rulesync 3.14.0 → 3.15.0

package/dist/index.cjs

@@ -112,6 +112,15 @@ async function readOrInitializeFileContent(filePath, initialContent = "") {
     return initialContent;
   }
 }
+function resolvePath(relativePath, baseDir) {
+  if (!baseDir) return relativePath;
+  const resolved = (0, import_node_path.resolve)(baseDir, relativePath);
+  const rel = (0, import_node_path.relative)(baseDir, resolved);
+  if (rel.startsWith("..") || (0, import_node_path.resolve)(resolved) !== resolved) {
+    throw new Error(`Path traversal detected: ${relativePath}`);
+  }
+  return resolved;
+}
 async function directoryExists(dirPath) {
   try {
     const stats = await (0, import_promises.stat)(dirPath);
@@ -176,14 +185,8 @@ function validateBaseDir(baseDir) {
   if (baseDir.includes("..")) {
     throw new Error(`baseDir cannot contain directory traversal (..): ${baseDir}`);
   }
-  if (baseDir.startsWith("/")) {
-    throw new Error(`baseDir must be a relative path. Absolute path not allowed: ${baseDir}`);
-  }
-  if (/^[a-zA-Z]:[/\\]/.test(baseDir)) {
-    throw new Error(`baseDir must be a relative path. Absolute path not allowed: ${baseDir}`);
-  }
-  const normalized = (0, import_node_path.resolve)(".", baseDir);
-  const rel = (0, import_node_path.relative)(".", normalized);
+  const normalized = (0, import_node_path.resolve)(baseDir);
+  const rel = (0, import_node_path.relative)(process.cwd(), normalized);
   if (rel.startsWith("..")) {
     throw new Error(`baseDir cannot contain directory traversal (..): ${baseDir}`);
   }
@@ -1654,9 +1657,28 @@ var CommandsProcessor = class extends FeatureProcessor {
 
 // src/config/config-resolver.ts
 var import_node_path13 = require("path");
-var import_c12 = require("c12");
+var import_jsonc_parser = require("jsonc-parser");
 
 // src/config/config.ts
+var import_mini10 = require("zod/mini");
+var ConfigParamsSchema = import_mini10.z.object({
+  baseDirs: import_mini10.z.array(import_mini10.z.string()),
+  targets: RulesyncTargetsSchema,
+  features: RulesyncFeaturesSchema,
+  verbose: import_mini10.z.boolean(),
+  delete: import_mini10.z.boolean(),
+  // New non-experimental options
+  global: (0, import_mini10.optional)(import_mini10.z.boolean()),
+  simulatedCommands: (0, import_mini10.optional)(import_mini10.z.boolean()),
+  simulatedSubagents: (0, import_mini10.optional)(import_mini10.z.boolean()),
+  modularMcp: (0, import_mini10.optional)(import_mini10.z.boolean()),
+  // Deprecated experimental options (for backward compatibility)
+  experimentalGlobal: (0, import_mini10.optional)(import_mini10.z.boolean()),
+  experimentalSimulateCommands: (0, import_mini10.optional)(import_mini10.z.boolean()),
+  experimentalSimulateSubagents: (0, import_mini10.optional)(import_mini10.z.boolean())
+});
+var PartialConfigParamsSchema = import_mini10.z.partial(ConfigParamsSchema);
+var RequiredConfigParamsSchema = import_mini10.z.required(ConfigParamsSchema);
 var Config = class {
   baseDirs;
   targets;
@@ -1771,46 +1793,18 @@ var ConfigResolver = class {
     experimentalSimulateCommands,
     experimentalSimulateSubagents
   }) {
-    if (!await fileExists(configPath)) {
-      if (experimentalGlobal !== void 0) {
-        warnDeprecatedOptions({ experimentalGlobal });
-      }
-      if (experimentalSimulateCommands !== void 0) {
-        warnDeprecatedOptions({ experimentalSimulateCommands });
-      }
-      if (experimentalSimulateSubagents !== void 0) {
-        warnDeprecatedOptions({ experimentalSimulateSubagents });
+    const validatedConfigPath = resolvePath(configPath, process.cwd());
+    let configByFile = {};
+    if (await fileExists(validatedConfigPath)) {
+      try {
+        const fileContent = await readFileContent(validatedConfigPath);
+        const jsonData = (0, import_jsonc_parser.parse)(fileContent);
+        configByFile = PartialConfigParamsSchema.parse(jsonData);
+      } catch (error) {
+        logger.error(`Failed to load config file: ${formatError(error)}`);
+        throw error;
       }
-      const resolvedGlobal2 = global ?? experimentalGlobal ?? defaults.global;
-      const resolvedSimulatedCommands2 = simulatedCommands ?? experimentalSimulateCommands ?? defaults.simulatedCommands;
-      const resolvedSimulatedSubagents2 = simulatedSubagents ?? experimentalSimulateSubagents ?? defaults.simulatedSubagents;
-      return new Config({
-        targets: targets ?? defaults.targets,
-        features: features ?? defaults.features,
-        verbose: verbose ?? defaults.verbose,
-        delete: isDelete ?? defaults.delete,
-        baseDirs: getBaseDirsInLightOfGlobal({
-          baseDirs: baseDirs ?? defaults.baseDirs,
-          global: resolvedGlobal2
-        }),
-        global: resolvedGlobal2,
-        simulatedCommands: resolvedSimulatedCommands2,
-        simulatedSubagents: resolvedSimulatedSubagents2,
-        modularMcp: modularMcp ?? defaults.modularMcp
-      });
     }
-    const loadOptions = {
-      name: "rulesync",
-      cwd: process.cwd(),
-      rcFile: false,
-      // Disable rc file lookup
-      configFile: "rulesync"
-      // Will look for rulesync.jsonc, rulesync.ts, etc.
-    };
-    if (configPath) {
-      loadOptions.configFile = configPath;
-    }
-    const { config: configByFile } = await (0, import_c12.loadConfig)(loadOptions);
     const deprecatedGlobal = experimentalGlobal ?? configByFile.experimentalGlobal;
     const deprecatedCommands = experimentalSimulateCommands ?? configByFile.experimentalSimulateCommands;
     const deprecatedSubagents = experimentalSimulateSubagents ?? configByFile.experimentalSimulateSubagents;
@@ -1866,20 +1860,18 @@ function getBaseDirsInLightOfGlobal({
   baseDirs,
   global
 }) {
-  if (isEnvTest) {
-    return baseDirs.map((baseDir) => (0, import_node_path13.join)(".", baseDir));
-  }
   if (global) {
     return [getHomeDirectory()];
   }
-  baseDirs.forEach((baseDir) => {
+  const resolvedBaseDirs = baseDirs.map((baseDir) => (0, import_node_path13.resolve)(baseDir));
+  resolvedBaseDirs.forEach((baseDir) => {
     validateBaseDir(baseDir);
   });
-  return baseDirs;
+  return resolvedBaseDirs;
 }
 
 // src/ignore/ignore-processor.ts
-var import_mini10 = require("zod/mini");
+var import_mini11 = require("zod/mini");
 
 // src/ignore/amazonqcli-ignore.ts
 var import_node_path15 = require("path");
@@ -2527,7 +2519,7 @@ var ignoreProcessorToolTargets = [
   "roo",
   "windsurf"
 ];
-var IgnoreProcessorToolTargetSchema = import_mini10.z.enum(ignoreProcessorToolTargets);
+var IgnoreProcessorToolTargetSchema = import_mini11.z.enum(ignoreProcessorToolTargets);
 var IgnoreProcessor = class extends FeatureProcessor {
   toolTarget;
   constructor({
@@ -2702,7 +2694,7 @@ var IgnoreProcessor = class extends FeatureProcessor {
 };
 
 // src/mcp/mcp-processor.ts
-var import_mini12 = require("zod/mini");
+var import_mini13 = require("zod/mini");
 
 // src/mcp/amazonqcli-mcp.ts
 var import_node_path27 = require("path");
@@ -2710,37 +2702,37 @@ var import_node_path27 = require("path");
 // src/mcp/rulesync-mcp.ts
 var import_node_path26 = require("path");
 var import_object = require("es-toolkit/object");
-var import_mini11 = require("zod/mini");
-var McpTransportTypeSchema = import_mini11.z.enum(["stdio", "sse", "http"]);
-var McpServerBaseSchema = import_mini11.z.object({
-  type: import_mini11.z.optional(import_mini11.z.enum(["stdio", "sse", "http"])),
-  command: import_mini11.z.optional(import_mini11.z.union([import_mini11.z.string(), import_mini11.z.array(import_mini11.z.string())])),
-  args: import_mini11.z.optional(import_mini11.z.array(import_mini11.z.string())),
-  url: import_mini11.z.optional(import_mini11.z.string()),
-  httpUrl: import_mini11.z.optional(import_mini11.z.string()),
-  env: import_mini11.z.optional(import_mini11.z.record(import_mini11.z.string(), import_mini11.z.string())),
-  disabled: import_mini11.z.optional(import_mini11.z.boolean()),
-  networkTimeout: import_mini11.z.optional(import_mini11.z.number()),
-  timeout: import_mini11.z.optional(import_mini11.z.number()),
-  trust: import_mini11.z.optional(import_mini11.z.boolean()),
-  cwd: import_mini11.z.optional(import_mini11.z.string()),
-  transport: import_mini11.z.optional(McpTransportTypeSchema),
-  alwaysAllow: import_mini11.z.optional(import_mini11.z.array(import_mini11.z.string())),
-  tools: import_mini11.z.optional(import_mini11.z.array(import_mini11.z.string())),
-  kiroAutoApprove: import_mini11.z.optional(import_mini11.z.array(import_mini11.z.string())),
-  kiroAutoBlock: import_mini11.z.optional(import_mini11.z.array(import_mini11.z.string())),
-  headers: import_mini11.z.optional(import_mini11.z.record(import_mini11.z.string(), import_mini11.z.string()))
+var import_mini12 = require("zod/mini");
+var McpTransportTypeSchema = import_mini12.z.enum(["stdio", "sse", "http"]);
+var McpServerBaseSchema = import_mini12.z.object({
+  type: import_mini12.z.optional(import_mini12.z.enum(["stdio", "sse", "http"])),
+  command: import_mini12.z.optional(import_mini12.z.union([import_mini12.z.string(), import_mini12.z.array(import_mini12.z.string())])),
+  args: import_mini12.z.optional(import_mini12.z.array(import_mini12.z.string())),
+  url: import_mini12.z.optional(import_mini12.z.string()),
+  httpUrl: import_mini12.z.optional(import_mini12.z.string()),
+  env: import_mini12.z.optional(import_mini12.z.record(import_mini12.z.string(), import_mini12.z.string())),
+  disabled: import_mini12.z.optional(import_mini12.z.boolean()),
+  networkTimeout: import_mini12.z.optional(import_mini12.z.number()),
+  timeout: import_mini12.z.optional(import_mini12.z.number()),
+  trust: import_mini12.z.optional(import_mini12.z.boolean()),
+  cwd: import_mini12.z.optional(import_mini12.z.string()),
+  transport: import_mini12.z.optional(McpTransportTypeSchema),
+  alwaysAllow: import_mini12.z.optional(import_mini12.z.array(import_mini12.z.string())),
+  tools: import_mini12.z.optional(import_mini12.z.array(import_mini12.z.string())),
+  kiroAutoApprove: import_mini12.z.optional(import_mini12.z.array(import_mini12.z.string())),
+  kiroAutoBlock: import_mini12.z.optional(import_mini12.z.array(import_mini12.z.string())),
+  headers: import_mini12.z.optional(import_mini12.z.record(import_mini12.z.string(), import_mini12.z.string()))
 });
-var ModularMcpServerSchema = import_mini11.z.extend(McpServerBaseSchema, {
-  description: import_mini11.z.string().check(import_mini11.z.minLength(1))
+var ModularMcpServerSchema = import_mini12.z.extend(McpServerBaseSchema, {
+  description: import_mini12.z.string().check(import_mini12.z.minLength(1))
 });
-var ModularMcpServersSchema = import_mini11.z.record(import_mini11.z.string(), ModularMcpServerSchema);
-var RulesyncMcpServersSchema = import_mini11.z.extend(McpServerBaseSchema, {
-  description: import_mini11.z.optional(import_mini11.z.string()),
-  targets: import_mini11.z.optional(RulesyncTargetsSchema)
+var ModularMcpServersSchema = import_mini12.z.record(import_mini12.z.string(), ModularMcpServerSchema);
+var RulesyncMcpServersSchema = import_mini12.z.extend(McpServerBaseSchema, {
+  description: import_mini12.z.optional(import_mini12.z.string()),
+  targets: import_mini12.z.optional(RulesyncTargetsSchema)
 });
-var RulesyncMcpConfigSchema = import_mini11.z.object({
-  mcpServers: import_mini11.z.record(import_mini11.z.string(), RulesyncMcpServersSchema)
+var RulesyncMcpConfigSchema = import_mini12.z.object({
+  mcpServers: import_mini12.z.record(import_mini12.z.string(), RulesyncMcpServersSchema)
 });
 var RulesyncMcp = class _RulesyncMcp extends RulesyncFile {
   json;
@@ -3537,7 +3529,7 @@ var mcpProcessorToolTargets = [
   "geminicli",
   "roo"
 ];
-var McpProcessorToolTargetSchema = import_mini12.z.enum(
+var McpProcessorToolTargetSchema = import_mini13.z.enum(
   // codexcli is not in the list of tool targets but we add it here because it is a valid tool target for global mode generation
   mcpProcessorToolTargets.concat("codexcli")
 );
@@ -3776,14 +3768,14 @@ var McpProcessor = class extends FeatureProcessor {
 // src/rules/rules-processor.ts
 var import_node_path65 = require("path");
 var import_fast_xml_parser = require("fast-xml-parser");
-var import_mini21 = require("zod/mini");
+var import_mini22 = require("zod/mini");
 
 // src/subagents/agentsmd-subagent.ts
 var import_node_path37 = require("path");
 
 // src/subagents/simulated-subagent.ts
 var import_node_path36 = require("path");
-var import_mini13 = require("zod/mini");
+var import_mini14 = require("zod/mini");
 
 // src/subagents/tool-subagent.ts
 var ToolSubagent = class extends ToolFile {
@@ -3818,9 +3810,9 @@ var ToolSubagent = class extends ToolFile {
 };
 
 // src/subagents/simulated-subagent.ts
-var SimulatedSubagentFrontmatterSchema = import_mini13.z.object({
-  name: import_mini13.z.string(),
-  description: import_mini13.z.string()
+var SimulatedSubagentFrontmatterSchema = import_mini14.z.object({
+  name: import_mini14.z.string(),
+  description: import_mini14.z.string()
 });
 var SimulatedSubagent = class extends ToolSubagent {
   frontmatter;
@@ -4054,22 +4046,22 @@ var RooSubagent = class _RooSubagent extends SimulatedSubagent {
 
 // src/subagents/subagents-processor.ts
 var import_node_path45 = require("path");
-var import_mini16 = require("zod/mini");
+var import_mini17 = require("zod/mini");
 
 // src/subagents/claudecode-subagent.ts
 var import_node_path44 = require("path");
-var import_mini15 = require("zod/mini");
+var import_mini16 = require("zod/mini");
 
 // src/subagents/rulesync-subagent.ts
 var import_node_path43 = require("path");
-var import_mini14 = require("zod/mini");
-var RulesyncSubagentModelSchema = import_mini14.z.enum(["opus", "sonnet", "haiku", "inherit"]);
-var RulesyncSubagentFrontmatterSchema = import_mini14.z.object({
+var import_mini15 = require("zod/mini");
+var RulesyncSubagentModelSchema = import_mini15.z.enum(["opus", "sonnet", "haiku", "inherit"]);
+var RulesyncSubagentFrontmatterSchema = import_mini15.z.object({
   targets: RulesyncTargetsSchema,
-  name: import_mini14.z.string(),
-  description: import_mini14.z.string(),
-  claudecode: import_mini14.z.optional(
-    import_mini14.z.object({
+  name: import_mini15.z.string(),
+  description: import_mini15.z.string(),
+  claudecode: import_mini15.z.optional(
+    import_mini15.z.object({
       model: RulesyncSubagentModelSchema
     })
   )
@@ -4143,10 +4135,10 @@ var RulesyncSubagent = class _RulesyncSubagent extends RulesyncFile {
 };
 
 // src/subagents/claudecode-subagent.ts
-var ClaudecodeSubagentFrontmatterSchema = import_mini15.z.object({
-  name: import_mini15.z.string(),
-  description: import_mini15.z.string(),
-  model: import_mini15.z.optional(import_mini15.z.enum(["opus", "sonnet", "haiku", "inherit"]))
+var ClaudecodeSubagentFrontmatterSchema = import_mini16.z.object({
+  name: import_mini16.z.string(),
+  description: import_mini16.z.string(),
+  model: import_mini16.z.optional(import_mini16.z.enum(["opus", "sonnet", "haiku", "inherit"]))
 });
 var ClaudecodeSubagent = class _ClaudecodeSubagent extends ToolSubagent {
   frontmatter;
@@ -4292,7 +4284,7 @@ var subagentsProcessorToolTargetsSimulated = [
   "roo"
 ];
 var subagentsProcessorToolTargetsGlobal = ["claudecode"];
-var SubagentsProcessorToolTargetSchema = import_mini16.z.enum(subagentsProcessorToolTargets);
+var SubagentsProcessorToolTargetSchema = import_mini17.z.enum(subagentsProcessorToolTargets);
 var SubagentsProcessor = class extends FeatureProcessor {
   toolTarget;
   global;
@@ -4577,23 +4569,23 @@ var import_node_path47 = require("path");
 
 // src/rules/rulesync-rule.ts
 var import_node_path46 = require("path");
-var import_mini17 = require("zod/mini");
-var RulesyncRuleFrontmatterSchema = import_mini17.z.object({
-  root: import_mini17.z.optional(import_mini17.z.optional(import_mini17.z.boolean())),
-  targets: import_mini17.z.optional(RulesyncTargetsSchema),
-  description: import_mini17.z.optional(import_mini17.z.string()),
-  globs: import_mini17.z.optional(import_mini17.z.array(import_mini17.z.string())),
-  agentsmd: import_mini17.z.optional(
-    import_mini17.z.object({
+var import_mini18 = require("zod/mini");
+var RulesyncRuleFrontmatterSchema = import_mini18.z.object({
+  root: import_mini18.z.optional(import_mini18.z.optional(import_mini18.z.boolean())),
+  targets: import_mini18.z.optional(RulesyncTargetsSchema),
+  description: import_mini18.z.optional(import_mini18.z.string()),
+  globs: import_mini18.z.optional(import_mini18.z.array(import_mini18.z.string())),
+  agentsmd: import_mini18.z.optional(
+    import_mini18.z.object({
       // @example "path/to/subproject"
-      subprojectPath: import_mini17.z.optional(import_mini17.z.string())
+      subprojectPath: import_mini18.z.optional(import_mini18.z.string())
     })
   ),
-  cursor: import_mini17.z.optional(
-    import_mini17.z.object({
-      alwaysApply: import_mini17.z.optional(import_mini17.z.boolean()),
-      description: import_mini17.z.optional(import_mini17.z.string()),
-      globs: import_mini17.z.optional(import_mini17.z.array(import_mini17.z.string()))
+  cursor: import_mini18.z.optional(
+    import_mini18.z.object({
+      alwaysApply: import_mini18.z.optional(import_mini18.z.boolean()),
+      description: import_mini18.z.optional(import_mini18.z.string()),
+      globs: import_mini18.z.optional(import_mini18.z.array(import_mini18.z.string()))
     })
   )
 });
@@ -5186,9 +5178,9 @@ var ClaudecodeRule = class _ClaudecodeRule extends ToolRule {
 
 // src/rules/cline-rule.ts
 var import_node_path53 = require("path");
-var import_mini18 = require("zod/mini");
-var ClineRuleFrontmatterSchema = import_mini18.z.object({
-  description: import_mini18.z.string()
+var import_mini19 = require("zod/mini");
+var ClineRuleFrontmatterSchema = import_mini19.z.object({
+  description: import_mini19.z.string()
 });
 var ClineRule = class _ClineRule extends ToolRule {
   static getSettablePaths() {
@@ -5335,10 +5327,10 @@ var CodexcliRule = class _CodexcliRule extends ToolRule {
 
 // src/rules/copilot-rule.ts
 var import_node_path55 = require("path");
-var import_mini19 = require("zod/mini");
-var CopilotRuleFrontmatterSchema = import_mini19.z.object({
-  description: import_mini19.z.optional(import_mini19.z.string()),
-  applyTo: import_mini19.z.optional(import_mini19.z.string())
+var import_mini20 = require("zod/mini");
+var CopilotRuleFrontmatterSchema = import_mini20.z.object({
+  description: import_mini20.z.optional(import_mini20.z.string()),
+  applyTo: import_mini20.z.optional(import_mini20.z.string())
 });
 var CopilotRule = class _CopilotRule extends ToolRule {
   frontmatter;
@@ -5505,11 +5497,11 @@ var CopilotRule = class _CopilotRule extends ToolRule {
 
 // src/rules/cursor-rule.ts
 var import_node_path56 = require("path");
-var import_mini20 = require("zod/mini");
-var CursorRuleFrontmatterSchema = import_mini20.z.object({
-  description: import_mini20.z.optional(import_mini20.z.string()),
-  globs: import_mini20.z.optional(import_mini20.z.string()),
-  alwaysApply: import_mini20.z.optional(import_mini20.z.boolean())
+var import_mini21 = require("zod/mini");
+var CursorRuleFrontmatterSchema = import_mini21.z.object({
+  description: import_mini21.z.optional(import_mini21.z.string()),
+  globs: import_mini21.z.optional(import_mini21.z.string()),
+  alwaysApply: import_mini21.z.optional(import_mini21.z.boolean())
 });
 var CursorRule = class _CursorRule extends ToolRule {
   frontmatter;
@@ -6225,7 +6217,7 @@ var rulesProcessorToolTargets = [
   "warp",
   "windsurf"
 ];
-var RulesProcessorToolTargetSchema = import_mini21.z.enum(rulesProcessorToolTargets);
+var RulesProcessorToolTargetSchema = import_mini22.z.enum(rulesProcessorToolTargets);
 var rulesProcessorToolTargetsGlobal = [
   "claudecode",
   "codexcli",
@@ -7715,7 +7707,7 @@ Attention, again, you are just the planner, so though you can read any files and
 }
 
 // src/cli/index.ts
-var getVersion = () => "3.14.0";
+var getVersion = () => "3.15.0";
 var main = async () => {
   const program = new import_commander.Command();
   const version = getVersion();