rulesync 16.39.1 → 17.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -44319,14 +44319,10 @@ function convertRulesyncToCodexProfile({ config, logger }) {
44319
44319
  }
44320
44320
  logger?.warn(`Codex CLI permissions support only read/edit/write/webfetch categories. Skipping: ${toolName}`);
44321
44321
  }
44322
- for (const [pattern, access] of mergeFilesystemCategoryRules({
44322
+ addCodexFilesystemRules({
44323
44323
  categoryRules: filesystemCategoryRules,
44324
- logger
44325
- })) addFilesystemRule({
44326
44324
  filesystem,
44327
44325
  workspaceRootFilesystem,
44328
- pattern,
44329
- access,
44330
44326
  logger
44331
44327
  });
44332
44328
  applyDefaultGitWriteRules({
@@ -44351,6 +44347,29 @@ function convertRulesyncToCodexProfile({ config, logger }) {
44351
44347
  ...network ? { network } : {}
44352
44348
  };
44353
44349
  }
44350
+ function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFilesystem, logger }) {
44351
+ for (const rule of mergeFilesystemCategoryRules({
44352
+ categoryRules,
44353
+ logger
44354
+ })) {
44355
+ const access = normalizeCodexFilesystemAccess({
44356
+ pattern: rule.pattern,
44357
+ access: rule.access,
44358
+ writeRestriction: rule.writeRestriction,
44359
+ logger
44360
+ });
44361
+ if (access === void 0) continue;
44362
+ if (access === "read" && rule.writeRestriction === "ask") logger?.warn(`Codex CLI cannot express "ask" for filesystem write permissions: pattern "${rule.pattern}" will be emitted as read-only.`);
44363
+ if (access === "read" && rule.writeRestriction === "deny") logger?.warn(`Codex CLI maps a write-side deny to read-only access: pattern "${rule.pattern}" will be emitted as "read". A broader read deny may be overridden by this more-specific path.`);
44364
+ addFilesystemRule({
44365
+ filesystem,
44366
+ workspaceRootFilesystem,
44367
+ pattern: rule.pattern,
44368
+ access,
44369
+ logger
44370
+ });
44371
+ }
44372
+ }
44354
44373
  function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem }) {
44355
44374
  if (config.codexcli?.git_write_rules === false) return;
44356
44375
  if (config.codexcli?.base_permission_profile === CODEX_READ_ONLY_BASELINE) return;
@@ -44500,6 +44519,23 @@ function addFilesystemRule({ filesystem, workspaceRootFilesystem, pattern, acces
44500
44519
  }
44501
44520
  workspaceRootFilesystem[pattern] = access;
44502
44521
  }
44522
+ function normalizeCodexFilesystemAccess({ pattern, access, writeRestriction, logger }) {
44523
+ if ((access === "read" || access === "write") && hasUnsupportedCodexFilesystemGlob(pattern)) {
44524
+ if (writeRestriction !== void 0) {
44525
+ logger?.warn(`Codex CLI only supports deny access for non-trailing filesystem globs: pattern "${pattern}" will be emitted as "deny" because its write-side ${writeRestriction} restriction cannot be represented as read-only access. Use an exact path or trailing "/**" for read/write access.`);
44526
+ return "deny";
44527
+ }
44528
+ logger?.warn(`Skipping unsupported Codex CLI ${access} filesystem glob "${pattern}"; the base permission profile remains in effect. Use an exact path or trailing "/**" for read/write access.`);
44529
+ return;
44530
+ }
44531
+ return access;
44532
+ }
44533
+ function hasCodexFilesystemGlob(pattern) {
44534
+ return pattern.includes("*") || pattern.includes("?") || pattern.includes("[") || pattern.includes("]");
44535
+ }
44536
+ function hasUnsupportedCodexFilesystemGlob(pattern) {
44537
+ return hasCodexFilesystemGlob(pattern.endsWith("/**") ? pattern.slice(0, -3) : pattern);
44538
+ }
44503
44539
  function canBeCodexFilesystemRoot(pattern) {
44504
44540
  return (0, node_path.isAbsolute)(pattern) || /^[A-Za-z]:[\\/]/.test(pattern) || pattern.startsWith("~/") || pattern === "~" || pattern.startsWith(":");
44505
44541
  }
@@ -44636,30 +44672,8 @@ function mapReadAction(action) {
44636
44672
  return action === "allow" ? "read" : "deny";
44637
44673
  }
44638
44674
  function mapWriteAction(action) {
44639
- return action === "allow" ? "write" : "deny";
44640
- }
44641
- /**
44642
- * Merge the canonical read/edit/write category rules into one Codex access
44643
- * level per path pattern (Codex models a single `deny` < `read` < `write`
44644
- * level, with no `ask`).
44645
- *
44646
- * - `edit` and `write` collapse onto Codex's write side; when both carry the
44647
- * same pattern, the more restrictive action wins (`deny` > `ask` > `allow`).
44648
- * - `read: allow` + write-side `allow` → `"write"`.
44649
- * - `read: allow` + write-side non-allow → `"read"` (readable but not
44650
- * writable — exactly what Codex's `"read"` level expresses).
44651
- * - `read` non-allow → `"deny"` regardless of the write side; a contradictory
44652
- * write-side `allow` (unreadable but writable is not expressible in Codex)
44653
- * is warned about.
44654
- * - Single-category patterns keep the existing mapReadAction/mapWriteAction
44655
- * mappings.
44656
- *
44657
- * Iteration order is read → edit → write with first-seen pattern order, so
44658
- * the emitted table is stable regardless of the authored category order.
44659
- * Note the merge is one-way: `"{path}" = "read"` imports back as
44660
- * `read: allow` only (the explicit write-side deny is implied by Codex's
44661
- * access level and not re-materialized).
44662
- */
44675
+ return action === "allow" ? "write" : "read";
44676
+ }
44663
44677
  function mergeFilesystemCategoryRules({ categoryRules, logger }) {
44664
44678
  const readRules = categoryRules.read ?? {};
44665
44679
  const writeSideRestrictiveness = {
@@ -44683,19 +44697,33 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
44683
44697
  const readAction = readRules[pattern];
44684
44698
  const writeAction = writeSideRules[pattern];
44685
44699
  if (readAction === void 0) {
44686
- merged.push([pattern, mapWriteAction(writeAction)]);
44700
+ merged.push({
44701
+ pattern,
44702
+ access: mapWriteAction(writeAction),
44703
+ ...writeAction === "ask" || writeAction === "deny" ? { writeRestriction: writeAction } : {}
44704
+ });
44687
44705
  continue;
44688
44706
  }
44689
44707
  if (writeAction === void 0) {
44690
- merged.push([pattern, mapReadAction(readAction)]);
44708
+ merged.push({
44709
+ pattern,
44710
+ access: mapReadAction(readAction)
44711
+ });
44691
44712
  continue;
44692
44713
  }
44693
44714
  if (readAction === "allow") {
44694
- merged.push([pattern, writeAction === "allow" ? "write" : "read"]);
44715
+ merged.push({
44716
+ pattern,
44717
+ access: writeAction === "allow" ? "write" : "read",
44718
+ ...writeAction === "ask" || writeAction === "deny" ? { writeRestriction: writeAction } : {}
44719
+ });
44695
44720
  continue;
44696
44721
  }
44697
44722
  if (writeAction === "allow") logger?.warn(`Codex CLI cannot express "writable but not readable": pattern "${pattern}" has read: ${readAction} and a write-side allow. Emitting "deny".`);
44698
- merged.push([pattern, "deny"]);
44723
+ merged.push({
44724
+ pattern,
44725
+ access: "deny"
44726
+ });
44699
44727
  }
44700
44728
  return merged;
44701
44729
  }
@@ -78573,7 +78601,8 @@ const RulesProcessorToolTargetSchema = zod_mini.z.enum(rulesProcessorToolTargetT
78573
78601
  const formatRulePaths = (rules) => rules.map((r) => (0, node_path.join)(r.getRelativeDirPath(), r.getRelativeFilePath())).join(", ");
78574
78602
  const RulesFeatureOptionsSchema = zod_mini.z.looseObject({
78575
78603
  ruleDiscoveryMode: zod_mini.z.optional(zod_mini.z.enum(["none", "explicit"])),
78576
- includeLocalRoot: zod_mini.z.optional(zod_mini.z.boolean())
78604
+ includeLocalRoot: zod_mini.z.optional(zod_mini.z.boolean()),
78605
+ includeRoot: zod_mini.z.optional(zod_mini.z.boolean())
78577
78606
  });
78578
78607
  const resolveRuleDiscoveryMode = ({ defaultMode, options }) => {
78579
78608
  if (defaultMode === "claudecode-legacy") return defaultMode;
@@ -78590,6 +78619,13 @@ const resolveIncludeLocalRoot = (options) => {
78590
78619
  if (!parsed.success) throw new Error(`Invalid options for rules feature: ${parsed.error.message}. \`includeLocalRoot\` must be a boolean.`);
78591
78620
  return parsed.data.includeLocalRoot ?? true;
78592
78621
  };
78622
+ const IncludeRootSchema = zod_mini.z.looseObject({ includeRoot: zod_mini.z.optional(zod_mini.z.boolean()) });
78623
+ const resolveIncludeRoot = (options) => {
78624
+ if (!options) return true;
78625
+ const parsed = IncludeRootSchema.safeParse(options);
78626
+ if (!parsed.success) throw new Error(`Invalid options for rules feature: ${parsed.error.message}. \`includeRoot\` must be a boolean.`);
78627
+ return parsed.data.includeRoot ?? true;
78628
+ };
78593
78629
  /**
78594
78630
  * Whether `candidate` is `base` itself or a class that extends it.
78595
78631
  *
@@ -79135,11 +79171,12 @@ var RulesProcessor = class extends FeatureProcessor {
79135
79171
  async convertRulesyncFilesToToolFiles(rulesyncFiles) {
79136
79172
  const rulesyncRules = rulesyncFiles.filter((file) => file instanceof RulesyncRule);
79137
79173
  const alignedRules = this.alignPiContextFile(rulesyncRules);
79138
- const localRootRules = alignedRules.filter((rule) => rule.getFrontmatter().localRoot);
79139
- const nonLocalRootRules = alignedRules.filter((rule) => !rule.getFrontmatter().localRoot);
79140
79174
  const factory = this.getFactory(this.toolTarget);
79141
79175
  const { meta } = factory;
79142
- const convertedRules = nonLocalRootRules.map((rulesyncRule) => {
79176
+ this.warnForIncludeRootOption(meta);
79177
+ const emittedRules = this.omitsRootFiles() ? alignedRules.filter((rule) => !rule.getFrontmatter().root && !rule.getFrontmatter().localRoot) : alignedRules;
79178
+ const localRootRules = emittedRules.filter((rule) => rule.getFrontmatter().localRoot);
79179
+ const convertedRules = emittedRules.filter((rule) => !rule.getFrontmatter().localRoot).map((rulesyncRule) => {
79143
79180
  if (!factory.class.isTargetedByRulesyncRule(rulesyncRule)) return null;
79144
79181
  return {
79145
79182
  toolRule: factory.class.fromRulesyncRule({
@@ -79276,6 +79313,57 @@ var RulesProcessor = class extends FeatureProcessor {
79276
79313
  getPromptBlockLanguage() {
79277
79314
  return this.isClaudecodeTarget() ? void 0 : this.language;
79278
79315
  }
79316
+ /**
79317
+ * `includeRoot: false` on the `claudecode` target (project scope only)
79318
+ * drops the root `CLAUDE.md` and the personal `CLAUDE.local.md`, keeping the
79319
+ * non-root `.claude/rules/*.md`. Claude Code falls back to `AGENTS.md` only
79320
+ * when none of `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` exists,
79321
+ * so emitting either root file would shadow an `AGENTS.md` written by another
79322
+ * target. Stale root files are swept by the regular orphan deletion because
79323
+ * they are no longer part of the generated output. Global scope keeps the
79324
+ * root file: `~/.claude/CLAUDE.md` never shadows `AGENTS.md`, and Claude Code
79325
+ * reads no global `AGENTS.md` to fall back to. `claudecode-legacy` is not
79326
+ * covered: its `.claude/memories/*.md` are only reachable through the
79327
+ * references listed in the root file.
79328
+ * @see https://code.claude.com/docs/en/memory#when-claude-code-reads-agents-md
79329
+ */
79330
+ omitsRootFiles() {
79331
+ return this.toolTarget === "claudecode" && !this.global && !resolveIncludeRoot(this.featureOptions);
79332
+ }
79333
+ /**
79334
+ * Warn when `includeRoot: false` is set where it has no effect, or where it
79335
+ * silently disables another option that writes into the root file.
79336
+ */
79337
+ warnForIncludeRootOption(meta) {
79338
+ if (resolveIncludeRoot(this.featureOptions)) return;
79339
+ if (this.toolTarget !== "claudecode") {
79340
+ this.logger.warn(`The rules option \`includeRoot\` is only supported by the claudecode target; ignoring it for ${this.toolTarget}.`);
79341
+ return;
79342
+ }
79343
+ if (this.global) {
79344
+ this.logger.warn("The rules option `includeRoot: false` has no effect in global mode: ~/.claude/CLAUDE.md does not shadow AGENTS.md, so it is still generated.");
79345
+ return;
79346
+ }
79347
+ if (resolveRuleDiscoveryMode({
79348
+ defaultMode: meta.ruleDiscoveryMode,
79349
+ options: this.featureOptions
79350
+ }) !== "auto") this.logger.warn("The rules option `ruleDiscoveryMode` has no effect with `includeRoot: false` on claudecode: the rule references it adds are written into CLAUDE.md, which is not generated.");
79351
+ }
79352
+ /**
79353
+ * With `includeRoot: false`, a hand-authored root file at an alternative
79354
+ * location (`.claude/CLAUDE.md`, `.claude/CLAUDE.local.md`) still keeps
79355
+ * Claude Code from reading `AGENTS.md`. Rulesync never writes those files, so
79356
+ * it leaves them in place and tells the user instead of deleting them.
79357
+ */
79358
+ async warnForShadowingAlternativeRoots(alternativeRoots) {
79359
+ const localRootFileName = this.getFactory(this.toolTarget).meta.localRootFileName;
79360
+ const globs = alternativeRoots.flatMap((alt) => [rootRelativeGlob(alt.relativeDirPath, alt.relativeFilePath), ...localRootFileName ? [rootRelativeGlob(alt.relativeDirPath, localRootFileName)] : []]);
79361
+ if (globs.length === 0) return;
79362
+ const filePaths = await findFilesByGlobs(globs, { cwd: this.outputRoot });
79363
+ if (filePaths.length === 0) return;
79364
+ const names = filePaths.map((filePath) => stripControlCharacters((0, node_path.relative)(this.outputRoot, filePath)));
79365
+ this.logger.warn(`${names.join(", ")} still ${names.length === 1 ? "keeps" : "keep"} Claude Code from reading AGENTS.md although \`includeRoot: false\` is set for claudecode. Rulesync does not delete ${names.length === 1 ? "it" : "them"}; remove ${names.length === 1 ? "it" : "them"} by hand once the content is covered by AGENTS.md.`);
79366
+ }
79279
79367
  isClaudecodeTarget() {
79280
79368
  return this.toolTarget === "claudecode" || this.toolTarget === "claudecode-legacy";
79281
79369
  }
@@ -79910,9 +79998,14 @@ As this project's AI coding tool, you must follow the additional conventions bel
79910
79998
  * Resolved once, up front, so the two blocks that need it do not depend
79911
79999
  * on each other's evaluation order.
79912
80000
  */
80001
+ const omitsRootFiles = this.omitsRootFiles();
79913
80002
  const primaryRootFilePaths = settablePaths.root ? await findFilesByGlobs(rootRelativeGlob(settablePaths.root.relativeDirPath ?? ".", settablePaths.root.relativeFilePath), { cwd: this.outputRoot }) : [];
79914
80003
  const rootToolRules = await (async () => {
79915
80004
  if (!settablePaths.root) return [];
80005
+ if (forDeletion && omitsRootFiles) {
80006
+ await this.warnForShadowingAlternativeRoots(settablePaths.alternativeRoots ?? []);
80007
+ return buildDeletionRulesFromPaths(primaryRootFilePaths);
80008
+ }
79916
80009
  const uniqueRootFilePaths = await findFilesWithFallback(primaryRootFilePaths, settablePaths.alternativeRoots, (alt) => rootRelativeGlob(alt.relativeDirPath, alt.relativeFilePath), this.outputRoot);
79917
80010
  if (forDeletion) return buildDeletionRulesFromPaths(uniqueRootFilePaths);
79918
80011
  return await buildImportRulesFromPaths(uniqueRootFilePaths);
@@ -79924,7 +80017,9 @@ As this project's AI coding tool, you must follow the additional conventions bel
79924
80017
  const filePaths = await (async () => {
79925
80018
  if (factory.class.getLocalRootFileGlob) return await findFilesByGlobs(factory.class.getLocalRootFileGlob({ fileName }), { cwd: this.outputRoot });
79926
80019
  if (!settablePaths.root) return [];
79927
- return await findFilesWithFallback(await findFilesByGlobs(rootRelativeGlob(settablePaths.root.relativeDirPath ?? ".", fileName), { cwd: this.outputRoot }), settablePaths.alternativeRoots, (alt) => rootRelativeGlob(alt.relativeDirPath, fileName), this.outputRoot);
80020
+ const primaryLocalFilePaths = await findFilesByGlobs(rootRelativeGlob(settablePaths.root.relativeDirPath ?? ".", fileName), { cwd: this.outputRoot });
80021
+ if (forDeletion && omitsRootFiles) return primaryLocalFilePaths;
80022
+ return await findFilesWithFallback(primaryLocalFilePaths, settablePaths.alternativeRoots, (alt) => rootRelativeGlob(alt.relativeDirPath, fileName), this.outputRoot);
79928
80023
  })();
79929
80024
  if (forDeletion) return buildDeletionRulesFromPaths(filePaths);
79930
80025
  return (await Promise.all(filePaths.map(async (filePath) => {
@@ -44294,14 +44294,10 @@ function convertRulesyncToCodexProfile({ config, logger }) {
44294
44294
  }
44295
44295
  logger?.warn(`Codex CLI permissions support only read/edit/write/webfetch categories. Skipping: ${toolName}`);
44296
44296
  }
44297
- for (const [pattern, access] of mergeFilesystemCategoryRules({
44297
+ addCodexFilesystemRules({
44298
44298
  categoryRules: filesystemCategoryRules,
44299
- logger
44300
- })) addFilesystemRule({
44301
44299
  filesystem,
44302
44300
  workspaceRootFilesystem,
44303
- pattern,
44304
- access,
44305
44301
  logger
44306
44302
  });
44307
44303
  applyDefaultGitWriteRules({
@@ -44326,6 +44322,29 @@ function convertRulesyncToCodexProfile({ config, logger }) {
44326
44322
  ...network ? { network } : {}
44327
44323
  };
44328
44324
  }
44325
+ function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFilesystem, logger }) {
44326
+ for (const rule of mergeFilesystemCategoryRules({
44327
+ categoryRules,
44328
+ logger
44329
+ })) {
44330
+ const access = normalizeCodexFilesystemAccess({
44331
+ pattern: rule.pattern,
44332
+ access: rule.access,
44333
+ writeRestriction: rule.writeRestriction,
44334
+ logger
44335
+ });
44336
+ if (access === void 0) continue;
44337
+ if (access === "read" && rule.writeRestriction === "ask") logger?.warn(`Codex CLI cannot express "ask" for filesystem write permissions: pattern "${rule.pattern}" will be emitted as read-only.`);
44338
+ if (access === "read" && rule.writeRestriction === "deny") logger?.warn(`Codex CLI maps a write-side deny to read-only access: pattern "${rule.pattern}" will be emitted as "read". A broader read deny may be overridden by this more-specific path.`);
44339
+ addFilesystemRule({
44340
+ filesystem,
44341
+ workspaceRootFilesystem,
44342
+ pattern: rule.pattern,
44343
+ access,
44344
+ logger
44345
+ });
44346
+ }
44347
+ }
44329
44348
  function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem }) {
44330
44349
  if (config.codexcli?.git_write_rules === false) return;
44331
44350
  if (config.codexcli?.base_permission_profile === CODEX_READ_ONLY_BASELINE) return;
@@ -44475,6 +44494,23 @@ function addFilesystemRule({ filesystem, workspaceRootFilesystem, pattern, acces
44475
44494
  }
44476
44495
  workspaceRootFilesystem[pattern] = access;
44477
44496
  }
44497
+ function normalizeCodexFilesystemAccess({ pattern, access, writeRestriction, logger }) {
44498
+ if ((access === "read" || access === "write") && hasUnsupportedCodexFilesystemGlob(pattern)) {
44499
+ if (writeRestriction !== void 0) {
44500
+ logger?.warn(`Codex CLI only supports deny access for non-trailing filesystem globs: pattern "${pattern}" will be emitted as "deny" because its write-side ${writeRestriction} restriction cannot be represented as read-only access. Use an exact path or trailing "/**" for read/write access.`);
44501
+ return "deny";
44502
+ }
44503
+ logger?.warn(`Skipping unsupported Codex CLI ${access} filesystem glob "${pattern}"; the base permission profile remains in effect. Use an exact path or trailing "/**" for read/write access.`);
44504
+ return;
44505
+ }
44506
+ return access;
44507
+ }
44508
+ function hasCodexFilesystemGlob(pattern) {
44509
+ return pattern.includes("*") || pattern.includes("?") || pattern.includes("[") || pattern.includes("]");
44510
+ }
44511
+ function hasUnsupportedCodexFilesystemGlob(pattern) {
44512
+ return hasCodexFilesystemGlob(pattern.endsWith("/**") ? pattern.slice(0, -3) : pattern);
44513
+ }
44478
44514
  function canBeCodexFilesystemRoot(pattern) {
44479
44515
  return isAbsolute(pattern) || /^[A-Za-z]:[\\/]/.test(pattern) || pattern.startsWith("~/") || pattern === "~" || pattern.startsWith(":");
44480
44516
  }
@@ -44611,30 +44647,8 @@ function mapReadAction(action) {
44611
44647
  return action === "allow" ? "read" : "deny";
44612
44648
  }
44613
44649
  function mapWriteAction(action) {
44614
- return action === "allow" ? "write" : "deny";
44615
- }
44616
- /**
44617
- * Merge the canonical read/edit/write category rules into one Codex access
44618
- * level per path pattern (Codex models a single `deny` < `read` < `write`
44619
- * level, with no `ask`).
44620
- *
44621
- * - `edit` and `write` collapse onto Codex's write side; when both carry the
44622
- * same pattern, the more restrictive action wins (`deny` > `ask` > `allow`).
44623
- * - `read: allow` + write-side `allow` → `"write"`.
44624
- * - `read: allow` + write-side non-allow → `"read"` (readable but not
44625
- * writable — exactly what Codex's `"read"` level expresses).
44626
- * - `read` non-allow → `"deny"` regardless of the write side; a contradictory
44627
- * write-side `allow` (unreadable but writable is not expressible in Codex)
44628
- * is warned about.
44629
- * - Single-category patterns keep the existing mapReadAction/mapWriteAction
44630
- * mappings.
44631
- *
44632
- * Iteration order is read → edit → write with first-seen pattern order, so
44633
- * the emitted table is stable regardless of the authored category order.
44634
- * Note the merge is one-way: `"{path}" = "read"` imports back as
44635
- * `read: allow` only (the explicit write-side deny is implied by Codex's
44636
- * access level and not re-materialized).
44637
- */
44650
+ return action === "allow" ? "write" : "read";
44651
+ }
44638
44652
  function mergeFilesystemCategoryRules({ categoryRules, logger }) {
44639
44653
  const readRules = categoryRules.read ?? {};
44640
44654
  const writeSideRestrictiveness = {
@@ -44658,19 +44672,33 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
44658
44672
  const readAction = readRules[pattern];
44659
44673
  const writeAction = writeSideRules[pattern];
44660
44674
  if (readAction === void 0) {
44661
- merged.push([pattern, mapWriteAction(writeAction)]);
44675
+ merged.push({
44676
+ pattern,
44677
+ access: mapWriteAction(writeAction),
44678
+ ...writeAction === "ask" || writeAction === "deny" ? { writeRestriction: writeAction } : {}
44679
+ });
44662
44680
  continue;
44663
44681
  }
44664
44682
  if (writeAction === void 0) {
44665
- merged.push([pattern, mapReadAction(readAction)]);
44683
+ merged.push({
44684
+ pattern,
44685
+ access: mapReadAction(readAction)
44686
+ });
44666
44687
  continue;
44667
44688
  }
44668
44689
  if (readAction === "allow") {
44669
- merged.push([pattern, writeAction === "allow" ? "write" : "read"]);
44690
+ merged.push({
44691
+ pattern,
44692
+ access: writeAction === "allow" ? "write" : "read",
44693
+ ...writeAction === "ask" || writeAction === "deny" ? { writeRestriction: writeAction } : {}
44694
+ });
44670
44695
  continue;
44671
44696
  }
44672
44697
  if (writeAction === "allow") logger?.warn(`Codex CLI cannot express "writable but not readable": pattern "${pattern}" has read: ${readAction} and a write-side allow. Emitting "deny".`);
44673
- merged.push([pattern, "deny"]);
44698
+ merged.push({
44699
+ pattern,
44700
+ access: "deny"
44701
+ });
44674
44702
  }
44675
44703
  return merged;
44676
44704
  }
@@ -78548,7 +78576,8 @@ const RulesProcessorToolTargetSchema = z.enum(rulesProcessorToolTargetTuple);
78548
78576
  const formatRulePaths = (rules) => rules.map((r) => join(r.getRelativeDirPath(), r.getRelativeFilePath())).join(", ");
78549
78577
  const RulesFeatureOptionsSchema = z.looseObject({
78550
78578
  ruleDiscoveryMode: z.optional(z.enum(["none", "explicit"])),
78551
- includeLocalRoot: z.optional(z.boolean())
78579
+ includeLocalRoot: z.optional(z.boolean()),
78580
+ includeRoot: z.optional(z.boolean())
78552
78581
  });
78553
78582
  const resolveRuleDiscoveryMode = ({ defaultMode, options }) => {
78554
78583
  if (defaultMode === "claudecode-legacy") return defaultMode;
@@ -78565,6 +78594,13 @@ const resolveIncludeLocalRoot = (options) => {
78565
78594
  if (!parsed.success) throw new Error(`Invalid options for rules feature: ${parsed.error.message}. \`includeLocalRoot\` must be a boolean.`);
78566
78595
  return parsed.data.includeLocalRoot ?? true;
78567
78596
  };
78597
+ const IncludeRootSchema = z.looseObject({ includeRoot: z.optional(z.boolean()) });
78598
+ const resolveIncludeRoot = (options) => {
78599
+ if (!options) return true;
78600
+ const parsed = IncludeRootSchema.safeParse(options);
78601
+ if (!parsed.success) throw new Error(`Invalid options for rules feature: ${parsed.error.message}. \`includeRoot\` must be a boolean.`);
78602
+ return parsed.data.includeRoot ?? true;
78603
+ };
78568
78604
  /**
78569
78605
  * Whether `candidate` is `base` itself or a class that extends it.
78570
78606
  *
@@ -79110,11 +79146,12 @@ var RulesProcessor = class extends FeatureProcessor {
79110
79146
  async convertRulesyncFilesToToolFiles(rulesyncFiles) {
79111
79147
  const rulesyncRules = rulesyncFiles.filter((file) => file instanceof RulesyncRule);
79112
79148
  const alignedRules = this.alignPiContextFile(rulesyncRules);
79113
- const localRootRules = alignedRules.filter((rule) => rule.getFrontmatter().localRoot);
79114
- const nonLocalRootRules = alignedRules.filter((rule) => !rule.getFrontmatter().localRoot);
79115
79149
  const factory = this.getFactory(this.toolTarget);
79116
79150
  const { meta } = factory;
79117
- const convertedRules = nonLocalRootRules.map((rulesyncRule) => {
79151
+ this.warnForIncludeRootOption(meta);
79152
+ const emittedRules = this.omitsRootFiles() ? alignedRules.filter((rule) => !rule.getFrontmatter().root && !rule.getFrontmatter().localRoot) : alignedRules;
79153
+ const localRootRules = emittedRules.filter((rule) => rule.getFrontmatter().localRoot);
79154
+ const convertedRules = emittedRules.filter((rule) => !rule.getFrontmatter().localRoot).map((rulesyncRule) => {
79118
79155
  if (!factory.class.isTargetedByRulesyncRule(rulesyncRule)) return null;
79119
79156
  return {
79120
79157
  toolRule: factory.class.fromRulesyncRule({
@@ -79251,6 +79288,57 @@ var RulesProcessor = class extends FeatureProcessor {
79251
79288
  getPromptBlockLanguage() {
79252
79289
  return this.isClaudecodeTarget() ? void 0 : this.language;
79253
79290
  }
79291
+ /**
79292
+ * `includeRoot: false` on the `claudecode` target (project scope only)
79293
+ * drops the root `CLAUDE.md` and the personal `CLAUDE.local.md`, keeping the
79294
+ * non-root `.claude/rules/*.md`. Claude Code falls back to `AGENTS.md` only
79295
+ * when none of `CLAUDE.md`, `.claude/CLAUDE.md` or `CLAUDE.local.md` exists,
79296
+ * so emitting either root file would shadow an `AGENTS.md` written by another
79297
+ * target. Stale root files are swept by the regular orphan deletion because
79298
+ * they are no longer part of the generated output. Global scope keeps the
79299
+ * root file: `~/.claude/CLAUDE.md` never shadows `AGENTS.md`, and Claude Code
79300
+ * reads no global `AGENTS.md` to fall back to. `claudecode-legacy` is not
79301
+ * covered: its `.claude/memories/*.md` are only reachable through the
79302
+ * references listed in the root file.
79303
+ * @see https://code.claude.com/docs/en/memory#when-claude-code-reads-agents-md
79304
+ */
79305
+ omitsRootFiles() {
79306
+ return this.toolTarget === "claudecode" && !this.global && !resolveIncludeRoot(this.featureOptions);
79307
+ }
79308
+ /**
79309
+ * Warn when `includeRoot: false` is set where it has no effect, or where it
79310
+ * silently disables another option that writes into the root file.
79311
+ */
79312
+ warnForIncludeRootOption(meta) {
79313
+ if (resolveIncludeRoot(this.featureOptions)) return;
79314
+ if (this.toolTarget !== "claudecode") {
79315
+ this.logger.warn(`The rules option \`includeRoot\` is only supported by the claudecode target; ignoring it for ${this.toolTarget}.`);
79316
+ return;
79317
+ }
79318
+ if (this.global) {
79319
+ this.logger.warn("The rules option `includeRoot: false` has no effect in global mode: ~/.claude/CLAUDE.md does not shadow AGENTS.md, so it is still generated.");
79320
+ return;
79321
+ }
79322
+ if (resolveRuleDiscoveryMode({
79323
+ defaultMode: meta.ruleDiscoveryMode,
79324
+ options: this.featureOptions
79325
+ }) !== "auto") this.logger.warn("The rules option `ruleDiscoveryMode` has no effect with `includeRoot: false` on claudecode: the rule references it adds are written into CLAUDE.md, which is not generated.");
79326
+ }
79327
+ /**
79328
+ * With `includeRoot: false`, a hand-authored root file at an alternative
79329
+ * location (`.claude/CLAUDE.md`, `.claude/CLAUDE.local.md`) still keeps
79330
+ * Claude Code from reading `AGENTS.md`. Rulesync never writes those files, so
79331
+ * it leaves them in place and tells the user instead of deleting them.
79332
+ */
79333
+ async warnForShadowingAlternativeRoots(alternativeRoots) {
79334
+ const localRootFileName = this.getFactory(this.toolTarget).meta.localRootFileName;
79335
+ const globs = alternativeRoots.flatMap((alt) => [rootRelativeGlob(alt.relativeDirPath, alt.relativeFilePath), ...localRootFileName ? [rootRelativeGlob(alt.relativeDirPath, localRootFileName)] : []]);
79336
+ if (globs.length === 0) return;
79337
+ const filePaths = await findFilesByGlobs(globs, { cwd: this.outputRoot });
79338
+ if (filePaths.length === 0) return;
79339
+ const names = filePaths.map((filePath) => stripControlCharacters(relative(this.outputRoot, filePath)));
79340
+ this.logger.warn(`${names.join(", ")} still ${names.length === 1 ? "keeps" : "keep"} Claude Code from reading AGENTS.md although \`includeRoot: false\` is set for claudecode. Rulesync does not delete ${names.length === 1 ? "it" : "them"}; remove ${names.length === 1 ? "it" : "them"} by hand once the content is covered by AGENTS.md.`);
79341
+ }
79254
79342
  isClaudecodeTarget() {
79255
79343
  return this.toolTarget === "claudecode" || this.toolTarget === "claudecode-legacy";
79256
79344
  }
@@ -79885,9 +79973,14 @@ As this project's AI coding tool, you must follow the additional conventions bel
79885
79973
  * Resolved once, up front, so the two blocks that need it do not depend
79886
79974
  * on each other's evaluation order.
79887
79975
  */
79976
+ const omitsRootFiles = this.omitsRootFiles();
79888
79977
  const primaryRootFilePaths = settablePaths.root ? await findFilesByGlobs(rootRelativeGlob(settablePaths.root.relativeDirPath ?? ".", settablePaths.root.relativeFilePath), { cwd: this.outputRoot }) : [];
79889
79978
  const rootToolRules = await (async () => {
79890
79979
  if (!settablePaths.root) return [];
79980
+ if (forDeletion && omitsRootFiles) {
79981
+ await this.warnForShadowingAlternativeRoots(settablePaths.alternativeRoots ?? []);
79982
+ return buildDeletionRulesFromPaths(primaryRootFilePaths);
79983
+ }
79891
79984
  const uniqueRootFilePaths = await findFilesWithFallback(primaryRootFilePaths, settablePaths.alternativeRoots, (alt) => rootRelativeGlob(alt.relativeDirPath, alt.relativeFilePath), this.outputRoot);
79892
79985
  if (forDeletion) return buildDeletionRulesFromPaths(uniqueRootFilePaths);
79893
79986
  return await buildImportRulesFromPaths(uniqueRootFilePaths);
@@ -79899,7 +79992,9 @@ As this project's AI coding tool, you must follow the additional conventions bel
79899
79992
  const filePaths = await (async () => {
79900
79993
  if (factory.class.getLocalRootFileGlob) return await findFilesByGlobs(factory.class.getLocalRootFileGlob({ fileName }), { cwd: this.outputRoot });
79901
79994
  if (!settablePaths.root) return [];
79902
- return await findFilesWithFallback(await findFilesByGlobs(rootRelativeGlob(settablePaths.root.relativeDirPath ?? ".", fileName), { cwd: this.outputRoot }), settablePaths.alternativeRoots, (alt) => rootRelativeGlob(alt.relativeDirPath, fileName), this.outputRoot);
79995
+ const primaryLocalFilePaths = await findFilesByGlobs(rootRelativeGlob(settablePaths.root.relativeDirPath ?? ".", fileName), { cwd: this.outputRoot });
79996
+ if (forDeletion && omitsRootFiles) return primaryLocalFilePaths;
79997
+ return await findFilesWithFallback(primaryLocalFilePaths, settablePaths.alternativeRoots, (alt) => rootRelativeGlob(alt.relativeDirPath, fileName), this.outputRoot);
79903
79998
  })();
79904
79999
  if (forDeletion) return buildDeletionRulesFromPaths(filePaths);
79905
80000
  return (await Promise.all(filePaths.map(async (filePath) => {
@@ -82224,4 +82319,4 @@ async function importChecksCore(params) {
82224
82319
  //#endregion
82225
82320
  export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
82226
82321
 
82227
- //# sourceMappingURL=import-B2ANxi1V.js.map
82322
+ //# sourceMappingURL=import-Csmx6n4n.js.map