rulesync 16.16.0 → 16.17.0

package/dist/{import-DimKwtQ6.js → import-u8yswsGB.js}

@@ -1,6 +1,6 @@
 import { ZodError } from "zod";
 import { meta, minLength, nonnegative, optional, refine, z } from "zod/mini";
-import { chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
 import path, { basename, dirname, extname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
 import { parse, printParseErrorCode } from "jsonc-parser";
 import os from "node:os";
@@ -9,6 +9,7 @@ import { globbySync, isGitIgnoredSync } from "globby";
 import matter from "gray-matter";
 import { YAMLException, dump, load } from "js-yaml";
 import { omit } from "es-toolkit/object";
+import { constants } from "node:fs";
 import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import * as smolToml from "smol-toml";
@@ -470,9 +471,22 @@ function isEnvTest() {
 }
 //#endregion
 //#region src/utils/file.ts
+/**
+* Whether a relative path leads out of the root it is relative to. Matching
+* whole segments matters: a directory really named `..cache` relatively
+* resolves to `..cache/file`, which a prefix test would report as an escape.
+*/
 function pathEscapesRoot(relativePath) {
 	return relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath);
 }
+/** Whether a single path segment is a hidden (dot-prefixed) name. */
+function isHiddenPathSegment(segment) {
+	return segment.startsWith(".") && segment !== "." && segment !== "..";
+}
+/** Split a path on both separators, so one predicate serves either platform. */
+function splitPathSegments(filePath) {
+	return filePath.split(/[/\\]/);
+}
 async function assertWritablePathInsideRoot(params) {
 	const { rootPath, targetPath } = params;
 	let existingPath = targetPath;
@@ -703,8 +717,45 @@ async function listDirectoryFiles(dir) {
 		return [];
 	}
 }
+/** How many dot-prefixed segments a path has, used to prefer a named alias over a hidden one. */
+function countHiddenSegments(filePath) {
+	return splitPathSegments(filePath).filter(isHiddenPathSegment).length;
+}
+/**
+* The real file a path denotes, posix-separated so it compares against the globby results
+* that produce it. Two paths share an identity when they resolve to the very same file --
+* a link beside its target, a link into a shared tree, or a cycle that walks back into an
+* ancestor and yields the same file forty levels down.
+*/
+async function realFileIdentity(filePath) {
+	try {
+		return toPosixPath(await realpath(filePath));
+	} catch {
+		return toPosixPath(filePath);
+	}
+}
+/**
+* Pick the one path that represents a file among the paths that resolve to it.
+*
+* The path that walked through no link at all wins outright: it is already the real one,
+* so it equals the file's identity. That keeps the real location of a file as the path
+* callers see, rather than an alias that happens to sort first -- a directory link named
+* `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a cycle must not replace
+* `sub/note.md` with the same file reached back through the cycle.
+* Failing that, the fewest dot-prefixed segments wins: when only links are on offer, the
+* named one represents the entry rather than a hidden alias that a hidden-entry rule may
+* then drop, taking the named path's content with it. `candidates` arrives in sorted
+* order, so ties keep the first one deterministically.
+*/
+function chooseRepresentative(candidates, identity) {
+	return candidates.reduce((best, candidate) => {
+		if (toPosixPath(best) === identity) return best;
+		if (toPosixPath(candidate) === identity) return candidate;
+		return countHiddenSegments(candidate) < countHiddenSegments(best) ? candidate : best;
+	});
+}
 async function findFilesByGlobs(globs, options = {}) {
-	const { type = "all", followSymbolicLinks = true, ignore } = options;
+	const { type = "all", followSymbolicLinks = true, ignore, dot = false } = options;
 	const globbyOptions = type === "file" ? {
 		onlyFiles: true,
 		onlyDirectories: false
@@ -719,23 +770,18 @@ async function findFilesByGlobs(globs, options = {}) {
 	const results = globbySync(normalizedGlobs, {
 		absolute: true,
 		followSymbolicLinks,
+		dot,
 		...ignore ? { ignore: ignore.map((pattern) => pattern.replaceAll("\\", "/")) } : {},
 		...globbyOptions
 	});
-	const seenRealPaths = /* @__PURE__ */ new Set();
-	const deduped = [];
+	const candidatesByFile = /* @__PURE__ */ new Map();
 	for (const result of results.toSorted()) {
-		let realResult;
-		try {
-			realResult = await realpath(result);
-		} catch {
-			realResult = result;
-		}
-		if (seenRealPaths.has(realResult)) continue;
-		seenRealPaths.add(realResult);
-		deduped.push(result);
+		const identity = await realFileIdentity(result);
+		const candidates = candidatesByFile.get(identity);
+		if (candidates === void 0) candidatesByFile.set(identity, [result]);
+		else candidates.push(result);
 	}
-	return deduped;
+	return [...candidatesByFile.entries()].map(([identity, candidates]) => chooseRepresentative(candidates, identity)).toSorted();
 }
 async function removeDirectory(dirPath) {
 	if ([
@@ -894,6 +940,25 @@ var CLIError = class extends Error {
 	}
 };
 //#endregion
+//#region src/utils/warned-once.ts
+/**
+* The messages a once-per-run warning has already emitted in this process.
+* This lives in its own module, free of imports, so the vitest setup file can
+* clear it between tests without pulling `logger.js` into every test's module
+* graph (which would defeat the module mocks some of those tests install).
+*/
+const warnedOnceMessages = /* @__PURE__ */ new Set();
+/** Whether `message` has not been emitted yet; records it when it has not. */
+function claimWarnOnce(message) {
+	if (warnedOnceMessages.has(message)) return false;
+	warnedOnceMessages.add(message);
+	return true;
+}
+/** Forget which warnings were already emitted, so each test starts silent. */
+function resetWarnedOnceMessages() {
+	warnedOnceMessages.clear();
+}
+//#endregion
 //#region src/utils/logger.ts
 /**
 * Base class for shared verbose/silent state and configuration logic
@@ -1046,6 +1111,17 @@ const fallbackLogger = new ConsoleLogger();
 function warnWithFallback(logger, message) {
 	(logger ?? fallbackLogger).warn(message);
 }
+/**
+* Emit a warning at most once per run. A single `generate` reads the same source
+* file once per enabled tool target, so a warning that describes the source
+* rather than the target would otherwise be printed a dozen identical times.
+* Diagnostics that name the file they are about qualify; anything whose text
+* varies with what the user should do next does not.
+*/
+function warnOnceWithFallback(logger, message) {
+	if (!claimWarnOnce(message)) return;
+	warnWithFallback(logger, message);
+}
 //#endregion
 //#region src/utils/validation.ts
 /**
@@ -1990,8 +2066,7 @@ var AiFile = class {
 		const fullPath = path.join(this.outputRoot, this.relativeDirPath, this.relativeFilePath);
 		const resolvedFull = resolve(fullPath);
 		const resolvedBase = resolve(this.outputRoot);
-		const rel = relative(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", relativeFilePath="${this.relativeFilePath}"`);
+		if (pathEscapesRoot(relative(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", relativeFilePath="${this.relativeFilePath}"`);
 		return fullPath;
 	}
 	getFileContent() {
@@ -2053,6 +2128,27 @@ var RulesyncFile = class extends AiFile {
 	}
 };
 //#endregion
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
+* line and paragraph separators, and the plain LRM/RLM marks. A name or value
+* copied out of an untrusted config file, a fetched repository, or a tool's own
+* settings file must never reach the terminal with these intact: they let the
+* text forge log lines, reorder what is printed around them, or inject escape
+* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
+* neutral characters beside them, so they go too — a diagnostic line is not the
+* place to preserve the typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+//#endregion
 //#region src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -2176,7 +2272,7 @@ function parseFrontmatter(content, filePath) {
 	let body;
 	let hasFrontmatter;
 	try {
-		const result = matter(content);
+		const result = matter(content, {});
 		frontmatter = result.data;
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
@@ -2190,6 +2286,104 @@ function parseFrontmatter(content, filePath) {
 		hasFrontmatter
 	};
 }
+/**
+* A top-level `key: value` entry. Nested entries are left alone deliberately:
+* the repair below rewrites a value's meaning, and the failure it exists for —
+* an unquoted sentence with a colon in it — is a `description`, which is always
+* top-level.
+*/
+const TOP_LEVEL_ENTRY_PATTERN = /^([A-Za-z_][\w.-]*):[^\S\r\n]+(\S.*)$/;
+/** A plain scalar that already starts as some other YAML construct. */
+const YAML_CONSTRUCT_PREFIX_PATTERN = /^["'|>&*![{#]/;
+/**
+* Cut a plain scalar at its inline comment — whitespace followed by `#`.
+*
+* This has to happen before anything else looks at the value, or a line such as
+* `allowed-tools: Read # TODO: add Bash later` reads as needing repair and comes
+* back quoted with the comment inside it, which for a list of tool permissions
+* would grant what the comment had disabled. Scanning by hand rather than with
+* `/\s+#.*$/`: that pattern is unanchored, so a long run of spaces with no `#`
+* after it backtracks from every starting position, and a value padded with a
+* megabyte of spaces takes minutes to reject. This is linear in the value.
+*/
+function stripInlineComment(rawValue) {
+	for (let index = 1; index < rawValue.length; index++) if (rawValue[index] === "#" && /\s/.test(rawValue[index - 1] ?? "")) return rawValue.slice(0, index).trimEnd();
+	return rawValue.trimEnd();
+}
+function repairFrontmatterLine(line) {
+	const unchanged = {
+		line,
+		droppedComment: false
+	};
+	const carriageReturn = line.endsWith("\r") ? "\r" : "";
+	const bareLine = carriageReturn === "" ? line : line.slice(0, -1);
+	const match = TOP_LEVEL_ENTRY_PATTERN.exec(bareLine);
+	if (!match) return unchanged;
+	const [, key = "", rawValue = ""] = match;
+	const value = stripInlineComment(rawValue);
+	if (value === "") return unchanged;
+	if (!/:(?:\s|$)/.test(value)) return unchanged;
+	if (YAML_CONSTRUCT_PREFIX_PATTERN.test(value)) return unchanged;
+	return {
+		line: `${key}: ${JSON.stringify(value)}${carriageReturn}`,
+		droppedComment: value !== rawValue.trimEnd()
+	};
+}
+/**
+* Quote the unquoted scalars that make a frontmatter block unparseable, or
+* return `undefined` when there is nothing to repair. Only the frontmatter
+* block is rewritten; the body is passed through untouched.
+*/
+function repairMalformedFrontmatterYaml(content) {
+	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
+	if (!opening) return;
+	const blockStart = opening[0].length;
+	const closing = /\r?\n---/.exec(content.slice(blockStart));
+	if (!closing) return;
+	const blockEnd = blockStart + closing.index;
+	const block = content.slice(blockStart, blockEnd);
+	const repairedLines = block.split("\n").map(repairFrontmatterLine);
+	const repairedBlock = repairedLines.map(({ line }) => line).join("\n");
+	if (repairedBlock === block) return;
+	return {
+		content: content.slice(0, blockStart) + repairedBlock + content.slice(blockEnd),
+		droppedComment: repairedLines.some(({ droppedComment }) => droppedComment)
+	};
+}
+/**
+* Parse frontmatter, retrying once with unquoted colon-bearing values quoted.
+*
+* Files authored for another client routinely carry YAML that only that
+* client's parser accepts — `description: Use this skill when: the user asks
+* about PDFs` is the case the Agent Skills client guide names. Without a retry
+* such a file is not merely reported, it is dropped: the lenient skill import
+* catches the parse error and skips the whole skill. The retry is deliberately
+* narrow — one pass, top-level entries only, and the original error is what
+* surfaces if it does not help, so a genuinely broken file still fails with the
+* message that describes what is actually wrong with it. A file with no closing
+* `---`, or one whose opening fence carries a language tag, is not repaired at
+* all: neither is a frontmatter block gray-matter would have read.
+*
+* @see https://agentskills.io/client-implementation/adding-skills-support
+*/
+function parseFrontmatterWithYamlRepair(content, filePath, options = {}) {
+	try {
+		return parseFrontmatter(content, filePath);
+	} catch (error) {
+		const repaired = repairMalformedFrontmatterYaml(content);
+		if (repaired === void 0) throw error;
+		let result;
+		try {
+			result = parseFrontmatter(repaired.content, filePath);
+		} catch {
+			throw error;
+		}
+		if (options.quiet === true) return result;
+		const commentNote = repaired.droppedComment ? " Text following a space and `#` was read as a YAML comment and left out of the value." : "";
+		warnOnceWithFallback(void 0, `Recovered malformed YAML frontmatter in ${filePath === void 0 ? "the input" : stripControlCharacters(toPosixPath(filePath))} by quoting values that contain a colon.${commentNote} Quote them in the file itself so other tools can read it too.`);
+		return result;
+	}
+}
 //#endregion
 //#region src/features/checks/rulesync-check.ts
 const RulesyncCheckFrontmatterSchema = z.looseObject({
@@ -5859,8 +6053,474 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 	}
 };
 //#endregion
+//#region src/utils/concurrency.ts
+/**
+* Map over items with a bounded number of operations in flight.
+*
+* `Promise.all(items.map(...))` starts every operation at once, which is fine
+* for a handful of paths and not fine for a directory tree of unknown size: a
+* few thousand concurrent `realpath` calls queue on the libuv thread pool and
+* hold their closures alive while they wait. Results keep the input order.
+*
+* `withSemaphore` in `src/lib/github-utils.ts` bounds concurrency too, but it
+* wraps one call at a time: the caller still writes `Promise.all(items.map(…))`
+* around it, so every item's promise chain is allocated up front. This walks a
+* shared cursor with `limit` workers instead, so a list of unknown size costs
+* `limit` pending operations rather than one per item.
+*/
+async function mapWithConcurrency({ items, limit, mapper }) {
+	const results = Array.from({ length: items.length });
+	let nextIndex = 0;
+	const runWorker = async () => {
+		while (nextIndex < items.length) {
+			const index = nextIndex;
+			nextIndex += 1;
+			const item = items[index];
+			if (item === void 0) continue;
+			results[index] = await mapper(item);
+		}
+	};
+	const workerCount = Math.max(1, Math.min(limit, items.length));
+	await Promise.all(Array.from({ length: workerCount }, () => runWorker()));
+	return results;
+}
+//#endregion
 //#region src/types/ai-dir.ts
-var AiDir = class {
+/**
+* Directories that hold credentials. Excluding these protects something, so
+* their exclusion is reported rather than silent.
+*/
+const NEVER_CARRIED_CREDENTIAL_DIR_NAMES = /* @__PURE__ */ new Set([
+	".ssh",
+	".aws",
+	".gnupg"
+]);
+/**
+* Directories that are refused only when the path leaves the skill directory to
+* reach them. These are the per-application trees of a home directory, where
+* naming every credential file is a list always one release behind -- `gcloud`
+* alone writes `credentials.db` and `application_default_credentials.json`, and
+* `.config/anthropic/` holds an API key. A skill that ships a `.config/` of its
+* own still carries it: what is refused is a link that reaches the *user's*.
+*
+* A tool home is deliberately absent. `~/.claude/skills/` and `~/.codex/` hold
+* the global skills this feature exists to share, so refusing a link that
+* reaches one would refuse the ordinary case along with the bad one.
+*/
+const NEVER_CARRIED_ESCAPING_DIR_NAMES = /* @__PURE__ */ new Set([
+	".config",
+	".local",
+	".azure",
+	".m2",
+	".terraform.d",
+	".docker",
+	".kube",
+	"keychains"
+]);
+/**
+* Whether an escaping real path passes through a directory only reachable by
+* escaping.
+*
+* Only the segments *past* the skill directory count. A global skill lives at
+* `~/.config/agents/skills/<name>` for Amp, Devin and Muse alike, so judging
+* the whole real path would refuse a link that never left the skills tree it
+* was already in -- the shared-directory case, reported as a credential.
+*/
+function escapesIntoCredentialDir({ realDirPath, realFilePath }) {
+	const normalize = (segment) => normalizePathSegment(segment.toLowerCase());
+	const dirSegments = splitPathSegments(realDirPath).map(normalize);
+	const fileSegments = splitPathSegments(realFilePath).map(normalize);
+	let shared = 0;
+	while (shared < dirSegments.length && shared < fileSegments.length && dirSegments[shared] === fileSegments[shared]) shared += 1;
+	return (dirSegments.length - shared > 1 ? fileSegments : fileSegments.slice(shared)).some((segment) => NEVER_CARRIED_ESCAPING_DIR_NAMES.has(segment));
+}
+/**
+* Directories that are never part of a skill for the ordinary reasons: a
+* nested repository, or a build/cache tree. Leaving these out is what a user
+* expects, so it happens quietly.
+*/
+const NEVER_CARRIED_NOISE_DIR_NAMES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".cache",
+	".venv",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".next",
+	".nuxt",
+	".turbo",
+	".parcel-cache",
+	".nyc_output",
+	".terraform"
+]);
+/** Files that hold credentials. Compared lower-cased. */
+const NEVER_CARRIED_CREDENTIAL_FILE_NAMES = /* @__PURE__ */ new Set([
+	".npmrc",
+	".netrc",
+	".git-credentials",
+	".pgpass",
+	".pypirc",
+	".htpasswd",
+	".dockercfg",
+	".envrc"
+]);
+/** Files that are local noise. Compared lower-cased. */
+const NEVER_CARRIED_NOISE_FILE_NAMES = /* @__PURE__ */ new Set([".ds_store"]);
+/** Credential files whose parent directory is otherwise ordinary content. */
+const NEVER_CARRIED_PATH_SUFFIXES = [
+	".docker/config.json",
+	".kube/config",
+	".config/gh/hosts.yml",
+	".config/gcloud/credentials.db",
+	".gem/credentials",
+	"gcloud/application_default_credentials.json",
+	".codex/auth.json",
+	".gemini/oauth_creds.json"
+];
+/** Whether a path ends in one of the credential files named above. */
+function endsWithNeverCarriedSuffix(filePath) {
+	const posixPath = toPosixPath(filePath).toLowerCase();
+	return NEVER_CARRIED_PATH_SUFFIXES.some((suffix) => posixPath === suffix || posixPath.endsWith(`/${suffix}`));
+}
+/**
+* `.env.<suffix>` spellings that are templates rather than real values.
+* Everything else matching `.env*` is treated as holding secrets, because
+* `.env.production` is no less sensitive than `.env` itself.
+*/
+const ENV_TEMPLATE_SUFFIXES = /* @__PURE__ */ new Set([
+	"example",
+	"sample",
+	"template",
+	"dist",
+	"defaults"
+]);
+/**
+* Kernel pseudo-filesystems, matched against the resolved real path. A link
+* into one of these does not reach a file at all: `/proc/self/environ` reads
+* back the entire environment of the running process, API keys included, and
+* `stat` reports it as an ordinary file. Nothing a skill carries lives here.
+*/
+const NEVER_CARRIED_REAL_PATH_ROOTS = [
+	"/proc",
+	"/sys",
+	"/dev"
+];
+/**
+* Whether a directory of this name is pruned during the walk, so it is never
+* descended into at all. Derived from the directory names above so the pruning
+* and the path check below cannot drift apart.
+*/
+function isNeverCarriedDirName(dirName) {
+	const normalized = normalizePathSegment(dirName.toLowerCase());
+	return NEVER_CARRIED_CREDENTIAL_DIR_NAMES.has(normalized) || NEVER_CARRIED_NOISE_DIR_NAMES.has(normalized) || isCredentialFileName(normalized);
+}
+/**
+* Windows drops trailing dots and spaces from a name, so a file called `.env `
+* is written as `.env` once it lands in a tool directory there. Normalizing
+* before every comparison means the name is judged as what it becomes.
+*/
+function normalizePathSegment(segment) {
+	const normalized = segment.replace(/[\s.]+$/, "");
+	return normalized === "" ? segment : normalized;
+}
+/**
+* Why a path reaches something that is never skill content, or `undefined`
+* when it does not.
+*
+* Carrying hidden entries means a secret sitting in a skill directory would be
+* copied into every enabled tool root, multiplying the places it can be
+* committed from, and a `.venv` would be copied file by file into each of them.
+* None of these names is ever skill content, so excluding them costs nothing.
+*
+* The check is applied to the resolved real path as well as the literal one:
+* the names are what makes an entry dangerous, and a symbolic link named
+* `vendor` pointing at `~/.aws` is exactly as dangerous as a directory called
+* `.aws`. Comparison is lower-cased because macOS and Windows resolve `.SSH`
+* and `.ssh` to the same file.
+*/
+function classifyNeverCarried(relativePath) {
+	const segments = toPosixPath(relativePath).toLowerCase().split("/").filter((segment) => segment !== "" && segment !== ".").map(normalizePathSegment);
+	const fileName = segments.at(-1) ?? "";
+	const posixPath = segments.join("/");
+	if (segments.slice(0, -1).some((segment) => isCredentialFileName(segment))) return "credential";
+	if (segments.some((segment) => NEVER_CARRIED_CREDENTIAL_DIR_NAMES.has(segment))) return "credential";
+	if (segments.some((segment) => NEVER_CARRIED_NOISE_DIR_NAMES.has(segment))) return "noise";
+	if (isCredentialFileName(fileName)) return "credential";
+	if (NEVER_CARRIED_NOISE_FILE_NAMES.has(fileName)) return "noise";
+	if (NEVER_CARRIED_PATH_SUFFIXES.some((suffix) => posixPath === suffix || posixPath.endsWith(`/${suffix}`))) return "credential";
+}
+/**
+* Whether a single path segment names a credential file, whether it is the file
+* itself or a directory somebody gave that name to.
+*/
+function isCredentialFileName(segment) {
+	const name = normalizePathSegment(segment.toLowerCase());
+	if (NEVER_CARRIED_CREDENTIAL_FILE_NAMES.has(name)) return true;
+	for (const base of [".env", ".envrc"]) {
+		if (name === base) return true;
+		if (name.startsWith(`${base}.`)) {
+			const lastPiece = name.split(".").at(-1) ?? "";
+			return !ENV_TEMPLATE_SUFFIXES.has(lastPiece);
+		}
+	}
+	return false;
+}
+/** Whether a resolved real path points into a kernel pseudo-filesystem. */
+function isSystemPseudoPath(absolutePath) {
+	const posixPath = toPosixPath(absolutePath);
+	return NEVER_CARRIED_REAL_PATH_ROOTS.some((root) => posixPath === root || posixPath.startsWith(`${root}/`));
+}
+/** How many links a chain may be followed before it is treated as a loop. */
+const MAX_LINK_CHAIN_HOPS = 40;
+/**
+* Whether reaching a path goes through a kernel pseudo-filesystem, even when it
+* does not end in one.
+*
+* Asking `realpath` alone is not enough, and the entries it is not enough for
+* are the dangerous ones: `/proc/<pid>/fd/N`, `exe`, `cwd` and `root` are magic
+* links, so resolving them lands *outside* `/proc`, on whatever file the
+* process happens to hold open — a private key another program is reading right
+* now would come back as an ordinary path and be carried. Following the chain a
+* hop at a time, and checking each hop, is what sees the `/proc` in the middle.
+*/
+async function resolvesThroughSystemPseudoPath(filePath) {
+	let currentPath = resolve(filePath);
+	let hops = 0;
+	for (; hops < MAX_LINK_CHAIN_HOPS; hops++) {
+		if (isSystemPseudoPath(currentPath)) return {
+			throughPseudoPath: true,
+			hops
+		};
+		try {
+			if (isSystemPseudoPath(await realpath(dirname(currentPath)))) return {
+				throughPseudoPath: true,
+				hops
+			};
+		} catch {}
+		let linkStats;
+		try {
+			linkStats = await lstat(currentPath);
+		} catch {
+			return {
+				throughPseudoPath: false,
+				hops
+			};
+		}
+		if (!linkStats.isSymbolicLink()) break;
+		let target;
+		try {
+			target = await readlink(currentPath);
+		} catch {
+			return {
+				throughPseudoPath: false,
+				hops
+			};
+		}
+		currentPath = isAbsolute(target) ? target : resolve(dirname(currentPath), target);
+	}
+	return {
+		throughPseudoPath: false,
+		hops
+	};
+}
+const MAX_CARRIED_FILES = 1e4;
+const MAX_CARRIED_DIRECTORIES = 1e4;
+/**
+* The bounds above limit what is *carried*; this one limits what is *looked at*.
+* A directory holding nothing but a few hundred thousand links to itself carries
+* no files and occupies no depth, and would still cost a `stat` apiece.
+*/
+const MAX_CARRIED_ENTRIES_EXAMINED = 2e5;
+const MAX_CARRIED_BYTES = 104857600;
+/** How many `realpath` calls the carried-file filter keeps in flight. */
+const CARRIED_REALPATH_CONCURRENCY = 32;
+/** Sort directory entries by name so a walk of the same tree is reproducible. */
+function compareByName(left, right) {
+	if (left.name === right.name) return 0;
+	return left.name < right.name ? -1 : 1;
+}
+/**
+* Order the routes that cross the same number of symbolic links: the one with
+* the fewest hidden segments first, so a named alias represents a shared tree
+* rather than a hidden one that a hidden-entry rule then refuses, taking the
+* named route's content with it.
+*/
+function comparePendingCarriedDirs(left, right) {
+	if (left.hiddenSegments !== right.hiddenSegments) return left.hiddenSegments - right.hiddenSegments;
+	if (left.depth !== right.depth) return left.depth - right.depth;
+	if (left.dirPath === right.dirPath) return 0;
+	return left.dirPath < right.dirPath ? -1 : 1;
+}
+/**
+* Collect the files under a carried directory, following symbolic links but
+* visiting each real directory exactly once, by its cheapest route.
+*
+* A glob walk cannot do this safely. Two links in one directory that both point
+* back at an ancestor double the paths walked per level, and the walker follows
+* them until the kernel's ELOOP limit (~40), so the path array alone exhausts
+* the heap long before anything reads a file — a depth bound only lowers the
+* exponent, while the base is whatever number of links the tree's author chose.
+* Remembering the real directories already visited removes the multiplication
+* itself: a cycle, and an alias for a directory already walked, both stop at the
+* entry that closes them.
+*
+* Which route represents a directory then matters, because the others are
+* dropped. The walk proceeds in rounds by the number of symbolic links crossed:
+* everything reachable without crossing one, then everything one link away, and
+* so on. A real location therefore always wins over an alias for it — at any
+* nesting depth, not just among siblings, which a depth-first walk could not
+* promise — and among aliases the named one wins over a hidden one.
+*
+* A broken link is skipped: it resolves to nothing to read.
+*/
+async function walkCarriedFiles(dirPath, { skipHiddenRoutes = false } = {}) {
+	const filePaths = [];
+	const visitedRealDirPaths = /* @__PURE__ */ new Set();
+	const truncations = /* @__PURE__ */ new Set();
+	const unreadablePaths = /* @__PURE__ */ new Set();
+	const pseudoPaths = /* @__PURE__ */ new Set();
+	const depthStoppedRealDirPaths = /* @__PURE__ */ new Set();
+	let deferredLinkedDirs = [];
+	/** Whether the walk has hit a bound that ends it rather than one branch of it. */
+	let examinedEntries = 0;
+	const isFull = () => truncations.has("count") || truncations.has("directories") || truncations.has("entries");
+	const addFile = (filePath) => {
+		if (filePaths.length >= 1e4) {
+			truncations.add("count");
+			return;
+		}
+		filePaths.push(filePath);
+	};
+	/** Carry what a symbolic link names, or hold its directory for the next round. */
+	const routeLinkedEntry = async (child, entryName) => {
+		let targetStats;
+		try {
+			targetStats = await stat(child.dirPath);
+		} catch {
+			return;
+		}
+		if (targetStats.isFile()) {
+			addFile(child.dirPath);
+			return;
+		}
+		if (!targetStats.isDirectory() || isNeverCarriedDirName(entryName)) return;
+		const { throughPseudoPath, hops } = await resolvesThroughSystemPseudoPath(child.dirPath);
+		examinedEntries += hops;
+		if (throughPseudoPath) {
+			pseudoPaths.add(child.dirPath);
+			return;
+		}
+		deferredLinkedDirs.push(child);
+	};
+	/** Walk one directory and everything below it that no symbolic link leads to. */
+	const walkWithoutCrossingLinks = async (pending) => {
+		if (isFull()) return;
+		let realCurrentPath;
+		try {
+			realCurrentPath = await realpath(pending.dirPath);
+		} catch {
+			unreadablePaths.add(pending.dirPath);
+			return;
+		}
+		if (visitedRealDirPaths.has(realCurrentPath)) return;
+		if (isSystemPseudoPath(realCurrentPath)) {
+			pseudoPaths.add(pending.dirPath);
+			return;
+		}
+		if (pending.depth > 12) {
+			depthStoppedRealDirPaths.add(realCurrentPath);
+			return;
+		}
+		if (visitedRealDirPaths.size >= 1e4) {
+			truncations.add("directories");
+			return;
+		}
+		visitedRealDirPaths.add(realCurrentPath);
+		let entries;
+		try {
+			entries = await readdir(pending.dirPath, { withFileTypes: true });
+		} catch {
+			unreadablePaths.add(pending.dirPath);
+			return;
+		}
+		const realSubDirs = [];
+		for (const entry of entries.toSorted(compareByName)) {
+			if (isFull()) return;
+			examinedEntries += 1;
+			if (examinedEntries > 2e5) {
+				truncations.add("entries");
+				return;
+			}
+			if (skipHiddenRoutes && isHiddenPathSegment(entry.name)) continue;
+			const entryPath = join(pending.dirPath, entry.name);
+			const child = {
+				dirPath: entryPath,
+				depth: pending.depth + 1,
+				hiddenSegments: pending.hiddenSegments + (isHiddenPathSegment(entry.name) ? 1 : 0)
+			};
+			if (entry.isFile()) {
+				addFile(entryPath);
+				continue;
+			}
+			if (entry.isDirectory()) {
+				if (!isNeverCarriedDirName(entry.name)) realSubDirs.push(child);
+				continue;
+			}
+			if (!entry.isSymbolicLink()) continue;
+			await routeLinkedEntry(child, entry.name);
+		}
+		for (const realSubDir of realSubDirs) {
+			if (isFull()) return;
+			await walkWithoutCrossingLinks(realSubDir);
+		}
+	};
+	let round = [{
+		dirPath,
+		depth: 0,
+		hiddenSegments: 0
+	}];
+	while (round.length > 0 && !isFull()) {
+		deferredLinkedDirs = [];
+		for (const pending of round.toSorted(comparePendingCarriedDirs)) {
+			if (isFull()) break;
+			await walkWithoutCrossingLinks(pending);
+		}
+		round = deferredLinkedDirs;
+	}
+	for (const realDirPath of depthStoppedRealDirPaths) if (!visitedRealDirPaths.has(realDirPath)) {
+		truncations.add("depth");
+		break;
+	}
+	return {
+		filePaths: filePaths.toSorted(),
+		truncations,
+		unreadablePaths: [...unreadablePaths],
+		pseudoPaths: [...pseudoPaths]
+	};
+}
+/** Render a set of refused or noteworthy paths for one warning line. */
+function formatReportedPaths(paths) {
+	const sorted = [...paths].toSorted();
+	const named = sorted.slice(0, 10).map((filePath) => stripControlCharacters(toPosixPath(filePath))).join(", ");
+	const remaining = sorted.length - 10;
+	return {
+		count: sorted.length,
+		list: `${named}${remaining > 0 ? `, and ${remaining} more` : ""}`
+	};
+}
+/** "entry" or "entries", so the warnings below read as sentences. */
+function entryWord(count) {
+	return count === 1 ? "entry" : "entries";
+}
+/** "resolves" or "resolve", to agree with the entry count it follows. */
+function resolveWord(count) {
+	return count === 1 ? "resolves" : "resolve";
+}
+var AiDir = class AiDir {
 	/**
 	* @example "."
 	*/
@@ -5910,8 +6570,7 @@ var AiDir = class {
 		const fullPath = path.join(this.outputRoot, this.relativeDirPath, this.dirName);
 		const resolvedFull = resolve(fullPath);
 		const resolvedBase = resolve(this.outputRoot);
-		const rel = relative(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`);
+		if (pathEscapesRoot(relative(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`);
 		return fullPath;
 	}
 	getMainFile() {
@@ -5937,9 +6596,227 @@ var AiDir = class {
 		};
 	}
 	/**
+	* A nested repository inside a carried directory is the one exclusion worth
+	* reporting: unlike `.DS_Store`, it is there on purpose, and the tree it
+	* points at is simply not reproduced on generate. Only the top level is
+	* checked, which is where a submodule or a stray `git init` puts it, so the
+	* check costs one stat per directory rather than a second walk. `fileExists`
+	* is a bare `stat`, so it answers for a submodule pointer file and for a real
+	* `.git` directory alike.
+	*/
+	static async warnOnNestedGitDirectory(dirPath) {
+		const gitEntryPath = join(dirPath, ".git");
+		if (await fileExists(gitEntryPath)) warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(gitEntryPath))} with its directory: a nested repository is excluded, so the files it tracks are copied but its history is not.`);
+	}
+	/** Whether any segment of a relative path is dot-prefixed. */
+	static hasHiddenSegment(relativePath) {
+		return splitPathSegments(relativePath).some(isHiddenPathSegment);
+	}
+	/**
+	* Whether the entry a path ends at is itself hidden, its ancestors aside.
+	* A shared skill tree usually lives under a dot-directory, so an ancestor
+	* says nothing about the file; its own name is what was chosen for it.
+	*/
+	static hasHiddenName(relativePath) {
+		return isHiddenPathSegment(splitPathSegments(relativePath).at(-1) ?? "");
+	}
+	/**
+	* Drop the entries a skill directory must not carry.
+	*
+	* Three rules. `classifyNeverCarried` comes first, evaluated against the
+	* resolved real path as well as the literal one: names that are never skill
+	* content stay out however they are reached, so renaming a symbolic link
+	* does not turn `~/.aws` into content a skill carries. Next, a real path
+	* inside a kernel pseudo-filesystem is refused outright — that is process
+	* state, not a file.
+	*
+	* The third concerns hidden entries a symbolic link reaches outside the
+	* directory. Following symlinks out of a source tree is deliberate and
+	* documented — it is how a shared skill is referenced from several projects
+	* without being duplicated (issue #1707), and the trust boundary is the tree
+	* you point Rulesync at. Carrying hidden entries changes what that costs,
+	* though: one ordinary-looking link to a home directory would pull in every
+	* dotfile under it, and those are the entries with credential value. What
+	* decides is the name in the skill directory, not what the link resolves
+	* through: a named file keeps its documented behavior even when the target
+	* sits under a dot-directory such as `~/.dotfiles`, because somebody chose
+	* that name. What the link resolves *to* still counts at the end of the path,
+	* though — `notes.md` pointing at `~/.claude/.credentials.json` reaches a
+	* file nobody named for a skill — so a hidden final segment is refused on
+	* either side. Reaching outside is reported either way, since content from
+	* outside the tree is about to be copied into every enabled tool root.
+	*
+	* A path that cannot be resolved is kept: `realpath` fails on a broken link
+	* or a race, and neither is a reason to silently drop a file.
+	*/
+	/** Report what a carried directory left out, once both walks have had their say. */
+	static warnOnRefusedCarriedFiles(dirPath, carried) {
+		const reportedDirPath = stripControlCharacters(toPosixPath(dirPath));
+		if (carried.refusedCredentials.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedCredentials);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} named as a credential store: ${list}. A skill must not ship secrets; read them from the environment instead.`);
+		}
+		if (carried.refusedPseudoPaths.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedPseudoPaths);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that ${resolveWord(count)} into a system pseudo-filesystem: ${list}. Those read back process state, not skill content.`);
+		}
+		if (carried.refusedNoiseAliases.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedNoiseAliases);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that ${resolveWord(count)} into a directory a skill never carries: ${list}. A nested repository, or a build or cache tree, is the usual target.`);
+		}
+		if (carried.refusedEscapedHidden.size > 0) {
+			const { count, list } = formatReportedPaths(carried.refusedEscapedHidden);
+			warnOnceWithFallback(void 0, `Not carrying ${count} hidden ${entryWord(count)} that ${resolveWord(count)} outside ${reportedDirPath}: ${list}. Copy them into the directory if the skill really needs them.`);
+		}
+		if (carried.carriedFromOutside.size > 0) {
+			const { count, list } = formatReportedPaths([...carried.carriedFromOutside].map((filePath) => {
+				const realFilePath = carried.realFilePathByPath.get(filePath);
+				return realFilePath === void 0 ? filePath : `${filePath} -> ${realFilePath}`;
+			}));
+			warnOnceWithFallback(void 0, `Carrying ${count} ${entryWord(count)} that ${resolveWord(count)} outside ${reportedDirPath}: ${list}. Their content is copied into every generated tool directory.`);
+		}
+	}
+	static async filterCarriedFiles(dirPath, filePaths) {
+		let realDirPath;
+		try {
+			realDirPath = await realpath(dirPath);
+		} catch {
+			realDirPath = resolve(dirPath);
+		}
+		const refusedCredentials = /* @__PURE__ */ new Set();
+		const refusedPseudoPaths = /* @__PURE__ */ new Set();
+		const refusedEscapedHidden = /* @__PURE__ */ new Set();
+		const refusedNoiseAliases = /* @__PURE__ */ new Set();
+		const carriedFromOutside = /* @__PURE__ */ new Set();
+		const realFilePathByPath = /* @__PURE__ */ new Map();
+		const verdicts = await mapWithConcurrency({
+			items: filePaths,
+			limit: CARRIED_REALPATH_CONCURRENCY,
+			mapper: async (filePath) => {
+				const literalPath = relative(dirPath, filePath);
+				const literalReason = classifyNeverCarried(literalPath);
+				if (literalReason !== void 0) {
+					if (literalReason === "credential") refusedCredentials.add(filePath);
+					return false;
+				}
+				let realFilePath;
+				try {
+					realFilePath = await realpath(filePath);
+				} catch {
+					return true;
+				}
+				realFilePathByPath.set(filePath, realFilePath);
+				if (isSystemPseudoPath(realFilePath)) {
+					refusedPseudoPaths.add(filePath);
+					return false;
+				}
+				const realPath = relative(realDirPath, realFilePath);
+				const realReason = classifyNeverCarried(realPath);
+				if (realReason !== void 0) {
+					if (realReason === "credential") refusedCredentials.add(filePath);
+					else refusedNoiseAliases.add(filePath);
+					return false;
+				}
+				if (!pathEscapesRoot(realPath)) return true;
+				if ((await resolvesThroughSystemPseudoPath(filePath)).throughPseudoPath) {
+					refusedPseudoPaths.add(filePath);
+					return false;
+				}
+				if (endsWithNeverCarriedSuffix(realFilePath)) {
+					refusedCredentials.add(filePath);
+					return false;
+				}
+				if (escapesIntoCredentialDir({
+					realDirPath,
+					realFilePath
+				})) {
+					refusedCredentials.add(filePath);
+					return false;
+				}
+				if (AiDir.hasHiddenSegment(literalPath) || AiDir.hasHiddenName(realPath)) {
+					refusedEscapedHidden.add(filePath);
+					return false;
+				}
+				carriedFromOutside.add(filePath);
+				return true;
+			}
+		});
+		return {
+			filePaths: filePaths.filter((_filePath, index) => verdicts[index]),
+			realFilePathByPath,
+			refusedCredentials,
+			refusedPseudoPaths,
+			refusedEscapedHidden,
+			refusedNoiseAliases,
+			carriedFromOutside
+		};
+	}
+	/**
+	* Report what the walk had to leave behind, so a skill that silently lost
+	* files says so rather than generating a directory that is quietly short.
+	*/
+	static warnOnCarriedWalkLimits({ reportedDirPath, truncations, unreadablePaths }) {
+		if (truncations.has("depth")) warnOnceWithFallback(void 0, `Not carrying the entries more than 12 directories below ${reportedDirPath}: a skill directory is walked to that depth only. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("count")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} beyond the first ${MAX_CARRIED_FILES}: a directory may carry at most that many files. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("directories")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} below the first ${MAX_CARRIED_DIRECTORIES} directories: a directory may carry files from at most that many directories. A symbolic link that reaches a large tree is the usual cause.`);
+		if (truncations.has("entries")) warnOnceWithFallback(void 0, `Not carrying the entries under ${reportedDirPath} that come after the first ${MAX_CARRIED_ENTRIES_EXAMINED} looked at: a directory is walked over at most that many entries. A tree of symbolic links that lead back into it is the usual cause.`);
+		if (unreadablePaths.length > 0) {
+			const { count, list } = formatReportedPaths(unreadablePaths);
+			warnOnceWithFallback(void 0, `Not carrying ${count} ${entryWord(count)} that could not be read: ${list}. A permission the current user does not hold is the usual cause.`);
+		}
+	}
+	/**
+	* Walk the directory once more with the hidden routes pruned, and take the
+	* files the first walk had to leave behind because the route that reached
+	* them ran through a hidden directory. This can only add files, and only ones
+	* a fully named route reaches.
+	*/
+	static async recoverCarriedFilesFromNamedRoutes({ dirPath, carried, carriedPaths, carriedRealPaths, walk }) {
+		const named = await walkCarriedFiles(dirPath, { skipHiddenRoutes: true });
+		const recovered = await AiDir.filterCarriedFiles(dirPath, named.filePaths);
+		for (const truncation of named.truncations) walk.truncations.add(truncation);
+		for (const unreadablePath of named.unreadablePaths) if (!walk.unreadablePaths.includes(unreadablePath)) walk.unreadablePaths.push(unreadablePath);
+		for (const pseudoPath of named.pseudoPaths) carried.refusedPseudoPaths.add(pseudoPath);
+		for (const refused of recovered.refusedCredentials) carried.refusedCredentials.add(refused);
+		for (const refused of recovered.refusedPseudoPaths) carried.refusedPseudoPaths.add(refused);
+		for (const refused of recovered.refusedNoiseAliases) carried.refusedNoiseAliases.add(refused);
+		for (const refused of recovered.refusedEscapedHidden) carried.refusedEscapedHidden.add(refused);
+		for (const filePath of recovered.filePaths) {
+			const realFilePath = recovered.realFilePathByPath.get(filePath) ?? filePath;
+			if (carriedRealPaths.has(realFilePath)) continue;
+			if (carriedPaths.length >= 1e4) {
+				walk.truncations.add("count");
+				break;
+			}
+			carriedRealPaths.add(realFilePath);
+			carriedPaths.push(filePath);
+			carried.realFilePathByPath.set(filePath, realFilePath);
+			if (recovered.carriedFromOutside.has(filePath)) carried.carriedFromOutside.add(filePath);
+		}
+		for (const filePath of carried.refusedEscapedHidden) {
+			const realFilePath = carried.realFilePathByPath.get(filePath) ?? filePath;
+			if (carriedRealPaths.has(realFilePath)) carried.refusedEscapedHidden.delete(filePath);
+		}
+	}
+	/**
 	* Recursively collects all files from a directory, excluding the specified main file.
 	* This is a common utility for loading additional files alongside the main file.
 	*
+	* Hidden entries are included. The directories this walks are skill trees,
+	* whose specification says a skill directory "may contain any files and
+	* directories beyond the required `SKILL.md`" — a `.env.example` beside the
+	* scripts that read it is content, not noise, and dropping it silently on
+	* both import and generate loses part of the skill. What is left out is the
+	* set of entries that are never skill content — a nested repository's `.git`,
+	* the macOS Finder's `.DS_Store`, credential stores, build and cache trees —
+	* as decided by `classifyNeverCarried`. Whole directories from that set are
+	* pruned during the walk too, so it never descends into them at all.
+	*
+	* The walk is bounded and cycle-aware — see `walkCarriedFiles` — because the
+	* tree may contain symbolic links that somebody else chose.
+	*
+	* @see https://agentskills.io/specification
+	*
 	* @param outputRoot - The base directory path
 	* @param relativeDirPath - The relative path to the directory containing the skill
 	* @param dirName - The name of the directory
@@ -5948,14 +6825,57 @@ var AiDir = class {
 	*/
 	static async collectOtherFiles(outputRoot, relativeDirPath, dirName, excludeFileName) {
 		const dirPath = join(outputRoot, relativeDirPath, dirName);
-		const filteredPaths = (await findFilesByGlobs(join(dirPath, "**", "*"), { type: "file" })).filter((filePath) => basename(filePath) !== excludeFileName);
-		return await Promise.all(filteredPaths.map(async (filePath) => {
-			const fileBuffer = await readFileBuffer(filePath);
-			return {
-				relativeFilePathToDirPath: relative(dirPath, filePath),
-				fileBuffer
-			};
-		}));
+		const walk = await walkCarriedFiles(dirPath);
+		const reportedDirPath = stripControlCharacters(toPosixPath(dirPath));
+		await AiDir.warnOnNestedGitDirectory(dirPath);
+		const carried = await AiDir.filterCarriedFiles(dirPath, walk.filePaths);
+		const carriedPaths = [...carried.filePaths];
+		const carriedRealPaths = new Set(carriedPaths.map((filePath) => carried.realFilePathByPath.get(filePath) ?? filePath));
+		if (carried.refusedEscapedHidden.size > 0) await AiDir.recoverCarriedFilesFromNamedRoutes({
+			dirPath,
+			carried,
+			carriedPaths,
+			carriedRealPaths,
+			walk
+		});
+		for (const pseudoPath of walk.pseudoPaths) carried.refusedPseudoPaths.add(pseudoPath);
+		AiDir.warnOnCarriedWalkLimits({
+			reportedDirPath,
+			truncations: walk.truncations,
+			unreadablePaths: walk.unreadablePaths
+		});
+		AiDir.warnOnRefusedCarriedFiles(dirPath, carried);
+		const filteredPaths = carriedPaths.toSorted().filter((filePath) => basename(filePath) !== excludeFileName);
+		const files = [];
+		let carriedBytes = 0;
+		for (const [index, filePath] of filteredPaths.entries()) {
+			const classifiedPath = carried.realFilePathByPath.get(filePath) ?? filePath;
+			let fileHandle;
+			try {
+				fileHandle = await open(classifiedPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+			} catch (error) {
+				warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(filePath))}: ${stripControlCharacters(formatError(error))}.`);
+				continue;
+			}
+			try {
+				const fileSize = (await fileHandle.stat()).size;
+				if (carriedBytes + fileSize > 104857600) {
+					warnOnceWithFallback(void 0, `Not carrying ${filteredPaths.length - index} of the ${filteredPaths.length} entries under ${reportedDirPath}: a directory may carry at most ${MAX_CARRIED_BYTES / 1024 / 1024}MB. A symbolic link that reaches a large tree is the usual cause.`);
+					break;
+				}
+				const fileBuffer = await fileHandle.readFile();
+				carriedBytes += fileBuffer.byteLength;
+				files.push({
+					relativeFilePathToDirPath: relative(dirPath, filePath),
+					fileBuffer
+				});
+			} catch (error) {
+				warnOnceWithFallback(void 0, `Not carrying ${stripControlCharacters(toPosixPath(filePath))}: ${stripControlCharacters(formatError(error))}.`);
+			} finally {
+				await fileHandle.close();
+			}
+		}
+		return files;
 	}
 };
 const RulesyncSkillFrontmatterSchema = z.looseObject({
@@ -6182,7 +7102,7 @@ var RulesyncSkill = class RulesyncSkill extends AiDir {
 		const skillDirPath = join(outputRoot, relativeDirPath, dirName);
 		const skillFilePath = join(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${skillFilePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${skillFilePath}: ${formatError(result.error)}`);
@@ -6619,27 +7539,6 @@ function companionFileContentsEquivalent({ filePath, expected, existing, compose
 	return tryFileContentsEquivalent(filePath, expectedText, existingText) ?? false;
 }
 //#endregion
-//#region src/utils/control-characters.ts
-/**
-* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
-* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
-* line and paragraph separators, and the plain LRM/RLM marks. A name or value
-* copied out of an untrusted config file, a fetched repository, or a tool's own
-* settings file must never reach the terminal with these intact: they let the
-* text forge log lines, reorder what is printed around them, or inject escape
-* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
-* neutral characters beside them, so they go too — a diagnostic line is not the
-* place to preserve the typography of a right-to-left name.
-*/
-const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
-/**
-* Removes every control character from `text` so it is safe to splice into a
-* log line or other terminal output.
-*/
-function stripControlCharacters(text) {
-	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
-}
-//#endregion
 //#region src/types/feature-processor.ts
 var FeatureProcessor = class {
 	outputRoot;
@@ -11566,6 +12465,26 @@ function toolSkillSearchRoots(paths) {
 * https://agentskills.io/client-implementation/adding-skills-support
 */
 const AGENT_SKILLS_INTEROP_ROOTS = /* @__PURE__ */ new Set([toPosixPath(AGENTSMD_SKILLS_DIR_PATH), toPosixPath(AMP_SKILLS_GLOBAL_DIR)]);
+/**
+* The one spec violation both sides of the conversion report. Generation warns
+* about it before writing the file; import warns about it because a conformant
+* client would skip the skill entirely, and a user who never sees that has no
+* reason to fix it.
+*/
+const EMPTY_SKILL_DESCRIPTION_VIOLATION = "`description` is required and must not be empty; conformant clients skip a skill without one";
+/**
+* Report a skill read from disk whose `description` is empty. This lives on the
+* read rather than on any one tool class because several targets share one
+* `.agents/skills` tree: which of them reports the skill must not depend on
+* which target the user happened to enable. Every loader calls it — the two
+* directory loaders (`loadSkillDirContent`, `SimulatedSkill.fromDirDefault`)
+* and the flat-file one — so the form a tool stores its skills in does not
+* decide whether the problem is reported either.
+*/
+function warnOnEmptyLoadedDescription({ skillFilePath, description }) {
+	if (typeof description !== "string" || description.length > 0) return;
+	warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ${EMPTY_SKILL_DESCRIPTION_VIOLATION}. Rulesync imports it anyway so the content is not lost; fill it in before relying on this skill.`);
+}
 function isAgentSkillsInteropRoot(relativeDirPath) {
 	return AGENT_SKILLS_INTEROP_ROOTS.has(toPosixPath(relativeDirPath));
 }
@@ -11678,7 +12597,11 @@ var ToolSkill = class extends AiDir {
 		const skillDirPath = join(outputRoot, actualRelativeDirPath, dirName);
 		const skillFilePath = join(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
+		warnOnEmptyLoadedDescription({
+			skillFilePath,
+			description: frontmatter.description
+		});
 		const otherFiles = await this.collectOtherFiles(outputRoot, actualRelativeDirPath, dirName, SKILL_FILE_NAME);
 		return {
 			outputRoot,
@@ -11803,6 +12726,10 @@ function toSpecConformantAgentSkillFields(section, { coerceMetadata = true } = {
 		...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
 	};
 }
+/** The `SKILL.md` a diagnostic should point at, in the scope it is written to. */
+function agentSkillFilePath({ outputRoot, relativeDirPath, dirName }) {
+	return join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
+}
 /**
 * Collect the normative violations the Agent Skills spec defines for a skill
 * about to be written. These are reported as warnings rather than errors:
@@ -11829,7 +12756,7 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
-	if (description.length === 0) violations.push("`description` is required and must not be empty; conformant clients skip a skill without one");
+	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
 	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
@@ -11948,12 +12875,16 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
+		const skillPath = agentSkillFilePath({
+			outputRoot,
+			relativeDirPath,
+			dirName
+		});
 		for (const violation of collectAgentSkillViolations({
 			frontmatter,
 			dirName,
 			sourceAllowedTools
-		})) warnWithFallback(logger, `${skillPath}: ${violation}`);
+		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -38550,9 +39481,13 @@ var SimulatedSkill = class extends ToolSkill {
 		const skillDirPath = join(outputRoot, actualRelativeDirPath, dirName);
 		const skillFilePath = join(skillDirPath, SKILL_FILE_NAME);
 		if (!await fileExists(skillFilePath)) throw new Error(`${SKILL_FILE_NAME} not found in ${skillDirPath}`);
-		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath);
 		const result = SimulatedSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${skillFilePath}: ${formatError(result.error)}`);
+		warnOnEmptyLoadedDescription({
+			skillFilePath,
+			description: result.data.description
+		});
 		const otherFiles = await this.collectOtherFiles(outputRoot, actualRelativeDirPath, dirName, SKILL_FILE_NAME);
 		return {
 			outputRoot,
@@ -42080,7 +43015,7 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 	}
 	static async fromFlatFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		const filePath = join(outputRoot, relativeDirPath, relativeFilePath);
-		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const { frontmatter, body } = parseFrontmatterWithYamlRepair(await readFileContent(filePath), filePath);
 		const result = KimiCodeFlatSkillFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		const fileName = basename(relativeFilePath, extname(relativeFilePath));
@@ -42090,6 +43025,10 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 			name: result.data.name ?? fileName,
 			description: result.data.description ?? firstBodyLine?.slice(0, 240) ?? "No description provided."
 		};
+		warnOnEmptyLoadedDescription({
+			skillFilePath: filePath,
+			description: normalizedFrontmatter.description
+		});
 		return new KimiCodeSkill({
 			outputRoot,
 			relativeDirPath,
@@ -43093,7 +44032,7 @@ var ReasonixSkill = class ReasonixSkill extends ToolSkill {
 	static async isDirOwned({ outputRoot, relativeDirPath, dirName }) {
 		const skillFilePath = join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
 		try {
-			const { frontmatter } = parseFrontmatter(await readFileContent(skillFilePath), skillFilePath);
+			const { frontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(skillFilePath), skillFilePath, { quiet: true });
 			return frontmatter["runAs"] !== REASONIX_SUBAGENT_RUN_AS;
 		} catch {
 			return true;
@@ -43462,8 +44401,7 @@ var TaktSkill = class TaktSkill extends ToolSkill {
 		const fullPath = join(this.outputRoot, this.relativeDirPath);
 		const resolvedFull = resolve(fullPath);
 		const resolvedBase = resolve(this.outputRoot);
-		const rel = relative(resolvedBase, resolvedFull);
-		if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}"`);
+		if (pathEscapesRoot(relative(resolvedBase, resolvedFull))) throw new Error(`Path traversal detected: Final path escapes outputRoot. outputRoot="${this.outputRoot}", relativeDirPath="${this.relativeDirPath}"`);
 		return fullPath;
 	}
 	getRelativePathFromCwd() {
@@ -48430,7 +49368,7 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
-		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const { frontmatter, body: content } = parseFrontmatterWithYamlRepair(fileContent, filePath);
 		const result = ReasonixSubagentFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		return new ReasonixSubagent({
@@ -48459,7 +49397,7 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 	static async isFileOwned({ outputRoot, relativeDirPath, relativeFilePath }) {
 		const filePath = join(outputRoot, relativeDirPath, relativeFilePath);
 		try {
-			const { frontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
+			const { frontmatter } = parseFrontmatterWithYamlRepair(await readFileContent(filePath), filePath, { quiet: true });
 			return frontmatter["runAs"] === REASONIX_SUBAGENT_RUN_AS;
 		} catch {
 			return false;
@@ -55853,6 +56791,7 @@ function resolveToolOutputRoot({ outputRoot, toolTarget, global }) {
 * `.rulesync/` files to disk. Rulesync file instances live in memory only.
 */
 async function convertFromTool(params) {
+	resetWarnedOnceMessages();
 	const packagingTarget = [params.fromTool, ...params.toTools].find(isPackagingToolTarget);
 	if (packagingTarget) throw new Error(`Plugin packaging target '${packagingTarget}' is not supported by convert. Use import and generate with explicit plugin directories.`);
 	const ctx = params;
@@ -56782,6 +57721,7 @@ async function collectHermesProjectPluginNames({ config, resultsById }) {
 async function generate(params) {
 	const { config, logger } = params;
 	resetRootShadowingWarnings({ logger });
+	resetWarnedOnceMessages();
 	for (const toolTarget of config.getTargets()) for (const outputRoot of config.getOutputRoots(toolTarget)) await assertPluginRootSafe({
 		toolTarget,
 		outputRoot
@@ -57341,6 +58281,7 @@ function getToolOutputRoot({ config, tool }) {
 */
 async function importFromTool(params) {
 	const { config, tool, logger } = params;
+	resetWarnedOnceMessages();
 	await assertPluginRootSafe({
 		toolTarget: tool,
 		outputRoot: getToolOutputRoot({
@@ -57662,6 +58603,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { SourceEntrySchema as $, RULESYNC_MCP_SCHEMA_URL as $t, RulesyncRule as A, writeFileBuffer as At, RulesyncCommandFrontmatterSchema as B, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Bt, CODEXCLI_DIR as C, removeDirectoryStrict as Ct, RulesyncSubagentFrontmatterSchema as D, resolvePath as Dt, RulesyncSubagent as E, removeTempDirectory as Et, RulesyncHooks as F, ToolTargetSchema as Ft, SHARED_USER_MANAGED_CONFIG_PATHS as G, RULESYNC_HOOKS_FILE_NAME as Gt, RulesyncCheckFrontmatterSchema as H, RULESYNC_CONFIG_SCHEMA_URL as Ht, getRulesyncSourceCandidates as I, MAX_FILE_SIZE as It, mergeInputRootConfigs as J, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Jt, SKILL_FILE_NAME as K, RULESYNC_HOOKS_LEGACY_FILE_NAME as Kt, resolveRulesyncSourceWritePath as L, RULESYNC_AIIGNORE_FILE_NAME as Lt, RulesyncPermissions as M, ALL_TOOL_TARGETS as Mt, RulesyncMcp as N, ALL_TOOL_TARGETS_WITH_WILDCARD as Nt, RulesyncSkill as O, runWithDirectoryRollback as Ot, RulesyncIgnore as P, PACKAGING_TOOL_TARGETS as Pt, GITIGNORE_DESTINATION_KEY as Q, RULESYNC_MCP_RELATIVE_FILE_PATH as Qt, parseJsonc as R, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Rt, CODEXCLI_BASH_RULES_FILE_NAME as S, removeDirectory as St, getLocalSkillDirNames as T, removeFileStrict as Tt, stringifyFrontmatter as U, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Ut, RulesyncCheck as V, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Vt, loadYaml as W, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Wt, CONFLICTING_TARGET_PAIRS as X, RULESYNC_MCP_FILE_NAME as Xt, resolveEffectiveInputRoots as Y, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Yt, ConfigFileSchema as Z, RULESYNC_MCP_LEGACY_FILE_NAME as Zt, CLAUDECODE_LOCAL_RULE_FILE_NAME as _, getHomeDirectory as _t, convertFromTool as a, RULESYNC_RELATIVE_DIR_PATH as an, CLIError as at, CLAUDECODE_SKILLS_DIR_PATH as b, readFileContent as bt, SubagentsProcessor as c, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as cn, assertTreeContainsNoSymlinks as ct, IgnoreProcessor as d, ALL_FEATURES_WITH_WILDCARD as dn, createTempDirectory as dt, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as en, findControlCharacter as et, HooksProcessor as f, DEPRECATED_FEATURE_REPLACEMENTS as fn, directoryExists as ft, CLAUDECODE_DIR as g, getFileSize as gt, QWENCODE_LOCAL_RULE_FILE_NAME as h, findFilesByGlobs as ht, getProcessorRegistryEntry as i, RULESYNC_PERMISSIONS_SCHEMA_URL as in, warnOnConflictingFlags as it, RulesyncRuleFrontmatterSchema as j, writeFileContent as jt, RulesyncSkillFrontmatterSchema as k, toPosixPath as kt, SkillsProcessor as l, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as ln, assertWritablePathInsideRoot as lt, QWENCODE_DIR as m, fileExists as mt, generate as n, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as nn, JsonLogger as nt, isPackagingToolTarget as o, RULESYNC_RULES_RELATIVE_DIR_PATH as on, ErrorCodes as ot, CommandsProcessor as p, formatError as pn, ensureDir as pt, ConfigResolver as q, RULESYNC_HOOKS_RELATIVE_FILE_PATH as qt, inspectInputRoots as r, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as rn, fallbackLogger as rt, RulesProcessor as s, RULESYNC_SKILLS_RELATIVE_DIR_PATH as sn, assertDirectoryIfExists as st, importFromTool as t, RULESYNC_PERMISSIONS_FILE_NAME as tn, ConsoleLogger as tt, McpProcessor as u, ALL_FEATURES as un, checkPathTraversal as ut, CLAUDECODE_MEMORIES_DIR_NAME as v, isSymlink as vt, stripControlCharacters as w, removeFile as wt, ChecksProcessor as x, readFileContentOrNull as xt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as y, listDirectoryFiles as yt, RulesyncCommand as z, RULESYNC_CHECKS_RELATIVE_DIR_PATH as zt };
+export { SourceEntrySchema as $, RULESYNC_MCP_LEGACY_FILE_NAME as $t, RulesyncRuleFrontmatterSchema as A, runWithDirectoryRollback as At, RulesyncCheck as B, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Bt, CODEXCLI_DIR as C, readFileContentOrNull as Ct, RulesyncSkill as D, removeFileStrict as Dt, RulesyncSubagentFrontmatterSchema as E, removeFile as Et, getRulesyncSourceCandidates as F, ALL_TOOL_TARGETS_WITH_WILDCARD as Ft, SHARED_USER_MANAGED_CONFIG_PATHS as G, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Gt, stringifyFrontmatter as H, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Ht, resolveRulesyncSourceWritePath as I, PACKAGING_TOOL_TARGETS as It, mergeInputRootConfigs as J, RULESYNC_HOOKS_LEGACY_FILE_NAME as Jt, SKILL_FILE_NAME as K, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Kt, parseJsonc as L, ToolTargetSchema as Lt, RulesyncMcp as M, writeFileBuffer as Mt, RulesyncIgnore as N, writeFileContent as Nt, RulesyncSkillFrontmatterSchema as O, removeTempDirectory as Ot, RulesyncHooks as P, ALL_TOOL_TARGETS as Pt, GITIGNORE_DESTINATION_KEY as Q, RULESYNC_MCP_FILE_NAME as Qt, RulesyncCommand as R, MAX_FILE_SIZE as Rt, CODEXCLI_BASH_RULES_FILE_NAME as S, readFileContent as St, RulesyncSubagent as T, removeDirectoryStrict as Tt, loadYaml as U, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Ut, RulesyncCheckFrontmatterSchema as V, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Vt, stripControlCharacters as W, RULESYNC_CONFIG_SCHEMA_URL as Wt, CONFLICTING_TARGET_PAIRS as X, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Xt, resolveEffectiveInputRoots as Y, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Yt, ConfigFileSchema as Z, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Zt, CLAUDECODE_LOCAL_RULE_FILE_NAME as _, getFileSize as _t, convertFromTool as a, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as an, resetWarnedOnceMessages as at, CLAUDECODE_SKILLS_DIR_PATH as b, listDirectoryFiles as bt, SubagentsProcessor as c, RULESYNC_RULES_RELATIVE_DIR_PATH as cn, assertDirectoryIfExists as ct, IgnoreProcessor as d, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as dn, checkPathTraversal as dt, RULESYNC_MCP_RELATIVE_FILE_PATH as en, findControlCharacter as et, HooksProcessor as f, ALL_FEATURES as fn, createTempDirectory as ft, CLAUDECODE_DIR as g, findFilesByGlobs as gt, QWENCODE_LOCAL_RULE_FILE_NAME as h, formatError as hn, fileExists as ht, getProcessorRegistryEntry as i, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as in, warnOnConflictingFlags as it, RulesyncPermissions as j, toPosixPath as jt, RulesyncRule as k, resolvePath as kt, SkillsProcessor as l, RULESYNC_SKILLS_RELATIVE_DIR_PATH as ln, assertTreeContainsNoSymlinks as lt, QWENCODE_DIR as m, DEPRECATED_FEATURE_REPLACEMENTS as mn, ensureDir as mt, generate as n, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as nn, JsonLogger as nt, isPackagingToolTarget as o, RULESYNC_PERMISSIONS_SCHEMA_URL as on, CLIError as ot, CommandsProcessor as p, ALL_FEATURES_WITH_WILDCARD as pn, directoryExists as pt, ConfigResolver as q, RULESYNC_HOOKS_FILE_NAME as qt, inspectInputRoots as r, RULESYNC_PERMISSIONS_FILE_NAME as rn, fallbackLogger as rt, RulesProcessor as s, RULESYNC_RELATIVE_DIR_PATH as sn, ErrorCodes as st, importFromTool as t, RULESYNC_MCP_SCHEMA_URL as tn, ConsoleLogger as tt, McpProcessor as u, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as un, assertWritablePathInsideRoot as ut, CLAUDECODE_MEMORIES_DIR_NAME as v, getHomeDirectory as vt, getLocalSkillDirNames as w, removeDirectory as wt, ChecksProcessor as x, pathEscapesRoot as xt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as y, isSymlink as yt, RulesyncCommandFrontmatterSchema as z, RULESYNC_AIIGNORE_FILE_NAME as zt };
 
-//# sourceMappingURL=import-DimKwtQ6.js.map
+//# sourceMappingURL=import-u8yswsGB.js.map