rulesync 16.16.0 → 16.17.0

package/dist/{import-NiPCjH6E.cjs → import-DDPTPxOX.cjs}

@@ -34,6 +34,7 @@ let gray_matter = require("gray-matter");
 gray_matter = __toESM(gray_matter, 1);
 let js_yaml = require("js-yaml");
 let es_toolkit_object = require("es-toolkit/object");
+let node_fs = require("node:fs");
 let node_crypto = require("node:crypto");
 let node_util = require("node:util");
 let smol_toml = require("smol-toml");
@@ -495,9 +496,22 @@ function isEnvTest() {
 }
 //#endregion
 //#region src/utils/file.ts
+/**
+* Whether a relative path leads out of the root it is relative to. Matching
+* whole segments matters: a directory really named `..cache` relatively
+* resolves to `..cache/file`, which a prefix test would report as an escape.
+*/
 function pathEscapesRoot(relativePath) {
 	return relativePath === ".." || relativePath.startsWith(`..${node_path.sep}`) || (0, node_path.isAbsolute)(relativePath);
 }
+/** Whether a single path segment is a hidden (dot-prefixed) name. */
+function isHiddenPathSegment(segment) {
+	return segment.startsWith(".") && segment !== "." && segment !== "..";
+}
+/** Split a path on both separators, so one predicate serves either platform. */
+function splitPathSegments(filePath) {
+	return filePath.split(/[/\\]/);
+}
 async function assertWritablePathInsideRoot(params) {
 	const { rootPath, targetPath } = params;
 	let existingPath = targetPath;
@@ -728,8 +742,45 @@ async function listDirectoryFiles(dir) {
 		return [];
 	}
 }
+/** How many dot-prefixed segments a path has, used to prefer a named alias over a hidden one. */
+function countHiddenSegments(filePath) {
+	return splitPathSegments(filePath).filter(isHiddenPathSegment).length;
+}
+/**
+* The real file a path denotes, posix-separated so it compares against the globby results
+* that produce it. Two paths share an identity when they resolve to the very same file --
+* a link beside its target, a link into a shared tree, or a cycle that walks back into an
+* ancestor and yields the same file forty levels down.
+*/
+async function realFileIdentity(filePath) {
+	try {
+		return toPosixPath(await (0, node_fs_promises.realpath)(filePath));
+	} catch {
+		return toPosixPath(filePath);
+	}
+}
+/**
+* Pick the one path that represents a file among the paths that resolve to it.
+*
+* The path that walked through no link at all wins outright: it is already the real one,
+* so it equals the file's identity. That keeps the real location of a file as the path
+* callers see, rather than an alias that happens to sort first -- a directory link named
+* `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a cycle must not replace
+* `sub/note.md` with the same file reached back through the cycle.
+* Failing that, the fewest dot-prefixed segments wins: when only links are on offer, the
+* named one represents the entry rather than a hidden alias that a hidden-entry rule may
+* then drop, taking the named path's content with it. `candidates` arrives in sorted
+* order, so ties keep the first one deterministically.
+*/
+function chooseRepresentative(candidates, identity) {
+	return candidates.reduce((best, candidate) => {
+		if (toPosixPath(best) === identity) return best;
+		if (toPosixPath(candidate) === identity) return candidate;
+		return countHiddenSegments(candidate) < countHiddenSegments(best) ? candidate : best;
+	});
+}
 async function findFilesByGlobs(globs, options = {}) {
-	const { type = "all", followSymbolicLinks = true, ignore } = options;
+	const { type = "all", followSymbolicLinks = true, ignore, dot = false } = options;
 	const globbyOptions = type === "file" ? {
 		onlyFiles: true,
 		onlyDirectories: false
@@ -744,23 +795,18 @@ async function findFilesByGlobs(globs, options = {}) {
 	const results = (0, globby.globbySync)(normalizedGlobs, {
 		absolute: true,
 		followSymbolicLinks,
+		dot,
 		...ignore ? { ignore: ignore.map((pattern) => pattern.replaceAll("\\", "/")) } : {},
 		...globbyOptions
 	});
-	const seenRealPaths = /* @__PURE__ */ new Set();
-	const deduped = [];
+	const candidatesByFile = /* @__PURE__ */ new Map();
 	for (const result of results.toSorted()) {
-		let realResult;
-		try {
-			realResult = await (0, node_fs_promises.realpath)(result);
-		} catch {
-			realResult = result;
-		}
-		if (seenRealPaths.has(realResult)) continue;
-		seenRealPaths.add(realResult);
-		deduped.push(result);
+		const identity = await realFileIdentity(result);
+		const candidates = candidatesByFile.get(identity);
+		if (candidates === void 0) candidatesByFile.set(identity, [result]);
+		else candidates.push(result);
 	}
-	return deduped;
+	return [...candidatesByFile.entries()].map(([identity, candidates]) => chooseRepresentative(candidates, identity)).toSorted();
 }
 async function removeDirectory(dirPath) {
 	if ([
@@ -919,6 +965,25 @@ var CLIError = class extends Error {
 	}
 };
 //#endregion
+//#region src/utils/warned-once.ts
+/**
+* The messages a once-per-run warning has already emitted in this process.
+* This lives in its own module, free of imports, so the vitest setup file can
+* clear it between tests without pulling `logger.js` into every test's module
+* graph (which would defeat the module mocks some of those tests install).
+*/
+const warnedOnceMessages = /* @__PURE__ */ new Set();
+/** Whether `message` has not been emitted yet; records it when it has not. */
+function claimWarnOnce(message) {
+	if (warnedOnceMessages.has(message)) return false;
+	warnedOnceMessages.add(message);
+	return true;
+}
+/** Forget which warnings were already emitted, so each test starts silent. */
+function resetWarnedOnceMessages() {
+	warnedOnceMessages.clear();
+}
+//#endregion
 //#region src/utils/logger.ts
 /**
 * Base class for shared verbose/silent state and configuration logic
@@ -1071,6 +1136,17 @@ const fallbackLogger = new ConsoleLogger();
 function warnWithFallback(logger, message) {
 	(logger ?? fallbackLogger).warn(message);
 }
+/**
+* Emit a warning at most once per run. A single `generate` reads the same source
+* file once per enabled tool target, so a warning that describes the source
+* rather than the target would otherwise be printed a dozen identical times.
+* Diagnostics that name the file they are about qualify; anything whose text
+* varies with what the user should do next does not.
+*/
+function warnOnceWithFallback(logger, message) {
+	if (!claimWarnOnce(message)) return;
+	warnWithFallback(logger, message);
+}
 //#endregion
 //#region src/utils/validation.ts
 /**
@@ -2015,8 +2091,7 @@ var AiFile = class {
 		const fullPath = node_path.default.join(this.outputRoot, this.relativeDirPath, this.relativeFilePath);
 		const resolvedFull = (0, node_path.resolve)(fullPath);
 		const resolvedBase = (0, node_path.resolve)(this.outputRoot);
-		const rel = (0, node_path.relative)(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || node_path.default.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", relativeFilePath="${this.relativeFilePath}"`);
+		if (pathEscapesRoot((0, node_path.relative)(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", relativeFilePath="${this.relativeFilePath}"`);
 		return fullPath;
 	}
 	getFileContent() {
@@ -2078,6 +2153,27 @@ var RulesyncFile = class extends AiFile {
 	}
 };
 //#endregion
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
+* line and paragraph separators, and the plain LRM/RLM marks. A name or value
+* copied out of an untrusted config file, a fetched repository, or a tool's own
+* settings file must never reach the terminal with these intact: they let the
+* text forge log lines, reorder what is printed around them, or inject escape
+* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
+* neutral characters beside them, so they go too — a diagnostic line is not the
+* place to preserve the typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+//#endregion
 //#region src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -2201,7 +2297,7 @@ function parseFrontmatter(content, filePath) {
 	let body;
 	let hasFrontmatter;
 	try {
-		const result = (0, gray_matter.default)(content);
+		const result = (0, gray_matter.default)(content, {});
 		frontmatter = result.data;
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
@@ -2215,6 +2311,104 @@ function parseFrontmatter(content, filePath) {
 		hasFrontmatter
 	};
 }
+/**
+* A top-level `key: value` entry. Nested entries are left alone deliberately:
+* the repair below rewrites a value's meaning, and the failure it exists for —
+* an unquoted sentence with a colon in it — is a `description`, which is always
+* top-level.
+*/
+const TOP_LEVEL_ENTRY_PATTERN = /^([A-Za-z_][\w.-]*):[^\S\r\n]+(\S.*)$/;
+/** A plain scalar that already starts as some other YAML construct. */
+const YAML_CONSTRUCT_PREFIX_PATTERN = /^["'|>&*![{#]/;
+/**
+* Cut a plain scalar at its inline comment — whitespace followed by `#`.
+*
+* This has to happen before anything else looks at the value, or a line such as
+* `allowed-tools: Read # TODO: add Bash later` reads as needing repair and comes
+* back quoted with the comment inside it, which for a list of tool permissions
+* would grant what the comment had disabled. Scanning by hand rather than with
+* `/\s+#.*$/`: that pattern is unanchored, so a long run of spaces with no `#`
+* after it backtracks from every starting position, and a value padded with a
+* megabyte of spaces takes minutes to reject. This is linear in the value.
+*/
+function stripInlineComment(rawValue) {
+	for (let index = 1; index < rawValue.length; index++) if (rawValue[index] === "#" && /\s/.test(rawValue[index - 1] ?? "")) return rawValue.slice(0, index).trimEnd();
+	return rawValue.trimEnd();
+}
+function repairFrontmatterLine(line) {
+	const unchanged = {
+		line,
+		droppedComment: false
+	};
+	const carriageReturn = line.endsWith("\r") ? "\r" : "";
+	const bareLine = carriageReturn === "" ? line : line.slice(0, -1);
+	const match = TOP_LEVEL_ENTRY_PATTERN.exec(bareLine);
+	if (!match) return unchanged;
+	const [, key = "", rawValue = ""] = match;
+	const value = stripInlineComment(rawValue);
+	if (value === "") return unchanged;
+	if (!/:(?:\s|$)/.test(value)) return unchanged;
+	if (YAML_CONSTRUCT_PREFIX_PATTERN.test(value)) return unchanged;
+	return {
+		line: `${key}: ${JSON.stringify(value)}${carriageReturn}`,
+		droppedComment: value !== rawValue.trimEnd()
+	};
+}
+/**
+* Quote the unquoted scalars that make a frontmatter block unparseable, or
+* return `undefined` when there is nothing to repair. Only the frontmatter
+* block is rewritten; the body is passed through untouched.
+*/
+function repairMalformedFrontmatterYaml(content) {
+	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
+	if (!opening) return;
+	const blockStart = opening[0].length;
+	const closing = /\r?\n---/.exec(content.slice(blockStart));
+	if (!closing) return;
+	const blockEnd = blockStart + closing.index;
+	const block = content.slice(blockStart, blockEnd);
+	const repairedLines = block.split("\n").map(repairFrontmatterLine);
+	const repairedBlock = repairedLines.map(({ line }) => line).join("\n");
+	if (repairedBlock === block) return;
+	return {
+		content: content.slice(0, blockStart) + repairedBlock + content.slice(blockEnd),
+		droppedComment: repairedLines.some(({ droppedComment }) => droppedComment)
+	};
+}
+/**
+* Parse frontmatter, retrying once with unquoted colon-bearing values quoted.
+*
+* Files authored for another client routinely carry YAML that only that
+* client's parser accepts — `description: Use this skill when: the user asks
+* about PDFs` is the case the Agent Skills client guide names. Without a retry
+* such a file is not merely reported, it is dropped: the lenient skill import
+* catches the parse error and skips the whole skill. The retry is deliberately
+* narrow — one pass, top-level entries only, and the original error is what
+* surfaces if it does not help, so a genuinely broken file still fails with the
+* message that describes what is actually wrong with it. A file with no closing
+* `---`, or one whose opening fence carries a language tag, is not repaired at
+* all: neither is a frontmatter block gray-matter would have read.
+*
+* @see https://agentskills.io/client-implementation/adding-skills-support
+*/
+function parseFrontmatterWithYamlRepair(content, filePath, options = {}) {
+	try {
+		return parseFrontmatter(content, filePath);
+	} catch (error) {
+		const repaired = repairMalformedFrontmatterYaml(content);
+		if (repaired === void 0) throw error;
+		let result;
+		try {
+			result = parseFrontmatter(repaired.content, filePath);
+		} catch {
+			throw error;
+		}
+		if (options.quiet === true) return result;
+		const commentNote = repaired.droppedComment ? " Text following a space and `#` was read as a YAML comment and left out of the value." : "";
+		warnOnceWithFallback(void 0, `Recovered malformed YAML frontmatter in ${filePath === void 0 ? "the input" : stripControlCharacters(toPosixPath(filePath))} by quoting values that contain a colon.${commentNote} Quote them in the file itself so other tools can read it too.`);
+		return result;
+	}
+}
 //#endregion
 //#region src/features/checks/rulesync-check.ts
 const RulesyncCheckFrontmatterSchema = zod_mini.z.looseObject({
@@ -5884,8 +6078,474 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 	}
 };
 //#endregion
+//#region src/utils/concurrency.ts
+/**
+* Map over items with a bounded number of operations in flight.
+*
+* `Promise.all(items.map(...))` starts every operation at once, which is fine
+* for a handful of paths and not fine for a directory tree of unknown size: a
+* few thousand concurrent `realpath` calls queue on the libuv thread pool and
+* hold their closures alive while they wait. Results keep the input order.
+*
+* `withSemaphore` in `src/lib/github-utils.ts` bounds concurrency too, but it
+* wraps one call at a time: the caller still writes `Promise.all(items.map(…))`
+* around it, so every item's promise chain is allocated up front. This walks a
+* shared cursor with `limit` workers instead, so a list of unknown size costs
+* `limit` pending operations rather than one per item.
+*/
+async function mapWithConcurrency({ items, limit, mapper }) {
+	const results = Array.from({ length: items.length });
+	let nextIndex = 0;
+	const runWorker = async () => {
+		while (nextIndex < items.length) {
+			const index = nextIndex;
+			nextIndex += 1;
+			const item = items[index];
+			if (item === void 0) continue;
+			results[index] = await mapper(item);
+		}
+	};
+	const workerCount = Math.max(1, Math.min(limit, items.length));
+	await Promise.all(Array.from({ length: workerCount }, () => runWorker()));
+	return results;
+}
+//#endregion
 //#region src/types/ai-dir.ts
-var AiDir = class {
+/**
+* Directories that hold credentials. Excluding these protects something, so
+* their exclusion is reported rather than silent.
+*/
+const NEVER_CARRIED_CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
+	".ssh",
+	".aws",
+	".gnupg"
+]);
+/**
+* Directories that are refused only when the path leaves the skill directory to
+* reach them. These are the per-application trees of a home directory, where
+* naming every credential file is a list always one release behind -- `gcloud`
+* alone writes `credentials.db` and `application_default_credentials.json`, and
+* `.config/anthropic/` holds an API key. A skill that ships a `.config/` of its
+* own still carries it: what is refused is a link that reaches the *user's*.
+*
+* A tool home is deliberately absent. `~/.claude/skills/` and `~/.codex/` hold
+* the global skills this feature exists to share, so refusing a link that
+* reaches one would refuse the ordinary case along with the bad one.
+*/
+const NEVER_CARRIED_ESCAPING_DIR_NAMES = /* @__PURE__ */ new Set([
+	".config",
+	".local",
+	".azure",
+	".m2",
+	".terraform.d",
+	".docker",
+	".kube",
+	"keychains"
+]);
+/**
+* Whether an escaping real path passes through a directory only reachable by
+* escaping.
+*
+* Only the segments *past* the skill directory count. A global skill lives at
+* `~/.config/agents/skills/<name>` for Amp, Devin and Muse alike, so judging
+* the whole real path would refuse a link that never left the skills tree it
+* was already in -- the shared-directory case, reported as a credential.
+*/
+function escapesIntoCredentialDir({ realDirPath, realFilePath }) {
+	const normalize = (segment) => normalizePathSegment(segment.toLowerCase());
+	const dirSegments = splitPathSegments(realDirPath).map(normalize);
+	const fileSegments = splitPathSegments(realFilePath).map(normalize);
+	let shared = 0;
+	while (shared < dirSegments.length && shared < fileSegments.length && dirSegments[shared] === fileSegments[shared]) shared += 1;
+	return (dirSegments.length - shared > 1 ? fileSegments : fileSegments.slice(shared)).some((segment) => NEVER_CARRIED_ESCAPING_DIR_NAMES.has(segment));
+}
+/**
+* Directories that are never part of a skill for the ordinary reasons: a
+* nested repository, or a build/cache tree. Leaving these out is what a user
+* expects, so it happens quietly.
+*/
+const NEVER_CARRIED_NOISE_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".cache",
+	".venv",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".next",
+	".nuxt",
+	".turbo",
+	".parcel-cache",
+	".nyc_output",
+	".terraform"
+]);
+/** Files that hold credentials. Compared lower-cased. */
+const NEVER_CARRIED_CREDENTIAL_FILE_NAMES = /* @__PURE__ */ new Set([
+	".npmrc",
+	".netrc",
+	".git-credentials",
+	".pgpass",
+	".pypirc",
+	".htpasswd",
+	".dockercfg",
+	".envrc"
+]);
+/** Files that are local noise. Compared lower-cased. */
+const NEVER_CARRIED_NOISE_FILE_NAMES = /* @__PURE__ */ new Set([".ds_store"]);
+/** Credential files whose parent directory is otherwise ordinary content. */
+const NEVER_CARRIED_PATH_SUFFIXES = [
+	".docker/config.json",
+	".kube/config",
+	".config/gh/hosts.yml",
+	".config/gcloud/credentials.db",
+	".gem/credentials",
+	"gcloud/application_default_credentials.json",
+	".codex/auth.json",
+	".gemini/oauth_creds.json"
+];
+/** Whether a path ends in one of the credential files named above. */
+function endsWithNeverCarriedSuffix(filePath) {
+	const posixPath = toPosixPath(filePath).toLowerCase();
+	return NEVER_CARRIED_PATH_SUFFIXES.some((suffix) => posixPath === suffix || posixPath.endsWith(`/${suffix}`));
+}
+/**
+* `.env.<suffix>` spellings that are templates rather than real values.
+* Everything else matching `.env*` is treated as holding secrets, because
+* `.env.production` is no less sensitive than `.env` itself.
+*/
+const ENV_TEMPLATE_SUFFIXES = /* @__PURE__ */ new Set([
+	"example",
+	"sample",
+	"template",
+	"dist",
+	"defaults"
+]);
+/**
+* Kernel pseudo-filesystems, matched against the resolved real path. A link
+* into one of these does not reach a file at all: `/proc/self/environ` reads
+* back the entire environment of the running process, API keys included, and
+* `stat` reports it as an ordinary file. Nothing a skill carries lives here.
+*/
+const NEVER_CARRIED_REAL_PATH_ROOTS = [
+	"/proc",
+	"/sys",
+	"/dev"
+];
+/**
+* Whether a directory of this name is pruned during the walk, so it is never
+* descended into at all. Derived from the directory names above so the pruning
+* and the path check below cannot drift apart.
+*/
+function isNeverCarriedDirName(dirName) {
+	const normalized = normalizePathSegment(dirName.toLowerCase());
+	return NEVER_CARRIED_CREDENTIAL_DIR_NAMES.has(normalized) || NEVER_CARRIED_NOISE_DIR_NAMES.has(normalized) || isCredentialFileName(normalized);
+}
+/**
+* Windows drops trailing dots and spaces from a name, so a file called `.env `
+* is written as `.env` once it lands in a tool directory there. Normalizing
+* before every comparison means the name is judged as what it becomes.
+*/
+function normalizePathSegment(segment) {
+	const normalized = segment.replace(/[\s.]+$/, "");
+	return normalized === "" ? segment : normalized;
+}
+/**
+* Why a path reaches something that is never skill content, or `undefined`
+* when it does not.
+*
+* Carrying hidden entries means a secret sitting in a skill directory would be
+* copied into every enabled tool root, multiplying the places it can be
+* committed from, and a `.venv` would be copied file by file into each of them.
+* None of these names is ever skill content, so excluding them costs nothing.
+*
+* The check is applied to the resolved real path as well as the literal one:
+* the names are what makes an entry dangerous, and a symbolic link named
+* `vendor` pointing at `~/.aws` is exactly as dangerous as a directory called
+* `.aws`. Comparison is lower-cased because macOS and Windows resolve `.SSH`
+* and `.ssh` to the same file.
+*/
+function classifyNeverCarried(relativePath) {
+	const segments = toPosixPath(relativePath).toLowerCase().split("/").filter((segment) => segment !== "" && segment !== ".").map(normalizePathSegment);
+	const fileName = segments.at(-1) ?? "";
+	const posixPath = segments.join("/");
+	if (segments.slice(0, -1).some((segment) => isCredentialFileName(segment))) return "credential";
+	if (segments.some((segment) => NEVER_CARRIED_CREDENTIAL_DIR_NAMES.has(segment))) return "credential";
+	if (segments.some((segment) => NEVER_CARRIED_NOISE_DIR_NAMES.has(segment))) return "noise";
+	if (isCredentialFileName(fileName)) return "credential";
+	if (NEVER_CARRIED_NOISE_FILE_NAMES.has(fileName)) return "noise";
+	if (NEVER_CARRIED_PATH_SUFFIXES.some((suffix) => posixPath === suffix || posixPath.endsWith(`/${suffix}`))) return "credential";
+}
+/**
+* Whether a single path segment names a credential file, whether it is the file
+* itself or a directory somebody gave that name to.
+*/
+function isCredentialFileName(segment) {
+	const name = normalizePathSegment(segment.toLowerCase());
+	if (NEVER_CARRIED_CREDENTIAL_FILE_NAMES.has(name)) return true;
+	for (const base of [".env", ".envrc"]) {
+		if (name === base) return true;
+		if (name.startsWith(`${base}.`)) {
+			const lastPiece = name.split(".").at(-1) ?? "";
+			return !ENV_TEMPLATE_SUFFIXES.has(lastPiece);
+		}
+	}
+	return false;
+}
+/** Whether a resolved real path points into a kernel pseudo-filesystem. */
+function isSystemPseudoPath(absolutePath) {
+	const posixPath = toPosixPath(absolutePath);
+	return NEVER_CARRIED_REAL_PATH_ROOTS.some((root) => posixPath === root || posixPath.startsWith(`${root}/`));
+}
+/** How many links a chain may be followed before it is treated as a loop. */
+const MAX_LINK_CHAIN_HOPS = 40;
+/**
+* Whether reaching a path goes through a kernel pseudo-filesystem, even when it
+* does not end in one.
+*
+* Asking `realpath` alone is not enough, and the entries it is not enough for
+* are the dangerous ones: `/proc/<pid>/fd/N`, `exe`, `cwd` and `root` are magic
+* links, so resolving them lands *outside* `/proc`, on whatever file the
+* process happens to hold open — a private key another program is reading right
+* now would come back as an ordinary path and be carried. Following the chain a
+* hop at a time, and checking each hop, is what sees the `/proc` in the middle.
+*/
+async function resolvesThroughSystemPseudoPath(filePath) {
+	let currentPath = (0, node_path.resolve)(filePath);
+	let hops = 0;
+	for (; hops < MAX_LINK_CHAIN_HOPS; hops++) {
+		if (isSystemPseudoPath(currentPath)) return {
+			throughPseudoPath: true,
+			hops
+		};
+		try {
+			if (isSystemPseudoPath(await (0, node_fs_promises.realpath)((0, node_path.dirname)(currentPath)))) return {
+				throughPseudoPath: true,
+				hops
+			};
+		} catch {}
+		let linkStats;
+		try {
+			linkStats = await (0, node_fs_promises.lstat)(currentPath);
+		} catch {
+			return {
+				throughPseudoPath: false,
+				hops
+			};
+		}
+		if (!linkStats.isSymbolicLink()) break;
+		let target;
+		try {
+			target = await (0, node_fs_promises.readlink)(currentPath);
+		} catch {
+			return {
+				throughPseudoPath: false,
+				hops
+			};
+		}
+		currentPath = (0, node_path.isAbsolute)(target) ? target : (0, node_path.resolve)((0, node_path.dirname)(currentPath), target);
+	}
+	return {
+		throughPseudoPath: false,
+		hops
+	};
+}
+const MAX_CARRIED_FILES = 1e4;
+const MAX_CARRIED_DIRECTORIES = 1e4;
+/**
+* The bounds above limit what is *carried*; this one limits what is *looked at*.
+* A directory holding nothing but a few hundred thousand links to itself carries
+* no files and occupies no depth, and would still cost a `stat` apiece.
+*/
+const MAX_CARRIED_ENTRIES_EXAMINED = 2e5;
+const MAX_CARRIED_BYTES = 104857600;
+/** How many `realpath` calls the carried-file filter keeps in flight. */
+const CARRIED_REALPATH_CONCURRENCY = 32;
+/** Sort directory entries by name so a walk of the same tree is reproducible. */
+function compareByName(left, right) {
+	if (left.name === right.name) return 0;
+	return left.name < right.name ? -1 : 1;
+}
+/**
+* Order the routes that cross the same number of symbolic links: the one with
+* the fewest hidden segments first, so a named alias represents a shared tree
+* rather than a hidden one that a hidden-entry rule then refuses, taking the
+* named route's content with it.
+*/
+function comparePendingCarriedDirs(left, right) {
+	if (left.hiddenSegments !== right.hiddenSegments) return left.hiddenSegments - right.hiddenSegments;
+	if (left.depth !== right.depth) return left.depth - right.depth;
+	if (left.dirPath === right.dirPath) return 0;
+	return left.dirPath < right.dirPath ? -1 : 1;
+}
+/**
+* Collect the files under a carried directory, following symbolic links but
+* visiting each real directory exactly once, by its cheapest route.
+*
+* A glob walk cannot do this safely. Two links in one directory that both point
+* back at an ancestor double the paths walked per level, and the walker follows
+* them until the kernel's ELOOP limit (~40), so the path array alone exhausts
+* the heap long before anything reads a file — a depth bound only lowers the
+* exponent, while the base is whatever number of links the tree's author chose.
+* Remembering the real directories already visited removes the multiplication
+* itself: a cycle, and an alias for a directory already walked, both stop at the
+* entry that closes them.
+*
+* Which route represents a directory then matters, because the others are
+* dropped. The walk proceeds in rounds by the number of symbolic links crossed:
+* everything reachable without crossing one, then everything one link away, and
+* so on. A real location therefore always wins over an alias for it — at any
+* nesting depth, not just among siblings, which a depth-first walk could not
+* promise — and among aliases the named one wins over a hidden one.
+*
+* A broken link is skipped: it resolves to nothing to read.
+*/
+async function walkCarriedFiles(dirPath, { skipHiddenRoutes = false } = {}) {
+	const filePaths = [];
+	const visitedRealDirPaths = /* @__PURE__ */ new Set();
+	const truncations = /* @__PURE__ */ new Set();
+	const unreadablePaths = /* @__PURE__ */ new Set();
+	const pseudoPaths = /* @__PURE__ */ new Set();
+	const depthStoppedRealDirPaths = /* @__PURE__ */ new Set();
+	let deferredLinkedDirs = [];
+	/** Whether the walk has hit a bound that ends it rather than one branch of it. */
+	let examinedEntries = 0;
+	const isFull = () => truncations.has("count") || truncations.has("directories") || truncations.has("entries");
+	const addFile = (filePath) => {
+		if (filePaths.length >= 1e4) {
+			truncations.add("count");
+			return;
+		}
+		filePaths.push(filePath);
+	};
+	/** Carry what a symbolic link names, or hold its directory for the next round. */
+	const routeLinkedEntry = async (child, entryName) => {
+		let targetStats;
+		try {
+			targetStats = await (0, node_fs_promises.stat)(child.dirPath);
+		} catch {
+			return;
+		}
+		if (targetStats.isFile()) {
+			addFile(child.dirPath);
+			return;
+		}
+		if (!targetStats.isDirectory() || isNeverCarriedDirName(entryName)) return;
+		const { throughPseudoPath, hops } = await resolvesThroughSystemPseudoPath(child.dirPath);
+		examinedEntries += hops;
+		if (throughPseudoPath) {
+			pseudoPaths.add(child.dirPath);
+			return;
+		}
+		deferredLinkedDirs.push(child);
+	};
+	/** Walk one directory and everything below it that no symbolic link leads to. */
+	const walkWithoutCrossingLinks = async (pending) => {
+		if (isFull()) return;
+		let realCurrentPath;
+		try {
+			realCurrentPath = await (0, node_fs_promises.realpath)(pending.dirPath);
+		} catch {
+			unreadablePaths.add(pending.dirPath);
+			return;
+		}
+		if (visitedRealDirPaths.has(realCurrentPath)) return;
+		if (isSystemPseudoPath(realCurrentPath)) {
+			pseudoPaths.add(pending.dirPath);
+			return;
+		}
+		if (pending.depth > 12) {
+			depthStoppedRealDirPaths.add(realCurrentPath);
+			return;
+		}
+		if (visitedRealDirPaths.size >= 1e4) {
+			truncations.add("directories");
+			return;
+		}
+		visitedRealDirPaths.add(realCurrentPath);
+		let entries;
+		try {
+			entries = await (0, node_fs_promises.readdir)(pending.dirPath, { withFileTypes: true });
+		} catch {
+			unreadablePaths.add(pending.dirPath);
+			return;
+		}
+		const realSubDirs = [];
+		for (const entry of entries.toSorted(compareByName)) {
+			if (isFull()) return;
+			examinedEntries += 1;
+			if (examinedEntries > 2e5) {
+				truncations.add("entries");
+				return;
+			}
+			if (skipHiddenRoutes && isHiddenPathSegment(entry.name)) continue;
+			const entryPath = (0, node_path.join)(pending.dirPath, entry.name);
+			const child = {
+				dirPath: entryPath,
+				depth: pending.depth + 1,
+				hiddenSegments: pending.hiddenSegments + (isHiddenPathSegment(entry.name) ? 1 : 0)
+			};
+			if (entry.isFile()) {
+				addFile(entryPath);
+				continue;
+			}
+			if (entry.isDirectory()) {
+				if (!isNeverCarriedDirName(entry.name)) realSubDirs.push(child);
+				continue;
+			}
+			if (!entry.isSymbolicLink()) continue;
+			await routeLinkedEntry(child, entry.name);
+		}
+		for (const realSubDir of realSubDirs) {
+			if (isFull()) return;
+			await walkWithoutCrossingLinks(realSubDir);
+		}
+	};
+	let round = [{
+		dirPath,
+		depth: 0,
+		hiddenSegments: 0
+	}];
+	while (round.length > 0 && !isFull()) {
+		deferredLinkedDirs = [];
+		for (const pending of round.toSorted(comparePendingCarriedDirs)) {
+			if (isFull()) break;
+			await walkWithoutCrossingLinks(pending);
+		}
+		round = deferredLinkedDirs;
+	}
+	for (const realDirPath of depthStoppedRealDirPaths) if (!visitedRealDirPaths.has(realDirPath)) {
+		truncations.add("depth");
+		break;
+	}
+	return {
+		filePaths: filePaths.toSorted(),
+		truncations,
+		unreadablePaths: [...unreadablePaths],
+		pseudoPaths: [...pseudoPaths]
+	};
+}
+/** Render a set of refused or noteworthy paths for one warning line. */
+function formatReportedPaths(paths) {
+	const sorted = [...paths].toSorted();
+	const named = sorted.slice(0, 10).map((filePath) => stripControlCharacters(toPosixPath(filePath))).join(", ");
+	const remaining = sorted.length - 10;
+	return {
+		count: sorted.length,
+		list: `${named}${remaining > 0 ? `, and ${remaining} more` : ""}`
+	};
+}
+/** "entry" or "entries", so the warnings below read as sentences. */
+function entryWord(count) {
+	return count === 1 ? "entry" : "entries";
+}
+/** "resolves" or "resolve", to agree with the entry count it follows. */
+function resolveWord(count) {
+	return count === 1 ? "resolves" : "resolve";
+}
+var AiDir = class AiDir {
 	/**
 	* @example "."
 	*/
@@ -5935,8 +6595,7 @@ var AiDir = class {
 		const fullPath = node_path.default.join(this.outputRoot, this.relativeDirPath, this.dirName);
 		const resolvedFull = (0, node_path.resolve)(fullPath);
 		const resolvedBase = (0, node_path.resolve)(this.outputRoot);
-		const rel = (0, node_path.relative)(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || node_path.default.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`);
+		if (pathEscapesRoot((0, node_path.relative)(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`);
 		return fullPath;
 	}
 	getMainFile() {
@@ -5962,9 +6621,227 @@ var AiDir = class {
 		};
 	}
 	/**
+	* A nested repository inside a carried directory is the one exclusion worth
+	* reporting: unlike `.DS_Store`, it is there on purpose, and the tree it
+	* points at is simply not reproduced on generate. Only the top level is
+	* checked, which is where a submodule or a stray `git init` puts it, so the
+	* check costs one stat per directory rather than a second walk. `fileExists`
+	* is a bare `stat`, so it answers for a submodule pointer file and for a real
+	* `.git` directory alike.
+	*/
+	static async warnOnNestedGitDirectory(dirPath) {
+		const gitEntryPath = (0, node_path.join)(dirPath, ".git");
+		if (await fileExists(gitEntryPath)) warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(gitEntryPath))} with its directory: a nested repository is excluded, so the files it tracks are copied but its history is not.`);
+	}
+	/** Whether any segment of a relative path is dot-prefixed. */
+	static hasHiddenSegment(relativePath) {
+		return splitPathSegments(relativePath).some(isHiddenPathSegment);
+	}
+	/**
+	* Whether the entry a path ends at is itself hidden, its ancestors aside.
+	* A shared skill tree usually lives under a dot-directory, so an ancestor
+	* says nothing about the file; its own name is what was chosen for it.
+	*/
+	static hasHiddenName(relativePath) {
+		return isHiddenPathSegment(splitPathSegments(relativePath).at(-1) ?? "");
+	}
+	/**
+	* Drop the entries a skill directory must not carry.
+	*
+	* Three rules. `classifyNeverCarried` comes first, evaluated against the
+	* resolved real path as well as the literal one: names that are never skill
+	* content stay out however they are reached, so renaming a symbolic link
+	* does not turn `~/.aws` into content a skill carries. Next, a real path
+	* inside a kernel pseudo-filesystem is refused outright — that is process
+	* state, not a file.
+	*
+	* The third concerns hidden entries a symbolic link reaches outside the
+	* directory. Following symlinks out of a source tree is deliberate and
+	* documented — it is how a shared skill is referenced from several projects
+	* without being duplicated (issue #1707), and the trust boundary is the tree
+	* you point Rulesync at. Carrying hidden entries changes what that costs,
+	* though: one ordinary-looking link to a home directory would pull in every
+	* dotfile under it, and those are the entries with credential value. What
+	* decides is the name in the skill directory, not what the link resolves
+	* through: a named file keeps its documented behavior even when the target
+	* sits under a dot-directory such as `~/.dotfiles`, because somebody chose
+	* that name. What the link resolves *to* still counts at the end of the path,
+	* though — `notes.md` pointing at `~/.claude/.credentials.json` reaches a
+	* file nobody named for a skill — so a hidden final segment is refused on
+	* either side. Reaching outside is reported either way, since content from
+	* outside the tree is about to be copied into every enabled tool root.
+	*
+	* A path that cannot be resolved is kept: `realpath` fails on a broken link
+	* or a race, and neither is a reason to silently drop a file.
+	*/
+	/** Report what a carried directory left out, once both walks have had their say. */
+	static warnOnRefusedCarriedFiles(dirPath, carried) {
+		const reportedDirPath = stripControlCharacters(toPosixPath(dirPath));
+		if (carried.refusedCredentials.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedCredentials);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} named as a credential store: ${list}. A skill must not ship secrets; read them from the environment instead.`);
+		}
+		if (carried.refusedPseudoPaths.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedPseudoPaths);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that ${resolveWord(count)} into a system pseudo-filesystem: ${list}. Those read back process state, not skill content.`);
+		}
+		if (carried.refusedNoiseAliases.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedNoiseAliases);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that ${resolveWord(count)} into a directory a skill never carries: ${list}. A nested repository, or a build or cache tree, is the usual target.`);
+		}
+		if (carried.refusedEscapedHidden.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedEscapedHidden);
+			warnOnceWithFallback(void 0, `Not carrying ${count} hidden ${entryWord(count)} that ${resolveWord(count)} outside ${reportedDirPath}: ${list}. Copy them into the directory if the skill really needs them.`);
+		}
+		if (carried.carriedFromOutside.size > 0) {
+			const { count, list } = formatReportedPaths([...carried.carriedFromOutside].map((filePath) => {
+				const realFilePath = carried.realFilePathByPath.get(filePath);
+				return realFilePath === void 0 ? filePath : `${filePath} -> ${realFilePath}`;
+			}));
+			warnOnceWithFallback(void 0, `Carrying ${count} ${entryWord(count)} that ${resolveWord(count)} outside ${reportedDirPath}: ${list}. Their content is copied into every generated tool directory.`);
+		}
+	}
+	static async filterCarriedFiles(dirPath, filePaths) {
+		let realDirPath;
+		try {
+			realDirPath = await (0, node_fs_promises.realpath)(dirPath);
+		} catch {
+			realDirPath = (0, node_path.resolve)(dirPath);
+		}
+		const refusedCredentials = /* @__PURE__ */ new Set();
+		const refusedPseudoPaths = /* @__PURE__ */ new Set();
+		const refusedEscapedHidden = /* @__PURE__ */ new Set();
+		const refusedNoiseAliases = /* @__PURE__ */ new Set();
+		const carriedFromOutside = /* @__PURE__ */ new Set();
+		const realFilePathByPath = /* @__PURE__ */ new Map();
+		const verdicts = await mapWithConcurrency({
+			items: filePaths,
+			limit: CARRIED_REALPATH_CONCURRENCY,
+			mapper: async (filePath) => {
+				const literalPath = (0, node_path.relative)(dirPath, filePath);
+				const literalReason = classifyNeverCarried(literalPath);
+				if (literalReason !== void 0) {
+					if (literalReason === "credential") refusedCredentials.add(filePath);
+					return false;
+				}
+				let realFilePath;
+				try {
+					realFilePath = await (0, node_fs_promises.realpath)(filePath);
+				} catch {
+					return true;
+				}
+				realFilePathByPath.set(filePath, realFilePath);
+				if (isSystemPseudoPath(realFilePath)) {
+					refusedPseudoPaths.add(filePath);
+					return false;
+				}
+				const realPath = (0, node_path.relative)(realDirPath, realFilePath);
+				const realReason = classifyNeverCarried(realPath);
+				if (realReason !== void 0) {
+					if (realReason === "credential") refusedCredentials.add(filePath);
+					else refusedNoiseAliases.add(filePath);
+					return false;
+				}
+				if (!pathEscapesRoot(realPath)) return true;
+				if ((await resolvesThroughSystemPseudoPath(filePath)).throughPseudoPath) {
+					refusedPseudoPaths.add(filePath);
+					return false;
+				}
+				if (endsWithNeverCarriedSuffix(realFilePath)) {
+					refusedCredentials.add(filePath);
+					return false;
+				}
+				if (escapesIntoCredentialDir({
+					realDirPath,
+					realFilePath
+				})) {
+					refusedCredentials.add(filePath);
+					return false;
+				}
+				if (AiDir.hasHiddenSegment(literalPath) || AiDir.hasHiddenName(realPath)) {
+					refusedEscapedHidden.add(filePath);
+					return false;
+				}
+				carriedFromOutside.add(filePath);
+				return true;
+			}
+		});
+		return {
+			filePaths: filePaths.filter((_filePath, index) => verdicts[index]),
+			realFilePathByPath,
+			refusedCredentials,
+			refusedPseudoPaths,
+			refusedEscapedHidden,
+			refusedNoiseAliases,
+			carriedFromOutside
+		};
+	}
+	/**
+	* Report what the walk had to leave behind, so a skill that silently lost
+	* files says so rather than generating a directory that is quietly short.
+	*/
+	static warnOnCarriedWalkLimits({ reportedDirPath, truncations, unreadablePaths }) {
+		if (truncations.has("depth")) warnOnceWithFallback(void 0, `Not carrying the entries more than 12 directories below ${reportedDirPath}: a skill directory is walked to that depth only. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("count")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} beyond the first ${MAX_CARRIED_FILES}: a directory may carry at most that many files. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("directories")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} below the first ${MAX_CARRIED_DIRECTORIES} directories: a directory may carry files from at most that many directories. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("entries")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} that come after the first ${MAX_CARRIED_ENTRIES_EXAMINED} looked at: a directory is walked over at most that many entries. A tree of symbolic links that lead back into it is the usual cause.`);
+		if (unreadablePaths.length > 0) {
+			const { count, list } = formatReportedPaths(unreadablePaths);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that could not be read: ${list}. A permission the current user does not hold is the usual cause.`);
+		}
+	}
+	/**
+	* Walk the directory once more with the hidden routes pruned, and take the
+	* files the first walk had to leave behind because the route that reached
+	* them ran through a hidden directory. This can only add files, and only ones
+	* a fully named route reaches.
+	*/
+	static async recoverCarriedFilesFromNamedRoutes({ dirPath, carried, carriedPaths, carriedRealPaths, walk }) {
+		const named = await walkCarriedFiles(dirPath, { skipHiddenRoutes: true });
+		const recovered = await AiDir.filterCarriedFiles(dirPath, named.filePaths);
+		for (const truncation of named.truncations) walk.truncations.add(truncation);
+		for (const unreadablePath of named.unreadablePaths) if (!walk.unreadablePaths.includes(unreadablePath)) walk.unreadablePaths.push(unreadablePath);
+		for (const pseudoPath of named.pseudoPaths) carried.refusedPseudoPaths.add(pseudoPath);
+		for (const refused of recovered.refusedCredentials) carried.refusedCredentials.add(refused);
+		for (const refused of recovered.refusedPseudoPaths) carried.refusedPseudoPaths.add(refused);
+		for (const refused of recovered.refusedNoiseAliases) carried.refusedNoiseAliases.add(refused);
+		for (const refused of recovered.refusedEscapedHidden) carried.refusedEscapedHidden.add(refused);
+		for (const filePath of recovered.filePaths) {
+			const realFilePath = recovered.realFilePathByPath.get(filePath) ?? filePath;
+			if (carriedRealPaths.has(realFilePath)) continue;
+			if (carriedPaths.length >= 1e4) {
+				walk.truncations.add("count");
+				break;
+			}
+			carriedRealPaths.add(realFilePath);
+			carriedPaths.push(filePath);
+			carried.realFilePathByPath.set(filePath, realFilePath);
+			if (recovered.carriedFromOutside.has(filePath)) carried.carriedFromOutside.add(filePath);
+		}
+		for (const filePath of carried.refusedEscapedHidden) {
+			const realFilePath = carried.realFilePathByPath.get(filePath) ?? filePath;
+			if (carriedRealPaths.has(realFilePath)) carried.refusedEscapedHidden.delete(filePath);
+		}
+	}
+	/**
 	* Recursively collects all files from a directory, excluding the specified main file.
 	* This is a common utility for loading additional files alongside the main file.
 	*
+	* Hidden entries are included. The directories this walks are skill trees,
+	* whose specification says a skill directory "may contain any files and
+	* directories beyond the required `SKILL.md`" — a `.env.example` beside the
+	* scripts that read it is content, not noise, and dropping it silently on
+	* both import and generate loses part of the skill. What is left out is the
+	* set of entries that are never skill content — a nested repository's `.git`,
+	* the macOS Finder's `.DS_Store`, credential stores, build and cache trees —
+	* as decided by `classifyNeverCarried`. Whole directories from that set are
+	* pruned during the walk too, so it never descends into them at all.
+	*
+	* The walk is bounded and cycle-aware — see `walkCarriedFiles` — because the
+	* tree may contain symbolic links that somebody else chose.
+	*
+	* @see https://agentskills.io/specification
+	*
 	* @param outputRoot - The base directory path
 	* @param relativeDirPath - The relative path to the directory containing the skill
 	* @param dirName - The name of the directory
@@ -5973,14 +6850,57 @@ var AiDir = class {
 	*/
 	static async collectOtherFiles(outputRoot, relativeDirPath, dirName, excludeFileName) {
 		const dirPath = (0, node_path.join)(outputRoot, relativeDirPath, dirName);
-		const filteredPaths = (await findFilesByGlobs((0, node_path.join)(dirPath, "**", "*"), { type: "file" })).filter((filePath) => (0, node_path.basename)(filePath) !== excludeFileName);
-		return await Promise.all(filteredPaths.map(async (filePath) => {
-			const fileBuffer = await readFileBuffer(filePath);
-			return {
-				relativeFilePathToDirPath: (0, node_path.relative)(dirPath, filePath),
-				fileBuffer
-			};
-		}));
+		const walk = await walkCarriedFiles(dirPath);
+		const reportedDirPath = stripControlCharacters(toPosixPath(dirPath));
+		await AiDir.warnOnNestedGitDirectory(dirPath);
+		const carried = await AiDir.filterCarriedFiles(dirPath, walk.filePaths);
+		const carriedPaths = [...carried.filePaths];
+		const carriedRealPaths = new Set(carriedPaths.map((filePath) => carried.realFilePathByPath.get(filePath) ?? filePath));
+		if (carried.refusedEscapedHidden.size > 0) await AiDir.recoverCarriedFilesFromNamedRoutes({
+			dirPath,
+			carried,
+			carriedPaths,
+			carriedRealPaths,
+			walk
+		});
+		for (const pseudoPath of walk.pseudoPaths) carried.refusedPseudoPaths.add(pseudoPath);
+		AiDir.warnOnCarriedWalkLimits({
+			reportedDirPath,
+			truncations: walk.truncations,
+			unreadablePaths: walk.unreadablePaths
+		});
+		AiDir.warnOnRefusedCarriedFiles(dirPath, carried);
+		const filteredPaths = carriedPaths.toSorted().filter((filePath) => (0, node_path.basename)(filePath) !== excludeFileName);
+		const files = [];
+		let carriedBytes = 0;
+		for (const [index, filePath] of filteredPaths.entries()) {
+			const classifiedPath = carried.realFilePathByPath.get(filePath) ?? filePath;
+			let fileHandle;
+			try {
+				fileHandle = await (0, node_fs_promises.open)(classifiedPath, node_fs.constants.O_RDONLY | (node_fs.constants.O_NOFOLLOW ?? 0));
+			} catch (error) {
+				warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(filePath))}: ${stripControlCharacters(formatError(error))}.`);
+				continue;
+			}
+			try {
+				const fileSize = (await fileHandle.stat()).size;
+				if (carriedBytes + fileSize > 104857600) {
+					warnOnceWithFallback(void 0, `Not carrying ${filteredPaths.length - index} of the ${filteredPaths.length} entries under ${reportedDirPath}: a directory may carry at most ${MAX_CARRIED_BYTES / 1024 / 1024}MB. A symbolic link that reaches a large tree is the usual cause.`);
+					break;
+				}
+				const fileBuffer = await fileHandle.readFile();
+				carriedBytes += fileBuffer.byteLength;
+				files.push({
+					relativeFilePathToDirPath: (0, node_path.relative)(dirPath, filePath),
+					fileBuffer
+				});
+			} catch (error) {
+				warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(filePath))}: ${stripControlCharacters(formatError(error))}.`);
+			} finally {
+				await fileHandle.close();
+			}
+		}
+		return files;
 	}
 };
 const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
@@ -6207,7 +7127,7 @@ var RulesyncSkill = class RulesyncSkill extends AiDir {
 		const skillDirPath = (0, node_path.join)(outputRoot, relativeDirPath, dirName);
 		const skillFilePath = (0, node_path.join)(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${skillFilePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${skillFilePath}: ${formatError(result.error)}`);
@@ -6644,27 +7564,6 @@ function companionFileContentsEquivalent({ filePath, expected, existing, compose
 	return tryFileContentsEquivalent(filePath, expectedText, existingText) ?? false;
 }
 //#endregion
-//#region src/utils/control-characters.ts
-/**
-* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
-* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
-* line and paragraph separators, and the plain LRM/RLM marks. A name or value
-* copied out of an untrusted config file, a fetched repository, or a tool's own
-* settings file must never reach the terminal with these intact: they let the
-* text forge log lines, reorder what is printed around them, or inject escape
-* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
-* neutral characters beside them, so they go too — a diagnostic line is not the
-* place to preserve the typography of a right-to-left name.
-*/
-const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
-/**
-* Removes every control character from `text` so it is safe to splice into a
-* log line or other terminal output.
-*/
-function stripControlCharacters(text) {
-	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
-}
-//#endregion
 //#region src/types/feature-processor.ts
 var FeatureProcessor = class {
 	outputRoot;
@@ -11591,6 +12490,26 @@ function toolSkillSearchRoots(paths) {
 * https://agentskills.io/client-implementation/adding-skills-support
 */
 const AGENT_SKILLS_INTEROP_ROOTS = /* @__PURE__ */ new Set([toPosixPath(AGENTSMD_SKILLS_DIR_PATH), toPosixPath(AMP_SKILLS_GLOBAL_DIR)]);
+/**
+* The one spec violation both sides of the conversion report. Generation warns
+* about it before writing the file; import warns about it because a conformant
+* client would skip the skill entirely, and a user who never sees that has no
+* reason to fix it.
+*/
+const EMPTY_SKILL_DESCRIPTION_VIOLATION = "`description` is required and must not be empty; conformant clients skip a skill without one";
+/**
+* Report a skill read from disk whose `description` is empty. This lives on the
+* read rather than on any one tool class because several targets share one
+* `.agents/skills` tree: which of them reports the skill must not depend on
+* which target the user happened to enable. Every loader calls it — the two
+* directory loaders (`loadSkillDirContent`, `SimulatedSkill.fromDirDefault`)
+* and the flat-file one — so the form a tool stores its skills in does not
+* decide whether the problem is reported either.
+*/
+function warnOnEmptyLoadedDescription({ skillFilePath, description }) {
+	if (typeof description !== "string" || description.length > 0) return;
+	warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ${EMPTY_SKILL_DESCRIPTION_VIOLATION}. Rulesync imports it anyway so the content is not lost; fill it in before relying on this skill.`);
+}
 function isAgentSkillsInteropRoot(relativeDirPath) {
 	return AGENT_SKILLS_INTEROP_ROOTS.has(toPosixPath(relativeDirPath));
 }
@@ -11703,7 +12622,11 @@ var ToolSkill = class extends AiDir {
 		const skillDirPath = (0, node_path.join)(outputRoot, actualRelativeDirPath, dirName);
 		const skillFilePath = (0, node_path.join)(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
+		warnOnEmptyLoadedDescription({
+			skillFilePath,
+			description: frontmatter.description
+		});
 		const otherFiles = await this.collectOtherFiles(outputRoot, actualRelativeDirPath, dirName, SKILL_FILE_NAME);
 		return {
 			outputRoot,
@@ -11828,6 +12751,10 @@ function toSpecConformantAgentSkillFields(section, { coerceMetadata = true } = {
 		...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
 	};
 }
+/** The `SKILL.md` a diagnostic should point at, in the scope it is written to. */
+function agentSkillFilePath({ outputRoot, relativeDirPath, dirName }) {
+	return (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
+}
 /**
 * Collect the normative violations the Agent Skills spec defines for a skill
 * about to be written. These are reported as warnings rather than errors:
@@ -11854,7 +12781,7 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
-	if (description.length === 0) violations.push("`description` is required and must not be empty; conformant clients skip a skill without one");
+	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
 	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
@@ -11973,12 +12900,16 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
+		const skillPath = agentSkillFilePath({
+			outputRoot,
+			relativeDirPath,
+			dirName
+		});
 		for (const violation of collectAgentSkillViolations({
 			frontmatter,
 			dirName,
 			sourceAllowedTools
-		})) warnWithFallback(logger, `${skillPath}: ${violation}`);
+		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -38575,9 +39506,13 @@ var SimulatedSkill = class extends ToolSkill {
 		const skillDirPath = (0, node_path.join)(outputRoot, actualRelativeDirPath, dirName);
 		const skillFilePath = (0, node_path.join)(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
 		const result = SimulatedSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${skillFilePath}: ${formatError(result.error)}`);
+		warnOnEmptyLoadedDescription({
+			skillFilePath,
+			description: result.data.description
+		});
 		const otherFiles = await this.collectOtherFiles(outputRoot, actualRelativeDirPath, dirName, SKILL_FILE_NAME);
 		return {
 			outputRoot,
@@ -42105,7 +43040,7 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 	}
 	static async fromFlatFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		const filePath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
-		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const { frontmatter, body } = parseFrontmatterWithYamlRepair(await readFileContent(filePath), filePath);
 		const result = KimiCodeFlatSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		const fileName = (0, node_path.basename)(relativeFilePath, (0, node_path.extname)(relativeFilePath));
@@ -42115,6 +43050,10 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 			name: result.data.name ?? fileName,
 			description: result.data.description ?? firstBodyLine?.slice(0, 240) ?? "No description provided."
 		};
+		warnOnEmptyLoadedDescription({
+			skillFilePath: filePath,
+			description: normalizedFrontmatter.description
+		});
 		return new KimiCodeSkill({
 			outputRoot,
 			relativeDirPath,
@@ -43118,7 +44057,7 @@ var ReasonixSkill = class ReasonixSkill extends ToolSkill {
 	static async isDirOwned({ outputRoot, relativeDirPath, dirName }) {
 		const skillFilePath = (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
 		try {
-			const { frontmatter } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+			const { frontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath, { quiet: true });
 			return frontmatter["runAs"] !== REASONIX_SUBAGENT_RUN_AS;
 		} catch {
 			return true;
@@ -43487,8 +44426,7 @@ var TaktSkill = class TaktSkill extends ToolSkill {
 		const fullPath = (0, node_path.join)(this.outputRoot, this.relativeDirPath);
 		const resolvedFull = (0, node_path.resolve)(fullPath);
 		const resolvedBase = (0, node_path.resolve)(this.outputRoot);
-		const rel = (0, node_path.relative)(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || node_path.default.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}"`);
+		if (pathEscapesRoot((0, node_path.relative)(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}"`);
 		return fullPath;
 	}
 	getRelativePathFromCwd() {
@@ -48455,7 +49393,7 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
-		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(fileContent, filePath);
 		const result = ReasonixSubagentFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		return new ReasonixSubagent({
@@ -48484,7 +49422,7 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 	static async isFileOwned({ outputRoot, relativeDirPath, relativeFilePath }) {
 		const filePath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
 		try {
-			const { frontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
+			const { frontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(filePath), filePath, { quiet: true });
 			return frontmatter["runAs"] === REASONIX_SUBAGENT_RUN_AS;
 		} catch {
 			return false;
@@ -55878,6 +56816,7 @@ function resolveToolOutputRoot({ outputRoot, toolTarget, global }) {
 * `.rulesync/` files to disk. Rulesync file instances live in memory only.
 */
 async function convertFromTool(params) {
+	resetWarnedOnceMessages();
 	const packagingTarget = [params.fromTool, ...params.toTools].find(isPackagingToolTarget);
 	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import and generate with explicit plugin directories.`);
 	const ctx = params;
@@ -56807,6 +57746,7 @@ async function collectHermesProjectPluginNames({ config, resultsById }) {
 async function generate(params) {
 	const { config, logger } = params;
 	resetRootShadowingWarnings({ logger });
+	resetWarnedOnceMessages();
 	for (const toolTarget of config.getTargets()) for (const outputRoot of config.getOutputRoots(toolTarget)) await assertPluginRootSafe({
 		toolTarget,
 		outputRoot
@@ -57366,6 +58306,7 @@ function getToolOutputRoot({ config, tool }) {
 */
 async function importFromTool(params) {
 	const { config, tool, logger } = params;
+	resetWarnedOnceMessages();
 	await assertPluginRootSafe({
 		toolTarget: tool,
 		outputRoot: getToolOutputRoot({
@@ -58317,6 +59258,12 @@ Object.defineProperty(exports, "parseJsonc", {
 		return parseJsonc$8;
 	}
 });
+Object.defineProperty(exports, "pathEscapesRoot", {
+	enumerable: true,
+	get: function() {
+		return pathEscapesRoot;
+	}
+});
 Object.defineProperty(exports, "readFileContent", {
 	enumerable: true,
 	get: function() {
@@ -58359,6 +59306,12 @@ Object.defineProperty(exports, "removeTempDirectory", {
 		return removeTempDirectory;
 	}
 });
+Object.defineProperty(exports, "resetWarnedOnceMessages", {
+	enumerable: true,
+	get: function() {
+		return resetWarnedOnceMessages;
+	}
+});
 Object.defineProperty(exports, "resolveEffectiveInputRoots", {
 	enumerable: true,
 	get: function() {