rulesync 36.0.0 → 36.0.2

package/dist/cli/index.cjs

@@ -1691,7 +1691,8 @@ async function listDirectoryRecursive(params) {
 	else if (entry.type === "dir") directories.push(entry);
 	else dropped = true;
 	if (dropped) onIncompleteDirectory?.(path);
-	const subResults = await Promise.all(directories.map((dir) => listDirectoryRecursive({
+	const failures = [];
+	const settled = await Promise.allSettled(directories.map((dir) => listDirectoryRecursive({
 		client,
 		owner,
 		repo,
@@ -1700,7 +1701,12 @@ async function listDirectoryRecursive(params) {
 		depth: depth + 1,
 		semaphore,
 		onIncompleteDirectory
+	}).catch((error) => {
+		failures.push(error);
+		throw error;
 	})));
+	if (failures.length > 0) throw failures[0];
+	const subResults = settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
 	return [...files, ...subResults.flat()];
 }
 /**
@@ -2411,6 +2417,12 @@ async function resolveAndFetchSources(params) {
 		failedSourceCount
 	};
 }
+/**
+* The claim of a source the prefetch does not list -- a git or npm transport
+* source -- whose selection is a wildcard: it may take any
+* name, so later sources download nothing a name decides.
+*/
+const ANY_NAME = Symbol("any name");
 function createNameClaim() {
 	let settle = () => {};
 	return {
@@ -2425,7 +2437,12 @@ function createClaimSlot(params) {
 	return {
 		earlier: async () => {
 			const claimed = await Promise.all(earlier.map((claim) => claim.names));
-			return /* @__PURE__ */ new Set([...reserved, ...claimed.flat()]);
+			const mayTakeAny = claimed.includes(ANY_NAME);
+			const names = /* @__PURE__ */ new Set([...reserved, ...claimed.flatMap((claim) => claim === ANY_NAME ? [] : claim)]);
+			return {
+				names,
+				has: (name) => mayTakeAny || names.has(name)
+			};
 		},
 		settle: own.settle
 	};
@@ -2450,13 +2467,30 @@ async function prefetchGithubSources(params) {
 		...rest,
 		semaphore: new es_toolkit_promise.Semaphore(10)
 	};
-	const items = sources.filter((sourceEntry) => (sourceEntry.transport ?? "github") === "github" && !hasEmptySelection(sourceEntry)).map((sourceEntry) => ({
+	const items = sources.filter((sourceEntry) => !hasEmptySelection(sourceEntry)).map((sourceEntry) => ({
 		sourceEntry,
+		listedThroughApi: isListedThroughGithubApi(sourceEntry),
 		skills: createNameClaim(),
 		rules: createNameClaim()
 	}));
+	for (const item of items.filter((candidate) => !candidate.listedThroughApi)) {
+		if (isGitlabSource(item.sourceEntry)) {
+			item.skills.settle([]);
+			item.rules.settle([]);
+			continue;
+		}
+		const filters = getSourceFilters(item.sourceEntry);
+		item.skills.settle(getSelectionClaim({
+			selection: filters.skills,
+			normalize: (name) => name
+		}));
+		item.rules.settle(getSelectionClaim({
+			selection: filters.rules,
+			normalize: normalizeRuleFilterName
+		}));
+	}
 	await require_import.mapWithConcurrency({
-		items,
+		items: items.filter((item) => item.listedThroughApi),
 		limit: 4,
 		mapper: async (item) => {
 			const earlier = items.slice(0, items.indexOf(item));
@@ -2485,14 +2519,36 @@ async function prefetchGithubSources(params) {
 		}
 	});
 }
+/** Whether the prefetch lists and downloads this source through the GitHub API. */
+function isListedThroughGithubApi(sourceEntry) {
+	if ((sourceEntry.transport ?? "github") !== "github") return false;
+	try {
+		return parseSource(sourceEntry.source).provider !== "gitlab";
+	} catch {
+		return true;
+	}
+}
+/** Whether this is a GitLab source, which the serial pass does not support yet. */
+function isGitlabSource(sourceEntry) {
+	if ((sourceEntry.transport ?? "github") !== "github") return false;
+	try {
+		return parseSource(sourceEntry.source).provider === "gitlab";
+	} catch {
+		return false;
+	}
+}
+/** What a source the prefetch does not list may take, judged by its selection alone. */
+function getSelectionClaim(params) {
+	const { selection, normalize } = params;
+	if (selection === void 0) return [];
+	return selection.includes("*") ? ANY_NAME : selection.map(normalize);
+}
 async function prefetchGithubSource(params) {
 	const { sourceEntry, lock, context, skillClaim, ruleClaim } = params;
 	const parsedFromSource = parseSource(sourceEntry.source);
-	if (parsedFromSource.provider === "gitlab") return;
 	const parsed = {
 		...parsedFromSource,
-		ref: sourceEntry.ref ?? parsedFromSource.ref,
-		path: sourceEntry.path ?? parsedFromSource.path
+		ref: sourceEntry.ref ?? parsedFromSource.ref
 	};
 	const locked = getLockedSource(lock, sourceEntry.source);
 	const ref = await resolvePrefetchRef({
@@ -2555,7 +2611,7 @@ async function prefetchGithubSkills(params) {
 	}
 	const skillFilter = sourceEntry.skills ?? ["*"];
 	const isWildcard = skillFilter.length === 1 && skillFilter[0] === "*";
-	const entries = await withSemaphore(semaphore, () => client.listDirectory(parsed.owner, parsed.repo, parsed.path ?? "skills", ref));
+	const entries = await withSemaphore(semaphore, () => client.listDirectory(parsed.owner, parsed.repo, resolveSkillsSourcePath(sourceEntry), ref));
 	const skillDirs = entries.filter((entry) => entry.type === "dir" && (isWildcard || skillFilter.includes(entry.name)));
 	const useRootFallback = shouldUseRootFallback({
 		skillFilter,
@@ -2624,13 +2680,13 @@ async function prefetchGithubRules(params) {
 		sourceEntry,
 		lockedRuleNames: getLockedRuleNames(locked),
 		localRuleNames: context.localRuleNames,
-		alreadyFetchedRuleNames: claimed,
+		alreadyFetchedRuleNames: claimed.names,
 		curatedDir: (0, node_path.join)(context.projectRoot, require_import.RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH)
 	})) {
 		claim.settle(getLockedRuleNames(locked));
 		return;
 	}
-	const entries = await withSemaphore(context.semaphore, () => context.client.listDirectory(parsed.owner, parsed.repo, sourceEntry.rulesPath ?? "rules", ref));
+	const entries = await withSemaphore(context.semaphore, () => context.client.listDirectory(parsed.owner, parsed.repo, resolveRulesSourcePath(sourceEntry), ref));
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
 	const isWildcard = ruleFilter.length === 1 && ruleFilter[0] === "*";
 	const files = entries.filter((entry) => {
@@ -3475,16 +3531,31 @@ async function canReuseLockedSkills(params) {
 	}) && await checkLockedSkillsExist(curatedDir, lockedSkillNames);
 }
 /**
-* The normalized path the skills of a source are read from: the source's
+* The path the skills of a source are read from, as declared: the source's
 * `path`, else (for the github transport) the path embedded in the source
-* spec, else `skills`.
+* spec, else `skills`. Every transport fetches from this path, and the
+* lockfile records its normalized form ({@link resolveSkillsPath}), so the
+* fetch and the lock comparison cannot pick different paths.
 */
-function resolveSkillsPath(sourceEntry) {
+function resolveSkillsSourcePath(sourceEntry) {
 	const embeddedPath = (sourceEntry.transport ?? "github") === "github" ? parseSource(sourceEntry.source).path : void 0;
-	return normalizeSourceDirPath(sourceEntry.path ?? embeddedPath ?? "skills");
+	return sourceEntry.path ?? embeddedPath ?? "skills";
 }
-function normalizeRulesPath(rulesPath) {
-	return normalizeSourceDirPath(rulesPath ?? "rules");
+/** The skills path of a source in the form the lockfile records and compares. */
+function resolveSkillsPath(sourceEntry) {
+	return normalizeSourceDirPath(resolveSkillsSourcePath(sourceEntry));
+}
+/**
+* The path the rules of a source are read from, as declared: the source's
+* `rulesPath`, else `rules`. The rules counterpart of
+* {@link resolveSkillsSourcePath}.
+*/
+function resolveRulesSourcePath(sourceEntry) {
+	return sourceEntry.rulesPath ?? "rules";
+}
+/** The rules path of a source in the form the lockfile records and compares. */
+function resolveRulesPath(sourceEntry) {
+	return normalizeSourceDirPath(resolveRulesSourcePath(sourceEntry));
 }
 /**
 * The form a source directory path is recorded in the lockfile and compared
@@ -3497,7 +3568,7 @@ function lockedRuleConfigMatches(params) {
 	const rules = getSourceFilters(params.sourceEntry).rules;
 	if (rules === void 0 || params.locked.ruleSelection === void 0) return false;
 	const selection = normalizeRuleSelection(rules);
-	return selection.length === params.locked.ruleSelection.length && selection.every((ruleName, index) => ruleName === params.locked.ruleSelection?.[index]) && normalizeRulesPath(params.sourceEntry.rulesPath) === params.locked.rulesPath;
+	return selection.length === params.locked.ruleSelection.length && selection.every((ruleName, index) => ruleName === params.locked.ruleSelection?.[index]) && resolveRulesPath(params.sourceEntry) === params.locked.rulesPath;
 }
 function assertMatchingRulesFound(params) {
 	if (params.ruleNames.length === 0) throw new Error(`No matching rules found in ${params.source}.`);
@@ -3543,7 +3614,7 @@ async function fetchRulesViaGithub(params) {
 	}
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
 	const isWildcard = ruleFilter.length === 1 && ruleFilter[0] === "*";
-	const rulesPath = sourceEntry.rulesPath ?? "rules";
+	const rulesPath = resolveRulesSourcePath(sourceEntry);
 	let entries;
 	try {
 		entries = await client.listDirectory(parsed.owner, parsed.repo, rulesPath, ref);
@@ -3598,7 +3669,7 @@ async function fetchRulesViaGithub(params) {
 		requestedRef,
 		resolvedRef: resolvedSha,
 		ruleSelection: normalizeRuleSelection(sourceEntry.rules ?? []),
-		rulesPath: normalizeRulesPath(sourceEntry.rulesPath),
+		rulesPath: resolveRulesPath(sourceEntry),
 		resolvedRuleNames: remoteRuleNames,
 		logger
 	});
@@ -3643,7 +3714,7 @@ async function fetchRulesViaGit(params) {
 		url: sourceKey,
 		ref: requestedRef,
 		resolvedRef,
-		skillsPath: sourceEntry.rulesPath ?? "rules",
+		skillsPath: resolveRulesSourcePath(sourceEntry),
 		logger
 	});
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
@@ -3676,7 +3747,7 @@ async function fetchRulesViaGit(params) {
 		requestedRef,
 		resolvedRef,
 		ruleSelection: normalizeRuleSelection(sourceEntry.rules ?? []),
-		rulesPath: normalizeRulesPath(sourceEntry.rulesPath),
+		rulesPath: resolveRulesPath(sourceEntry),
 		resolvedRuleNames: remoteRuleNames,
 		logger
 	});
@@ -3823,8 +3894,7 @@ async function fetchGithubSkillDir(params) {
 * names already written into `fetchedSkills`.
 */
 async function discoverGithubSkillDirs(params) {
-	const { parsed, ref, resolvedSha, skillFilter, isWildcard, curatedDir, locked, sourceKey, localSkillNames, alreadyFetchedSkillNames, client, semaphore, getExecutablePaths, fetchedSkills, logger } = params;
-	const skillsBasePath = parsed.path ?? "skills";
+	const { parsed, skillsBasePath, ref, resolvedSha, skillFilter, isWildcard, curatedDir, locked, sourceKey, localSkillNames, alreadyFetchedSkillNames, client, semaphore, getExecutablePaths, fetchedSkills, logger } = params;
 	try {
 		const entries = await client.listDirectory(parsed.owner, parsed.repo, skillsBasePath, ref);
 		const remoteSkillDirs = entries.filter((e) => e.type === "dir").map((e) => ({
@@ -3889,8 +3959,7 @@ async function fetchSource(params) {
 	const parsedFromSource = parseSource(sourceEntry.source);
 	const parsed = {
 		...parsedFromSource,
-		ref: sourceEntry.ref ?? parsedFromSource.ref,
-		path: sourceEntry.path ?? parsedFromSource.path
+		ref: sourceEntry.ref ?? parsedFromSource.ref
 	};
 	if (parsed.provider === "gitlab") throw new Error(`GitLab sources are not yet supported: "${sourceEntry.source}".`);
 	const sourceKey = sourceEntry.source;
@@ -3934,6 +4003,7 @@ async function fetchSource(params) {
 	const fetchedSkills = {};
 	const discovery = await discoverGithubSkillDirs({
 		parsed,
+		skillsBasePath: resolveSkillsSourcePath(sourceEntry),
 		ref,
 		resolvedSha,
 		skillFilter,
@@ -4046,7 +4116,7 @@ async function fetchSourceViaGit(params) {
 			url,
 			ref: requestedRef,
 			resolvedRef: resolvedSha,
-			skillsPath: sourceEntry.path ?? "skills",
+			skillsPath: resolveSkillsSourcePath(sourceEntry),
 			logger
 		}),
 		skillFilter,
@@ -4270,7 +4340,7 @@ function buildNpmLockEntry(params) {
 		...sourceEntry.rules !== void 0 && {
 			rules: mergedRules,
 			ruleSelection: normalizeRuleSelection(sourceEntry.rules),
-			rulesPath: normalizeRulesPath(sourceEntry.rulesPath),
+			rulesPath: resolveRulesPath(sourceEntry),
 			resolvedRuleNames
 		}
 	};
@@ -4285,7 +4355,7 @@ async function fetchNpmSkills(params) {
 	const declaredWildcard = skillFilter.length === 1 && skillFilter[0] === "*";
 	const selectedFiles = selectNpmSkillFiles({
 		allFiles,
-		skillsPath: sourceEntry.path ?? "skills",
+		skillsPath: resolveSkillsSourcePath(sourceEntry),
 		skillFilter,
 		isWildcard: declaredWildcard,
 		packageName
@@ -4333,7 +4403,7 @@ async function fetchNpmRules(params) {
 		resolvedRuleNames: []
 	};
 	const { allFiles, sourceEntry, packageName, lockedForIntegrityCheck, lockedRuleNames, curatedRulesDir, localRuleNames, alreadyFetchedRuleNames, resolvedVersion, updateSources, logger } = params;
-	const normalizedRulesPath = normalizeRulesPath(sourceEntry.rulesPath);
+	const normalizedRulesPath = resolveRulesPath(sourceEntry);
 	const rulePrefix = normalizedRulesPath === "." ? "" : `${normalizedRulesPath}/`;
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
 	const isWildcard = ruleFilter.length === 1 && ruleFilter[0] === "*";
@@ -14033,7 +14103,7 @@ function wrapCommand$1({ name, errorCode, handler, getVersion, loggerFactory = c
 }
 //#endregion
 //#region src/cli/program.ts
-const getVersion = () => "36.0.0";
+const getVersion = () => "36.0.2";
 const FEATURES_HELP = `${require_import.ALL_FEATURES.join(",")}; ignore is deprecated, use permissions`;
 function wrapCommand(name, errorCode, handler) {
 	return wrapCommand$1({

package/dist/cli/index.js

@@ -1688,7 +1688,8 @@ async function listDirectoryRecursive(params) {
 	else if (entry.type === "dir") directories.push(entry);
 	else dropped = true;
 	if (dropped) onIncompleteDirectory?.(path);
-	const subResults = await Promise.all(directories.map((dir) => listDirectoryRecursive({
+	const failures = [];
+	const settled = await Promise.allSettled(directories.map((dir) => listDirectoryRecursive({
 		client,
 		owner,
 		repo,
@@ -1697,7 +1698,12 @@ async function listDirectoryRecursive(params) {
 		depth: depth + 1,
 		semaphore,
 		onIncompleteDirectory
+	}).catch((error) => {
+		failures.push(error);
+		throw error;
 	})));
+	if (failures.length > 0) throw failures[0];
+	const subResults = settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
 	return [...files, ...subResults.flat()];
 }
 /**
@@ -2408,6 +2414,12 @@ async function resolveAndFetchSources(params) {
 		failedSourceCount
 	};
 }
+/**
+* The claim of a source the prefetch does not list -- a git or npm transport
+* source -- whose selection is a wildcard: it may take any
+* name, so later sources download nothing a name decides.
+*/
+const ANY_NAME = Symbol("any name");
 function createNameClaim() {
 	let settle = () => {};
 	return {
@@ -2422,7 +2434,12 @@ function createClaimSlot(params) {
 	return {
 		earlier: async () => {
 			const claimed = await Promise.all(earlier.map((claim) => claim.names));
-			return /* @__PURE__ */ new Set([...reserved, ...claimed.flat()]);
+			const mayTakeAny = claimed.includes(ANY_NAME);
+			const names = /* @__PURE__ */ new Set([...reserved, ...claimed.flatMap((claim) => claim === ANY_NAME ? [] : claim)]);
+			return {
+				names,
+				has: (name) => mayTakeAny || names.has(name)
+			};
 		},
 		settle: own.settle
 	};
@@ -2447,13 +2464,30 @@ async function prefetchGithubSources(params) {
 		...rest,
 		semaphore: new Semaphore(10)
 	};
-	const items = sources.filter((sourceEntry) => (sourceEntry.transport ?? "github") === "github" && !hasEmptySelection(sourceEntry)).map((sourceEntry) => ({
+	const items = sources.filter((sourceEntry) => !hasEmptySelection(sourceEntry)).map((sourceEntry) => ({
 		sourceEntry,
+		listedThroughApi: isListedThroughGithubApi(sourceEntry),
 		skills: createNameClaim(),
 		rules: createNameClaim()
 	}));
+	for (const item of items.filter((candidate) => !candidate.listedThroughApi)) {
+		if (isGitlabSource(item.sourceEntry)) {
+			item.skills.settle([]);
+			item.rules.settle([]);
+			continue;
+		}
+		const filters = getSourceFilters(item.sourceEntry);
+		item.skills.settle(getSelectionClaim({
+			selection: filters.skills,
+			normalize: (name) => name
+		}));
+		item.rules.settle(getSelectionClaim({
+			selection: filters.rules,
+			normalize: normalizeRuleFilterName
+		}));
+	}
 	await mapWithConcurrency({
-		items,
+		items: items.filter((item) => item.listedThroughApi),
 		limit: 4,
 		mapper: async (item) => {
 			const earlier = items.slice(0, items.indexOf(item));
@@ -2482,14 +2516,36 @@ async function prefetchGithubSources(params) {
 		}
 	});
 }
+/** Whether the prefetch lists and downloads this source through the GitHub API. */
+function isListedThroughGithubApi(sourceEntry) {
+	if ((sourceEntry.transport ?? "github") !== "github") return false;
+	try {
+		return parseSource(sourceEntry.source).provider !== "gitlab";
+	} catch {
+		return true;
+	}
+}
+/** Whether this is a GitLab source, which the serial pass does not support yet. */
+function isGitlabSource(sourceEntry) {
+	if ((sourceEntry.transport ?? "github") !== "github") return false;
+	try {
+		return parseSource(sourceEntry.source).provider === "gitlab";
+	} catch {
+		return false;
+	}
+}
+/** What a source the prefetch does not list may take, judged by its selection alone. */
+function getSelectionClaim(params) {
+	const { selection, normalize } = params;
+	if (selection === void 0) return [];
+	return selection.includes("*") ? ANY_NAME : selection.map(normalize);
+}
 async function prefetchGithubSource(params) {
 	const { sourceEntry, lock, context, skillClaim, ruleClaim } = params;
 	const parsedFromSource = parseSource(sourceEntry.source);
-	if (parsedFromSource.provider === "gitlab") return;
 	const parsed = {
 		...parsedFromSource,
-		ref: sourceEntry.ref ?? parsedFromSource.ref,
-		path: sourceEntry.path ?? parsedFromSource.path
+		ref: sourceEntry.ref ?? parsedFromSource.ref
 	};
 	const locked = getLockedSource(lock, sourceEntry.source);
 	const ref = await resolvePrefetchRef({
@@ -2552,7 +2608,7 @@ async function prefetchGithubSkills(params) {
 	}
 	const skillFilter = sourceEntry.skills ?? ["*"];
 	const isWildcard = skillFilter.length === 1 && skillFilter[0] === "*";
-	const entries = await withSemaphore(semaphore, () => client.listDirectory(parsed.owner, parsed.repo, parsed.path ?? "skills", ref));
+	const entries = await withSemaphore(semaphore, () => client.listDirectory(parsed.owner, parsed.repo, resolveSkillsSourcePath(sourceEntry), ref));
 	const skillDirs = entries.filter((entry) => entry.type === "dir" && (isWildcard || skillFilter.includes(entry.name)));
 	const useRootFallback = shouldUseRootFallback({
 		skillFilter,
@@ -2621,13 +2677,13 @@ async function prefetchGithubRules(params) {
 		sourceEntry,
 		lockedRuleNames: getLockedRuleNames(locked),
 		localRuleNames: context.localRuleNames,
-		alreadyFetchedRuleNames: claimed,
+		alreadyFetchedRuleNames: claimed.names,
 		curatedDir: join(context.projectRoot, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH)
 	})) {
 		claim.settle(getLockedRuleNames(locked));
 		return;
 	}
-	const entries = await withSemaphore(context.semaphore, () => context.client.listDirectory(parsed.owner, parsed.repo, sourceEntry.rulesPath ?? "rules", ref));
+	const entries = await withSemaphore(context.semaphore, () => context.client.listDirectory(parsed.owner, parsed.repo, resolveRulesSourcePath(sourceEntry), ref));
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
 	const isWildcard = ruleFilter.length === 1 && ruleFilter[0] === "*";
 	const files = entries.filter((entry) => {
@@ -3472,16 +3528,31 @@ async function canReuseLockedSkills(params) {
 	}) && await checkLockedSkillsExist(curatedDir, lockedSkillNames);
 }
 /**
-* The normalized path the skills of a source are read from: the source's
+* The path the skills of a source are read from, as declared: the source's
 * `path`, else (for the github transport) the path embedded in the source
-* spec, else `skills`.
+* spec, else `skills`. Every transport fetches from this path, and the
+* lockfile records its normalized form ({@link resolveSkillsPath}), so the
+* fetch and the lock comparison cannot pick different paths.
 */
-function resolveSkillsPath(sourceEntry) {
+function resolveSkillsSourcePath(sourceEntry) {
 	const embeddedPath = (sourceEntry.transport ?? "github") === "github" ? parseSource(sourceEntry.source).path : void 0;
-	return normalizeSourceDirPath(sourceEntry.path ?? embeddedPath ?? "skills");
+	return sourceEntry.path ?? embeddedPath ?? "skills";
 }
-function normalizeRulesPath(rulesPath) {
-	return normalizeSourceDirPath(rulesPath ?? "rules");
+/** The skills path of a source in the form the lockfile records and compares. */
+function resolveSkillsPath(sourceEntry) {
+	return normalizeSourceDirPath(resolveSkillsSourcePath(sourceEntry));
+}
+/**
+* The path the rules of a source are read from, as declared: the source's
+* `rulesPath`, else `rules`. The rules counterpart of
+* {@link resolveSkillsSourcePath}.
+*/
+function resolveRulesSourcePath(sourceEntry) {
+	return sourceEntry.rulesPath ?? "rules";
+}
+/** The rules path of a source in the form the lockfile records and compares. */
+function resolveRulesPath(sourceEntry) {
+	return normalizeSourceDirPath(resolveRulesSourcePath(sourceEntry));
 }
 /**
 * The form a source directory path is recorded in the lockfile and compared
@@ -3494,7 +3565,7 @@ function lockedRuleConfigMatches(params) {
 	const rules = getSourceFilters(params.sourceEntry).rules;
 	if (rules === void 0 || params.locked.ruleSelection === void 0) return false;
 	const selection = normalizeRuleSelection(rules);
-	return selection.length === params.locked.ruleSelection.length && selection.every((ruleName, index) => ruleName === params.locked.ruleSelection?.[index]) && normalizeRulesPath(params.sourceEntry.rulesPath) === params.locked.rulesPath;
+	return selection.length === params.locked.ruleSelection.length && selection.every((ruleName, index) => ruleName === params.locked.ruleSelection?.[index]) && resolveRulesPath(params.sourceEntry) === params.locked.rulesPath;
 }
 function assertMatchingRulesFound(params) {
 	if (params.ruleNames.length === 0) throw new Error(`No matching rules found in ${params.source}.`);
@@ -3540,7 +3611,7 @@ async function fetchRulesViaGithub(params) {
 	}
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
 	const isWildcard = ruleFilter.length === 1 && ruleFilter[0] === "*";
-	const rulesPath = sourceEntry.rulesPath ?? "rules";
+	const rulesPath = resolveRulesSourcePath(sourceEntry);
 	let entries;
 	try {
 		entries = await client.listDirectory(parsed.owner, parsed.repo, rulesPath, ref);
@@ -3595,7 +3666,7 @@ async function fetchRulesViaGithub(params) {
 		requestedRef,
 		resolvedRef: resolvedSha,
 		ruleSelection: normalizeRuleSelection(sourceEntry.rules ?? []),
-		rulesPath: normalizeRulesPath(sourceEntry.rulesPath),
+		rulesPath: resolveRulesPath(sourceEntry),
 		resolvedRuleNames: remoteRuleNames,
 		logger
 	});
@@ -3640,7 +3711,7 @@ async function fetchRulesViaGit(params) {
 		url: sourceKey,
 		ref: requestedRef,
 		resolvedRef,
-		skillsPath: sourceEntry.rulesPath ?? "rules",
+		skillsPath: resolveRulesSourcePath(sourceEntry),
 		logger
 	});
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
@@ -3673,7 +3744,7 @@ async function fetchRulesViaGit(params) {
 		requestedRef,
 		resolvedRef,
 		ruleSelection: normalizeRuleSelection(sourceEntry.rules ?? []),
-		rulesPath: normalizeRulesPath(sourceEntry.rulesPath),
+		rulesPath: resolveRulesPath(sourceEntry),
 		resolvedRuleNames: remoteRuleNames,
 		logger
 	});
@@ -3820,8 +3891,7 @@ async function fetchGithubSkillDir(params) {
 * names already written into `fetchedSkills`.
 */
 async function discoverGithubSkillDirs(params) {
-	const { parsed, ref, resolvedSha, skillFilter, isWildcard, curatedDir, locked, sourceKey, localSkillNames, alreadyFetchedSkillNames, client, semaphore, getExecutablePaths, fetchedSkills, logger } = params;
-	const skillsBasePath = parsed.path ?? "skills";
+	const { parsed, skillsBasePath, ref, resolvedSha, skillFilter, isWildcard, curatedDir, locked, sourceKey, localSkillNames, alreadyFetchedSkillNames, client, semaphore, getExecutablePaths, fetchedSkills, logger } = params;
 	try {
 		const entries = await client.listDirectory(parsed.owner, parsed.repo, skillsBasePath, ref);
 		const remoteSkillDirs = entries.filter((e) => e.type === "dir").map((e) => ({
@@ -3886,8 +3956,7 @@ async function fetchSource(params) {
 	const parsedFromSource = parseSource(sourceEntry.source);
 	const parsed = {
 		...parsedFromSource,
-		ref: sourceEntry.ref ?? parsedFromSource.ref,
-		path: sourceEntry.path ?? parsedFromSource.path
+		ref: sourceEntry.ref ?? parsedFromSource.ref
 	};
 	if (parsed.provider === "gitlab") throw new Error(`GitLab sources are not yet supported: "${sourceEntry.source}".`);
 	const sourceKey = sourceEntry.source;
@@ -3931,6 +4000,7 @@ async function fetchSource(params) {
 	const fetchedSkills = {};
 	const discovery = await discoverGithubSkillDirs({
 		parsed,
+		skillsBasePath: resolveSkillsSourcePath(sourceEntry),
 		ref,
 		resolvedSha,
 		skillFilter,
@@ -4043,7 +4113,7 @@ async function fetchSourceViaGit(params) {
 			url,
 			ref: requestedRef,
 			resolvedRef: resolvedSha,
-			skillsPath: sourceEntry.path ?? "skills",
+			skillsPath: resolveSkillsSourcePath(sourceEntry),
 			logger
 		}),
 		skillFilter,
@@ -4267,7 +4337,7 @@ function buildNpmLockEntry(params) {
 		...sourceEntry.rules !== void 0 && {
 			rules: mergedRules,
 			ruleSelection: normalizeRuleSelection(sourceEntry.rules),
-			rulesPath: normalizeRulesPath(sourceEntry.rulesPath),
+			rulesPath: resolveRulesPath(sourceEntry),
 			resolvedRuleNames
 		}
 	};
@@ -4282,7 +4352,7 @@ async function fetchNpmSkills(params) {
 	const declaredWildcard = skillFilter.length === 1 && skillFilter[0] === "*";
 	const selectedFiles = selectNpmSkillFiles({
 		allFiles,
-		skillsPath: sourceEntry.path ?? "skills",
+		skillsPath: resolveSkillsSourcePath(sourceEntry),
 		skillFilter,
 		isWildcard: declaredWildcard,
 		packageName
@@ -4330,7 +4400,7 @@ async function fetchNpmRules(params) {
 		resolvedRuleNames: []
 	};
 	const { allFiles, sourceEntry, packageName, lockedForIntegrityCheck, lockedRuleNames, curatedRulesDir, localRuleNames, alreadyFetchedRuleNames, resolvedVersion, updateSources, logger } = params;
-	const normalizedRulesPath = normalizeRulesPath(sourceEntry.rulesPath);
+	const normalizedRulesPath = resolveRulesPath(sourceEntry);
 	const rulePrefix = normalizedRulesPath === "." ? "" : `${normalizedRulesPath}/`;
 	const ruleFilter = (sourceEntry.rules ?? []).map(normalizeRuleFilterName);
 	const isWildcard = ruleFilter.length === 1 && ruleFilter[0] === "*";
@@ -14030,7 +14100,7 @@ function wrapCommand$1({ name, errorCode, handler, getVersion, loggerFactory = c
 }
 //#endregion
 //#region src/cli/program.ts
-const getVersion = () => "36.0.0";
+const getVersion = () => "36.0.2";
 const FEATURES_HELP = `${ALL_FEATURES.join(",")}; ignore is deprecated, use permissions`;
 function wrapCommand(name, errorCode, handler) {
 	return wrapCommand$1({