rulesync 30.0.0 → 31.0.0

package/dist/{import-XIYCKmjg.cjs → import-CBvXTNp8.cjs}

@@ -935,6 +935,7 @@ const checksProcessorToolTargetTuple = [
 	"cursor",
 	"factorydroid",
 	"gitlabduo",
+	"goose",
 	"hermesagent",
 	"kilo",
 	"qwencode",
@@ -14221,12 +14222,12 @@ const AmpCheckFrontmatterSchema = zod_mini.z.looseObject({
 * this format continue to apply.
 * @see https://ampcode.com/docs/review
 */
-var AmpCheck = class AmpCheck extends ToolCheck {
+var AmpCheck = class extends ToolCheck {
 	frontmatter;
 	body;
 	constructor({ frontmatter, body, fileContent, ...rest }) {
 		if (rest.validate !== false) {
-			const result = AmpCheckFrontmatterSchema.safeParse(frontmatter);
+			const result = new.target.getFrontmatterSchema().safeParse(frontmatter);
 			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
 		}
 		super({
@@ -14236,6 +14237,26 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		this.frontmatter = frontmatter;
 		this.body = body;
 	}
+	/**
+	* The tool target this check format belongs to, which is also the name of
+	* its tool-specific frontmatter section. Goose reads the same per-file
+	* format with a few extra keys, so `GooseCheck` reuses this class through
+	* these hooks.
+	*/
+	static getCheckToolTarget() {
+		return "amp";
+	}
+	/** The frontmatter schema a check file of this tool is validated against. */
+	static getFrontmatterSchema() {
+		return AmpCheckFrontmatterSchema;
+	}
+	/**
+	* Frontmatter keys only this tool reads. Import moves them into the tool's
+	* own section so they are not passed on to every other checks target.
+	*/
+	static getToolOnlyKeys() {
+		return [];
+	}
 	static getSettablePaths({ global = false } = {}) {
 		return { relativeDirPath: global ? AMP_CHECKS_GLOBAL_DIR : AMP_CHECKS_PROJECT_DIR };
 	}
@@ -14247,6 +14268,10 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 	}
 	toRulesyncCheck() {
 		const { name: _name, description, "severity-default": severityDefault, tools, ...restFields } = this.frontmatter;
+		const checkClass = this.constructor;
+		const toolOnlyKeys = new Set(checkClass.getToolOnlyKeys());
+		const sharedFields = Object.fromEntries(Object.entries(restFields).filter(([key]) => !toolOnlyKeys.has(key)));
+		const toolSection = Object.fromEntries(Object.entries(restFields).filter(([key]) => toolOnlyKeys.has(key)));
 		return new RulesyncCheck({
 			outputRoot: ".",
 			frontmatter: {
@@ -14254,7 +14279,8 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 				...description !== void 0 && { description },
 				...severityDefault !== void 0 && { severity: severityDefault },
 				...tools !== void 0 && { tools },
-				...restFields
+				...sharedFields,
+				...Object.keys(toolSection).length > 0 && { [checkClass.getCheckToolTarget()]: toolSection }
 			},
 			body: this.body,
 			relativeDirPath: RULESYNC_CHECKS_RELATIVE_DIR_PATH,
@@ -14269,22 +14295,24 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		const { targets: _targets, description, severity, tools, ...restFields } = rulesyncFrontmatter;
 		const toolTargetKeys = new Set(ALL_TOOL_TARGETS);
 		const passthroughFields = Object.fromEntries(Object.entries(restFields).filter(([key]) => !toolTargetKeys.has(key) && key !== "name"));
-		const ampSection = this.filterToolSpecificSection(rulesyncFrontmatter.amp ?? {}, ["name"]);
+		const toolTarget = this.getCheckToolTarget();
+		const rawSection = rulesyncFrontmatter[toolTarget];
+		const toolSection = this.filterToolSpecificSection(rawSection !== null && typeof rawSection === "object" && !Array.isArray(rawSection) ? rawSection : {}, ["name"]);
 		const rawAmpFrontmatter = {
 			name,
 			...description !== void 0 && { description },
 			...severity !== void 0 && { "severity-default": severity },
 			...tools !== void 0 && { tools },
 			...passthroughFields,
-			...ampSection
+			...toolSection
 		};
-		const result = AmpCheckFrontmatterSchema.safeParse(rawAmpFrontmatter);
-		if (!result.success) throw new Error(`Invalid amp check frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
+		const result = this.getFrontmatterSchema().safeParse(rawAmpFrontmatter);
+		if (!result.success) throw new Error(`Invalid ${toolTarget} check frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
 		const ampFrontmatter = result.data;
 		const body = rulesyncCheck.getBody();
 		const fileContent = stringifyFrontmatter(body, ampFrontmatter);
 		const paths = this.getSettablePaths({ global });
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			frontmatter: ampFrontmatter,
 			body,
@@ -14299,7 +14327,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 			success: true,
 			error: null
 		};
-		const result = AmpCheckFrontmatterSchema.safeParse(this.frontmatter);
+		const result = this.constructor.getFrontmatterSchema().safeParse(this.frontmatter);
 		if (result.success) return {
 			success: true,
 			error: null
@@ -14312,7 +14340,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 	static isTargetedByRulesyncCheck(rulesyncCheck) {
 		return this.isTargetedByRulesyncCheckDefault({
 			rulesyncCheck,
-			toolTarget: "amp"
+			toolTarget: this.getCheckToolTarget()
 		});
 	}
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
@@ -14320,9 +14348,9 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
 		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
-		const result = AmpCheckFrontmatterSchema.safeParse(frontmatter);
+		const result = this.getFrontmatterSchema().safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath,
@@ -14333,7 +14361,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		});
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -15433,6 +15461,60 @@ var GitlabduoCheck = class GitlabduoCheck extends ToolCheck {
 	}
 };
 //#endregion
+//#region src/constants/goose-paths.ts
+const GOOSE_DIR = ".goose";
+const GOOSE_GLOBAL_DIR = (0, node_path.join)(".config", "goose");
+const GOOSE_RULE_FILE_NAME = ".goosehints";
+const GOOSE_MCP_FILE_NAME = "config.yaml";
+const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
+const GOOSE_HOOKS_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync", "hooks");
+const GOOSE_HOOKS_FILE_NAME = "hooks.json";
+const GOOSE_PLUGIN_MCP_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync");
+const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
+const GOOSE_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "skills");
+const GOOSE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "skills");
+const GOOSE_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "recipes");
+const GOOSE_GLOBAL_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "recipes");
+const GOOSE_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "agents");
+const GOOSE_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "agents");
+const GOOSE_CHECKS_PROJECT_DIR = (0, node_path.join)(".agents", "checks");
+const GOOSE_CHECKS_GLOBAL_DIR = (0, node_path.join)(GOOSE_GLOBAL_DIR, "checks");
+//#endregion
+//#region src/features/checks/goose-check.ts
+const GooseCheckFrontmatterSchema = zod_mini.z.extend(AmpCheckFrontmatterSchema, {
+	model: zod_mini.z.optional(zod_mini.z.string()),
+	"turn-limit": zod_mini.z.optional(zod_mini.z.int().check(zod_mini.z.nonnegative()))
+});
+/**
+* Represents a Goose review check (`goose review`), written to the user-wide
+* `~/.config/goose/checks/` (global scope only).
+*
+* Goose discovers repository checks in `.agents/checks/*.md`, the same
+* cross-tool directory the `amp` checks target already writes (Goose's
+* `tools` and `severity-default` fields exist for parity with Amp's), so the
+* project scope is left to `amp` rather than having two targets own the same
+* files. Its global discovery reads `~/.config/goose/checks/` first, then
+* `~/.config/agents/checks/`. The file format is Amp's, so this class reuses
+* `AmpCheck` and adds Goose's `model` and `turn-limit`, which live in the
+* `goose:` section of a rulesync check; `name` is derived from the file name.
+*
+* @see https://github.com/aaif-goose/goose/blob/main/crates/goose/src/checks/mod.rs
+*/
+var GooseCheck = class extends AmpCheck {
+	static getCheckToolTarget() {
+		return "goose";
+	}
+	static getFrontmatterSchema() {
+		return GooseCheckFrontmatterSchema;
+	}
+	static getToolOnlyKeys() {
+		return ["model", "turn-limit"];
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? GOOSE_CHECKS_GLOBAL_DIR : GOOSE_CHECKS_PROJECT_DIR };
+	}
+};
+//#endregion
 //#region src/constants/hermesagent-paths.ts
 /**
 * Hermes Agent configuration-layout conventions.
@@ -16161,6 +16243,14 @@ const toolCheckFactories = /* @__PURE__ */ new Map([
 			committedOutput: true
 		}
 	}],
+	["goose", {
+		class: GooseCheck,
+		meta: {
+			supportsGlobal: true,
+			supportsProject: false,
+			filePattern: "*.md"
+		}
+	}],
 	["hermesagent", {
 		class: HermesagentCheck,
 		meta: {
@@ -16206,7 +16296,9 @@ const defaultGetFactory$6 = (target) => {
 	return factory;
 };
 const allToolTargetKeys$5 = [...toolCheckFactories.keys()];
-const checksProcessorToolTargets = allToolTargetKeys$5;
+const checksProcessorToolTargets = allToolTargetKeys$5.filter((target) => {
+	return toolCheckFactories.get(target)?.meta.supportsProject !== false;
+});
 const checksProcessorToolTargetsGlobal = allToolTargetKeys$5.filter((target) => {
 	return toolCheckFactories.get(target)?.meta.supportsGlobal ?? false;
 });
@@ -16377,23 +16469,6 @@ var ChecksProcessor = class extends FeatureProcessor {
 	}
 };
 //#endregion
-//#region src/constants/goose-paths.ts
-const GOOSE_DIR = ".goose";
-const GOOSE_GLOBAL_DIR = (0, node_path.join)(".config", "goose");
-const GOOSE_RULE_FILE_NAME = ".goosehints";
-const GOOSE_MCP_FILE_NAME = "config.yaml";
-const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
-const GOOSE_HOOKS_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync", "hooks");
-const GOOSE_HOOKS_FILE_NAME = "hooks.json";
-const GOOSE_PLUGIN_MCP_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync");
-const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
-const GOOSE_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "skills");
-const GOOSE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "skills");
-const GOOSE_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "recipes");
-const GOOSE_GLOBAL_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "recipes");
-const GOOSE_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "agents");
-const GOOSE_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "agents");
-//#endregion
 //#region src/utils/tool-home.ts
 /**
 * Where the rulesync-side source files of a tool with a home override belong.
@@ -18115,27 +18190,71 @@ const CLINE_HOOKS_GLOBAL_DIR_PATH = (0, node_path.join)("Documents", "Cline", "H
 const CLINE_HOOKS_MANIFEST_FILE_NAME = "rulesync-hooks.json";
 //#endregion
 //#region src/features/commands/cline-command.ts
+const CLINE_WORKFLOW_FIELD_TYPES = {
+	name: "string",
+	disabled: "boolean",
+	enabled: "boolean"
+};
+function sanitizeClineWorkflowFrontmatter({ cline, relativeFilePath, logger }) {
+	if (!isRecord$1(cline)) return {};
+	return Object.fromEntries(Object.entries(cline).filter(([key, value]) => {
+		const expected = Object.hasOwn(CLINE_WORKFLOW_FIELD_TYPES, key) ? CLINE_WORKFLOW_FIELD_TYPES[key] : void 0;
+		if (expected === void 0 || typeof value === expected) return true;
+		warnWithFallback(logger, `Cline commands: dropping cline.${key} from ${relativeFilePath}: Cline rejects the whole workflow unless it is a ${expected}.`);
+		return false;
+	}));
+}
+/**
+* Cline workflows (commands). A workflow may carry YAML frontmatter that Cline
+* reads: `name` (the slash-command name) and a `disabled` / `enabled` switch
+* (`parseWorkflowConfigFromMarkdown` in Cline's
+* `user-instruction-config-loader.ts`). The `cline:` section of a
+* `.rulesync/commands/*.md` file is written as that frontmatter, and every key
+* of an imported workflow's frontmatter is lifted back into `cline:`, so
+* hand-written workflow frontmatter survives an import → generate round trip.
+* Cline's own UI toggle is kept in Cline's state, not in the file. A workflow
+* without a `cline:` section is written as a bare body, as before.
+*
+* @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/extensions/config/user-instruction-config-loader.ts
+*/
 var ClineCommand = class ClineCommand extends ToolCommand {
 	static getSettablePaths({ global } = {}) {
 		if (global) return { relativeDirPath: CLINE_COMMANDS_GLOBAL_DIR_PATH };
 		return { relativeDirPath: CLINE_COMMANDS_DIR_PATH };
 	}
+	/** The workflow's own frontmatter, or an empty object for a bare body. */
+	getClineFrontmatter() {
+		const { frontmatter } = parseFrontmatter(this.getFileContent(), this.getFilePath());
+		return isRecord$1(frontmatter) ? frontmatter : {};
+	}
 	toRulesyncCommand() {
+		const cline = this.getClineFrontmatter();
+		const rulesyncFrontmatter = {
+			targets: ["*"],
+			...Object.keys(cline).length > 0 && { cline }
+		};
+		const body = this.getBody();
 		return new RulesyncCommand({
 			outputRoot: process.cwd(),
-			frontmatter: { targets: ["*"] },
-			body: this.getFileContent(),
+			frontmatter: rulesyncFrontmatter,
+			body,
 			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
 			relativeFilePath: this.relativeFilePath,
-			fileContent: this.getFileContent(),
+			fileContent: stringifyFrontmatter(body, rulesyncFrontmatter),
 			validate: true
 		});
 	}
-	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
+		const cline = sanitizeClineWorkflowFrontmatter({
+			cline: rulesyncCommand.getFrontmatter().cline,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
+			logger
+		});
+		const body = rulesyncCommand.getBody();
 		return new ClineCommand({
 			outputRoot,
-			fileContent: rulesyncCommand.getBody(),
+			fileContent: Object.keys(cline).length > 0 ? stringifyFrontmatter(body, cline) : body,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
 			validate
@@ -18148,7 +18267,7 @@ var ClineCommand = class ClineCommand extends ToolCommand {
 		};
 	}
 	getBody() {
-		return this.getFileContent();
+		return parseFrontmatter(this.getFileContent(), this.getFilePath()).body.trim();
 	}
 	static isTargetedByRulesyncCommand(rulesyncCommand) {
 		return this.isTargetedByRulesyncCommandDefault({
@@ -18159,12 +18278,13 @@ var ClineCommand = class ClineCommand extends ToolCommand {
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		const { body: content } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const cline = isRecord$1(frontmatter) ? frontmatter : {};
 		return new ClineCommand({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath,
-			fileContent: content.trim(),
+			fileContent: Object.keys(cline).length > 0 ? stringifyFrontmatter(body.trim(), cline) : body.trim(),
 			validate
 		});
 	}
@@ -40544,6 +40664,35 @@ function convertFromCodexFormat(codexMcp) {
 	}
 	return result;
 }
+/**
+* Keys Codex refuses on each transport. Its `McpServerConfig` deserializer
+* calls `throw_if_set` for these, and the error fails the whole `config.toml`,
+* not just the one server, so they are dropped with a warning instead of
+* written. Checked against `codex-rs/config/src/mcp_types.rs` at rust-v0.162.1.
+*/
+const CODEX_STDIO_REJECTED_KEYS = [
+	"url",
+	"bearer_token_env_var",
+	"bearer_token",
+	"http_headers_helper",
+	"http_headers",
+	"env_http_headers",
+	"oauth",
+	"oauth_resource",
+	"auth"
+];
+const CODEX_HTTP_REJECTED_KEYS = [
+	"args",
+	"env",
+	"env_vars",
+	"cwd",
+	"bearer_token"
+];
+function dropTransportRejectedKeys({ converted, isStdio, serverName }) {
+	const dropped = (isStdio ? CODEX_STDIO_REJECTED_KEYS : CODEX_HTTP_REJECTED_KEYS).filter((key) => converted[key] !== void 0);
+	for (const key of dropped) delete converted[key];
+	if (dropped.length > 0) warnWithFallback(void 0, `[CodexCliMcp] Dropping ${dropped.map((key) => `'${key}'`).join(", ")} from ${isStdio ? "stdio" : "url-based"} MCP server "${serverName}": Codex rejects ${dropped.length === 1 ? "this key" : "these keys"} on a ${isStdio ? "stdio" : "url-based"} server and would fail to load the whole config.toml.`);
+}
 function convertToCodexFormat(mcpServers) {
 	const result = {};
 	const originalNames = /* @__PURE__ */ new Map();
@@ -40586,6 +40735,11 @@ function convertToCodexFormat(mcpServers) {
 			converted,
 			serverName: name
 		});
+		dropTransportRejectedKeys({
+			converted,
+			isStdio,
+			serverName: name
+		});
 		const previousName = originalNames.get(codexName);
 		if (previousName !== void 0) warnWithFallback(void 0, `Codex MCP server name collision: "${previousName}" and "${name}" both normalize to "${codexName}"; "${name}" (processed last) overwrites "${previousName}".`);
 		originalNames.set(codexName, name);
@@ -67806,10 +67960,15 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 			outputRoot,
 			logger
 		});
+		const inheritedProvider = global ? void 0 : await readGlobalTaktProvider({
+			projectFilePath: filePath,
+			logger
+		});
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const provider = resolveActiveProvider({
 			config,
-			runtime: runtime.active ? runtime.config : void 0
+			runtime: runtime.active ? runtime.config : void 0,
+			inheritedProvider
 		});
 		const mode = deriveTaktPermissionMode(rulesyncJson);
 		const override = isPlainObject$1(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
@@ -67919,10 +68078,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 * `provider_profiles` (unless that key is the pre-0.68.0 `claude` fallback),
 * else the `claude-sdk` default (Takt 0.68.0+).
 */
-function resolveActiveProvider({ config, runtime }) {
+function resolveActiveProvider({ config, runtime, inheritedProvider }) {
 	const fromRuntime = runtime === void 0 ? void 0 : resolveRuntimeProvider(runtime);
 	if (fromRuntime !== void 0) return fromRuntime;
-	if (typeof config[TAKT_PROVIDER_KEY] === "string" && config[TAKT_PROVIDER_KEY].trim() !== "") return config[TAKT_PROVIDER_KEY];
+	const local = readProviderName(config);
+	if (local !== void 0) return local;
+	if (inheritedProvider !== void 0) return inheritedProvider;
 	const profiles = config[TAKT_PROVIDER_PROFILES_KEY];
 	if (isPlainObject$1(profiles)) {
 		const keys = Object.keys(profiles);
@@ -67930,6 +68091,43 @@ function resolveActiveProvider({ config, runtime }) {
 	}
 	return TAKT_DEFAULT_PROVIDER;
 }
+/**
+* The top-level `provider:` of a Takt `config.yaml`, when it names one: either
+* the plain name or the block form `provider: { type: <name>, ... }` Takt also
+* accepts (`ConfigProviderReference`).
+*/
+function readProviderName(config) {
+	const raw = config[TAKT_PROVIDER_KEY];
+	const provider = isPlainObject$1(raw) ? raw.type : raw;
+	return typeof provider === "string" && provider.trim() !== "" ? provider : void 0;
+}
+/**
+* The top-level `provider:` of the global `~/.takt/config.yaml`, read for a
+* project-scope generate. An unresolvable home directory, a missing or
+* unparsable file, or one that names no provider all mean "nothing inherited".
+*/
+async function readGlobalTaktProvider({ projectFilePath, logger }) {
+	let globalPath;
+	try {
+		globalPath = (0, node_path.join)(getHomeDirectory(), TAKT_DIR, TAKT_CONFIG_FILE_NAME);
+	} catch {
+		return;
+	}
+	if (globalPath === projectFilePath) return;
+	try {
+		const content = await readFileContentOrNull(globalPath);
+		if (content === null) return;
+		return readProviderName(parseSharedConfig({
+			format: "yaml",
+			fileContent: content,
+			filePath: globalPath,
+			invalidRootPolicy: "error"
+		}));
+	} catch (error) {
+		logger?.warn(`Takt permissions: could not read the provider from ${globalPath} (${formatError(error)}); falling back to the project config alone.`);
+		return;
+	}
+}
 /** A plain object carrying at least one entry (Takt's "assignment" test). */
 function hasEntries(value) {
 	return isPlainObject$1(value) && Object.keys(value).length > 0;