIED_NOISE_FILE_NAMES.has(fileName)) return "noise";
+	if (NEVER_CARRIED_PATH_SUFFIXES.some((suffix) => posixPath === suffix || posixPath.endsWith(`/${suffix}`))) return "credential";
+}
+/**
+* Whether a single path segment names a credential file, whether it is the file
+* itself or a directory somebody gave that name to.
+*/
+function isCredentialFileName(segment) {
+	const name = normalizePathSegment(segment.toLowerCase());
+	if (NEVER_CARRIED_CREDENTIAL_FILE_NAMES.has(name)) return true;
+	for (const base of [".env", ".envrc"]) {
+		if (name === base) return true;
+		if (name.startsWith(`${base}.`)) {
+			const lastPiece = name.split(".").at(-1) ?? "";
+			return !ENV_TEMPLATE_SUFFIXES.has(lastPiece);
+		}
+	}
+	return false;
+}
+/** Whether a resolved real path points into a kernel pseudo-filesystem. */
+function isSystemPseudoPath(absolutePath) {
+	const posixPath = toPosixPath(absolutePath);
+	return NEVER_CARRIED_REAL_PATH_ROOTS.some((root) => posixPath === root || posixPath.startsWith(`${root}/`));
+}
+/** How many links a chain may be followed before it is treated as a loop. */
+const MAX_LINK_CHAIN_HOPS = 40;
+/**
+* Whether reaching a path goes through a kernel pseudo-filesystem, even when it
+* does not end in one.
+*
+* Asking `realpath` alone is not enough, and the entries it is not enough for
+* are the dangerous ones: `/proc/<pid>/fd/N`, `exe`, `cwd` and `root` are magic
+* links, so resolving them lands *outside* `/proc`, on whatever file the
+* process happens to hold open — a private key another program is reading right
+* now would come back as an ordinary path and be carried. Following the chain a
+* hop at a time, and checking each hop, is what sees the `/proc` in the middle.
+*/
+async function resolvesThroughSystemPseudoPath(filePath) {
+	let currentPath = (0, node_path.resolve)(filePath);
+	let hops = 0;
+	for (; hops < MAX_LINK_CHAIN_HOPS; hops++) {
+		if (isSystemPseudoPath(currentPath)) return {
+			throughPseudoPath: true,
+			hops
+		};
+		try {
+			if (isSystemPseudoPath(await (0, node_fs_promises.realpath)((0, node_path.dirname)(currentPath)))) return {
+				throughPseudoPath: true,
+				hops
+			};
+		} catch {}
+		let linkStats;
+		try {
+			linkStats = await (0, node_fs_promises.lstat)(currentPath);
+		} catch {
+			return {
+				throughPseudoPath: false,
+				hops
+			};
+		}
+		if (!linkStats.isSymbolicLink()) break;
+		let target;
+		try {
+			target = await (0, node_fs_promises.readlink)(currentPath);
+		} catch {
+			return {
+				throughPseudoPath: false,
+				hops
+			};
+		}
+		currentPath = (0, node_path.isAbsolute)(target) ? target : (0, node_path.resolve)((0, node_path.dirname)(currentPath), target);
+	}
+	return {
+		throughPseudoPath: false,
+		hops
+	};
+}
+const MAX_CARRIED_FILES = 1e4;
+const MAX_CARRIED_DIRECTORIES = 1e4;
+/**
+* The bounds above limit what is *carried*; this one limits what is *looked at*.
+* A directory holding nothing but a few hundred thousand links to itself carries
+* no files and occupies no depth, and would still cost a `stat` apiece.
+*/
+const MAX_CARRIED_ENTRIES_EXAMINED = 2e5;
+const MAX_CARRIED_BYTES = 104857600;
+/** How many `realpath` calls the carried-file filter keeps in flight. */
+const CARRIED_REALPATH_CONCURRENCY = 32;
+/** Sort directory entries by name so a walk of the same tree is reproducible. */
+function compareByName(left, right) {
+	if (left.name === right.name) return 0;
+	return left.name < right.name ? -1 : 1;
+}
+/**
+* Order the routes that cross the same number of symbolic links: the one with
+* the fewest hidden segments first, so a named alias represents a shared tree
+* rather than a hidden one that a hidden-entry rule then refuses, taking the
+* named route's content with it.
+*/
+function comparePendingCarriedDirs(left, right) {
+	if (left.hiddenSegments !== right.hiddenSegments) return left.hiddenSegments - right.hiddenSegments;
+	if (left.depth !== right.depth) return left.depth - right.depth;
+	if (left.dirPath === right.dirPath) return 0;
+	return left.dirPath < right.dirPath ? -1 : 1;
+}
+/**
+* Collect the files under a carried directory, following symbolic links but
+* visiting each real directory exactly once, by its cheapest route.
+*
+* A glob walk cannot do this safely. Two links in one directory that both point
+* back at an ancestor double the paths walked per level, and the walker follows
+* them until the kernel's ELOOP limit (~40), so the path array alone exhausts
+* the heap long before anything reads a file — a depth bound only lowers the
+* exponent, while the base is whatever number of links the tree's author chose.
+* Remembering the real directories already visited removes the multiplication
+* itself: a cycle, and an alias for a directory already walked, both stop at the
+* entry that closes them.
+*
+* Which route represents a directory then matters, because the others are
+* dropped. The walk proceeds in rounds by the number of symbolic links crossed:
+* everything reachable without crossing one, then everything one link away, and
+* so on. A real location therefore always wins over an alias for it — at any
+* nesting depth, not just among siblings, which a depth-first walk could not
+* promise — and among aliases the named one wins over a hidden one.
+*
+* A broken link is skipped: it resolves to nothing to read.
+*/
+async function walkCarriedFiles(dirPath, { skipHiddenRoutes = false } = {}) {
+	const filePaths = [];
+	const visitedRealDirPaths = /* @__PURE__ */ new Set();
+	const truncations = /* @__PURE__ */ new Set();
+	const unreadablePaths = /* @__PURE__ */ new Set();
+	const pseudoPaths = /* @__PURE__ */ new Set();
+	const depthStoppedRealDirPaths = /* @__PURE__ */ new Set();
+	let deferredLinkedDirs = [];
+	/** Whether the walk has hit a bound that ends it rather than one branch of it. */
+	let examinedEntries = 0;
+	const isFull = () => truncations.has("count") || truncations.has("directories") || truncations.has("entries");
+	const addFile = (filePath) => {
+		if (filePaths.length >= 1e4) {
+			truncations.add("count");
+			return;
+		}
+		filePaths.push(filePath);
+	};
+	/** Carry what a symbolic link names, or hold its directory for the next round. */
+	const routeLinkedEntry = async (child, entryName) => {
+		let targetStats;
+		try {
+			targetStats = await (0, node_fs_promises.stat)(child.dirPath);
+		} catch {
+			return;
+		}
+		if (targetStats.isFile()) {
+			addFile(child.dirPath);
+			return;
+		}
+		if (!targetStats.isDirectory() || isNeverCarriedDirName(entryName)) return;
+		const { throughPseudoPath, hops } = await resolvesThroughSystemPseudoPath(child.dirPath);
+		examinedEntries += hops;
+		if (throughPseudoPath) {
+			pseudoPaths.add(child.dirPath);
+			return;
+		}
+		deferredLinkedDirs.push(child);
+	};
+	/** Walk one directory and everything below it that no symbolic link leads to. */
+	const walkWithoutCrossingLinks = async (pending) => {
+		if (isFull()) return;
+		let realCurrentPath;
+		try {
+			realCurrentPath = await (0, node_fs_promises.realpath)(pending.dirPath);
+		} catch {
+			unreadablePaths.add(pending.dirPath);
+			return;
+		}
+		if (visitedRealDirPaths.has(realCurrentPath)) return;
+		if (isSystemPseudoPath(realCurrentPath)) {
+			pseudoPaths.add(pending.dirPath);
+			return;
+		}
+		if (pending.depth > 12) {
+			depthStoppedRealDirPaths.add(realCurrentPath);
+			return;
+		}
+		if (visitedRealDirPaths.size >= 1e4) {
+			truncations.add("directories");
+			return;
+		}
+		visitedRealDirPaths.add(realCurrentPath);
+		let entries;
+		try {
+			entries = await (0, node_fs_promises.readdir)(pending.dirPath, { withFileTypes: true });
+		} catch {
+			unreadablePaths.add(pending.dirPath);
+			return;
+		}
+		const realSubDirs = [];
+		for (const entry of entries.toSorted(compareByName)) {
+			if (isFull()) return;
+			examinedEntries += 1;
+			if (examinedEntries > 2e5) {
+				truncations.add("entries");
+				return;
+			}
+			if (skipHiddenRoutes && isHiddenPathSegment(entry.name)) continue;
+			const entryPath = (0, node_path.join)(pending.dirPath, entry.name);
+			const child = {
+				dirPath: entryPath,
+				depth: pending.depth + 1,
+				hiddenSegments: pending.hiddenSegments + (isHiddenPathSegment(entry.name) ? 1 : 0)
+			};
+			if (entry.isFile()) {
+				addFile(entryPath);
+				continue;
+			}
+			if (entry.isDirectory()) {
+				if (!isNeverCarriedDirName(entry.name)) realSubDirs.push(child);
+				continue;
+			}
+			if (!entry.isSymbolicLink()) continue;
+			await routeLinkedEntry(child, entry.name);
+		}
+		for (const realSubDir of realSubDirs) {
+			if (isFull()) return;
+			await walkWithoutCrossingLinks(realSubDir);
+		}
+	};
+	let round = [{
+		dirPath,
+		depth: 0,
+		hiddenSegments: 0
+	}];
+	while (round.length > 0 && !isFull()) {
+		deferredLinkedDirs = [];
+		for (const pending of round.toSorted(comparePendingCarriedDirs)) {
+			if (isFull()) break;
+			await walkWithoutCrossingLinks(pending);
+		}
+		round = deferredLinkedDirs;
+	}
+	for (const realDirPath of depthStoppedRealDirPaths) if (!visitedRealDirPaths.has(realDirPath)) {
+		truncations.add("depth");
+		break;
+	}
+	return {
+		filePaths: filePaths.toSorted(),
+		truncations,
+		unreadablePaths: [...unreadablePaths],
+		pseudoPaths: [...pseudoPaths]
+	};
+}
+/** Render a set of refused or noteworthy paths for one warning line. */
+function formatReportedPaths(paths) {
+	const sorted = [...paths].toSorted();
+	const named = sorted.slice(0, 10).map((filePath) => stripControlCharacters(toPosixPath(filePath))).join(", ");
+	const remaining = sorted.length - 10;
+	return {
+		count: sorted.length,
+		list: `${named}${remaining > 0 ? `, and ${remaining} more` : ""}`
+	};
+}
+/** "entry" or "entries", so the warnings below read as sentences. */
+function entryWord(count) {
+	return count === 1 ? "entry" : "entries";
+}
+/** "resolves" or "resolve", to agree with the entry count it follows. */
+function resolveWord(count) {
+	return count === 1 ? "resolves" : "resolve";
+}
+var AiDir = class AiDir {
 	/**
 	* @example "."
 	*/
@@ -5520,8 +6595,7 @@ var AiDir = class {
 		const fullPath = node_path.default.join(this.outputRoot, this.relativeDirPath, this.dirName);
 		const resolvedFull = (0, node_path.resolve)(fullPath);
 		const resolvedBase = (0, node_path.resolve)(this.outputRoot);
-		const rel = (0, node_path.relative)(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || node_path.default.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`);
+		if (pathEscapesRoot((0, node_path.relative)(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`);
 		return fullPath;
 	}
 	getMainFile() {
@@ -5547,9 +6621,227 @@ var AiDir = class {
 		};
 	}
 	/**
+	* A nested repository inside a carried directory is the one exclusion worth
+	* reporting: unlike `.DS_Store`, it is there on purpose, and the tree it
+	* points at is simply not reproduced on generate. Only the top level is
+	* checked, which is where a submodule or a stray `git init` puts it, so the
+	* check costs one stat per directory rather than a second walk. `fileExists`
+	* is a bare `stat`, so it answers for a submodule pointer file and for a real
+	* `.git` directory alike.
+	*/
+	static async warnOnNestedGitDirectory(dirPath) {
+		const gitEntryPath = (0, node_path.join)(dirPath, ".git");
+		if (await fileExists(gitEntryPath)) warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(gitEntryPath))} with its directory: a nested repository is excluded, so the files it tracks are copied but its history is not.`);
+	}
+	/** Whether any segment of a relative path is dot-prefixed. */
+	static hasHiddenSegment(relativePath) {
+		return splitPathSegments(relativePath).some(isHiddenPathSegment);
+	}
+	/**
+	* Whether the entry a path ends at is itself hidden, its ancestors aside.
+	* A shared skill tree usually lives under a dot-directory, so an ancestor
+	* says nothing about the file; its own name is what was chosen for it.
+	*/
+	static hasHiddenName(relativePath) {
+		return isHiddenPathSegment(splitPathSegments(relativePath).at(-1) ?? "");
+	}
+	/**
+	* Drop the entries a skill directory must not carry.
+	*
+	* Three rules. `classifyNeverCarried` comes first, evaluated against the
+	* resolved real path as well as the literal one: names that are never skill
+	* content stay out however they are reached, so renaming a symbolic link
+	* does not turn `~/.aws` into content a skill carries. Next, a real path
+	* inside a kernel pseudo-filesystem is refused outright — that is process
+	* state, not a file.
+	*
+	* The third concerns hidden entries a symbolic link reaches outside the
+	* directory. Following symlinks out of a source tree is deliberate and
+	* documented — it is how a shared skill is referenced from several projects
+	* without being duplicated (issue #1707), and the trust boundary is the tree
+	* you point Rulesync at. Carrying hidden entries changes what that costs,
+	* though: one ordinary-looking link to a home directory would pull in every
+	* dotfile under it, and those are the entries with credential value. What
+	* decides is the name in the skill directory, not what the link resolves
+	* through: a named file keeps its documented behavior even when the target
+	* sits under a dot-directory such as `~/.dotfiles`, because somebody chose
+	* that name. What the link resolves *to* still counts at the end of the path,
+	* though — `notes.md` pointing at `~/.claude/.credentials.json` reaches a
+	* file nobody named for a skill — so a hidden final segment is refused on
+	* either side. Reaching outside is reported either way, since content from
+	* outside the tree is about to be copied into every enabled tool root.
+	*
+	* A path that cannot be resolved is kept: `realpath` fails on a broken link
+	* or a race, and neither is a reason to silently drop a file.
+	*/
+	/** Report what a carried directory left out, once both walks have had their say. */
+	static warnOnRefusedCarriedFiles(dirPath, carried) {
+		const reportedDirPath = stripControlCharacters(toPosixPath(dirPath));
+		if (carried.refusedCredentials.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedCredentials);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} named as a credential store: ${list}. A skill must not ship secrets; read them from the environment instead.`);
+		}
+		if (carried.refusedPseudoPaths.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedPseudoPaths);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that ${resolveWord(count)} into a system pseudo-filesystem: ${list}. Those read back process state, not skill content.`);
+		}
+		if (carried.refusedNoiseAliases.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedNoiseAliases);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that ${resolveWord(count)} into a directory a skill never carries: ${list}. A nested repository, or a build or cache tree, is the usual target.`);
+		}
+		if (carried.refusedEscapedHidden.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedEscapedHidden);
+			warnOnceWithFallback(void 0, `Not carrying ${count} hidden ${entryWord(count)} that ${resolveWord(count)} outside ${reportedDirPath}: ${list}. Copy them into the directory if the skill really needs them.`);
+		}
+		if (carried.carriedFromOutside.size > 0) {
+			const { count, list } = formatReportedPaths([...carried.carriedFromOutside].map((filePath) => {
+				const realFilePath = carried.realFilePathByPath.get(filePath);
+				return realFilePath === void 0 ? filePath : `${filePath} -> ${realFilePath}`;
+			}));
+			warnOnceWithFallback(void 0, `Carrying ${count} ${entryWord(count)} that ${resolveWord(count)} outside ${reportedDirPath}: ${list}. Their content is copied into every generated tool directory.`);
+		}
+	}
+	static async filterCarriedFiles(dirPath, filePaths) {
+		let realDirPath;
+		try {
+			realDirPath = await (0, node_fs_promises.realpath)(dirPath);
+		} catch {
+			realDirPath = (0, node_path.resolve)(dirPath);
+		}
+		const refusedCredentials = /* @__PURE__ */ new Set();
+		const refusedPseudoPaths = /* @__PURE__ */ new Set();
+		const refusedEscapedHidden = /* @__PURE__ */ new Set();
+		const refusedNoiseAliases = /* @__PURE__ */ new Set();
+		const carriedFromOutside = /* @__PURE__ */ new Set();
+		const realFilePathByPath = /* @__PURE__ */ new Map();
+		const verdicts = await mapWithConcurrency({
+			items: filePaths,
+			limit: CARRIED_REALPATH_CONCURRENCY,
+			mapper: async (filePath) => {
+				const literalPath = (0, node_path.relative)(dirPath, filePath);
+				const literalReason = classifyNeverCarried(literalPath);
+				if (literalReason !== void 0) {
+					if (literalReason === "credential") refusedCredentials.add(filePath);
+					return false;
+				}
+				let realFilePath;
+				try {
+					realFilePath = await (0, node_fs_promises.realpath)(filePath);
+				} catch {
+					return true;
+				}
+				realFilePathByPath.set(filePath, realFilePath);
+				if (isSystemPseudoPath(realFilePath)) {
+					refusedPseudoPaths.add(filePath);
+					return false;
+				}
+				const realPath = (0, node_path.relative)(realDirPath, realFilePath);
+				const realReason = classifyNeverCarried(realPath);
+				if (realReason !== void 0) {
+					if (realReason === "credential") refusedCredentials.add(filePath);
+					else refusedNoiseAliases.add(filePath);
+					return false;
+				}
+				if (!pathEscapesRoot(realPath)) return true;
+				if ((await resolvesThroughSystemPseudoPath(filePath)).throughPseudoPath) {
+					refusedPseudoPaths.add(filePath);
+					return false;
+				}
+				if (endsWithNeverCarriedSuffix(realFilePath)) {
+					refusedCredentials.add(filePath);
+					return false;
+				}
+				if (escapesIntoCredentialDir({
+					realDirPath,
+					realFilePath
+				})) {
+					refusedCredentials.add(filePath);
+					return false;
+				}
+				if (AiDir.hasHiddenSegment(literalPath) || AiDir.hasHiddenName(realPath)) {
+					refusedEscapedHidden.add(filePath);
+					return false;
+				}
+				carriedFromOutside.add(filePath);
+				return true;
+			}
+		});
+		return {
+			filePaths: filePaths.filter((_filePath, index) => verdicts[index]),
+			realFilePathByPath,
+			refusedCredentials,
+			refusedPseudoPaths,
+			refusedEscapedHidden,
+			refusedNoiseAliases,
+			carriedFromOutside
+		};
+	}
+	/**
+	* Report what the walk had to leave behind, so a skill that silently lost
+	* files says so rather than generating a directory that is quietly short.
+	*/
+	static warnOnCarriedWalkLimits({ reportedDirPath, truncations, unreadablePaths }) {
+		if (truncations.has("depth")) warnOnceWithFallback(void 0, `Not carrying the entries more than 12 directories below ${reportedDirPath}: a skill directory is walked to that depth only. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("count")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} beyond the first ${MAX_CARRIED_FILES}: a directory may carry at most that many files. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("directories")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} below the first ${MAX_CARRIED_DIRECTORIES} directories: a directory may carry files from at most that many directories. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("entries")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} that come after the first ${MAX_CARRIED_ENTRIES_EXAMINED} looked at: a directory is walked over at most that many entries. A tree of symbolic links that lead back into it is the usual cause.`);
+		if (unreadablePaths.length > 0) {
+			const { count, list } = formatReportedPaths(unreadablePaths);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that could not be read: ${list}. A permission the current user does not hold is the usual cause.`);
+		}
+	}
+	/**
+	* Walk the directory once more with the hidden routes pruned, and take the
+	* files the first walk had to leave behind because the route that reached
+	* them ran through a hidden directory. This can only add files, and only ones
+	* a fully named route reaches.
+	*/
+	static async recoverCarriedFilesFromNamedRoutes({ dirPath, carried, carriedPaths, carriedRealPaths, walk }) {
+		const named = await walkCarriedFiles(dirPath, { skipHiddenRoutes: true });
+		const recovered = await AiDir.filterCarriedFiles(dirPath, named.filePaths);
+		for (const truncation of named.truncations) walk.truncations.add(truncation);
+		for (const unreadablePath of named.unreadablePaths) if (!walk.unreadablePaths.includes(unreadablePath)) walk.unreadablePaths.push(unreadablePath);
+		for (const pseudoPath of named.pseudoPaths) carried.refusedPseudoPaths.add(pseudoPath);
+		for (const refused of recovered.refusedCredentials) carried.refusedCredentials.add(refused);
+		for (const refused of recovered.refusedPseudoPaths) carried.refusedPseudoPaths.add(refused);
+		for (const refused of recovered.refusedNoiseAliases) carried.refusedNoiseAliases.add(refused);
+		for (const refused of recovered.refusedEscapedHidden) carried.refusedEscapedHidden.add(refused);
+		for (const filePath of recovered.filePaths) {
+			const realFilePath = recovered.realFilePathByPath.get(filePath) ?? filePath;
+			if (carriedRealPaths.has(realFilePath)) continue;
+			if (carriedPaths.length >= 1e4) {
+				walk.truncations.add("count");
+				break;
+			}
+			carriedRealPaths.add(realFilePath);
+			carriedPaths.push(filePath);
+			carried.realFilePathByPath.set(filePath, realFilePath);
+			if (recovered.carriedFromOutside.has(filePath)) carried.carriedFromOutside.add(filePath);
+		}
+		for (const filePath of carried.refusedEscapedHidden) {
+			const realFilePath = carried.realFilePathByPath.get(filePath) ?? filePath;
+			if (carriedRealPaths.has(realFilePath)) carried.refusedEscapedHidden.delete(filePath);
+		}
+	}
+	/**
 	* Recursively collects all files from a directory, excluding the specified main file.
 	* This is a common utility for loading additional files alongside the main file.
 	*
+	* Hidden entries are included. The directories this walks are skill trees,
+	* whose specification says a skill directory "may contain any files and
+	* directories beyond the required `SKILL.md`" — a `.env.example` beside the
+	* scripts that read it is content, not noise, and dropping it silently on
+	* both import and generate loses part of the skill. What is left out is the
+	* set of entries that are never skill content — a nested repository's `.git`,
+	* the macOS Finder's `.DS_Store`, credential stores, build and cache trees —
+	* as decided by `classifyNeverCarried`. Whole directories from that set are
+	* pruned during the walk too, so it never descends into them at all.
+	*
+	* The walk is bounded and cycle-aware — see `walkCarriedFiles` — because the
+	* tree may contain symbolic links that somebody else chose.
+	*
+	* @see https://agentskills.io/specification
+	*
 	* @param outputRoot - The base directory path
 	* @param relativeDirPath - The relative path to the directory containing the skill
 	* @param dirName - The name of the directory
@@ -5558,14 +6850,57 @@ var AiDir = class {
 	*/
 	static async collectOtherFiles(outputRoot, relativeDirPath, dirName, excludeFileName) {
 		const dirPath = (0, node_path.join)(outputRoot, relativeDirPath, dirName);
-		const filteredPaths = (await findFilesByGlobs((0, node_path.join)(dirPath, "**", "*"), { type: "file" })).filter((filePath) => (0, node_path.basename)(filePath) !== excludeFileName);
-		return await Promise.all(filteredPaths.map(async (filePath) => {
-			const fileBuffer = await readFileBuffer(filePath);
-			return {
-				relativeFilePathToDirPath: (0, node_path.relative)(dirPath, filePath),
-				fileBuffer
-			};
-		}));
+		const walk = await walkCarriedFiles(dirPath);
+		const reportedDirPath = stripControlCharacters(toPosixPath(dirPath));
+		await AiDir.warnOnNestedGitDirectory(dirPath);
+		const carried = await AiDir.filterCarriedFiles(dirPath, walk.filePaths);
+		const carriedPaths = [...carried.filePaths];
+		const carriedRealPaths = new Set(carriedPaths.map((filePath) => carried.realFilePathByPath.get(filePath) ?? filePath));
+		if (carried.refusedEscapedHidden.size > 0) await AiDir.recoverCarriedFilesFromNamedRoutes({
+			dirPath,
+			carried,
+			carriedPaths,
+			carriedRealPaths,
+			walk
+		});
+		for (const pseudoPath of walk.pseudoPaths) carried.refusedPseudoPaths.add(pseudoPath);
+		AiDir.warnOnCarriedWalkLimits({
+			reportedDirPath,
+			truncations: walk.truncations,
+			unreadablePaths: walk.unreadablePaths
+		});
+		AiDir.warnOnRefusedCarriedFiles(dirPath, carried);
+		const filteredPaths = carriedPaths.toSorted().filter((filePath) => (0, node_path.basename)(filePath) !== excludeFileName);
+		const files = [];
+		let carriedBytes = 0;
+		for (const [index, filePath] of filteredPaths.entries()) {
+			const classifiedPath = carried.realFilePathByPath.get(filePath) ?? filePath;
+			let fileHandle;
+			try {
+				fileHandle = await (0, node_fs_promises.open)(classifiedPath, node_fs.constants.O_RDONLY | (node_fs.constants.O_NOFOLLOW ?? 0));
+			} catch (error) {
+				warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(filePath))}: ${stripControlCharacters(formatError(error))}.`);
+				continue;
+			}
+			try {
+				const fileSize = (await fileHandle.stat()).size;
+				if (carriedBytes + fileSize > 104857600) {
+					warnOnceWithFallback(void 0, `Not carrying ${filteredPaths.length - index} of the ${filteredPaths.length} entries under ${reportedDirPath}: a directory may carry at most ${MAX_CARRIED_BYTES / 1024 / 1024}MB. A symbolic link that reaches a large tree is the usual cause.`);
+					break;
+				}
+				const fileBuffer = await fileHandle.readFile();
+				carriedBytes += fileBuffer.byteLength;
+				files.push({
+					relativeFilePathToDirPath: (0, node_path.relative)(dirPath, filePath),
+					fileBuffer
+				});
+			} catch (error) {
+				warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(filePath))}: ${stripControlCharacters(formatError(error))}.`);
+			} finally {
+				await fileHandle.close();
+			}
+		}
+		return files;
 	}
 };
 const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
@@ -5705,7 +7040,11 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
 		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 		enabled: zod_mini.z.optional(zod_mini.z.boolean()),
-		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+		license: zod_mini.z.optional(zod_mini.z.unknown()),
+		compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+		metadata: zod_mini.z.optional(zod_mini.z.unknown()),
+		version: zod_mini.z.optional(zod_mini.z.unknown())
 	})),
 	grokcli: zod_mini.z.optional(zod_mini.z.looseObject({
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
@@ -5788,7 +7127,7 @@ var RulesyncSkill = class RulesyncSkill extends AiDir {
 		const skillDirPath = (0, node_path.join)(outputRoot, relativeDirPath, dirName);
 		const skillFilePath = (0, node_path.join)(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${skillFilePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${skillFilePath}: ${formatError(result.error)}`);
@@ -5881,8 +7220,9 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath }) {
-		const filePath = (0, node_path.join)(outputRoot, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths().relativeDirPath;
+		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncSubagentFrontmatterSchema.safeParse(frontmatter);
@@ -5890,7 +7230,7 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 		const filename = (0, node_path.basename)(relativeFilePath);
 		return new RulesyncSubagent({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath: filename,
 			frontmatter: result.data,
 			body: content.trim()
@@ -5900,16 +7240,18 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 //#endregion
 //#region src/features/skills/skills-utils.ts
 /**
-* Returns the set of local skill directory names (excluding `.curated`).
+* Returns the set of local skill directory names (excluding `.curated`)
+* from a rulesync source tree (e.g. `/repo/.rulesync` or
+* `/repo/.rulesync.local`).
 */
-async function getLocalSkillDirNames(outputRoot) {
-	const skillsDir = (0, node_path.join)(outputRoot, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
+async function getLocalSkillDirNames(sourceTree) {
+	const skillsDir = (0, node_path.join)(sourceTree, SKILLS_FEATURE_SUBDIR);
 	const names = /* @__PURE__ */ new Set();
 	if (!await directoryExists(skillsDir)) return names;
 	const dirPaths = await findFilesByGlobs((0, node_path.join)(skillsDir, "*"), { type: "dir" });
 	for (const dirPath of dirPaths) {
 		const name = (0, node_path.basename)(dirPath);
-		if (name === (0, node_path.basename)(RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH)) continue;
+		if (name === (0, node_path.basename)(CURATED_SKILLS_FEATURE_SUBDIR)) continue;
 		names.add(name);
 	}
 	return names;
@@ -6225,12 +7567,25 @@ function companionFileContentsEquivalent({ filePath, expected, existing, compose
 //#region src/types/feature-processor.ts
 var FeatureProcessor = class {
 	outputRoot;
-	inputRoot;
+	/**
+	* Ordered, non-empty list of rulesync source-tree directories. Each entry
+	* is a source tree itself — the directory that directly contains feature
+	* subdirectories (`rules/`, `commands/`, …) and single-file features
+	* (`mcp.jsonc`, `hooks.jsonc`, …). Later entries take precedence in
+	* per-feature merges. Defaults to `[join(process.cwd(), ".rulesync")]`.
+	*
+	* The singular user-facing alias (`inputRoot` in `rulesync.jsonc` / the
+	* `--input-root` CLI flag / `GenerateOptions.inputRoot`) is deprecated
+	* and collapsed into `[join(inputRoot, ".rulesync")]` before it ever
+	* reaches a processor — every internal consumer only ever sees the
+	* plural form, with the source tree already resolved.
+	*/
+	inputRoots;
 	dryRun;
 	logger;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, dryRun = false, logger }) {
 		this.outputRoot = outputRoot;
-		this.inputRoot = inputRoot;
+		this.inputRoots = inputRoots !== void 0 && inputRoots.length > 0 ? [inputRoots[0], ...inputRoots.slice(1)] : [(0, node_path.join)(process.cwd(), RULESYNC_RELATIVE_DIR_PATH)];
 		this.dryRun = dryRun;
 		this.logger = logger;
 	}
@@ -6297,6 +7652,198 @@ var FeatureProcessor = class {
 		return orphanFiles.length;
 	}
 };
+/**
+* Messages already reported for a given logger.
+*
+* One `generate` run constructs a single-file processor per tool target and
+* per output root — more than twenty times for `--targets "*"` — and each one
+* re-resolves the same roots. Keying on the logger — created once per run, and
+* once per test — keeps the shadowing warning to a single line instead of
+* repeating it for every target. `--watch` reuses one logger across runs, so
+* {@link resetRootShadowingWarnings} clears the set at the start of each one.
+*/
+const warnedRootShadowingByLogger = /* @__PURE__ */ new WeakMap();
+/**
+* Forget which shadowing warnings have already been reported.
+*
+* `generate` calls this once per run. Without it, `--watch` reuses one logger
+* for the whole session, so the warning would be printed on the first
+* generation and never again — the opposite of why it is a warning, since
+* `--watch` is exactly when an overlay is most likely to be added or edited.
+*/
+function resetRootShadowingWarnings({ logger }) {
+	warnedRootShadowingByLogger.delete(logger);
+}
+/**
+* Return the last input root that contains any of the given `relativePaths`,
+* or `undefined` when none of the roots has any of them. Used by single-file
+* features (hooks, permissions, ignore) to implement the "later root wins
+* the whole file" merge policy without materializing the file contents.
+*
+* `relativePaths` accepts a small list so features that historically read
+* either a recommended path or a legacy alias (e.g. `.rulesync/mcp.jsonc`
+* plus `.rulesync/mcp.json`) can preserve that resolution order per root.
+* A root counts as "having" the file as long as at least one candidate path
+* is present.
+*/
+async function pickLastRootWithFile({ inputRoots, relativePaths, logger, artifactName }) {
+	let winner;
+	const rootsWithFile = [];
+	for (const root of inputRoots) for (const relativePath of relativePaths) if (await fileExists((0, node_path.join)(root, relativePath))) {
+		winner = root;
+		rootsWithFile.push(root);
+		break;
+	}
+	if (rootsWithFile.length > 1 && winner !== void 0) {
+		const shadowed = rootsWithFile.slice(0, -1);
+		const message = `${artifactName} is provided by more than one input root; '${stripControlCharacters(winner)}' replaces the whole file from ${shadowed.map((root) => `'${stripControlCharacters(root)}'`).join(", ")}.`;
+		let warnedMessages = warnedRootShadowingByLogger.get(logger);
+		if (warnedMessages === void 0) {
+			warnedMessages = /* @__PURE__ */ new Set();
+			warnedRootShadowingByLogger.set(logger, warnedMessages);
+		}
+		if (!warnedMessages.has(message)) {
+			warnedMessages.add(message);
+			logger.warn(message);
+		}
+	}
+	return winner;
+}
+/**
+* Merge per-root result lists into a single ordered list, keeping the
+* later root's entry when two roots produced an item with the same
+* identity. Identity is intentionally provided by the caller so
+* per-feature nuances (case-insensitive filesystems, directory names for
+* skills, server names for MCP) live next to the feature that owns them.
+*
+* The returned list preserves the FIRST appearance order of each identity —
+* items in the earliest root keep their position, but their content is
+* replaced by the last root that provided the same identity. This matches
+* the "overlay" mental model: an overlay changes content, not order.
+*/
+function mergeByIdentity({ perRoot, identity }) {
+	const order = [];
+	const winnerByKey = /* @__PURE__ */ new Map();
+	for (const rootItems of perRoot) for (const item of rootItems) {
+		const key = identity(item);
+		if (!winnerByKey.has(key)) order.push(key);
+		winnerByKey.set(key, item);
+	}
+	return order.map((key) => winnerByKey.get(key));
+}
+/**
+* The key two spellings share when a case-insensitive filesystem would give
+* them one file. `toLowerCase()` is locale-independent (unlike
+* `toLocaleLowerCase`, it does not turn `I` into the Turkish `ı` under a Turkish
+* locale), and the NFC pass folds the composed and decomposed spellings of an
+* accented name — which macOS also resolves to a single directory —
+* onto each other.
+*
+* This is simple lowercasing rather than full Unicode case folding, so it is
+* deliberately narrower than what a filesystem considers one file: a Greek
+* final sigma, a Turkish `ı` under NTFS's upcasing, and a Win32 name whose
+* trailing dot is stripped all still produce distinct keys. Those pairs keep
+* the pre-existing behavior (both are imported, and the later one wins on the
+* filesystem); folding them here would instead drop names that a
+* case-sensitive filesystem keeps genuinely apart.
+*/
+function caseFoldIdentity(identity) {
+	return identity.normalize("NFC").toLowerCase();
+}
+/**
+* Group spellings by their case-folded identity, keeping every original
+* spelling. On a case-sensitive filesystem one identity can cover several
+* spellings at once, and the caller needs them all to describe a collision
+* accurately.
+*/
+function groupSpellingsByCaseFoldedIdentity(spellings) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const spelling of spellings) {
+		const identity = caseFoldIdentity(spelling);
+		const existing = grouped.get(identity);
+		if (existing === void 0) grouped.set(identity, [spelling]);
+		else existing.push(spelling);
+	}
+	return grouped;
+}
+/**
+* Build the warning emitted when a `.curated/` entry and a local entry in the
+* same tree differ only in case.
+*
+* `.curated/` is expanded from a declarative source (an external Git repository
+* or npm package), so its names are untrusted input; both sides are stripped of
+* control characters before they reach the terminal.
+*
+* The winning local spelling is the LAST one, matching the precedence
+* {@link mergeByCaseInsensitiveIdentity} applies afterwards; any other spelling
+* that folds onto the same identity is listed too, so the message never names a
+* spelling that loses.
+*/
+function formatCuratedCaseCollisionWarning({ artifactKind, entryNoun, treeDirPath, curatedSpelling, localSpellings }) {
+	const winner = localSpellings[localSpellings.length - 1] ?? "";
+	const shadowed = localSpellings.slice(0, -1);
+	const shadowedSuffix = shadowed.length === 0 ? "" : ` Other local spellings that fold onto the same identity: ${shadowed.map((spelling) => `'${stripControlCharacters(spelling)}'`).join(", ")}.`;
+	return `Case-insensitive ${artifactKind} collision under ${stripControlCharacters(treeDirPath)}: curated '${stripControlCharacters(curatedSpelling)}' and local '${stripControlCharacters(winner)}' resolve to the same identity. The local ${entryNoun} wins and the curated ${entryNoun} is skipped.` + shadowedSuffix;
+}
+/**
+* Merge artifacts whose filenames are case-insensitive identities, warning
+* when distinct spellings collapse to the same key. Exact-name overlays are
+* intentional and remain quiet; only case-only ambiguity is diagnosed.
+*
+* Precedence here is the opposite of {@link ClaimedIdentities}: this merges
+* overlay roots, where the LAST entry wins, while the tool-side loaders keep
+* the FIRST root to claim a name.
+*/
+function mergeByCaseInsensitiveIdentity({ perRoot, identity, artifactName, logger }) {
+	const spellingByKey = /* @__PURE__ */ new Map();
+	const warnedKeys = /* @__PURE__ */ new Set();
+	return mergeByIdentity({
+		perRoot,
+		identity: (item) => {
+			const spelling = identity(item);
+			const key = caseFoldIdentity(spelling);
+			const previousSpelling = spellingByKey.get(key);
+			if (previousSpelling !== void 0 && previousSpelling !== spelling && !warnedKeys.has(key)) {
+				logger.warn(`Case-insensitive ${artifactName} collision: '${stripControlCharacters(previousSpelling)}' and '${stripControlCharacters(spelling)}' resolve to the same identity. The later entry wins.`);
+				warnedKeys.add(key);
+			}
+			if (previousSpelling === void 0) spellingByKey.set(key, spelling);
+			return key;
+		}
+	});
+}
+/**
+* Tracks the import identities already claimed while scanning, folding case
+* through {@link caseFoldIdentity}.
+*
+* The tool-side loaders scan several roots in precedence order and keep the
+* first spelling of each identity. Comparing those identities exactly lets
+* `.junie/skills/dup-skill` and `.agents/skills/Dup-Skill` both through, and
+* since macOS and Windows resolve the two written-back directories to a
+* single one, the shared Agent Skills copy lands last and overwrites the
+* tool-specific one — inverting the precedence the roots were ordered by.
+*
+* The FIRST claimer wins, which is the opposite of the overlay precedence in
+* {@link mergeByCaseInsensitiveIdentity}: roots are passed in precedence
+* order, so the earliest one to name a skill is the one that should keep it.
+*/
+var ClaimedIdentities = class {
+	claimByKey = /* @__PURE__ */ new Map();
+	/**
+	* Claim `identity` on behalf of `source`. Returns `null` when nothing held
+	* it yet, or the standing claim when something did.
+	*/
+	claim({ identity, source }) {
+		const key = caseFoldIdentity(identity);
+		const claimed = this.claimByKey.get(key);
+		if (claimed !== void 0) return claimed;
+		this.claimByKey.set(key, {
+			spelling: identity,
+			source
+		});
+		return null;
+	}
+};
 //#endregion
 //#region src/constants/amp-paths.ts
 const AMP_DIR = ".amp";
@@ -8619,10 +10166,10 @@ var ChecksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$6, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$6, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -8659,11 +10206,15 @@ var ChecksProcessor = class extends FeatureProcessor {
 		return toolFiles.filter((file) => file instanceof ToolCheck).flatMap((toolCheck) => toolCheck.toRulesyncChecks());
 	}
 	/**
-	* Implementation of abstract method from Processor
-	* Load and parse rulesync check files from .rulesync/checks/ directory
+	* Load check files from a single source-tree's `checks/` subtree.
+	* `sourceTree` is the source tree itself (e.g. `/repo/.rulesync` or
+	* `/repo/.rulesync.local`).
 	*/
-	async loadRulesyncFiles() {
-		const checksDir = (0, node_path.join)(this.inputRoot, RulesyncCheck.getSettablePaths().relativeDirPath);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = (0, node_path.dirname)(sourceTree);
+		const treeName = (0, node_path.basename)(sourceTree);
+		const treeChecksDirPath = (0, node_path.join)(treeName, CHECKS_FEATURE_SUBDIR);
+		const checksDir = (0, node_path.join)(sourceTree, CHECKS_FEATURE_SUBDIR);
 		if (!await directoryExists(checksDir)) {
 			this.logger.debug(`Rulesync checks directory not found: ${checksDir}`);
 			return [];
@@ -8679,7 +10230,8 @@ var ChecksProcessor = class extends FeatureProcessor {
 			const filepath = (0, node_path.join)(checksDir, mdFile);
 			try {
 				const rulesyncCheck = await RulesyncCheck.fromFile({
-					outputRoot: this.inputRoot,
+					outputRoot: treeParent,
+					relativeDirPath: treeChecksDirPath,
 					relativeFilePath: mdFile,
 					validate: true
 				});
@@ -8690,6 +10242,21 @@ var ChecksProcessor = class extends FeatureProcessor {
 				continue;
 			}
 		}
+		return rulesyncChecks;
+	}
+	/**
+	* Implementation of abstract method from Processor
+	* Load and parse rulesync check files from every configured input root's
+	* `.rulesync/checks/` directory, merging by relative file path so a check
+	* from a later root replaces the earlier root's copy.
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncChecks = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (check) => check.getRelativeFilePath(),
+			artifactName: "check",
+			logger: this.logger
+		});
 		this.logger.debug(`Successfully loaded ${rulesyncChecks.length} rulesync checks`);
 		return rulesyncChecks;
 	}
@@ -10168,18 +11735,23 @@ function commandSlug(relativeFilePath) {
 	return (0, node_path.basename)(relativeFilePath, ".md").replace(/[^a-zA-Z0-9_-]/g, "-");
 }
 /**
-* Whether a rulesync command exists whose slug matches `dirName`.
+* Whether a rulesync command exists whose slug matches `dirName` in any of
+* the configured input roots.
+*
+* `inputRoots[i]` is a source tree itself (e.g. `/repo/.rulesync` or
+* `/repo/.rulesync.local`), so commands live directly under
+* `<sourceTree>/commands/`.
 *
 * Used by the skills-surface `isDirOwned` hooks of tools whose commands are
 * emitted as `<slug>/SKILL.md` into the skills tree: a directory matching a
 * current command slug is owned by the commands feature, so the skills
 * feature must neither import it as a skill nor delete it as an orphan
-* skill. Once the command is removed from `.rulesync/commands/`, the
-* directory stops matching and the skills feature cleans it up as a regular
-* orphan.
+* skill. Once the command is removed from every source tree's `commands/`
+* directory, the directory stops matching and the skills feature cleans
+* it up as a regular orphan.
 */
-async function rulesyncCommandSlugExists({ inputRoot, dirName }) {
-	return (await findFilesByGlobs((0, node_path.join)(inputRoot, RULESYNC_COMMANDS_RELATIVE_DIR_PATH, "**", "*.md"))).some((filePath) => commandSlug((0, node_path.basename)(filePath)) === dirName);
+async function rulesyncCommandSlugExists({ inputRoots, dirName }) {
+	return (await Promise.all(inputRoots.map((root) => findFilesByGlobs((0, node_path.join)(root, COMMANDS_FEATURE_SUBDIR, "**", "*.md"))))).flat().some((filePath) => commandSlug((0, node_path.basename)(filePath)) === dirName);
 }
 //#endregion
 //#region src/features/commands/devin-command.ts
@@ -10869,11 +12441,10 @@ var GrokcliCommand = class GrokcliCommand extends ToolCommand {
 	* output is lost — so this warns rather than failing the run the way the
 	* Hermes check does, where the two surfaces really do write the same path.
 	*/
-	static async validateRulesyncCommands({ inputRoot, rulesyncCommands, logger }) {
+	static async validateRulesyncCommands({ inputRoots, rulesyncCommands, logger }) {
 		const commandNames = new Set(rulesyncCommands.filter((command) => this.isTargetedByRulesyncCommand(command)).map((command) => (0, node_path.basename)(command.getRelativeFilePath(), ".md")));
 		if (commandNames.size === 0) return;
-		const skillsRoot = (0, node_path.join)(inputRoot, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
-		const shadowed = (await findFilesByGlobs((0, node_path.join)(skillsRoot, "**", "SKILL.md"))).map((filePath) => (0, node_path.basename)((0, node_path.dirname)(filePath))).filter((skillName) => commandNames.has(skillName));
+		const shadowed = (await Promise.all(inputRoots.map((root) => findFilesByGlobs((0, node_path.join)(root, SKILLS_FEATURE_SUBDIR, "**", "SKILL.md"))))).flat().map((filePath) => (0, node_path.basename)((0, node_path.dirname)(filePath))).filter((skillName) => commandNames.has(skillName));
 		if (shadowed.length > 0) logger.warn(`Grok CLI resolves skills before commands, so these skills shadow the same-named commands, which will never be reachable: ${[...new Set(shadowed)].toSorted().join(", ")}. Rename either side to make both invocable.`);
 	}
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
@@ -10919,6 +12490,26 @@ function toolSkillSearchRoots(paths) {
 * https://agentskills.io/client-implementation/adding-skills-support
 */
 const AGENT_SKILLS_INTEROP_ROOTS = /* @__PURE__ */ new Set([toPosixPath(AGENTSMD_SKILLS_DIR_PATH), toPosixPath(AMP_SKILLS_GLOBAL_DIR)]);
+/**
+* The one spec violation both sides of the conversion report. Generation warns
+* about it before writing the file; import warns about it because a conformant
+* client would skip the skill entirely, and a user who never sees that has no
+* reason to fix it.
+*/
+const EMPTY_SKILL_DESCRIPTION_VIOLATION = "`description` is required and must not be empty; conformant clients skip a skill without one";
+/**
+* Report a skill read from disk whose `description` is empty. This lives on the
+* read rather than on any one tool class because several targets share one
+* `.agents/skills` tree: which of them reports the skill must not depend on
+* which target the user happened to enable. Every loader calls it — the two
+* directory loaders (`loadSkillDirContent`, `SimulatedSkill.fromDirDefault`)
+* and the flat-file one — so the form a tool stores its skills in does not
+* decide whether the problem is reported either.
+*/
+function warnOnEmptyLoadedDescription({ skillFilePath, description }) {
+	if (typeof description !== "string" || description.length > 0) return;
+	warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ${EMPTY_SKILL_DESCRIPTION_VIOLATION}. Rulesync imports it anyway so the content is not lost; fill it in before relying on this skill.`);
+}
 function isAgentSkillsInteropRoot(relativeDirPath) {
 	return AGENT_SKILLS_INTEROP_ROOTS.has(toPosixPath(relativeDirPath));
 }
@@ -11031,7 +12622,11 @@ var ToolSkill = class extends AiDir {
 		const skillDirPath = (0, node_path.join)(outputRoot, actualRelativeDirPath, dirName);
 		const skillFilePath = (0, node_path.join)(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
+		warnOnEmptyLoadedDescription({
+			skillFilePath,
+			description: frontmatter.description
+		});
 		const otherFiles = await this.collectOtherFiles(outputRoot, actualRelativeDirPath, dirName, SKILL_FILE_NAME);
 		return {
 			outputRoot,
@@ -11156,6 +12751,10 @@ function toSpecConformantAgentSkillFields(section, { coerceMetadata = true } = {
 		...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
 	};
 }
+/** The `SKILL.md` a diagnostic should point at, in the scope it is written to. */
+function agentSkillFilePath({ outputRoot, relativeDirPath, dirName }) {
+	return (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
+}
 /**
 * Collect the normative violations the Agent Skills spec defines for a skill
 * about to be written. These are reported as warnings rather than errors:
@@ -11182,7 +12781,7 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
-	if (description.length === 0) violations.push("`description` is required and must not be empty; conformant clients skip a skill without one");
+	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
 	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
@@ -11301,12 +12900,16 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
+		const skillPath = agentSkillFilePath({
+			outputRoot,
+			relativeDirPath,
+			dirName
+		});
 		for (const violation of collectAgentSkillViolations({
 			frontmatter,
 			dirName,
 			sourceAllowedTools
-		})) warnWithFallback(logger, `${skillPath}: ${violation}`);
+		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -11645,7 +13248,7 @@ var HermesagentCommand = class HermesagentCommand extends ToolCommand {
 	static getExtraSharedWritePaths() {
 		return getHermesagentSharedConfigWritePaths();
 	}
-	static async validateRulesyncCommands({ inputRoot, rulesyncCommands }) {
+	static async validateRulesyncCommands({ inputRoots, rulesyncCommands }) {
 		const commandSlugs = /* @__PURE__ */ new Set();
 		const commandOrigins = /* @__PURE__ */ new Map();
 		for (const command of rulesyncCommands.filter((candidate) => this.isTargetedByRulesyncCommand(candidate))) {
@@ -11657,13 +13260,25 @@ var HermesagentCommand = class HermesagentCommand extends ToolCommand {
 			commandOrigins.set(slug, origin);
 			commandSlugs.add(slug);
 		}
-		const skillsRoot = (0, node_path.join)(inputRoot, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
-		const skillFiles = await findFilesByGlobs((0, node_path.join)(skillsRoot, "**", "SKILL.md"));
-		const collisions = (await Promise.all(skillFiles.map((path) => RulesyncSkill.fromDir({
-			outputRoot: inputRoot,
-			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
-			dirName: toPosixPath((0, node_path.relative)(skillsRoot, (0, node_path.dirname)(path)))
-		})))).filter((skill) => HermesagentSkill.isTargetedByRulesyncSkill(skill)).map((skill) => hermesSlashName(skill.getFrontmatter().name)).filter((slug) => commandSlugs.has(slug));
+		const skillsByName = /* @__PURE__ */ new Map();
+		for (const rootPath of inputRoots) {
+			const skillsRoot = (0, node_path.join)(rootPath, SKILLS_FEATURE_SUBDIR);
+			const skillFiles = await findFilesByGlobs((0, node_path.join)(skillsRoot, "**", "SKILL.md"));
+			const loaded = await Promise.all(skillFiles.map(async (filePath) => {
+				const dirName = toPosixPath((0, node_path.relative)(skillsRoot, (0, node_path.dirname)(filePath)));
+				return {
+					rulesyncSkill: await RulesyncSkill.fromDir({
+						outputRoot: rootPath,
+						relativeDirPath: SKILLS_FEATURE_SUBDIR,
+						dirName
+					}),
+					dirName,
+					rootPath
+				};
+			}));
+			for (const entry of loaded) skillsByName.set(caseFoldIdentity(entry.dirName), entry);
+		}
+		const collisions = [...skillsByName.values()].map(({ rulesyncSkill }) => rulesyncSkill).filter((skill) => HermesagentSkill.isTargetedByRulesyncSkill(skill)).map((skill) => hermesSlashName(skill.getFrontmatter().name)).filter((slug) => commandSlugs.has(slug));
 		if (collisions.length > 0) throw new Error(`Hermes command and skill slash-name collision: ${[...new Set(collisions)].toSorted().join(", ")}`);
 	}
 	static async getAuxiliaryFiles({ toolCommands, outputRoot, global = false, forDeletion = false }) {
@@ -11796,6 +13411,8 @@ const JUNIE_PERMISSIONS_FILE_NAME = "allowlist.json";
 const JUNIE_IGNORE_FILE_NAME = ".aiignore";
 const JUNIE_RULE_FILE_NAME = "AGENTS.md";
 const JUNIE_LEGACY_RULE_FILE_NAME = "guidelines.md";
+const JUNIE_RULES_DIR_NAME = "rules";
+const JUNIE_PLAYBOOK_FILE_NAME = "playbook.md";
 //#endregion
 //#region src/features/commands/junie-command.ts
 const JunieCommandFrontmatterSchema = zod_mini.z.looseObject({ description: zod_mini.z.optional(zod_mini.z.string()) });
@@ -13756,10 +15373,10 @@ var CommandsProcessor = class extends FeatureProcessor {
 	global;
 	getFactory;
 	flattenedCommandNaming;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$5, dryRun = false, flattenedCommandNaming = "basename", logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$5, dryRun = false, flattenedCommandNaming = "basename", logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -13774,7 +15391,7 @@ var CommandsProcessor = class extends FeatureProcessor {
 		const rulesyncCommands = rulesyncFiles.filter((file) => file instanceof RulesyncCommand);
 		const factory = this.getFactory(this.toolTarget);
 		await factory.class.validateRulesyncCommands?.({
-			inputRoot: this.inputRoot,
+			inputRoots: this.inputRoots,
 			rulesyncCommands,
 			logger: this.logger
 		});
@@ -13826,16 +15443,36 @@ var CommandsProcessor = class extends FeatureProcessor {
 		return rel;
 	}
 	/**
-	* Implementation of abstract method from FeatureProcessor
-	* Load and parse rulesync command files from .rulesync/commands/ directory
+	* Load rulesync command files from a single source-tree's `commands/`
+	* subtree. `sourceTree` is the source tree itself (e.g.
+	* `/repo/.rulesync` or `/repo/.rulesync.local`).
 	*/
-	async loadRulesyncFiles() {
-		const basePath = (0, node_path.join)(this.inputRoot, RulesyncCommand.getSettablePaths().relativeDirPath);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = (0, node_path.dirname)(sourceTree);
+		const treeName = (0, node_path.basename)(sourceTree);
+		const treeCommandsDirPath = (0, node_path.join)(treeName, COMMANDS_FEATURE_SUBDIR);
+		const basePath = (0, node_path.join)(sourceTree, COMMANDS_FEATURE_SUBDIR);
 		const rulesyncCommandPaths = await findFilesByGlobs((0, node_path.join)(basePath, "**", "*.md"));
-		const rulesyncCommands = await Promise.all(rulesyncCommandPaths.map((path) => RulesyncCommand.fromFile({
-			outputRoot: this.inputRoot,
+		return await Promise.all(rulesyncCommandPaths.map((path) => RulesyncCommand.fromFile({
+			outputRoot: treeParent,
+			relativeDirPath: treeCommandsDirPath,
 			relativeFilePath: this.safeRelativePath(basePath, path)
 		})));
+	}
+	/**
+	* Implementation of abstract method from FeatureProcessor
+	* Load and parse rulesync command files from every configured input root's
+	* `.rulesync/commands/` directory, merging by relative path so a command
+	* with the same target path from a later root replaces the earlier root's
+	* copy.
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncCommands = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (command) => command.getRelativeFilePath(),
+			artifactName: "command",
+			logger: this.logger
+		});
 		this.logger.debug(`Successfully loaded ${rulesyncCommands.length} rulesync commands`);
 		return rulesyncCommands;
 	}
@@ -19475,6 +21112,7 @@ function vibeEntryToCanonicalDef(raw) {
 	const entry = raw;
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
+	if (isPrototypePollutionKey(vibeEvent)) return null;
 	const canonicalEvent = VIBE_TO_CANONICAL_EVENT_NAMES[vibeEvent] ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
@@ -20023,10 +21661,10 @@ const hooksProcessorToolTargetsGlobalImportable = [...toolHooksFactories.entries
 var HooksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -20036,9 +21674,17 @@ var HooksProcessor = class extends FeatureProcessor {
 		this.global = global;
 	}
 	async loadRulesyncFiles() {
+		const relativePaths = getRulesyncSourceCandidates({ paths: RulesyncHooks.getSettablePaths() }).map((candidate) => candidate.relativeFilePath);
+		const sourceTree = await pickLastRootWithFile({
+			inputRoots: this.inputRoots,
+			relativePaths,
+			logger: this.logger,
+			artifactName: "The hooks file"
+		}) ?? this.inputRoots[0];
 		try {
 			return [await RulesyncHooks.fromFile({
-				outputRoot: this.inputRoot,
+				outputRoot: (0, node_path.dirname)(sourceTree),
+				relativeDirPath: (0, node_path.basename)(sourceTree),
 				validate: true
 			})];
 		} catch (error) {
@@ -21580,10 +23226,10 @@ var IgnoreProcessor = class extends FeatureProcessor {
 	getFactory;
 	featureOptions;
 	global;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, getFactory = defaultGetFactory$4, global = false, dryRun = false, logger, featureOptions }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, getFactory = defaultGetFactory$4, global = false, dryRun = false, logger, featureOptions }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -21600,11 +23246,35 @@ var IgnoreProcessor = class extends FeatureProcessor {
 	}
 	/**
 	* Implementation of abstract method from FeatureProcessor
-	* Load and parse rulesync ignore files from .rulesync/ignore/ directory
+	*
+	* Load and parse the rulesync ignore file. `inputRoots[i]` is a source
+	* tree itself (e.g. `/repo/.rulesync.local`); the recommended `.aiignore`
+	* lives directly inside it. The legacy `.rulesyncignore` is shared at the
+	* project root, so it is intentionally not considered when choosing which
+	* source tree wins; `RulesyncIgnore.fromFile` still uses it as a fallback
+	* for the chosen tree.
+	*
+	* When multiple input roots are configured, the last root that provides
+	* an ignore file wins entirely (whole-file replacement — no line-level
+	* merge in this slice; see the "Deliberately out of scope" section of
+	* the inputRoots plan for context). If no root has the file, fall back
+	* to the primary root's path so the underlying `RulesyncIgnore.fromFile`
+	* surfaces the same missing-file error it would in the single-root case.
 	*/
 	async loadRulesyncFiles() {
+		const paths = RulesyncIgnore.getSettablePaths();
+		const relativePaths = getRulesyncSourceCandidates({ paths }).filter((candidate) => candidate.relativeDirPath === paths.recommended.relativeDirPath).map((candidate) => candidate.relativeFilePath);
+		const sourceTree = await pickLastRootWithFile({
+			inputRoots: this.inputRoots,
+			relativePaths,
+			logger: this.logger,
+			artifactName: "The ignore file (.aiignore)"
+		}) ?? this.inputRoots[0];
 		try {
-			return [await RulesyncIgnore.fromFile({ outputRoot: this.inputRoot })];
+			return [await RulesyncIgnore.fromFile({
+				outputRoot: (0, node_path.dirname)(sourceTree),
+				relativeDirPath: (0, node_path.basename)(sourceTree)
+			})];
 		} catch (error) {
 			this.logger.error(`Failed to load rulesync ignore file (${RULESYNC_AIIGNORE_RELATIVE_FILE_PATH}): ${formatError(error)}`);
 			return [];
@@ -26639,11 +28309,86 @@ function disabledNamesOf(config) {
 	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
+* The value `mcp.mcpConfigPath` needs so Rovo Dev reads the project-scope
+* `.rovodev/mcp.json`. A config-file value, not a filesystem path, so it is
+* always POSIX-separated.
+*/
+const ROVODEV_PROJECT_MCP_CONFIG_POINTER = node_path.posix.join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME);
+/**
+* The keys that make an entry in `mcp.json` something Rovo Dev can start:
+* a local process, or a remote endpoint under either spelling the canonical
+* config accepts.
+*/
+const MCP_SERVER_ENDPOINT_KEYS = [
+	"command",
+	"url",
+	"httpUrl"
+];
+function normalizeMcpConfigPathValue(value) {
+	return toPosixPath(value).replace(/^\.\//, "");
+}
+/**
+* Point `mcp.mcpConfigPath` at the project-scope `mcp.json` rulesync writes,
+* and report whether the block gained a value it did not already carry.
+*
+* Rovo Dev's `mcpConfigPath` defaults to a file under the user's home
+* directory, so a repo-committed `.rovodev/mcp.json` is inert until the active
+* config points at it — the Bitbucket Agentic Pipelines guide documents
+* registering the server and setting the pointer as two required steps. Global
+* scope is left alone: there the default already resolves to the file rulesync
+* writes.
+*
+* The pointer names one config rather than merging with the default, so it is
+* written only when this project actually has a Rovo Dev server to run — a
+* server that targets `rovodev` and is not disabled. Otherwise `mcp.json` is
+* generated empty, and pointing at it would take away the user's global
+* servers for this repository in exchange for nothing.
+*
+* That condition can also stop holding after the fact, once the last server is
+* removed from the canonical config or switched off. Rulesync does not take
+* the pointer back out — it cannot tell its own past value from a user who
+* typed the same string — but it says so, since the file is now a live setting
+* that resolves to nothing.
+*
+* A pointer the user aimed somewhere else is theirs, not ours: overwriting it
+* would silently redirect Rovo Dev away from a file they chose. It is named in
+* a warning instead, because the generated `mcp.json` is unread while it
+* stands.
+*
+* Whatever the outcome, it is logged: writing the pointer turns servers that
+* were generated-but-never-read into servers Rovo Dev actually spawns, and
+* points it away from the global MCP config, so it is not something to do
+* quietly.
+*
+* @see https://support.atlassian.com/bitbucket-cloud/docs/rovo-dev-advanced-agentic-configuration/
+* @see https://support.atlassian.com/rovo/docs/manage-rovo-dev-cli-settings/
+*/
+function applyProjectMcpConfigPointer({ existingMcp, global, hasLiveServers, logger }) {
+	if (global) return false;
+	const existing = existingMcp.mcpConfigPath;
+	const pointsAtGeneratedFile = typeof existing === "string" && normalizeMcpConfigPathValue(existing) === ROVODEV_PROJECT_MCP_CONFIG_POINTER;
+	if (!hasLiveServers) {
+		if (pointsAtGeneratedFile) logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)} points at ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)}, which now has no enabled server. Rovo Dev reads that file instead of the global MCP config, so this project has no MCP servers at all until one targeting rovodev is added back — remove the mcp.mcpConfigPath line to fall back to the global config.`);
+		return false;
+	}
+	if (existing === void 0) {
+		existingMcp.mcpConfigPath = ROVODEV_PROJECT_MCP_CONFIG_POINTER;
+		logger?.info(`Rovo Dev MCP: setting mcp.mcpConfigPath to "${ROVODEV_PROJECT_MCP_CONFIG_POINTER}" in ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)}. Rovo Dev will now launch the servers in ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} for this project instead of the ones in the default global MCP config.`);
+		return true;
+	}
+	if (pointsAtGeneratedFile) return false;
+	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${JSON.stringify(existing)} in ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)}. Rovo Dev reads MCP servers from that path, so the generated ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} is unused until it is set to "${ROVODEV_PROJECT_MCP_CONFIG_POINTER}".`);
+	return false;
+}
+/**
 * Auxiliary writer for the `mcp:` block of `.rovodev/config.yml` (project) /
 * `~/.rovodev/config.yml` (global). Carries `disabledMcpServers` — the key
-* Rovo Dev actually consults to switch a server off — recomputed from the
-* existing block so user keys (`mcpConfigPath`, `allowedMcpServers`, ...) and
-* disabled names for servers rulesync does not manage survive.
+* Rovo Dev actually consults to switch a server off — plus `mcpConfigPath`,
+* which rulesync authors in project scope when the key is absent and this
+* project has a server to run (see `applyProjectMcpConfigPointer`). The block
+* is recomputed from the existing one, so user keys (`allowedMcpServers`,
+* ...), a `mcpConfigPath` the user aimed elsewhere, and disabled names for
+* servers rulesync does not manage all survive.
 */
 var RovodevMcpConfigYaml = class extends ToolFile {
 	isDeletable() {
@@ -26776,7 +28521,17 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 		const mergedDisabled = [...existingDisabled.filter((name) => !managedNameSet.has(name)), ...disabledNames].toSorted();
 		if (mergedDisabled.length > 0) existingMcp.disabledMcpServers = mergedDisabled;
 		else delete existingMcp.disabledMcpServers;
-		if (mergedDisabled.length === 0 && existingContent.trim() === "") return [];
+		const wrotePointer = applyProjectMcpConfigPointer({
+			existingMcp,
+			global,
+			hasLiveServers: managedNames.filter((name) => {
+				if (disabledNames.includes(name)) return false;
+				const server = servers[name];
+				return isRecord$1(server) && MCP_SERVER_ENDPOINT_KEYS.some((endpointKey) => server[endpointKey] !== void 0);
+			}).length > 0,
+			logger
+		});
+		if (mergedDisabled.length === 0 && !wrotePointer && existingContent.trim() === "") return [];
 		const fileContent = applySharedConfigPatch({
 			fileKey: ROVODEV_CONFIG_SHARED_FILE_KEY,
 			feature: "mcp",
@@ -27869,10 +29624,10 @@ var McpProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$3, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$3, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -27888,7 +29643,10 @@ var McpProcessor = class extends FeatureProcessor {
 	*/
 	async loadRulesyncFiles() {
 		try {
-			return [await RulesyncMcp.fromFile({ outputRoot: this.inputRoot })];
+			return [await RulesyncMcp.fromRoots({
+				inputRoots: this.inputRoots,
+				logger: this.logger
+			})];
 		} catch (error) {
 			this.logger.error(`Failed to load a Rulesync MCP file (${RULESYNC_MCP_RELATIVE_FILE_PATH}): ${formatError(error)}`);
 			return [];
@@ -29430,27 +31188,6 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	return { permission };
 }
 //#endregion
-//#region src/utils/control-characters.ts
-/**
-* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
-* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
-* line and paragraph separators, and the plain LRM/RLM marks. A name or value
-* copied out of an untrusted config file, a fetched repository, or a tool's own
-* settings file must never reach the terminal with these intact: they let the
-* text forge log lines, reorder what is printed around them, or inject escape
-* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
-* neutral characters beside them, so they go too — a diagnostic line is not the
-* place to preserve the typography of a right-to-left name.
-*/
-const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
-/**
-* Removes every control character from `text` so it is safe to splice into a
-* log line or other terminal output.
-*/
-function stripControlCharacters(text) {
-	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
-}
-//#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Claude Code tool names (PascalCase).
@@ -29536,8 +31273,8 @@ function deepMergeRecords(base, patch) {
 *
 * Deliberately NOT listed:
 * - `ripgrep` / `bwrapPath` / `socatPath`: each names an executable, so
-*   `stripCommandExecutingSandboxPaths` refuses them in both scopes rather than
-*   emitting them under `--global`.
+*   `CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL` refuses them in both scopes
+*   rather than emitting them under `--global`.
 * - `credentials.envVars` / `credentials.files`: the ignored-at-project-scope
 *   unit is the individual entry's mode, not the settings key, and the same
 *   lists carry `deny` entries that project settings *do* honor — dropping a
@@ -29556,6 +31293,30 @@ const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["allowAppleEvents"]
 ];
 /**
+* `sandbox.*` paths documented with a `Managed` scope: Claude Code reads them
+* only from the settings file an organization deploys. Neither file rulesync
+* writes is that file, so they are dropped in **both** scopes — the `sandbox`
+* counterpart of {@link CLAUDECODE_UNHONORED_KEY_SOURCES}, which does the same
+* for top-level `Managed` keys.
+*
+* Both only ever *narrow* the policy — they stop a lower-scoped file from
+* re-opening what managed settings blocked — so neither is trust-widening. They
+* are dropped rather than written for the opposite reason: written into a
+* project or user file they do nothing at all, and a `sandbox` block that reads
+* as though it locked the policy to managed values while Claude Code ignores it
+* is the more dangerous of the two failure modes.
+*
+* Import keeps them, unlike the command-executing paths: the value in an
+* existing `settings.json` was hand-written to be honored somewhere, and
+* round-tripping it preserves the author's intent for the day it moves into a
+* managed file. The cost is a warning on every generate until it is removed,
+* which the refusal message points at.
+*
+* @see https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-allowmanagedreadpathsonly
+*   — "Scope: `Managed`"; the `network` entry says the same.
+*/
+const CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS = [["filesystem", "allowManagedReadPathsOnly"], ["network", "allowManagedDomainsOnly"]];
+/**
 * Walks `segments` from `root`, returning the record they name or `undefined` if
 * any step is missing or not a record. Shared by everything below that addresses
 * a `sandbox` path, so a nested path added to one of the tables is actually
@@ -29602,6 +31363,18 @@ function deleteSandboxPath({ target, path }) {
 	return true;
 }
 /**
+* The one warning that names every trust-affecting setting this generate wrote
+* to `relativeFilePath`. Emitted once per file: the individual reasons are what
+* matter, but the "review this as you would a hook" framing only needs saying
+* once, and repeating it per key buries the reasons in boilerplate.
+*/
+function warnOnTrustAffectingEntries({ entries, relativeFilePath, logger }) {
+	if (entries.length === 0) return;
+	const one = entries.length === 1;
+	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
+	logger?.warn(`Claude Code permissions: writing ${entries.length} trust-affecting ${one ? "setting" : "settings"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
+}
+/**
 * The `permissions.defaultMode` values that start a session with fewer prompts
 * than the default. `plan` and `default` are absent because they do not widen
 * anything.
@@ -29614,14 +31387,22 @@ const CLAUDECODE_WIDENING_DEFAULT_MODES = {
 /**
 * The `permissions` fields that widen rather than restrict: a `defaultMode` that
 * removes prompts, and `additionalDirectories`, which moves the
-* working-directory boundary. Warned for the same reason `disableAllHooks` is: a
-* shareable permissions file should not loosen the permission system quietly.
+* working-directory boundary. Reported for the same reason `disableAllHooks` is:
+* a shareable permissions file should not loosen the permission system quietly.
 */
-function warnOnWideningPermissionFields({ fields, relativeFilePath, logger }) {
+function collectWideningPermissionFields({ fields }) {
+	const entries = [];
 	const defaultMode = fields.defaultMode;
-	if (typeof defaultMode === "string" && Object.hasOwn(CLAUDECODE_WIDENING_DEFAULT_MODES, defaultMode)) logger?.warn(`Claude Code permissions: writing 'permissions.defaultMode: "${defaultMode}"' to ${relativeFilePath}; ${CLAUDECODE_WIDENING_DEFAULT_MODES[defaultMode]}. Review it as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+	if (typeof defaultMode === "string" && Object.hasOwn(CLAUDECODE_WIDENING_DEFAULT_MODES, defaultMode)) entries.push({
+		label: `permissions.defaultMode: "${defaultMode}"`,
+		reason: CLAUDECODE_WIDENING_DEFAULT_MODES[defaultMode]
+	});
 	const additionalDirectories = fields.additionalDirectories;
-	if (additionalDirectories !== void 0 && !(Array.isArray(additionalDirectories) && additionalDirectories.length === 0)) logger?.warn(`Claude Code permissions: writing 'permissions.additionalDirectories' to ${relativeFilePath}; it moves the boundary of what Claude Code may read and edit outside the project. Review the paths, especially if this permissions file came from 'rulesync fetch'.`);
+	if (additionalDirectories !== void 0 && !(Array.isArray(additionalDirectories) && additionalDirectories.length === 0)) entries.push({
+		label: "permissions.additionalDirectories",
+		reason: "moves the boundary of what Claude Code may read and edit outside the project"
+	});
+	return entries;
 }
 /**
 * `sandbox` paths whose value names a binary Claude Code runs. `sandbox` has its
@@ -29638,6 +31419,18 @@ const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
 	["socatPath"]
 ];
 /**
+* The predicates the "which value actually widens?" tables are built from.
+* Each names the value that does *not* widen and reports everything else, never
+* the reverse: the override is authored JSONC, so a key can carry any value at
+* all, and one Claude Code coerces is still honored. Reporting an off-type value
+* keeps the warning fail-safe — silence has to mean "this cannot loosen
+* anything", not "this is not the type the table expected".
+*/
+const isNotFalse = (value) => value !== false;
+const isNotTrue = (value) => value !== true;
+const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
+const isNonEmptyMap = (value) => !isPlainRecord(value) || Object.keys(value).length > 0;
+/**
 * `sandbox` paths that loosen the sandbox rather than naming something to run:
 * they let commands out of it, weaken the isolation it provides, or redirect
 * where its traffic goes. They are written like `env` is — the ordinary uses are
@@ -29657,77 +31450,77 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 	{
 		path: ["allowAppleEvents"],
 		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
-		widens: (value) => value === true
+		widens: isNotFalse
 	},
 	{
 		path: ["allowUnsandboxedCommands"],
 		reason: "controls whether Claude may retry a blocked command outside the sandbox",
-		widens: (value) => value !== false
+		widens: isNotFalse
 	},
 	{
 		path: ["autoAllowBashIfSandboxed"],
 		reason: "controls whether every Bash command the sandbox accepts runs without a prompt",
-		widens: (value) => value !== false
+		widens: isNotFalse
 	},
 	{
 		path: ["enableWeakerNestedSandbox"],
 		reason: "runs the Linux sandbox inside an unprivileged container, which weakens it",
-		widens: (value) => value === true
+		widens: isNotFalse
 	},
 	{
 		path: ["enableWeakerNetworkIsolation"],
 		reason: "weakens the sandbox's network isolation on macOS",
-		widens: (value) => value === true
+		widens: isNotFalse
 	},
 	{
 		path: ["enabled"],
 		reason: "turns the sandbox on, and sandboxed Bash commands then run without a permission prompt unless `autoAllowBashIfSandboxed` is false",
-		widens: (value) => value === true
+		widens: isNotFalse
 	},
 	{
 		path: ["excludedCommands"],
 		reason: "names commands that always run outside the sandbox, with no sandbox policy applied",
-		widens: (value) => !Array.isArray(value) || value.length > 0
+		widens: isNonEmptyList
 	},
 	{
 		path: ["filesystem", "allowRead"],
 		reason: "re-opens reading inside a region the sandbox's `denyRead` blocks",
-		widens: (value) => !Array.isArray(value) || value.length > 0
+		widens: isNonEmptyList
 	},
 	{
 		path: ["filesystem", "allowWrite"],
 		reason: "adds paths sandboxed commands may write to, outside the working directory",
-		widens: (value) => !Array.isArray(value) || value.length > 0
+		widens: isNonEmptyList
 	},
 	{
 		path: ["ignoreViolations"],
 		reason: "hides the sandbox violations it names, so a blocked access stops being reported",
-		widens: (value) => isPlainRecord(value) ? Object.keys(value).length > 0 : value !== false
+		widens: (value) => isNonEmptyMap(value) && isNotFalse(value)
 	},
 	{
 		path: ["network", "allowAllUnixSockets"],
 		reason: "lets sandboxed commands connect to every Unix socket",
-		widens: (value) => value === true
+		widens: isNotFalse
 	},
 	{
 		path: ["network", "allowedDomains"],
 		reason: "pre-allows domains sandboxed commands may reach without a prompt",
-		widens: (value) => !Array.isArray(value) || value.length > 0
+		widens: isNonEmptyList
 	},
 	{
 		path: ["network", "allowLocalBinding"],
 		reason: "lets sandboxed commands bind local ports",
-		widens: (value) => value === true
+		widens: isNotFalse
 	},
 	{
 		path: ["network", "allowMachLookup"],
 		reason: "names the macOS services sandboxed commands may reach, and `*` means every service",
-		widens: (value) => !Array.isArray(value) || value.length > 0
+		widens: isNonEmptyList
 	},
 	{
 		path: ["network", "allowUnixSockets"],
 		reason: "names Unix sockets sandboxed commands may reach, and one such as `/var/run/docker.sock` is host access",
-		widens: (value) => !Array.isArray(value) || value.length > 0
+		widens: isNonEmptyList
 	},
 	{
 		path: ["network", "httpProxyPort"],
@@ -29741,11 +31534,12 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 	}
 ];
 /**
-* Warns once per authored `sandbox` path that loosens the sandbox. Nothing is
-* removed — the value is written, just not silently. Called on the filtered
-* `sandbox` so it never claims to be writing a path the scope filters dropped.
+* Every authored `sandbox` path that loosens the sandbox. Nothing is removed —
+* the values are written, just not silently. Called on the filtered `sandbox`
+* so it never claims to be writing a path the scope filters dropped.
 */
-function warnOnTrustAffectingSandboxPaths({ sandbox, relativeFilePath, logger }) {
+function collectTrustAffectingSandboxPaths({ sandbox }) {
+	const entries = [];
 	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
 		const leaf = path.at(-1);
 		if (leaf === void 0) continue;
@@ -29756,38 +31550,49 @@ function warnOnTrustAffectingSandboxPaths({ sandbox, relativeFilePath, logger })
 		if (parent === void 0) continue;
 		const value = parent[leaf];
 		if (value === void 0 || !widens(value)) continue;
-		logger?.warn(`Claude Code permissions: writing 'sandbox.${path.join(".")}' to ${relativeFilePath}; it ${reason}. Review the value as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+		entries.push({
+			label: `sandbox.${path.join(".")}`,
+			reason
+		});
 	}
+	return entries;
 }
+/** Paths that name an executable Claude Code runs. Refused in both scopes. */
+const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL = {
+	paths: CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS,
+	warn: ({ label, relativeFilePath }) => `Claude Code permissions: '${label}' names an executable Claude Code runs, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; set this path in ${relativeFilePath} by hand.`
+};
 /**
-* Copy of the authored `sandbox` override with the paths that name an
-* executable removed, warning once per dropped path.
+* Paths Claude Code honors only from managed settings. Refused in both scopes,
+* like the command-executing paths, because managed settings are not a file
+* rulesync writes in either of them.
 */
-function stripCommandExecutingSandboxPaths({ sandbox, relativeFilePath, logger }) {
-	const filtered = structuredClone(sandbox);
-	for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) {
-		if (!deleteSandboxPath({
-			target: filtered,
-			path
-		})) continue;
-		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' names an executable Claude Code runs, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; set this path in ${relativeFilePath} by hand.`);
-	}
-	return filtered;
-}
+const CLAUDECODE_MANAGED_ONLY_SANDBOX_REFUSAL = {
+	paths: CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS,
+	warn: ({ label, relativeFilePath }) => `Claude Code permissions: '${label}' is only honored in managed settings, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in the managed settings file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`
+};
+/** Paths Claude Code honors only above project scope. Refused at project scope. */
+const CLAUDECODE_GLOBAL_ONLY_SANDBOX_REFUSAL = {
+	paths: CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS,
+	warn: ({ label, relativeFilePath }) => `Claude Code permissions: '${label}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`
+};
 /**
-* Copy of the authored `sandbox` override with the user/managed-only paths
-* removed, warning once per dropped path. Only the override copy is filtered —
-* a value already hand-written in the target file is left untouched, matching
-* the `qwencode` `security.allowPrivateNetworkHooks` precedent.
+* Copy of the authored `sandbox` override with every path of every passed
+* refusal removed, warning once per dropped path. Only the override copy is
+* filtered — a value already hand-written in the target file is left untouched,
+* matching the `qwencode` `security.allowPrivateNetworkHooks` precedent.
 */
-function stripGlobalOnlySandboxPaths({ sandbox, relativeFilePath, logger }) {
+function stripSandboxPaths({ sandbox, refusals, relativeFilePath, logger }) {
 	const filtered = structuredClone(sandbox);
-	for (const path of CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS) {
+	for (const { paths, warn } of refusals) for (const path of paths) {
 		if (!deleteSandboxPath({
 			target: filtered,
 			path
 		})) continue;
-		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+		logger?.warn(warn({
+			label: `sandbox.${path.join(".")}`,
+			relativeFilePath
+		}));
 	}
 	return filtered;
 }
@@ -29811,7 +31616,7 @@ const CLAUDECODE_MASKABLE_CREDENTIAL_LISTS = ["envVars", "files"];
 * such entries to `deny`), so the "reads as masked but isn't" state this guards
 * against cannot slip through a differently-spelled value.
 *
-* Like `stripGlobalOnlySandboxPaths`, only the override copy is filtered — a
+* Like `stripSandboxPaths`, only the override copy is filtered — a
 * value already in the target file is left untouched, which is why the warning
 * points at it.
 *
@@ -29978,6 +31783,9 @@ const CLAUDECODE_TRUST_AFFECTING_KEYS = {
 	allowedHttpHookUrls: "limits which URLs an HTTP hook may target, and an empty list means every URL",
 	allowedMcpServers: "allowlists the MCP servers that may be used, and entries from every settings file merge into one list, so an entry here widens an allowlist deployed elsewhere",
 	autoMode: "auto-approves shell commands with a classifier rather than with a prompt",
+	claudeMdExcludes: "skips the CLAUDE.md files its patterns match, so the instructions a repository relies on can be dropped from every session",
+	companyAnnouncements: "prints the strings it names at startup as your organization's announcement, so a fetched value speaks to the reader with your organization's voice",
+	crossSessionInbound: "decides what a session does with messages arriving from your other Claude Code sessions, and `accept` delivers them straight to Claude",
 	disableAllHooks: "controls whether hooks run at all",
 	disableSkillShellExecution: "re-opens the inline shell commands in a skill or custom command that a user setting had turned off",
 	enableAllProjectMcpServers: "auto-approves every server in the project `.mcp.json`",
@@ -29986,17 +31794,58 @@ const CLAUDECODE_TRUST_AFFECTING_KEYS = {
 	env: "sets environment variables for every process Claude Code spawns, so a value such as `NODE_OPTIONS` or `PATH` runs code and `ANTHROPIC_BASE_URL` redirects every prompt",
 	extraKnownMarketplaces: "registers plugin marketplace sources",
 	httpHookAllowedEnvVars: "controls which environment variables an HTTP hook may put in a request header, credentials included",
+	modelOverrides: "maps the model IDs it names to provider-specific model IDs, so an entry decides which inference profile or deployment every call for that model is routed to",
 	outputStyle: "replaces the system prompt every session runs with",
+	prUrlTemplate: "rewrites the pull-request links Claude Code renders, so they can point at a host of the template's choosing rather than at the reviewed PR",
+	remoteControlAtStartup: "connects Remote Control automatically at session start, and the transcript of a connected session is stored on Anthropic servers to sync it across devices",
 	skipAutoPermissionPrompt: "removes the confirmation shown before auto-approval mode starts",
-	skipDangerousModePermissionPrompt: "removes the confirmation shown before the mode that skips every permission check starts"
+	skipDangerousModePermissionPrompt: "removes the confirmation shown before the mode that skips every permission check starts",
+	skipWebFetchPreflight: "turns off the WebFetch domain safety check, so WebFetch retrieves any URL without consulting Anthropic's blocklist"
 };
 /**
 * The keys from the table above that only widen at one particular value.
 * `disableSkillShellExecution: true` turns inline shell execution off, which
-* restricts; the `false` that turns it back on is what a fetched override could
-* use to undo a user setting, so only that value is warned about.
-*/
-const CLAUDECODE_TRUST_KEY_WIDENING_VALUES = { disableSkillShellExecution: (value) => value === false };
+* restricts; anything else re-opens it, and that is what a fetched override
+* could use to undo a user setting. The rest default to off, so only a value
+* other than the one that leaves them off is worth a line — and for the
+* list-valued and map-valued keys, only a non-empty one, since an empty list or
+* map excludes, announces and overrides nothing.
+*/
+const CLAUDECODE_TRUST_KEY_WIDENING_VALUES = {
+	claudeMdExcludes: isNonEmptyList,
+	companyAnnouncements: isNonEmptyList,
+	crossSessionInbound: (value) => value !== "hold" && value !== "refuse",
+	disableSkillShellExecution: isNotTrue,
+	modelOverrides: isNonEmptyMap,
+	remoteControlAtStartup: isNotFalse,
+	skipWebFetchPreflight: isNotFalse
+};
+/**
+* Top-level keys a project-scoped `.claude/settings.json` honors at one value
+* but ignores at another — the value-level counterpart of
+* {@link CLAUDECODE_USER_SCOPE_ONLY_KEYS}, which is scoped per key. The ignored
+* value is dropped at project scope for the same reason a wholly unhonored key
+* is: committing it would read as a policy that never applies.
+*
+* `remoteControlAtStartup` is the only entry whose honored value can be decided
+* from the value alone. Claude Code honors a `false` from project or local
+* settings — a repository may turn auto-connect off for its own checkout — but
+* ignores a `true`, so that a checked-in file cannot turn Remote Control on for
+* everyone who opens the repository.
+*
+* `crossSessionInbound` is on the same documented list but deliberately absent
+* here: it is a ladder (`accept` < `hold` < `refuse`) whose project value is
+* honored only when it is stricter than the one above it, which no per-value
+* predicate can decide without reading the user's own settings. It is warned
+* about through {@link CLAUDECODE_TRUST_AFFECTING_KEYS} instead, since under
+* `--global` its loosening value is honored outright.
+*
+* @see https://code.claude.com/docs/en/settings#security-keys-where-the-stricter-value-applies
+*/
+const CLAUDECODE_PROJECT_SCOPE_IGNORED_VALUES = { remoteControlAtStartup: {
+	ignored: isNotFalse,
+	note: "Claude Code honors only a `false` there, so that a checked-in file cannot turn Remote Control on for everyone who opens the repository"
+} };
 /**
 * A key name is authored data that ends up in a log line, so strip the control
 * characters that would let it forge a line or hide the warnings beside it, and
@@ -30024,12 +31873,13 @@ const CLAUDECODE_SETTINGS_KEY_ALIASES = {
 /**
 * Copy of the authored top-level passthrough with the keys the target file
 * cannot honor removed, warning once per dropped key. Like
-* `stripGlobalOnlySandboxPaths`, only the override copy is filtered — a value
+* `stripSandboxPaths`, only the override copy is filtered — a value
 * already hand-written in the target file is left untouched, which is why the
 * warning points at it.
 */
 function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logger }) {
 	const filtered = {};
+	const trustAffecting = [];
 	for (const [key, value] of Object.entries(overrides)) {
 		const shown = displayKey(key);
 		const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
@@ -30045,11 +31895,22 @@ function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logge
 			logger?.warn(`Claude Code permissions: '${shown}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — Claude Code reads it from user, local or managed settings. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
 			continue;
 		}
-		const widensAtValue = CLAUDECODE_TRUST_KEY_WIDENING_VALUES[canonicalKey];
-		if (Object.hasOwn(CLAUDECODE_TRUST_AFFECTING_KEYS, canonicalKey) && (widensAtValue === void 0 || widensAtValue(value))) logger?.warn(`Claude Code permissions: writing '${shown}' to ${relativeFilePath}; it ${CLAUDECODE_TRUST_AFFECTING_KEYS[canonicalKey]}. Review the value as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+		const projectIgnored = Object.hasOwn(CLAUDECODE_PROJECT_SCOPE_IGNORED_VALUES, canonicalKey) ? CLAUDECODE_PROJECT_SCOPE_IGNORED_VALUES[canonicalKey] : void 0;
+		if (!global && projectIgnored !== void 0 && projectIgnored.ignored(value)) {
+			logger?.warn(`Claude Code permissions: this value of '${shown}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — ${projectIgnored.note}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		const widensAtValue = Object.hasOwn(CLAUDECODE_TRUST_KEY_WIDENING_VALUES, canonicalKey) ? CLAUDECODE_TRUST_KEY_WIDENING_VALUES[canonicalKey] : void 0;
+		if (Object.hasOwn(CLAUDECODE_TRUST_AFFECTING_KEYS, canonicalKey) && (widensAtValue === void 0 || widensAtValue(value))) trustAffecting.push({
+			label: shown,
+			reason: CLAUDECODE_TRUST_AFFECTING_KEYS[canonicalKey]
+		});
 		filtered[key] = value;
 	}
-	return filtered;
+	return {
+		filtered,
+		trustAffecting
+	};
 }
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
@@ -30119,15 +31980,12 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			config,
 			logger
 		});
+		const trustAffecting = [];
 		const overridePermissions = config.claudecode?.permissions;
 		if (overridePermissions && typeof overridePermissions === "object") {
 			const { allow: _a, ask: _k, deny: _d, ...rest } = overridePermissions;
 			const nonListFields = Object.fromEntries(Object.entries(rest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
-			warnOnWideningPermissionFields({
-				fields: nonListFields,
-				relativeFilePath: paths.relativeFilePath,
-				logger
-			});
+			trustAffecting.push(...collectWideningPermissionFields({ fields: nonListFields }));
 			settings.permissions = {
 				...settings.permissions,
 				...nonListFields
@@ -30135,25 +31993,22 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
 		if (isPlainRecord(overrideSandbox)) {
-			const executableFreeSandbox = stripCommandExecutingSandboxPaths({
+			const honorableSandbox = stripSandboxPaths({
 				sandbox: overrideSandbox,
+				refusals: [
+					CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL,
+					CLAUDECODE_MANAGED_ONLY_SANDBOX_REFUSAL,
+					...global ? [] : [CLAUDECODE_GLOBAL_ONLY_SANDBOX_REFUSAL]
+				],
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
-			const scopedSandbox = global ? executableFreeSandbox : stripProjectIgnoredMaskEntries({
-				sandbox: stripGlobalOnlySandboxPaths({
-					sandbox: executableFreeSandbox,
-					relativeFilePath: paths.relativeFilePath,
-					logger
-				}),
-				relativeFilePath: paths.relativeFilePath,
-				logger
-			});
-			warnOnTrustAffectingSandboxPaths({
-				sandbox: scopedSandbox,
+			const scopedSandbox = global ? honorableSandbox : stripProjectIgnoredMaskEntries({
+				sandbox: honorableSandbox,
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
+			trustAffecting.push(...collectTrustAffectingSandboxPaths({ sandbox: scopedSandbox }));
 			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
 		const overrideTopLevel = {};
@@ -30163,13 +32018,19 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			if (value === void 0) continue;
 			overrideTopLevel[key] = value;
 		}
-		const scopedTopLevel = stripUnhonoredTopLevelKeys({
+		const { filtered: scopedTopLevel, trustAffecting: trustAffectingTopLevel } = stripUnhonoredTopLevelKeys({
 			overrides: overrideTopLevel,
 			global,
 			relativeFilePath: paths.relativeFilePath,
 			logger
 		});
+		trustAffecting.push(...trustAffectingTopLevel);
 		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
+		warnOnTrustAffectingEntries({
+			entries: trustAffecting,
+			relativeFilePath: paths.relativeFilePath,
+			logger
+		});
 		const managedToolNames = managedClaudeToolNames(config);
 		const merged = applyPermissions({
 			settings,
@@ -35147,11 +37008,8 @@ const TOOL_KEY_TO_CATEGORY = {
 	updateConfluencePage: "edit"
 };
 const MANAGED_TOOL_KEYS = [.../* @__PURE__ */ new Set([...Object.values(CATEGORY_TO_TOOL_KEYS).flat(), ...Object.keys(TOOL_KEY_TO_CATEGORY)])];
-const OWNED_TOOL_PERMISSION_KEYS = [
-	"bash",
-	"allowedExternalPaths",
-	"default"
-];
+const OWNED_TOOL_PERMISSION_KEYS = ["allowedExternalPaths", "default"];
+const MANAGED_BASH_KEYS = ["default", "commands"];
 /**
 * Permissions adapter for Rovo Dev CLI.
 *
@@ -35287,6 +37145,22 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 	}
 };
 /**
+* Report a `toolPermissions.bash.runInSandbox: false` that this generate is
+* about to carry through.
+*
+* The unmanaged `bash` siblings survive untouched, which for this one means a
+* generate is not the reset a user might read it as: every command the agent
+* runs stays outside the sandbox. Rulesync never authors the key and will not
+* start owning it, but a setting that persists on a committed file and loosens
+* containment should not do so without saying anything — least of all on the
+* path where the user just tightened `.rulesync/permissions.*`.
+*/
+function warnAboutPreservedSandboxOptOut({ existingToolPermissions, filePath, logger }) {
+	const existingBash = existingToolPermissions.bash;
+	if (!isRecord$1(existingBash) || existingBash.runInSandbox !== false) return;
+	logger?.warn(`${filePath}: keeping toolPermissions.bash.runInSandbox: false — rulesync does not manage that key, so regenerating does not restore Rovo Dev's sandbox for bash commands.`);
+}
+/**
 * Resolve the `toolPermissions` block to write, merging the generated levels
 * over the existing file. Every other top-level key of `config.yml` is the
 * caller's to preserve; inside this block, keys rulesync manages are owned and
@@ -35294,6 +37168,11 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 */
 function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, filePath, logger }) {
 	const existingToolPermissions = isRecord$1(existing) ? { ...existing } : {};
+	warnAboutPreservedSandboxOptOut({
+		existingToolPermissions,
+		filePath,
+		logger
+	});
 	if (Object.keys(generated).length === 0 && sourceStatesRules) {
 		if (!isRecord$1(existing)) return;
 		const strippedKeys = stripPermissiveOwnedValues(existingToolPermissions);
@@ -35302,9 +37181,12 @@ function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, f
 	}
 	const hasExistingToolsRecord = isRecord$1(existingToolPermissions.tools);
 	const existingTools = hasExistingToolsRecord ? { ...existingToolPermissions.tools } : {};
+	const hasExistingBashRecord = isRecord$1(existingToolPermissions.bash);
+	const existingBash = hasExistingBashRecord ? { ...existingToolPermissions.bash } : {};
 	warnAboutDroppedOwnedKeys({
 		existingToolPermissions,
 		existingTools,
+		existingBash,
 		generated,
 		filePath,
 		logger
@@ -35314,15 +37196,22 @@ function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, f
 		delete existingToolPermissions[toolKey];
 		delete existingTools[toolKey];
 	}
+	for (const bashKey of MANAGED_BASH_KEYS) delete existingBash[bashKey];
 	const tools = {
 		...existingTools,
 		...generated.tools
 	};
+	const bash = {
+		...existingBash,
+		...generated.bash
+	};
 	if (hasExistingToolsRecord) delete existingToolPermissions.tools;
+	if (hasExistingBashRecord) delete existingToolPermissions.bash;
 	return {
 		...existingToolPermissions,
 		...generated,
-		...Object.keys(tools).length > 0 ? { tools } : {}
+		...Object.keys(tools).length > 0 ? { tools } : {},
+		...Object.keys(bash).length > 0 ? { bash } : {}
 	};
 }
 /**
@@ -35331,9 +37220,14 @@ function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, f
 * `/directories` and by an "always allow" answer to a prompt — so their removal
 * must not be silent.
 */
-function warnAboutDroppedOwnedKeys({ existingToolPermissions, existingTools, generated, filePath, logger }) {
+function warnAboutDroppedOwnedKeys({ existingToolPermissions, existingTools, existingBash, generated, filePath, logger }) {
 	const newTools = generated.tools ?? {};
-	const droppedKeys = [...OWNED_TOOL_PERMISSION_KEYS.filter((ownedKey) => existingToolPermissions[ownedKey] !== void 0 && generated[ownedKey] === void 0), ...MANAGED_TOOL_KEYS.filter((toolKey) => existingTools[toolKey] !== void 0 && newTools[toolKey] === void 0).map((toolKey) => `tools.${toolKey}`)];
+	const newBash = generated.bash ?? {};
+	const droppedKeys = [
+		...OWNED_TOOL_PERMISSION_KEYS.filter((ownedKey) => existingToolPermissions[ownedKey] !== void 0 && generated[ownedKey] === void 0),
+		...MANAGED_TOOL_KEYS.filter((toolKey) => existingTools[toolKey] !== void 0 && newTools[toolKey] === void 0).map((toolKey) => `tools.${toolKey}`),
+		...MANAGED_BASH_KEYS.filter((bashKey) => existingBash[bashKey] !== void 0 && newBash[bashKey] === void 0).map((bashKey) => `bash.${bashKey}`)
+	];
 	if (droppedKeys.length > 0) logger?.warn(`Rovo Dev permissions: removing ${droppedKeys.map((key) => `"${key}"`).join(", ")} from ${filePath} because the rulesync source no longer produces them.`);
 }
 /**
@@ -37441,10 +39335,10 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 var PermissionsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -37454,9 +39348,17 @@ var PermissionsProcessor = class extends FeatureProcessor {
 		this.global = global;
 	}
 	async loadRulesyncFiles() {
+		const relativePaths = getRulesyncSourceCandidates({ paths: RulesyncPermissions.getSettablePaths() }).map((candidate) => candidate.relativeFilePath);
+		const sourceTree = await pickLastRootWithFile({
+			inputRoots: this.inputRoots,
+			relativePaths,
+			logger: this.logger,
+			artifactName: "The permissions file"
+		}) ?? this.inputRoots[0];
 		try {
 			return [await RulesyncPermissions.fromFile({
-				outputRoot: this.inputRoot,
+				outputRoot: (0, node_path.dirname)(sourceTree),
+				relativeDirPath: (0, node_path.basename)(sourceTree),
 				validate: true
 			})];
 		} catch (error) {
@@ -37604,9 +39506,13 @@ var SimulatedSkill = class extends ToolSkill {
 		const skillDirPath = (0, node_path.join)(outputRoot, actualRelativeDirPath, dirName);
 		const skillFilePath = (0, node_path.join)(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
 		const result = SimulatedSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${skillFilePath}: ${formatError(result.error)}`);
+		warnOnEmptyLoadedDescription({
+			skillFilePath,
+			description: result.data.description
+		});
 		const otherFiles = await this.collectOtherFiles(outputRoot, actualRelativeDirPath, dirName, SKILL_FILE_NAME);
 		return {
 			outputRoot,
@@ -37880,13 +39786,26 @@ var RovodevSkill = class RovodevSkill extends ToolSkill {
 //#region src/types/dir-feature-processor.ts
 var DirFeatureProcessor = class {
 	outputRoot;
-	inputRoot;
+	/**
+	* Ordered, non-empty list of rulesync source-tree directories. Each entry
+	* is a source tree itself — the directory that directly contains
+	* feature subdirectories (`rules/`, `skills/`, …) and single-file
+	* features (`mcp.jsonc`, `hooks.jsonc`, …). Later entries take precedence
+	* when two trees supply the same relative path. Defaults to
+	* `[join(process.cwd(), ".rulesync")]`.
+	*
+	* The singular user-facing alias (`inputRoot` in `rulesync.jsonc` / the
+	* `--input-root` CLI flag / `GenerateOptions.inputRoot`) is deprecated
+	* and collapsed into `[join(inputRoot, ".rulesync")]` before it ever
+	* reaches a processor.
+	*/
+	inputRoots;
 	dryRun;
 	avoidBlockScalars;
 	logger;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), dryRun = false, avoidBlockScalars = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, dryRun = false, avoidBlockScalars = false, logger }) {
 		this.outputRoot = outputRoot;
-		this.inputRoot = inputRoot;
+		this.inputRoots = inputRoots !== void 0 && inputRoots.length > 0 ? [inputRoots[0], ...inputRoots.slice(1)] : [(0, node_path.join)(process.cwd(), RULESYNC_RELATIVE_DIR_PATH)];
 		this.dryRun = dryRun;
 		this.avoidBlockScalars = avoidBlockScalars;
 		this.logger = logger;
@@ -40145,9 +42064,9 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 	* slug is owned by the commands feature: it must not be imported as a
 	* skill nor deleted as an orphan skill.
 	*/
-	static async isDirOwned({ dirName, inputRoot }) {
+	static async isDirOwned({ dirName, inputRoots }) {
 		return !await rulesyncCommandSlugExists({
-			inputRoot,
+			inputRoots,
 			dirName
 		});
 	}
@@ -40197,7 +42116,11 @@ const FactorydroidSkillFrontmatterSchema = zod_mini.z.looseObject({
 	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
 	enabled: zod_mini.z.optional(zod_mini.z.boolean()),
-	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	license: zod_mini.z.optional(zod_mini.z.unknown()),
+	compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+	metadata: zod_mini.z.optional(zod_mini.z.unknown()),
+	version: zod_mini.z.optional(zod_mini.z.unknown())
 });
 /**
 * Represents a Factory Droid skill directory.
@@ -40250,16 +42173,10 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 		};
 	}
 	toRulesyncSkill() {
-		const frontmatter = this.getFrontmatter();
-		const factorydroidBlock = {
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
-			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter.enabled !== void 0 && { enabled: frontmatter.enabled },
-			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] }
-		};
+		const { name, description, ...factorydroidBlock } = this.getFrontmatter();
 		const rulesyncFrontmatter = {
-			name: frontmatter.name,
-			description: frontmatter.description,
+			name,
+			description,
 			targets: ["*"],
 			...Object.keys(factorydroidBlock).length > 0 && { factorydroid: factorydroidBlock }
 		};
@@ -40286,13 +42203,13 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 			rootFrontmatter: rulesyncFrontmatter,
 			section: factorydroidSection
 		});
+		const { name: _sectionName, description: _sectionDescription, ...section } = factorydroidSection ?? {};
 		const factorydroidFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
+			...section,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
-			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
-			...factorydroidSection?.enabled !== void 0 && { enabled: factorydroidSection.enabled },
-			...factorydroidSection?.["allowed-tools"] !== void 0 && { "allowed-tools": factorydroidSection["allowed-tools"] }
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable }
 		};
 		return new FactorydroidSkill({
 			outputRoot,
@@ -40704,7 +42621,10 @@ var JunieSkill = class JunieSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths(_options) {
-		return { relativeDirPath: JUNIE_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: JUNIE_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return JunieSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -41120,7 +43040,7 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 	}
 	static async fromFlatFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		const filePath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
-		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const { frontmatter, body } = parseFrontmatterWithYamlRepair(await readFileContent(filePath), filePath);
 		const result = KimiCodeFlatSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		const fileName = (0, node_path.basename)(relativeFilePath, (0, node_path.extname)(relativeFilePath));
@@ -41130,6 +43050,10 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 			name: result.data.name ?? fileName,
 			description: result.data.description ?? firstBodyLine?.slice(0, 240) ?? "No description provided."
 		};
+		warnOnEmptyLoadedDescription({
+			skillFilePath: filePath,
+			description: normalizedFrontmatter.description
+		});
 		return new KimiCodeSkill({
 			outputRoot,
 			relativeDirPath,
@@ -42133,7 +44057,7 @@ var ReasonixSkill = class ReasonixSkill extends ToolSkill {
 	static async isDirOwned({ outputRoot, relativeDirPath, dirName }) {
 		const skillFilePath = (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
 		try {
-			const { frontmatter } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+			const { frontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath, { quiet: true });
 			return frontmatter["runAs"] !== REASONIX_SUBAGENT_RUN_AS;
 		} catch {
 			return true;
@@ -42502,8 +44426,7 @@ var TaktSkill = class TaktSkill extends ToolSkill {
 		const fullPath = (0, node_path.join)(this.outputRoot, this.relativeDirPath);
 		const resolvedFull = (0, node_path.resolve)(fullPath);
 		const resolvedBase = (0, node_path.resolve)(this.outputRoot);
-		const rel = (0, node_path.relative)(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || node_path.default.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}"`);
+		if (pathEscapesRoot((0, node_path.relative)(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}"`);
 		return fullPath;
 	}
 	getRelativePathFromCwd() {
@@ -42866,9 +44789,9 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 	* slug is owned by the commands feature: it must not be imported as a
 	* skill nor deleted as an orphan skill.
 	*/
-	static async isDirOwned({ dirName, inputRoot }) {
+	static async isDirOwned({ dirName, inputRoots }) {
 		return !await rulesyncCommandSlugExists({
-			inputRoot,
+			inputRoots,
 			dirName
 		});
 	}
@@ -43426,10 +45349,10 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$2, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$2, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			avoidBlockScalars: toolTarget === "cursor",
 			logger
@@ -43467,39 +45390,67 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		return rulesyncSkills;
 	}
 	/**
-	* Implementation of abstract method from DirFeatureProcessor
-	* Load and parse rulesync skill directories from .rulesync/skills/ directory
-	* and also from .rulesync/skills/.curated/ for remote skills.
-	* Local skills take precedence over curated skills with the same name.
+	* Load rulesync skill directories from a single source-tree's `skills/`
+	* (and `skills/.curated/`) subtree. `sourceTree` is the source tree
+	* itself (e.g. `/repo/.rulesync` or `/repo/.rulesync.local`). Intra-tree:
+	* local skills take precedence over curated skills with the same name.
 	*/
-	async loadRulesyncDirs() {
-		const localDirNames = [...await getLocalSkillDirNames(this.inputRoot)];
+	async loadRulesyncDirsForRoot(sourceTree) {
+		const treeParent = (0, node_path.dirname)(sourceTree);
+		const treeName = (0, node_path.basename)(sourceTree);
+		const treeSkillsDirPath = (0, node_path.join)(treeName, SKILLS_FEATURE_SUBDIR);
+		const treeCuratedSkillsDirPath = (0, node_path.join)(treeName, CURATED_SKILLS_FEATURE_SUBDIR);
+		const localDirNames = [...await getLocalSkillDirNames(sourceTree)];
 		const localSkills = await Promise.all(localDirNames.map((dirName) => RulesyncSkill.fromDir({
-			outputRoot: this.inputRoot,
+			outputRoot: treeParent,
+			relativeDirPath: treeSkillsDirPath,
 			dirName,
 			global: this.global
 		})));
-		const localSkillNames = new Set(localDirNames);
-		const curatedDirPath = (0, node_path.join)(this.inputRoot, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
+		const localSkillNamesByIdentity = groupSpellingsByCaseFoldedIdentity(localDirNames);
+		const curatedDirPath = (0, node_path.join)(sourceTree, CURATED_SKILLS_FEATURE_SUBDIR);
 		let curatedSkills = [];
 		if (await directoryExists(curatedDirPath)) {
 			const nonConflicting = (await findFilesByGlobs((0, node_path.join)(curatedDirPath, "*"), { type: "dir" })).map((path) => (0, node_path.basename)(path)).filter((name) => {
-				if (localSkillNames.has(name)) {
-					this.logger.debug(`Skipping curated skill "${name}": local skill takes precedence.`);
-					return false;
-				}
-				return true;
+				const spellings = localSkillNamesByIdentity.get(caseFoldIdentity(name));
+				if (spellings === void 0) return true;
+				if (spellings.includes(name)) this.logger.debug(`Skipping curated skill "${name}": local skill takes precedence.`);
+				else this.logger.warn(formatCuratedCaseCollisionWarning({
+					artifactKind: "skill",
+					entryNoun: "skill",
+					treeDirPath: treeSkillsDirPath,
+					curatedSpelling: name,
+					localSpellings: spellings
+				}));
+				return false;
 			});
-			const curatedRelativeDirPath = RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH;
 			curatedSkills = await Promise.all(nonConflicting.map((dirName) => RulesyncSkill.fromDir({
-				outputRoot: this.inputRoot,
-				relativeDirPath: curatedRelativeDirPath,
+				outputRoot: treeParent,
+				relativeDirPath: treeCuratedSkillsDirPath,
 				dirName,
 				global: this.global
 			})));
 		}
-		const allSkills = [...localSkills, ...curatedSkills];
-		this.logger.debug(`Successfully loaded ${allSkills.length} rulesync skills (${localSkills.length} local, ${curatedSkills.length} curated)`);
+		return [...localSkills, ...curatedSkills];
+	}
+	/**
+	* Implementation of abstract method from DirFeatureProcessor.
+	*
+	* Load and parse rulesync skill directories from every configured input
+	* root's `.rulesync/skills/` tree (each root also honours its own
+	* `.curated/` subdirectory). When two roots supply a skill with the same
+	* directory name, the later root's skill replaces the earlier root's copy
+	* atomically (companion files included) — an overlay always ships a whole
+	* skill directory, never a partial patch.
+	*/
+	async loadRulesyncDirs() {
+		const allSkills = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncDirsForRoot(root))),
+			identity: (skill) => skill.getDirName(),
+			artifactName: "skill",
+			logger: this.logger
+		});
+		this.logger.debug(`Successfully loaded ${allSkills.length} rulesync skills`);
 		return allSkills;
 	}
 	/**
@@ -43515,7 +45466,17 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		}) : [];
 		const configuredRootPaths = new Set(configuredRoots.map((root) => root.relativeDirPath));
 		const roots = [...toolSkillImportRoots(paths), ...configuredRoots];
-		const seenSkillNames = /* @__PURE__ */ new Set();
+		const claimedSkillNames = new ClaimedIdentities();
+		const claimSkillName = ({ skill, relativeDirPath, sourcePath }) => {
+			const skillName = skill.getImportIdentity();
+			const claimed = claimedSkillNames.claim({
+				identity: skillName,
+				source: relativeDirPath
+			});
+			if (claimed === null) return true;
+			if (claimed.spelling !== skillName) this.logger.warn(`Case-insensitive ${this.toolTarget} skill collision: "${claimed.spelling}" and "${skillName}" resolve to the same skill directory. Keeping "${claimed.spelling}" from ${claimed.source === relativeDirPath ? "earlier in the same root" : `the higher-precedence ${claimed.source}`} and ignoring ${sourcePath}, which is not imported.`);
+			return false;
+		};
 		const toolSkills = [];
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
@@ -43531,54 +45492,60 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 					outputRoot: rootOutputRoot,
 					relativeDirPath,
 					dirName,
-					inputRoot: this.inputRoot
+					inputRoots: this.inputRoots
 				})) continue;
 				ownedDirNames.push(dirName);
 			}
 			const directorySkills = (await Promise.all(ownedDirNames.map(async (dirName) => {
+				const sourcePath = (0, node_path.join)(relativeDirPath, dirName);
 				try {
-					return await factory.class.fromDir({
-						outputRoot: rootOutputRoot,
-						relativeDirPath,
-						dirName,
-						global: this.global
-					});
+					return {
+						skill: await factory.class.fromDir({
+							outputRoot: rootOutputRoot,
+							relativeDirPath,
+							dirName,
+							global: this.global
+						}),
+						sourcePath
+					};
 				} catch (error) {
 					if (!isLenientRoot) throw error;
-					this.logger.warn(`Skipping ${(0, node_path.join)(relativeDirPath, dirName)}: ${formatError(error)}`);
+					this.logger.warn(`Skipping ${sourcePath}: ${formatError(error)}`);
 					return null;
 				}
-			}))).filter((skill) => skill !== null);
-			for (const skill of directorySkills) {
-				const skillName = skill.getImportIdentity();
-				if (seenSkillNames.has(skillName)) continue;
-				seenSkillNames.add(skillName);
-				toolSkills.push(skill);
-			}
+			}))).filter((loaded) => loaded !== null);
+			for (const { skill, sourcePath } of directorySkills) if (claimSkillName({
+				skill,
+				relativeDirPath,
+				sourcePath
+			})) toolSkills.push(skill);
 			if (!factory.class.fromFlatFile) continue;
 			const fromFlatFile = factory.class.fromFlatFile;
 			const directoryStems = new Set(ownedDirNames);
 			const flatFilePaths = (await findFilesByGlobs((0, node_path.join)(skillsDirPath, "*.md"), { type: "file" })).filter((filePath) => !directoryStems.has((0, node_path.basename)(filePath, ".md")));
 			const flatSkills = (await Promise.all(flatFilePaths.map(async (filePath) => {
+				const sourcePath = (0, node_path.join)(relativeDirPath, (0, node_path.basename)(filePath));
 				try {
-					return await fromFlatFile({
-						outputRoot: rootOutputRoot,
-						relativeDirPath,
-						relativeFilePath: (0, node_path.basename)(filePath),
-						global: this.global
-					});
+					return {
+						skill: await fromFlatFile({
+							outputRoot: rootOutputRoot,
+							relativeDirPath,
+							relativeFilePath: (0, node_path.basename)(filePath),
+							global: this.global
+						}),
+						sourcePath
+					};
 				} catch (error) {
 					if (!isLenientRoot) throw error;
-					this.logger.warn(`Skipping ${(0, node_path.join)(relativeDirPath, (0, node_path.basename)(filePath))}: ${formatError(error)}`);
+					this.logger.warn(`Skipping ${sourcePath}: ${formatError(error)}`);
 					return null;
 				}
-			}))).filter((skill) => skill !== null);
-			for (const skill of flatSkills) {
-				const skillName = skill.getImportIdentity();
-				if (seenSkillNames.has(skillName)) continue;
-				seenSkillNames.add(skillName);
-				toolSkills.push(skill);
-			}
+			}))).filter((loaded) => loaded !== null);
+			for (const { skill, sourcePath } of flatSkills) if (claimSkillName({
+				skill,
+				relativeDirPath,
+				sourcePath
+			})) toolSkills.push(skill);
 		}
 		this.logger.debug(`Successfully loaded ${toolSkills.length} skills from ${roots.length} root(s)`);
 		return toolSkills;
@@ -43608,7 +45575,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 					outputRoot: this.outputRoot,
 					relativeDirPath: root,
 					dirName,
-					inputRoot: this.inputRoot
+					inputRoots: this.inputRoots
 				})) continue;
 				const toolSkill = factory.class.forDeletion({
 					outputRoot: this.outputRoot,
@@ -46366,6 +48333,7 @@ const JunieSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	disallowedTools: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
 	mcpServers: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
 	model: zod_mini.z.optional(zod_mini.z.string()),
+	permissionMode: zod_mini.z.optional(zod_mini.z.string()),
 	reasoningLevel: zod_mini.z.optional(zod_mini.z.string()),
 	maxTurns: zod_mini.z.optional(zod_mini.z.number()),
 	skills: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
@@ -47425,7 +49393,7 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
-		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(fileContent, filePath);
 		const result = ReasonixSubagentFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		return new ReasonixSubagent({
@@ -47454,7 +49422,7 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 	static async isFileOwned({ outputRoot, relativeDirPath, relativeFilePath }) {
 		const filePath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
 		try {
-			const { frontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
+			const { frontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(filePath), filePath, { quiet: true });
 			return frontmatter["runAs"] === REASONIX_SUBAGENT_RUN_AS;
 		} catch {
 			return false;
@@ -48346,14 +50314,25 @@ const subagentsProcessorToolTargetsSimulated = allToolTargetKeys$1.filter((targe
 const subagentsProcessorToolTargetsGlobal = allToolTargetKeys$1.filter((target) => {
 	return toolSubagentFactories.get(target)?.meta.supportsGlobal ?? false;
 });
+/**
+* Stands in for a discovery root when a subagent came from a tool's own config
+* file rather than a directory (see `loadAdditionalImportFiles`). The angle
+* brackets keep it from ever matching a real relative directory path.
+*/
+const INLINE_SOURCE = "<inline>";
+/**
+* The single "root" of the post-conversion output guard, which de-duplicates
+* `.rulesync/subagents/` paths rather than discovery roots.
+*/
+const OUTPUT_SOURCE = "<output>";
 var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -48399,24 +50378,31 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			rulesyncSubagents.push(toolSubagent.toRulesyncSubagent());
 		}
 		const uniqueRulesyncSubagents = [];
-		const seenOutputPaths = /* @__PURE__ */ new Set();
+		const claimedOutputPaths = new ClaimedIdentities();
 		for (const rulesyncSubagent of rulesyncSubagents) {
 			const outputPath = (0, node_path.join)(rulesyncSubagent.getRelativeDirPath(), rulesyncSubagent.getRelativeFilePath());
-			if (seenOutputPaths.has(outputPath)) {
-				this.logger.warn(`Multiple ${this.toolTarget} subagents resolve to "${outputPath}"; keeping the first and ignoring this copy.`);
+			const claimed = claimedOutputPaths.claim({
+				identity: outputPath,
+				source: OUTPUT_SOURCE
+			});
+			if (claimed !== null) {
+				this.logger.warn(claimed.spelling === outputPath ? `Multiple ${this.toolTarget} subagents resolve to "${outputPath}"; keeping the first and ignoring this copy.` : `${this.toolTarget} subagent "${outputPath}" differs only in case from "${claimed.spelling}", which is the same file on a case-insensitive filesystem; keeping the first and ignoring this copy.`);
 				continue;
 			}
-			seenOutputPaths.add(outputPath);
 			uniqueRulesyncSubagents.push(rulesyncSubagent);
 		}
 		return uniqueRulesyncSubagents;
 	}
 	/**
-	* Implementation of abstract method from Processor
-	* Load and parse rulesync subagent files from .rulesync/subagents/ directory
+	* Load subagent files from a single source-tree's `subagents/` subtree.
+	* `sourceTree` is the source tree itself (e.g. `/repo/.rulesync` or
+	* `/repo/.rulesync.local`).
 	*/
-	async loadRulesyncFiles() {
-		const subagentsDir = (0, node_path.join)(this.inputRoot, RulesyncSubagent.getSettablePaths().relativeDirPath);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = (0, node_path.dirname)(sourceTree);
+		const treeName = (0, node_path.basename)(sourceTree);
+		const treeSubagentsDirPath = (0, node_path.join)(treeName, SUBAGENTS_FEATURE_SUBDIR);
+		const subagentsDir = (0, node_path.join)(sourceTree, SUBAGENTS_FEATURE_SUBDIR);
 		if (!await directoryExists(subagentsDir)) {
 			this.logger.debug(`Rulesync subagents directory not found: ${subagentsDir}`);
 			return [];
@@ -48432,7 +50418,8 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			const filepath = (0, node_path.join)(subagentsDir, mdFile);
 			try {
 				const rulesyncSubagent = await RulesyncSubagent.fromFile({
-					outputRoot: this.inputRoot,
+					outputRoot: treeParent,
+					relativeDirPath: treeSubagentsDirPath,
 					relativeFilePath: mdFile,
 					validate: true
 				});
@@ -48443,8 +50430,24 @@ var SubagentsProcessor = class extends FeatureProcessor {
 				continue;
 			}
 		}
+		return rulesyncSubagents;
+	}
+	/**
+	* Implementation of abstract method from Processor
+	* Load and parse rulesync subagent files from every configured input root's
+	* `.rulesync/subagents/` directory, merging by relative file path so a
+	* subagent with the same target path from a later root replaces the
+	* earlier root's copy.
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncSubagents = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (subagent) => subagent.getRelativeFilePath(),
+			artifactName: "subagent",
+			logger: this.logger
+		});
 		if (rulesyncSubagents.length === 0) {
-			this.logger.debug(`No valid subagents found in ${subagentsDir}`);
+			this.logger.debug(`No valid subagents found`);
 			return [];
 		}
 		this.logger.debug(`Successfully loaded ${rulesyncSubagents.length} rulesync subagents`);
@@ -48459,7 +50462,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		const paths = factory.class.getSettablePaths({ global: this.global });
 		const roots = forDeletion ? [paths.relativeDirPath] : [paths.relativeDirPath, ...paths.importDirPaths ?? []];
 		const toolSubagents = [];
-		const seenRelativeFilePaths = /* @__PURE__ */ new Set();
+		const claimedRelativeFilePaths = new ClaimedIdentities();
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
 			const dirPath = typeof root === "string" ? root : root.relativeDirPath;
@@ -48498,37 +50501,77 @@ var SubagentsProcessor = class extends FeatureProcessor {
 				relativeFilePath: toRelativeFilePath(path),
 				global: this.global
 			})));
-			const deduped = [];
-			for (const subagent of loaded) {
-				const key = subagent.getImportIdentity();
-				if (seenRelativeFilePaths.has(key)) {
-					this.logger.warn(`Duplicate ${this.toolTarget} subagent "${key}" found in ${dirPath}; keeping the one from a higher-precedence directory and ignoring this copy.`);
-					continue;
-				}
-				seenRelativeFilePaths.add(key);
-				deduped.push(subagent);
-			}
-			toolSubagents.push(...deduped);
+			toolSubagents.push(...this.claimStandaloneSubagents({
+				loaded,
+				dirPath,
+				claimedRelativeFilePaths
+			}));
 		}
 		if (!forDeletion && factory.class.loadAdditionalImportFiles) {
 			const additionalSubagents = await factory.class.loadAdditionalImportFiles({
 				outputRoot: this.outputRoot,
 				global: this.global
 			});
-			for (const subagent of additionalSubagents) {
-				const key = subagent.getImportIdentity();
-				if (seenRelativeFilePaths.has(key)) {
-					this.logger.warn(`Duplicate ${this.toolTarget} subagent "${key}" defined inline; keeping the standalone file and ignoring the inline copy.`);
-					continue;
-				}
-				seenRelativeFilePaths.add(key);
-				toolSubagents.push(subagent);
-			}
+			toolSubagents.push(...this.claimInlineSubagents({
+				additionalSubagents,
+				claimedRelativeFilePaths
+			}));
 		}
 		this.logger.debug(`Successfully loaded ${toolSubagents.length} ${this.toolTarget} subagents from ${roots.length} root(s)`);
 		return toolSubagents;
 	}
 	/**
+	* Keeps the subagents from one discovery root whose import identity is still
+	* unclaimed, warning about each copy that loses. Split out of
+	* `loadToolFiles` so the two de-duplication passes stay readable side by
+	* side (and so that method stays within the linter's complexity budget).
+	*
+	* When more than one discovery root is scanned (e.g. Junie's `.junie/agents/`
+	* plus `.agents/`), two roots can hold a subagent with the same relative
+	* path. Downstream conversion keys by that path, so a later one would
+	* silently overwrite an earlier one. Warn instead of failing, keeping the
+	* earlier (higher-precedence) root's file.
+	*/
+	claimStandaloneSubagents({ loaded, dirPath, claimedRelativeFilePaths }) {
+		const deduped = [];
+		for (const subagent of loaded) {
+			const key = subagent.getImportIdentity();
+			const claimed = claimedRelativeFilePaths.claim({
+				identity: key,
+				source: dirPath
+			});
+			if (claimed === null) {
+				deduped.push(subagent);
+				continue;
+			}
+			const keptFrom = claimed.source === dirPath ? `the earlier one in ${dirPath}` : `the one from the higher-precedence ${claimed.source}`;
+			this.logger.warn(claimed.spelling === key ? `Duplicate ${this.toolTarget} subagent "${key}" found in ${dirPath}; keeping ${keptFrom} and ignoring this copy.` : `Duplicate ${this.toolTarget} subagent "${key}" found in ${dirPath} differs only in case from "${claimed.spelling}"; keeping ${keptFrom} and ignoring this copy.`);
+		}
+		return deduped;
+	}
+	/**
+	* The same claim-or-warn pass for subagents defined inline in a tool's own
+	* config file (see `loadAdditionalImportFiles`), which are scanned after
+	* every standalone file so a Markdown file of the same name wins.
+	*/
+	claimInlineSubagents({ additionalSubagents, claimedRelativeFilePaths }) {
+		const deduped = [];
+		for (const subagent of additionalSubagents) {
+			const key = subagent.getImportIdentity();
+			const claimed = claimedRelativeFilePaths.claim({
+				identity: key,
+				source: INLINE_SOURCE
+			});
+			if (claimed === null) {
+				deduped.push(subagent);
+				continue;
+			}
+			const kept = claimed.source === INLINE_SOURCE ? "the earlier inline definition" : `the standalone file in ${claimed.source}`;
+			this.logger.warn(claimed.spelling === key ? `Duplicate ${this.toolTarget} subagent "${key}" defined inline; keeping ${kept} and ignoring the inline copy.` : `Inline ${this.toolTarget} subagent "${key}" differs only in case from "${claimed.spelling}"; keeping ${kept} and ignoring the inline copy.`);
+		}
+		return deduped;
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Return the tool targets that this processor supports
 	*/
@@ -51458,17 +53501,32 @@ var HermesagentRule = class HermesagentRule extends ToolRule {
 * Rule generator for JetBrains Junie AI coding agent
 *
 * Generates `.junie/AGENTS.md` files based on rulesync rule content. Junie CLI
-* resolves project guidelines **first-match-wins**: `.junie/AGENTS.md` → root
-* `AGENTS.md` → legacy `.junie/guidelines.md` / `.junie/guidelines/`. Only the
-* first match is loaded, it documents no `@`-reference or file-inclusion
-* mechanism, and no `.junie/memories/` read path exists — so non-root rules
-* are folded into the single root `.junie/AGENTS.md` by the RulesProcessor
-* (`nonRoot` is `undefined`, mirroring the warp / deepagents
-* targets; decision recorded in issue #2211). The legacy
+* resolves project guidelines in this order: `.junie/AGENTS.md` → root
+* `AGENTS.md` **combined with `.junie/playbook.md` and every
+* `.junie/rules/*.md`** → legacy `.junie/guidelines.md` / `.junie/guidelines/`.
+* The multi-file branch exists, but it is unreachable while `.junie/AGENTS.md`
+* is present: that file "is used exclusively and no other guidelines files are
+* combined with it". So emitting `.junie/rules/*.md` next to the root file
+* rulesync writes would produce files Junie never reads, and moving the root
+* output to project-root `AGENTS.md` would both change every existing output
+* path and collide with the `agentsmd` target. Non-root rules therefore stay
+* folded into the single root `.junie/AGENTS.md` by the RulesProcessor
+* (`nonRoot` is `undefined`, mirroring the warp / deepagents targets) — the
+* fold is lossless, since Junie loads that one file in full. The original
+* rationale for this shape was recorded in issue #2211 and re-confirmed
+* against the 2026-08-21 docs revision in issue #2728. The legacy
 * `.junie/guidelines.md` is still accepted as an import fallback, but
 * generation always targets `.junie/AGENTS.md`. Junie uses plain markdown
 * without frontmatter requirements.
 *
+* The multi-file branch is still read on **import**, though: a repo that
+* authors `.junie/rules/*.md` or `.junie/playbook.md` by hand — the live
+* layout whenever `.junie/AGENTS.md` is absent, which is exactly the state a
+* first `rulesync import` finds — declares those paths as `importOnlyRoots`
+* and imports them as non-root rules. They are never written back there:
+* generating `.junie/AGENTS.md` moves Junie onto the first branch, where the
+* folded root file carries the same content.
+*
 * Global (user) scope writes a single `~/.junie/AGENTS.md` file. Junie merges
 * these user-scope guidelines with the project guidelines (both are included
 * and marked clearly).
@@ -51490,6 +53548,14 @@ var JunieRule = class JunieRule extends ToolRule {
 			alternativeRoots: [{
 				relativeDirPath: buildToolPath(JUNIE_DIR, ".", excludeToolDir),
 				relativeFilePath: JUNIE_LEGACY_RULE_FILE_NAME
+			}],
+			importOnlyRoots: [{
+				relativeDirPath: buildToolPath(JUNIE_DIR, JUNIE_RULES_DIR_NAME, excludeToolDir),
+				onlyWhenRootAbsent: true
+			}, {
+				relativeDirPath: buildToolPath(JUNIE_DIR, ".", excludeToolDir),
+				relativeFilePath: JUNIE_PLAYBOOK_FILE_NAME,
+				onlyWhenRootAbsent: true
 			}]
 		};
 	}
@@ -51500,7 +53566,7 @@ var JunieRule = class JunieRule extends ToolRule {
 	static isRootRelativeFilePath(relativeFilePath) {
 		return relativeFilePath === "AGENTS.md" || relativeFilePath === "guidelines.md";
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath: relativeDirPathParam, relativeFilePath, validate = true, global = false }) {
 		if (global) {
 			const paths = this.getSettablePaths({ global: true });
 			if (!("root" in paths) || !paths.root) throw new Error("JunieRule global settable paths must include a root path");
@@ -51514,7 +53580,8 @@ var JunieRule = class JunieRule extends ToolRule {
 				root: true
 			});
 		}
-		const relativeDirPath = this.getSettablePaths().root.relativeDirPath;
+		const settablePaths = this.getSettablePaths();
+		const relativeDirPath = relativeDirPathParam ?? settablePaths.root.relativeDirPath;
 		const relativePath = (0, node_path.join)(relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
 		return new JunieRule({
@@ -51523,7 +53590,7 @@ var JunieRule = class JunieRule extends ToolRule {
 			relativeFilePath,
 			fileContent,
 			validate,
-			root: JunieRule.isRootRelativeFilePath(relativeFilePath)
+			root: relativeDirPath === settablePaths.root.relativeDirPath && JunieRule.isRootRelativeFilePath(relativeFilePath)
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
@@ -53875,10 +55942,23 @@ const defaultGetFactory = (target) => {
 	if (!factory) throw new Error(`Unsupported tool target: ${target}`);
 	return factory;
 };
-const findFilesWithFallback = async (primaryGlob, alternativeRoots, buildAltGlob) => {
-	const primaryFilePaths = await findFilesByGlobs(primaryGlob);
+/**
+* How many skipped import-only paths a single warning names before it
+* summarizes the rest. Keeps one line readable when a rules directory holds
+* dozens of files.
+*/
+const MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS = 10;
+/**
+* Fall back to a tool's legacy roots when its primary root file is absent.
+*
+* The primary hits are passed in rather than globbed here, so that callers
+* which need "the root file Rulesync generates" — rather than "whatever root
+* the tool will read" — can keep the two apart. A legacy root is a file
+* Rulesync reads but never writes, and the difference matters to them.
+*/
+const findFilesWithFallback = async (primaryFilePaths, alternativeRoots, buildAltGlob) => {
 	if (primaryFilePaths.length > 0) return primaryFilePaths;
-	if (alternativeRoots) return findFilesByGlobs(alternativeRoots.map(buildAltGlob));
+	if (alternativeRoots) return await findFilesByGlobs(alternativeRoots.map(buildAltGlob));
 	return [];
 };
 var RulesProcessor = class extends FeatureProcessor {
@@ -53890,10 +55970,10 @@ var RulesProcessor = class extends FeatureProcessor {
 	getFactory;
 	skills;
 	featureOptions;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, simulateCommands = false, simulateSubagents = false, simulateSkills = false, global = false, getFactory = defaultGetFactory, skills, featureOptions, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, simulateCommands = false, simulateSubagents = false, simulateSkills = false, global = false, getFactory = defaultGetFactory, skills, featureOptions, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -54268,25 +56348,45 @@ As this project's AI coding tool, you must follow the additional conventions bel
 				claimedBy.set(target.toLowerCase(), source);
 				continue;
 			}
-			this.logger.warn(`Both ${previous} and ${source} import to ${(0, node_path.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, target)} (compared case-insensitively, as on macOS and Windows); the last one wins wherever they collide.`);
+			this.logger.warn(`Both ${stripControlCharacters(previous)} and ${stripControlCharacters(source)} import to ${stripControlCharacters((0, node_path.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, target))} (compared case-insensitively, as on macOS and Windows); the last one wins wherever they collide.`);
 		}
 		return rulesyncRules;
 	}
 	/**
-	* Implementation of abstract method from FeatureProcessor
-	* Load and parse rulesync rule files from .rulesync/rules/ directory
+	* Load rulesync rule files from a single source-tree's `rules/` (and
+	* `rules/.curated/`) subtree. `sourceTree` is the source tree itself
+	* (e.g. `/repo/.rulesync` or `/repo/.rulesync.local`), NOT its parent.
+	*
+	* Intra-tree behavior — the local-wins-over-curated rule and the
+	* case-insensitive collision handling — is preserved from the previous
+	* single-root implementation. See `loadRulesyncFiles` for how the
+	* per-root results are combined into the effective set.
 	*/
-	async loadRulesyncFiles() {
-		const rulesyncOutputRoot = (0, node_path.join)(this.inputRoot, RULESYNC_RULES_RELATIVE_DIR_PATH);
-		const curatedOutputRoot = (0, node_path.join)(this.inputRoot, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = (0, node_path.dirname)(sourceTree);
+		const treeName = (0, node_path.basename)(sourceTree);
+		const treeRulesDirPath = (0, node_path.join)(treeName, RULES_FEATURE_SUBDIR);
+		const rulesyncOutputRoot = (0, node_path.join)(sourceTree, RULES_FEATURE_SUBDIR);
+		const curatedOutputRoot = (0, node_path.join)(sourceTree, CURATED_RULES_FEATURE_SUBDIR);
 		const [discoveredFiles, discoveredCuratedFiles] = await Promise.all([findFilesByGlobs((0, node_path.join)(rulesyncOutputRoot, "**", "*.md")), findFilesByGlobs((0, node_path.join)(curatedOutputRoot, "**", "*.md"))]);
 		const files = [.../* @__PURE__ */ new Set([...discoveredFiles, ...discoveredCuratedFiles])];
 		const localFiles = files.filter((file) => !(0, node_path.relative)(rulesyncOutputRoot, file).startsWith(`.curated${node_path.sep}`));
-		const localRelativePaths = new Set(localFiles.map((file) => (0, node_path.relative)(rulesyncOutputRoot, file)));
+		const localRelativePathsByIdentity = groupSpellingsByCaseFoldedIdentity(localFiles.map((file) => (0, node_path.relative)(rulesyncOutputRoot, file)));
 		const curatedFiles = files.filter((file) => (0, node_path.relative)(rulesyncOutputRoot, file).startsWith(`.curated${node_path.sep}`)).map((file) => ({
 			file,
 			relativeFilePath: (0, node_path.relative)(curatedOutputRoot, file)
-		})).filter(({ relativeFilePath }) => !localRelativePaths.has(relativeFilePath));
+		})).filter(({ relativeFilePath }) => {
+			const spellings = localRelativePathsByIdentity.get(caseFoldIdentity(relativeFilePath));
+			if (spellings === void 0) return true;
+			if (!spellings.includes(relativeFilePath)) this.logger.warn(formatCuratedCaseCollisionWarning({
+				artifactKind: "rule",
+				entryNoun: "file",
+				treeDirPath: treeRulesDirPath,
+				curatedSpelling: (0, node_path.join)(".curated", relativeFilePath),
+				localSpellings: spellings
+			}));
+			return false;
+		});
 		const selectedFiles = [...localFiles.map((file) => ({
 			file,
 			sourceRelativeFilePath: (0, node_path.relative)(rulesyncOutputRoot, file),
@@ -54296,25 +56396,41 @@ As this project's AI coding tool, you must follow the additional conventions bel
 			sourceRelativeFilePath: (0, node_path.join)(".curated", relativeFilePath),
 			relativeFilePath
 		}))];
-		this.logger.debug(`Found ${selectedFiles.length} rulesync files`);
-		const rulesyncRules = await Promise.all(selectedFiles.map(async ({ sourceRelativeFilePath, relativeFilePath }) => {
+		this.logger.debug(`Found ${selectedFiles.length} rulesync files under ${rulesyncOutputRoot}`);
+		return await Promise.all(selectedFiles.map(async ({ sourceRelativeFilePath, relativeFilePath }) => {
 			checkPathTraversal({
 				relativePath: sourceRelativeFilePath,
 				intendedRootDir: rulesyncOutputRoot
 			});
 			const rule = await RulesyncRule.fromFile({
-				outputRoot: this.inputRoot,
+				outputRoot: treeParent,
+				relativeDirPath: treeRulesDirPath,
 				relativeFilePath: sourceRelativeFilePath
 			});
 			if (sourceRelativeFilePath === relativeFilePath) return rule;
 			return new RulesyncRule({
-				outputRoot: this.inputRoot,
-				relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+				outputRoot: treeParent,
+				relativeDirPath: treeRulesDirPath,
 				relativeFilePath,
 				frontmatter: rule.getFrontmatter(),
 				body: rule.getBody()
 			});
 		}));
+	}
+	/**
+	* Implementation of abstract method from FeatureProcessor
+	* Load and parse rulesync rule files from every configured input root's
+	* `.rulesync/rules/` directory, merging by relative path so that a rule
+	* with the same target path from a later root replaces the earlier root's
+	* copy (case-insensitive, matching the intra-root collision handling).
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncRules = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (rule) => rule.getRelativeFilePath(),
+			artifactName: "rule",
+			logger: this.logger
+		});
 		const factory = this.getFactory(this.toolTarget);
 		const targetedRootRules = rulesyncRules.filter((rule) => rule.getFrontmatter().root).filter((rule) => factory.class.isTargetedByRulesyncRule(rule));
 		if (targetedRootRules.length === 0 && rulesyncRules.length > 0) this.logger.warn(`No root rulesync rule file found for target '${this.toolTarget}'. Consider adding 'root: true' to one of your rule files in ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
@@ -54408,23 +56524,42 @@ As this project's AI coding tool, you must follow the additional conventions bel
 					});
 				}).filter((rule) => rule.isDeletable());
 			};
+			/**
+			* Import counterpart of {@link buildDeletionRulesFromPaths} for the
+			* root-shaped scans (root, legacy roots, and read-only roots), whose
+			* paths all sit at a directory Rulesync resolves from the file itself.
+			*/
+			const buildImportRulesFromPaths = (filePaths) => Promise.all(filePaths.map((filePath) => {
+				const relativeDirPath = resolveRelativeDirPath(filePath);
+				checkPathTraversal({
+					relativePath: relativeDirPath,
+					intendedRootDir: this.outputRoot
+				});
+				return factory.class.fromFile({
+					outputRoot: this.outputRoot,
+					relativeDirPath,
+					relativeFilePath: (0, node_path.basename)(filePath),
+					global: this.global
+				});
+			}));
+			/**
+			* The tool's own root file, as opposed to whichever root
+			* `rootToolRules` ends up resolving. A legacy root reached through
+			* `alternativeRoots` is deliberately not counted here: it is a
+			* hand-authored file Rulesync never writes, so it has folded nothing in,
+			* and in Junie's resolution order it ranks *below* the multi-file layout
+			* that `importOnlyRoots` describes. Gating those roots on it would drop
+			* exactly the files the tool is really reading.
+			*
+			* Resolved once, up front, so the two blocks that need it do not depend
+			* on each other's evaluation order.
+			*/
+			const primaryRootFilePaths = settablePaths.root ? await findFilesByGlobs((0, node_path.join)(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", settablePaths.root.relativeFilePath)) : [];
 			const rootToolRules = await (async () => {
 				if (!settablePaths.root) return [];
-				const uniqueRootFilePaths = await findFilesWithFallback((0, node_path.join)(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", settablePaths.root.relativeFilePath), settablePaths.alternativeRoots, (alt) => (0, node_path.join)(this.outputRoot, alt.relativeDirPath, alt.relativeFilePath));
+				const uniqueRootFilePaths = await findFilesWithFallback(primaryRootFilePaths, settablePaths.alternativeRoots, (alt) => (0, node_path.join)(this.outputRoot, alt.relativeDirPath, alt.relativeFilePath));
 				if (forDeletion) return buildDeletionRulesFromPaths(uniqueRootFilePaths);
-				return await Promise.all(uniqueRootFilePaths.map((filePath) => {
-					const relativeDirPath = resolveRelativeDirPath(filePath);
-					checkPathTraversal({
-						relativePath: relativeDirPath,
-						intendedRootDir: this.outputRoot
-					});
-					return factory.class.fromFile({
-						outputRoot: this.outputRoot,
-						relativeFilePath: (0, node_path.basename)(filePath),
-						relativeDirPath,
-						global: this.global
-					});
-				}));
+				return await buildImportRulesFromPaths(uniqueRootFilePaths);
 			})();
 			this.logger.debug(`Found ${rootToolRules.length} root tool rule files`);
 			const localRootToolRules = await (async () => {
@@ -54436,7 +56571,7 @@ As this project's AI coding tool, you must follow the additional conventions bel
 						fileName
 					}));
 					if (!settablePaths.root) return [];
-					return await findFilesWithFallback((0, node_path.join)(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", fileName), settablePaths.alternativeRoots, (alt) => (0, node_path.join)(this.outputRoot, alt.relativeDirPath, fileName));
+					return await findFilesWithFallback(await findFilesByGlobs((0, node_path.join)(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", fileName)), settablePaths.alternativeRoots, (alt) => (0, node_path.join)(this.outputRoot, alt.relativeDirPath, fileName));
 				})();
 				if (forDeletion) return buildDeletionRulesFromPaths(filePaths);
 				return (await Promise.all(filePaths.map(async (filePath) => {
@@ -54512,6 +56647,29 @@ As this project's AI coding tool, you must follow the additional conventions bel
 				}));
 			})();
 			this.logger.debug(`Found ${nestedToolRules.length} nested tool rule files`);
+			const importOnlyToolRules = await (async () => {
+				const importOnlyRoots = "importOnlyRoots" in settablePaths ? settablePaths.importOnlyRoots : void 0;
+				if (forDeletion || !importOnlyRoots || importOnlyRoots.length === 0) return [];
+				const rootFilePath = primaryRootFilePaths[0];
+				const scannedPaths = [];
+				const skippedPaths = [];
+				for (const importOnlyRoot of importOnlyRoots) {
+					const matchedPaths = await findFilesByGlobs((0, node_path.join)(this.outputRoot, importOnlyRoot.relativeDirPath, importOnlyRoot.relativeFilePath ?? `*.${factory.meta.extension}`), { type: "file" });
+					if (importOnlyRoot.onlyWhenRootAbsent === true && rootFilePath !== void 0) {
+						skippedPaths.push(...matchedPaths);
+						continue;
+					}
+					scannedPaths.push(...matchedPaths);
+				}
+				if (skippedPaths.length > 0 && rootFilePath !== void 0) {
+					const skippedNames = skippedPaths.map((filePath) => stripControlCharacters((0, node_path.relative)(this.outputRoot, filePath)));
+					const listedNames = skippedNames.slice(0, MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS);
+					const remainingCount = skippedNames.length - listedNames.length;
+					this.logger.warn(`Not importing ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} for ${this.toolTarget}: ${stripControlCharacters((0, node_path.relative)(this.outputRoot, rootFilePath))} exists, and the tool reads that file exclusively. Delete them once you have checked that content is in the root file, or move it into ${RULESYNC_RULES_RELATIVE_DIR_PATH} if it is not.`);
+				}
+				return await buildImportRulesFromPaths(scannedPaths);
+			})();
+			this.logger.debug(`Found ${importOnlyToolRules.length} import-only tool rule files`);
 			const nonRootToolRules = await (async () => {
 				if (!settablePaths.nonRoot) return [];
 				const nonRootOutputRoot = (0, node_path.join)(this.outputRoot, settablePaths.nonRoot.relativeDirPath);
@@ -54544,6 +56702,7 @@ As this project's AI coding tool, you must follow the additional conventions bel
 			})();
 			this.logger.debug(`Found ${nonRootToolRules.length} non-root tool rule files`);
 			return [
+				...importOnlyToolRules,
 				...rootToolRules,
 				...localRootToolRules,
 				...rootMirrorDeletionRules,
@@ -54657,6 +56816,7 @@ function resolveToolOutputRoot({ outputRoot, toolTarget, global }) {
 * `.rulesync/` files to disk. Rulesync file instances live in memory only.
 */
 async function convertFromTool(params) {
+	resetWarnedOnceMessages();
 	const packagingTarget = [params.fromTool, ...params.toTools].find(isPackagingToolTarget);
 	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import and generate with explicit plugin directories.`);
 	const ctx = params;
@@ -55351,14 +57511,53 @@ function warnUnsupportedTargets(params) {
 	}
 }
 /**
-* Check if .rulesync directory exists.
-*
-* The `.rulesync/` directory lives under the *input* root (where source rules
-* are read from), not under any individual output root, so callers always pass
-* `config.getInputRoot()` here.
+* Inspect every configured input-root path. The first entry is the required
+* base source tree; later entries are optional overlays and may be absent.
+* Each existing entry is a rulesync source tree itself (the directory that
+* directly holds `rules/`, `skills/`, `mcp.jsonc`, etc.). Existing empty
+* directories are valid because delete and check workflows still need to
+* inspect generated outputs.
 */
-async function checkRulesyncDirExists(params) {
-	return fileExists((0, node_path.join)(params.inputRoot, RULESYNC_RELATIVE_DIR_PATH));
+async function inspectInputRoots(inputRoots) {
+	const existing = [];
+	const missing = [];
+	const invalidOverlays = [];
+	const nonDirectories = /* @__PURE__ */ new Set();
+	for (const [index, root] of inputRoots.entries()) if (await directoryExists(root)) existing.push(root);
+	else {
+		missing.push(root);
+		if (await fileExists(root)) {
+			nonDirectories.add(root);
+			if (index > 0) invalidOverlays.push(root);
+		}
+	}
+	const primaryRoot = inputRoots[0];
+	const displayPrimaryRoot = stripControlCharacters(primaryRoot ?? "");
+	if (primaryRoot === void 0 || existing.includes(primaryRoot)) {
+		const invalidOverlay = invalidOverlays[0];
+		return {
+			existing,
+			missing,
+			message: invalidOverlay === void 0 ? void 0 : `Configured optional input root '${stripControlCharacters(invalidOverlay)}' exists but is not a directory.`
+		};
+	}
+	const defaultRoot = (0, node_path.join)(process.cwd(), RULESYNC_RELATIVE_DIR_PATH);
+	if (primaryRoot === defaultRoot && !nonDirectories.has(primaryRoot)) return {
+		existing,
+		missing,
+		message: `Rulesync source directory '${defaultRoot}' does not exist. Run 'rulesync init' first.`
+	};
+	const settingHint = `your input root setting ('inputRoots', or the deprecated 'inputRoot')`;
+	if (nonDirectories.has(primaryRoot)) return {
+		existing,
+		missing,
+		message: `Configured primary input root '${displayPrimaryRoot}' exists but is not a directory. Point ${settingHint} at a directory.`
+	};
+	return {
+		existing,
+		missing,
+		message: `Configured primary input root '${displayPrimaryRoot}' does not exist. Create the directory or update ${settingHint}.`
+	};
 }
 function dependsOnReachable(byId, from, target) {
 	const seen = /* @__PURE__ */ new Set();
@@ -55489,7 +57688,7 @@ async function warnSkillSubagentNameCollisions(params) {
 		const subagentsDirPath = subagentFactory.class.getSettablePaths({ global }).relativeDirPath;
 		if (subagentsDirPath !== skillFactory.class.getSettablePaths({ global }).relativeDirPath) continue;
 		const subagentsProcessor = new SubagentsProcessor({
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global,
 			logger
@@ -55497,7 +57696,7 @@ async function warnSkillSubagentNameCollisions(params) {
 		const subagentNames = new Set((await subagentsProcessor.loadRulesyncFiles()).filter((file) => file instanceof RulesyncSubagent).filter((file) => subagentFactory.class.isTargetedByRulesyncSubagent(file)).map((file) => (0, node_path.basename)(file.getRelativeFilePath(), (0, node_path.extname)(file.getRelativeFilePath()))));
 		if (subagentNames.size === 0) continue;
 		const skillNames = (await new SkillsProcessor({
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global,
 			logger
@@ -55546,6 +57745,8 @@ async function collectHermesProjectPluginNames({ config, resultsById }) {
 */
 async function generate(params) {
 	const { config, logger } = params;
+	resetRootShadowingWarnings({ logger });
+	resetWarnedOnceMessages();
 	for (const toolTarget of config.getTargets()) for (const outputRoot of config.getOutputRoots(toolTarget)) await assertPluginRootSafe({
 		toolTarget,
 		outputRoot
@@ -55684,7 +57885,7 @@ async function generateRulesCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			simulateCommands: config.getSimulateCommands(),
@@ -55734,7 +57935,7 @@ async function generateIgnoreCore(params) {
 		for (const outputRoot of config.getOutputRoots(toolTarget)) try {
 			const processor = new IgnoreProcessor({
 				outputRoot,
-				inputRoot: config.getInputRoot(),
+				inputRoots: config.getInputRoots(),
 				toolTarget,
 				global,
 				dryRun: config.isPreviewMode(),
@@ -55781,7 +57982,7 @@ async function generateMcpCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55827,7 +58028,7 @@ async function generateCommandsCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55874,7 +58075,7 @@ async function generateSubagentsCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55921,7 +58122,7 @@ async function generateSkillsCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55966,7 +58167,7 @@ async function generateHooksCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -56008,7 +58209,7 @@ async function generatePermissionsCore(params) {
 					toolTarget,
 					global: config.getGlobal()
 				}),
-				inputRoot: config.getInputRoot(),
+				inputRoots: config.getInputRoots(),
 				toolTarget,
 				global: config.getGlobal(),
 				dryRun: config.isPreviewMode(),
@@ -56054,7 +58255,7 @@ async function generateChecksCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -56105,6 +58306,7 @@ function getToolOutputRoot({ config, tool }) {
 */
 async function importFromTool(params) {
 	const { config, tool, logger } = params;
+	resetWarnedOnceMessages();
 	await assertPluginRootSafe({
 		toolTarget: tool,
 		outputRoot: getToolOutputRoot({
@@ -56918,12 +59120,6 @@ Object.defineProperty(exports, "checkPathTraversal", {
 		return checkPathTraversal;
 	}
 });
-Object.defineProperty(exports, "checkRulesyncDirExists", {
-	enumerable: true,
-	get: function() {
-		return checkRulesyncDirExists;
-	}
-});
 Object.defineProperty(exports, "convertFromTool", {
 	enumerable: true,
 	get: function() {
@@ -57020,6 +59216,12 @@ Object.defineProperty(exports, "importFromTool", {
 		return importFromTool;
 	}
 });
+Object.defineProperty(exports, "inspectInputRoots", {
+	enumerable: true,
+	get: function() {
+		return inspectInputRoots;
+	}
+});
 Object.defineProperty(exports, "isPackagingToolTarget", {
 	enumerable: true,
 	get: function() {
@@ -57044,12 +59246,24 @@ Object.defineProperty(exports, "loadYaml", {
 		return loadYaml;
 	}
 });
+Object.defineProperty(exports, "mergeInputRootConfigs", {
+	enumerable: true,
+	get: function() {
+		return mergeInputRootConfigs;
+	}
+});
 Object.defineProperty(exports, "parseJsonc", {
 	enumerable: true,
 	get: function() {
 		return parseJsonc$8;
 	}
 });
+Object.defineProperty(exports, "pathEscapesRoot", {
+	enumerable: true,
+	get: function() {
+		return pathEscapesRoot;
+	}
+});
 Object.defineProperty(exports, "readFileContent", {
 	enumerable: true,
 	get: function() {
@@ -57092,6 +59306,18 @@ Object.defineProperty(exports, "removeTempDirectory", {
 		return removeTempDirectory;
 	}
 });
+Object.defineProperty(exports, "resetWarnedOnceMessages", {
+	enumerable: true,
+	get: function() {
+		return resetWarnedOnceMessages;
+	}
+});
+Object.defineProperty(exports, "resolveEffectiveInputRoots", {
+	enumerable: true,
+	get: function() {
+		return resolveEffectiveInputRoots;
+	}
+});
 Object.defineProperty(exports, "resolvePath", {
 	enumerable: true,
 	get: function() {