rulesync 16.32.0 → 16.32.1

package/dist/{import-0wSuIchf.cjs → import-NHZnMc--.cjs}

@@ -30714,13 +30714,17 @@ function isRemoteMcpServer(serverConfig) {
 function resolveRemoteMcpUrl(serverConfig) {
 	return serverConfig.url || serverConfig.httpUrl || void 0;
 }
-/** The `command` array a `local` server is spawned with, `args` merged in. */
+/**
+* The `command` array a `local` server is spawned with, `args` merged in. An
+* entry carrying `args` but no `command` comes back empty rather than with
+* `args[0]` promoted to its program: every adapter writes element 0 back out
+* as the executable (or the whole array as the command line), so the caller
+* skips such an entry the same way as one with nothing to spawn at all.
+*/
 function resolveLocalMcpCommand(serverConfig) {
-	const commandArray = [];
-	if (serverConfig.command) {
-		if (Array.isArray(serverConfig.command)) commandArray.push(...serverConfig.command);
-		else commandArray.push(serverConfig.command);
-	}
+	const { command } = serverConfig;
+	const commandArray = Array.isArray(command) ? [...command] : command ? [command] : [];
+	if (commandArray.length === 0) return [];
 	if (serverConfig.args) commandArray.push(...serverConfig.args);
 	return commandArray;
 }
@@ -30730,9 +30734,13 @@ function resolveLocalMcpCommand(serverConfig) {
 * spells the transport out. Writing `{type: "local", command: []}` for it would
 * give the tool a server it cannot start and the importer a file it cannot read
 * back, so it is skipped out loud instead.
+*
+* The server name comes straight from the user's config, so it is quoted
+* through `quoteValueForWarning` rather than interpolated: a crafted name could
+* otherwise carry a line break or control characters into the log.
 */
 function warnAndSkipMcpServer({ toolName, serverName, reason, logger }) {
-	logger?.warn(`${toolName} MCP: skipping "${serverName}" because it declares ${reason}.`);
+	logger?.warn(`${toolName} MCP: skipping ${quoteValueForWarning(serverName)} because it declares ${reason}.`);
 	return null;
 }
 /**
@@ -30820,8 +30828,10 @@ function asBobRemoteType(stated, url) {
 * streamable HTTP server carries `type: "streamable-http"` and `url`, and an
 * SSE server carries a bare `url`. The canonical `transport` alias and the
 * Claude-style `httpUrl` alias are folded into `type`/`url`; `env`, `cwd`,
-* `headers`, `timeout`, `alwaysAllow` and `disabled` pass through unchanged,
-* as Bob documents all of them.
+* `headers`, `timeout`, `alwaysAllow` and `disabled` pass through, as Bob
+* documents all of them (`env` and `headers` with their prototype-pollution
+* keys dropped, since Bob spreads those maps into the process environment and
+* the HTTP requests).
 *
 * Bob Shell documents the same file with an `httpURL` key instead of
 * `type` + `url` for streamable HTTP. rulesync writes the IDE spelling (the two
@@ -31763,7 +31773,7 @@ function convertRemoteServer({ serverName, serverConfig, logger }) {
 	return converted;
 }
 function convertStdioServer({ serverName, serverConfig, logger }) {
-	const [command, ...args] = (typeof serverConfig.command === "string" ? serverConfig.command !== "" : Array.isArray(serverConfig.command) && serverConfig.command.length > 0) ? resolveLocalMcpCommand(serverConfig) : [];
+	const [command, ...args] = resolveLocalMcpCommand(serverConfig);
 	if (!command) {
 		warnAndSkipMcpServer({
 			toolName: "Continue",
@@ -31779,7 +31789,7 @@ function convertStdioServer({ serverName, serverConfig, logger }) {
 	};
 	if (args.length > 0) converted.args = args;
 	if (isRecord$1(serverConfig.env)) converted.env = omitPrototypePollutionKeys(serverConfig.env);
-	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server "${serverName}" was not written; put the variables in "env" instead.`);
+	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server ${quoteValueForWarning(serverName)} was not written; put the variables in "env" instead.`);
 	return converted;
 }
 /**

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_import = require("./import-0wSuIchf.cjs");
+const require_import = require("./import-NHZnMc--.cjs");
 //#region src/index.ts
 async function generate(options = {}) {
 	const { silent = true, verbose = false, ...rest } = options;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { In as ALL_FEATURES, at as ConfigResolver, en as ALL_TOOL_TARGETS, i as inspectInputRoots, mt as ConsoleLogger, o as convertFromTool$1, r as generate$1, t as importFromTool$1 } from "./import-D5n_V39C.js";
+import { In as ALL_FEATURES, at as ConfigResolver, en as ALL_TOOL_TARGETS, i as inspectInputRoots, mt as ConsoleLogger, o as convertFromTool$1, r as generate$1, t as importFromTool$1 } from "./import-CT7-pKL6.js";
 //#region src/index.ts
 async function generate(options = {}) {
 	const { silent = true, verbose = false, ...rest } = options;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulesync",
-  "version": "16.32.0",
+  "version": "16.32.1",
   "description": "Unified AI rules management CLI tool that generates configuration files for various AI development tools",
   "keywords": [
     "ai",