rulesync 43.1.1 → 43.1.2

package/dist/{import-BiQjbRR6.cjs → import-BTqYh7nP.cjs}

@@ -15889,17 +15889,24 @@ function toolSkillSearchRoots(paths) {
 	return [paths.relativeDirPath, ...paths.alternativeSkillRoots ?? []];
 }
 /**
-* The Agent Skills interoperability roots: project `.agents/skills/`, global
-* `~/.agents/skills/` (same relative path, home output root), and Amp's global
-* equivalent `~/.config/agents/skills/`. Foreign-authored — potentially
-* non-conformant — skills are the most likely to live here, so every tool that
-* scans one of these roots imports it leniently (skip-and-warn per skill), per
-* the Agent Skills client-implementation guide, while keeping fail-fast
-* behavior for its own native root. Amp's read-only global discovery root
-* `~/.config/amp/skills/` follows the same skip-and-warn rule.
-* https://agentskills.io/client-implementation/adding-skills-support
-*/
-const AGENT_SKILLS_INTEROP_ROOTS = /* @__PURE__ */ new Set([
+* Skill roots that every tool scanning them imports leniently (skip-and-warn
+* per skill) instead of failing fast, regardless of the tool's own
+* `lenientImport` flag.
+*
+* - The Agent Skills interoperability roots: project `.agents/skills/`, global
+*   `~/.agents/skills/` (same relative path, home output root), and Amp's
+*   global equivalent `~/.config/agents/skills/`. Foreign-authored —
+*   potentially non-conformant — skills are the most likely to live here, so
+*   they are imported leniently per the Agent Skills client-implementation
+*   guide, while each tool keeps fail-fast behavior for its own native root.
+*   https://agentskills.io/client-implementation/adding-skills-support
+* - Amp's read-only global discovery root `~/.config/amp/skills/`, which is not
+*   an interop root but follows the same skip-and-warn rule.
+*
+* Other import-only roots (e.g. GitLab Duo's legacy skills root, Kimi Code's
+* shared root) are not listed here and stay fail-fast.
+*/
+const LENIENT_IMPORT_SKILL_ROOTS = /* @__PURE__ */ new Set([
 	toPosixPath(AGENTSMD_SKILLS_DIR_PATH),
 	toPosixPath(AMP_SKILLS_GLOBAL_DIR),
 	toPosixPath(AMP_SKILLS_NATIVE_GLOBAL_DIR)
@@ -15924,8 +15931,8 @@ function warnOnEmptyLoadedDescription({ skillFilePath, description }) {
 	if (typeof description !== "string" || description.length > 0) return;
 	warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ${EMPTY_SKILL_DESCRIPTION_VIOLATION}. Rulesync imports it anyway so the content is not lost; fill it in before relying on this skill.`);
 }
-function isAgentSkillsInteropRoot(relativeDirPath) {
-	return AGENT_SKILLS_INTEROP_ROOTS.has(toPosixPath(relativeDirPath));
+function isLenientImportSkillRoot(relativeDirPath) {
+	return LENIENT_IMPORT_SKILL_ROOTS.has(toPosixPath(relativeDirPath));
 }
 /** Ordered import roots: managed roots first, followed by read-only discovery roots. */
 function toolSkillImportRoots(paths) {
@@ -33155,7 +33162,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
 			const relativeDirPath = typeof root === "string" ? root : root.relativeDirPath;
-			const isLenientRoot = configuredRootPaths.has(relativeDirPath) || factory.meta.lenientImport === true || isAgentSkillsInteropRoot(relativeDirPath);
+			const isLenientRoot = configuredRootPaths.has(relativeDirPath) || factory.meta.lenientImport === true || isLenientImportSkillRoot(relativeDirPath);
 			const skillsDirPath = (0, node_path.join)(rootOutputRoot, relativeDirPath);
 			if (!await directoryExists(skillsDirPath)) continue;
 			const ownedDirNames = [];
@@ -55844,7 +55851,7 @@ function isFieldApplicable({ commandOnly, hookType }) {
 * silence — the mirror of the import side.
 */
 function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn }) {
-	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength } of fields) {
+	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag } of fields) {
 		const value = def[canonical];
 		if (value === void 0) continue;
 		if (!isFieldApplicable({
@@ -55861,9 +55868,10 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool can express as "${tool}".`);
 			continue;
 		}
+		if (onlyWithFlag !== void 0 && def[onlyWithFlag] !== true) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" has no effect without "${onlyWithFlag}": true; this tool reads "${tool}" only on "${onlyWithFlag}" hooks.`);
 		if (maxLength !== void 0 && typeof value === "string") {
 			const length = collapseWhitespaceForLength ? value.replace(/\s+/g, " ").trim().length : value.length;
-			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
+			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long${collapseWhitespaceForLength ? " after collapsing whitespace" : ""}; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
 		}
 	}
 	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
@@ -64264,14 +64272,16 @@ const QODER_SPEC = {
 			{
 				canonical: "rewakeMessage",
 				tool: "rewakeMessage",
-				commandOnly: true
+				commandOnly: true,
+				onlyWithFlag: "asyncRewake"
 			},
 			{
 				canonical: "rewakeSummary",
 				tool: "rewakeSummary",
 				commandOnly: true,
 				maxLength: 300,
-				collapseWhitespaceForLength: true
+				collapseWhitespaceForLength: true,
+				onlyWithFlag: "asyncRewake"
 			}
 		],
 		booleanPassthroughFields: [
@@ -69651,7 +69661,7 @@ var CodebuddyMcp = class CodebuddyMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/codebuff-mcp.ts
-const TOOL_NAME$1 = "codebuff";
+const TOOL_NAME$2 = "codebuff";
 const MAPPED_KEYS = /* @__PURE__ */ new Set([
 	"type",
 	"transport",
@@ -69686,14 +69696,14 @@ function toCodebuffEnv({ name, env, logger }) {
 		}
 		if (value.startsWith("$")) {
 			warnAndSkipMcpServer({
-				toolName: TOOL_NAME$1,
+				toolName: TOOL_NAME$2,
 				serverName: name,
 				reason: `env ${quoteValueForWarning(key)} starting with "$" that is not a whole \${VAR} reference, which Codebuff would resolve as a variable name and fail to load the whole mcp.json`,
 				logger
 			});
 			return null;
 		}
-		if (CANONICAL_ENV_REF.test(value)) logger?.warn(`${TOOL_NAME$1} MCP: env ${quoteValueForWarning(key)} of server ${quoteValueForWarning(name)} embeds a \${VAR} reference; Codebuff only resolves a whole-value \$VAR, so it is written as literal text.`);
+		if (CANONICAL_ENV_REF.test(value)) logger?.warn(`${TOOL_NAME$2} MCP: env ${quoteValueForWarning(key)} of server ${quoteValueForWarning(name)} embeds a \${VAR} reference; Codebuff only resolves a whole-value \$VAR, so it is written as literal text.`);
 		converted.push([key, value]);
 	}
 	return Object.fromEntries(converted);
@@ -69710,31 +69720,31 @@ function toCodebuffEnv({ name, env, logger }) {
 */
 function toCodebuffServer({ name, server, logger }) {
 	if (server.disabled === true) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "disabled: true, which Codebuff has no per-server switch for",
 		logger
 	});
 	const transport = server.type ?? server.transport;
 	if (transport === "ws") return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "the WebSocket transport, which Codebuff does not support",
 		logger
 	});
 	const dropped = Object.keys(server).filter((key) => !MAPPED_KEYS.has(key));
-	if (dropped.length > 0) logger?.warn(`${TOOL_NAME$1} MCP: dropping ${dropped.map((key) => quoteValueForWarning(key)).join(", ")} from server ${quoteValueForWarning(name)}; Codebuff rejects keys outside its server schema.`);
+	if (dropped.length > 0) logger?.warn(`${TOOL_NAME$2} MCP: dropping ${dropped.map((key) => quoteValueForWarning(key)).join(", ")} from server ${quoteValueForWarning(name)}; Codebuff rejects keys outside its server schema.`);
 	if (isRemoteMcpServer(server)) {
 		const url = resolveRemoteMcpUrl(server);
 		if (url === void 0) return warnAndSkipMcpServer({
-			toolName: TOOL_NAME$1,
+			toolName: TOOL_NAME$2,
 			serverName: name,
 			reason: "a remote transport without a url",
 			logger
 		});
 		const params = server.params;
 		const validParams = isRecord(params) && Object.values(params).every((value) => typeof value === "string");
-		if (params !== void 0 && !validParams) logger?.warn(`${TOOL_NAME$1} MCP: dropping params from server ${quoteValueForWarning(name)}; Codebuff accepts only a map of string values.`);
+		if (params !== void 0 && !validParams) logger?.warn(`${TOOL_NAME$2} MCP: dropping params from server ${quoteValueForWarning(name)}; Codebuff accepts only a map of string values.`);
 		return {
 			type: transport === "sse" ? "sse" : "http",
 			url,
@@ -69744,7 +69754,7 @@ function toCodebuffServer({ name, server, logger }) {
 	}
 	const [command, ...args] = resolveLocalMcpCommand(server);
 	if (command === void 0) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "no command to spawn",
 		logger
@@ -72414,7 +72424,7 @@ var CursorMcp = class CursorMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/deepagents-mcp.ts
-const TOOL_NAME = "deepagents";
+const TOOL_NAME$1 = "deepagents";
 /**
 * Map a canonical transport onto the three dcode accepts.
 *
@@ -72455,7 +72465,7 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 			return true;
 		}
 		warnAndSkipMcpServer({
-			toolName: TOOL_NAME,
+			toolName: TOOL_NAME$1,
 			serverName: name,
 			reason: "an empty command list, which leaves deepagents nothing to spawn",
 			logger
@@ -72483,7 +72493,7 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 */
 function toDeepagentsOauth({ name, oauth, converted, logger }) {
 	if (!isSlackOauthServer(converted)) {
-		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
 		return;
 	}
 	const source = isRecord(oauth) ? oauth : {};
@@ -72492,18 +72502,18 @@ function toDeepagentsOauth({ name, oauth, converted, logger }) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 		const nativeKey = key === "clientId" ? "client_id" : key;
 		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
-			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
 			continue;
 		}
 		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
 		if (!isDeepagentsOauthValue(value)) {
-			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
 			continue;
 		}
 		result[nativeKey] = value;
 	}
 	if (result.client_id === void 0) {
-		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
 		return;
 	}
 	return result;
@@ -72532,14 +72542,14 @@ function isSlackOauthServer(server) {
 */
 function toDeepagentsServer({ name, server, logger }) {
 	if (server.disabled === true) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "disabled: true, which deepagents does not read from .mcp.json (the server would still run)",
 		logger
 	});
 	const rawTransport = server.transport ?? server.type;
 	if (rawTransport === "ws") return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
@@ -72569,21 +72579,21 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
 	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "both enabledTools and disabledTools, which deepagents rejects — pick one",
 		logger
 	});
 	if (enabledTools !== void 0) {
 		if (enabledTools.length === 0) return warnAndSkipMcpServer({
-			toolName: TOOL_NAME,
+			toolName: TOOL_NAME$1,
 			serverName: name,
 			reason: "an empty enabledTools list, which allows no tools at all and which deepagents rejects",
 			logger
 		});
 		converted.allowedTools = enabledTools;
 	} else if (disabledTools !== void 0) {
-		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
+		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME$1} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
 		else converted.disabledTools = disabledTools;
 	}
 	return converted;
@@ -73235,6 +73245,32 @@ var DshMcp = class DshMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/factorydroid-mcp.ts
+const TOOL_NAME = "factorydroid";
+/**
+* Drop servers whose `enabledTools` allowlist is empty.
+*
+* Canonically an empty allowlist allows no tools, but Droid applies
+* `enabledTools` only "when the list is non-empty"
+* (https://docs.factory.com/harness/mcp), so writing `[]` would load every
+* tool the server reports. Skipping the server is the only form that does not
+* hand the model more tools than the canonical config allows.
+*/
+function skipEmptyAllowlistServers({ mcpServers, logger }) {
+	const kept = {};
+	for (const [name, server] of Object.entries(mcpServers)) {
+		if (server.enabledTools?.length === 0) {
+			warnAndSkipMcpServer({
+				toolName: TOOL_NAME,
+				serverName: name,
+				reason: "an empty enabledTools list, which allows no tools at all but which Factory Droid treats as no filter",
+				logger
+			});
+			continue;
+		}
+		kept[name] = server;
+	}
+	return kept;
+}
 var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -73260,8 +73296,11 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 			validate
 		});
 	}
-	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true }) {
-		const factorydroidConfig = { mcpServers: rulesyncMcp.getMcpServers() };
+	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, logger }) {
+		const factorydroidConfig = { mcpServers: skipEmptyAllowlistServers({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			logger
+		}) };
 		const fileContent = JSON.stringify(factorydroidConfig, null, 2);
 		return new FactorydroidMcp({
 			outputRoot,

package/dist/{import-COu_2AUF.js → import-D2uYjAdc.js}

@@ -15867,17 +15867,24 @@ function toolSkillSearchRoots(paths) {
 	return [paths.relativeDirPath, ...paths.alternativeSkillRoots ?? []];
 }
 /**
-* The Agent Skills interoperability roots: project `.agents/skills/`, global
-* `~/.agents/skills/` (same relative path, home output root), and Amp's global
-* equivalent `~/.config/agents/skills/`. Foreign-authored — potentially
-* non-conformant — skills are the most likely to live here, so every tool that
-* scans one of these roots imports it leniently (skip-and-warn per skill), per
-* the Agent Skills client-implementation guide, while keeping fail-fast
-* behavior for its own native root. Amp's read-only global discovery root
-* `~/.config/amp/skills/` follows the same skip-and-warn rule.
-* https://agentskills.io/client-implementation/adding-skills-support
-*/
-const AGENT_SKILLS_INTEROP_ROOTS = /* @__PURE__ */ new Set([
+* Skill roots that every tool scanning them imports leniently (skip-and-warn
+* per skill) instead of failing fast, regardless of the tool's own
+* `lenientImport` flag.
+*
+* - The Agent Skills interoperability roots: project `.agents/skills/`, global
+*   `~/.agents/skills/` (same relative path, home output root), and Amp's
+*   global equivalent `~/.config/agents/skills/`. Foreign-authored —
+*   potentially non-conformant — skills are the most likely to live here, so
+*   they are imported leniently per the Agent Skills client-implementation
+*   guide, while each tool keeps fail-fast behavior for its own native root.
+*   https://agentskills.io/client-implementation/adding-skills-support
+* - Amp's read-only global discovery root `~/.config/amp/skills/`, which is not
+*   an interop root but follows the same skip-and-warn rule.
+*
+* Other import-only roots (e.g. GitLab Duo's legacy skills root, Kimi Code's
+* shared root) are not listed here and stay fail-fast.
+*/
+const LENIENT_IMPORT_SKILL_ROOTS = /* @__PURE__ */ new Set([
 	toPosixPath(AGENTSMD_SKILLS_DIR_PATH),
 	toPosixPath(AMP_SKILLS_GLOBAL_DIR),
 	toPosixPath(AMP_SKILLS_NATIVE_GLOBAL_DIR)
@@ -15902,8 +15909,8 @@ function warnOnEmptyLoadedDescription({ skillFilePath, description }) {
 	if (typeof description !== "string" || description.length > 0) return;
 	warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ${EMPTY_SKILL_DESCRIPTION_VIOLATION}. Rulesync imports it anyway so the content is not lost; fill it in before relying on this skill.`);
 }
-function isAgentSkillsInteropRoot(relativeDirPath) {
-	return AGENT_SKILLS_INTEROP_ROOTS.has(toPosixPath(relativeDirPath));
+function isLenientImportSkillRoot(relativeDirPath) {
+	return LENIENT_IMPORT_SKILL_ROOTS.has(toPosixPath(relativeDirPath));
 }
 /** Ordered import roots: managed roots first, followed by read-only discovery roots. */
 function toolSkillImportRoots(paths) {
@@ -33133,7 +33140,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
 			const relativeDirPath = typeof root === "string" ? root : root.relativeDirPath;
-			const isLenientRoot = configuredRootPaths.has(relativeDirPath) || factory.meta.lenientImport === true || isAgentSkillsInteropRoot(relativeDirPath);
+			const isLenientRoot = configuredRootPaths.has(relativeDirPath) || factory.meta.lenientImport === true || isLenientImportSkillRoot(relativeDirPath);
 			const skillsDirPath = join(rootOutputRoot, relativeDirPath);
 			if (!await directoryExists(skillsDirPath)) continue;
 			const ownedDirNames = [];
@@ -55822,7 +55829,7 @@ function isFieldApplicable({ commandOnly, hookType }) {
 * silence — the mirror of the import side.
 */
 function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn }) {
-	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength } of fields) {
+	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag } of fields) {
 		const value = def[canonical];
 		if (value === void 0) continue;
 		if (!isFieldApplicable({
@@ -55839,9 +55846,10 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool can express as "${tool}".`);
 			continue;
 		}
+		if (onlyWithFlag !== void 0 && def[onlyWithFlag] !== true) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" has no effect without "${onlyWithFlag}": true; this tool reads "${tool}" only on "${onlyWithFlag}" hooks.`);
 		if (maxLength !== void 0 && typeof value === "string") {
 			const length = collapseWhitespaceForLength ? value.replace(/\s+/g, " ").trim().length : value.length;
-			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
+			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long${collapseWhitespaceForLength ? " after collapsing whitespace" : ""}; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
 		}
 	}
 	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
@@ -64242,14 +64250,16 @@ const QODER_SPEC = {
 			{
 				canonical: "rewakeMessage",
 				tool: "rewakeMessage",
-				commandOnly: true
+				commandOnly: true,
+				onlyWithFlag: "asyncRewake"
 			},
 			{
 				canonical: "rewakeSummary",
 				tool: "rewakeSummary",
 				commandOnly: true,
 				maxLength: 300,
-				collapseWhitespaceForLength: true
+				collapseWhitespaceForLength: true,
+				onlyWithFlag: "asyncRewake"
 			}
 		],
 		booleanPassthroughFields: [
@@ -69629,7 +69639,7 @@ var CodebuddyMcp = class CodebuddyMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/codebuff-mcp.ts
-const TOOL_NAME$1 = "codebuff";
+const TOOL_NAME$2 = "codebuff";
 const MAPPED_KEYS = /* @__PURE__ */ new Set([
 	"type",
 	"transport",
@@ -69664,14 +69674,14 @@ function toCodebuffEnv({ name, env, logger }) {
 		}
 		if (value.startsWith("$")) {
 			warnAndSkipMcpServer({
-				toolName: TOOL_NAME$1,
+				toolName: TOOL_NAME$2,
 				serverName: name,
 				reason: `env ${quoteValueForWarning(key)} starting with "$" that is not a whole \${VAR} reference, which Codebuff would resolve as a variable name and fail to load the whole mcp.json`,
 				logger
 			});
 			return null;
 		}
-		if (CANONICAL_ENV_REF.test(value)) logger?.warn(`${TOOL_NAME$1} MCP: env ${quoteValueForWarning(key)} of server ${quoteValueForWarning(name)} embeds a \${VAR} reference; Codebuff only resolves a whole-value \$VAR, so it is written as literal text.`);
+		if (CANONICAL_ENV_REF.test(value)) logger?.warn(`${TOOL_NAME$2} MCP: env ${quoteValueForWarning(key)} of server ${quoteValueForWarning(name)} embeds a \${VAR} reference; Codebuff only resolves a whole-value \$VAR, so it is written as literal text.`);
 		converted.push([key, value]);
 	}
 	return Object.fromEntries(converted);
@@ -69688,31 +69698,31 @@ function toCodebuffEnv({ name, env, logger }) {
 */
 function toCodebuffServer({ name, server, logger }) {
 	if (server.disabled === true) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "disabled: true, which Codebuff has no per-server switch for",
 		logger
 	});
 	const transport = server.type ?? server.transport;
 	if (transport === "ws") return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "the WebSocket transport, which Codebuff does not support",
 		logger
 	});
 	const dropped = Object.keys(server).filter((key) => !MAPPED_KEYS.has(key));
-	if (dropped.length > 0) logger?.warn(`${TOOL_NAME$1} MCP: dropping ${dropped.map((key) => quoteValueForWarning(key)).join(", ")} from server ${quoteValueForWarning(name)}; Codebuff rejects keys outside its server schema.`);
+	if (dropped.length > 0) logger?.warn(`${TOOL_NAME$2} MCP: dropping ${dropped.map((key) => quoteValueForWarning(key)).join(", ")} from server ${quoteValueForWarning(name)}; Codebuff rejects keys outside its server schema.`);
 	if (isRemoteMcpServer(server)) {
 		const url = resolveRemoteMcpUrl(server);
 		if (url === void 0) return warnAndSkipMcpServer({
-			toolName: TOOL_NAME$1,
+			toolName: TOOL_NAME$2,
 			serverName: name,
 			reason: "a remote transport without a url",
 			logger
 		});
 		const params = server.params;
 		const validParams = isRecord(params) && Object.values(params).every((value) => typeof value === "string");
-		if (params !== void 0 && !validParams) logger?.warn(`${TOOL_NAME$1} MCP: dropping params from server ${quoteValueForWarning(name)}; Codebuff accepts only a map of string values.`);
+		if (params !== void 0 && !validParams) logger?.warn(`${TOOL_NAME$2} MCP: dropping params from server ${quoteValueForWarning(name)}; Codebuff accepts only a map of string values.`);
 		return {
 			type: transport === "sse" ? "sse" : "http",
 			url,
@@ -69722,7 +69732,7 @@ function toCodebuffServer({ name, server, logger }) {
 	}
 	const [command, ...args] = resolveLocalMcpCommand(server);
 	if (command === void 0) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "no command to spawn",
 		logger
@@ -72392,7 +72402,7 @@ var CursorMcp = class CursorMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/deepagents-mcp.ts
-const TOOL_NAME = "deepagents";
+const TOOL_NAME$1 = "deepagents";
 /**
 * Map a canonical transport onto the three dcode accepts.
 *
@@ -72433,7 +72443,7 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 			return true;
 		}
 		warnAndSkipMcpServer({
-			toolName: TOOL_NAME,
+			toolName: TOOL_NAME$1,
 			serverName: name,
 			reason: "an empty command list, which leaves deepagents nothing to spawn",
 			logger
@@ -72461,7 +72471,7 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 */
 function toDeepagentsOauth({ name, oauth, converted, logger }) {
 	if (!isSlackOauthServer(converted)) {
-		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
 		return;
 	}
 	const source = isRecord(oauth) ? oauth : {};
@@ -72470,18 +72480,18 @@ function toDeepagentsOauth({ name, oauth, converted, logger }) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 		const nativeKey = key === "clientId" ? "client_id" : key;
 		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
-			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
 			continue;
 		}
 		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
 		if (!isDeepagentsOauthValue(value)) {
-			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
 			continue;
 		}
 		result[nativeKey] = value;
 	}
 	if (result.client_id === void 0) {
-		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
 		return;
 	}
 	return result;
@@ -72510,14 +72520,14 @@ function isSlackOauthServer(server) {
 */
 function toDeepagentsServer({ name, server, logger }) {
 	if (server.disabled === true) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "disabled: true, which deepagents does not read from .mcp.json (the server would still run)",
 		logger
 	});
 	const rawTransport = server.transport ?? server.type;
 	if (rawTransport === "ws") return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
@@ -72547,21 +72557,21 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
 	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "both enabledTools and disabledTools, which deepagents rejects — pick one",
 		logger
 	});
 	if (enabledTools !== void 0) {
 		if (enabledTools.length === 0) return warnAndSkipMcpServer({
-			toolName: TOOL_NAME,
+			toolName: TOOL_NAME$1,
 			serverName: name,
 			reason: "an empty enabledTools list, which allows no tools at all and which deepagents rejects",
 			logger
 		});
 		converted.allowedTools = enabledTools;
 	} else if (disabledTools !== void 0) {
-		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
+		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME$1} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
 		else converted.disabledTools = disabledTools;
 	}
 	return converted;
@@ -73213,6 +73223,32 @@ var DshMcp = class DshMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/factorydroid-mcp.ts
+const TOOL_NAME = "factorydroid";
+/**
+* Drop servers whose `enabledTools` allowlist is empty.
+*
+* Canonically an empty allowlist allows no tools, but Droid applies
+* `enabledTools` only "when the list is non-empty"
+* (https://docs.factory.com/harness/mcp), so writing `[]` would load every
+* tool the server reports. Skipping the server is the only form that does not
+* hand the model more tools than the canonical config allows.
+*/
+function skipEmptyAllowlistServers({ mcpServers, logger }) {
+	const kept = {};
+	for (const [name, server] of Object.entries(mcpServers)) {
+		if (server.enabledTools?.length === 0) {
+			warnAndSkipMcpServer({
+				toolName: TOOL_NAME,
+				serverName: name,
+				reason: "an empty enabledTools list, which allows no tools at all but which Factory Droid treats as no filter",
+				logger
+			});
+			continue;
+		}
+		kept[name] = server;
+	}
+	return kept;
+}
 var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -73238,8 +73274,11 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 			validate
 		});
 	}
-	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true }) {
-		const factorydroidConfig = { mcpServers: rulesyncMcp.getMcpServers() };
+	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, logger }) {
+		const factorydroidConfig = { mcpServers: skipEmptyAllowlistServers({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			logger
+		}) };
 		const fileContent = JSON.stringify(factorydroidConfig, null, 2);
 		return new FactorydroidMcp({
 			outputRoot,
@@ -106436,4 +106475,4 @@ async function importChecksCore(params) {
 }
 export { RulesyncPermissions as $, formatError as $n, isSymlink as $t, CODEBUDDY_DIR as A, MAX_FILE_SIZE as An, withFallbackLoggerTarget as At, CLAUDECODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Bn, assertTreeContainsNoSymlinks as Bt, QWENCODE_LOCAL_RULE_FILE_NAME as C, PACKAGING_TOOL_TARGETS as Cn, getSourceTransport as Ct, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as D, DEPRECATED_FEATURE_REPLACEMENTS as Dn, WarningCollectingLogger as Dt, FACTORYDROID_DIR as E, ALL_FEATURES_WITH_WILDCARD as En, JsonLogger as Et, groupSpellingsByCaseFoldedIdentity as F, RULESYNC_CONFIG_SCHEMA_URL as Fn, PathOutsideRootError as Ft, toInstructionBudgetFile as G, RULESYNC_PERMISSIONS_SCHEMA_URL as Gn, ensureDir as Gt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as H, RULESYNC_MCP_SCHEMA_URL as Hn, checkPathTraversal as Ht, CODEXCLI_BASH_RULES_FILE_NAME as I, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as In, applyFileMode as It, RulesyncSubagentFrontmatterSchema as J, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Jn, findFilesByGlobs as Jt, getLocalSkillDirNames as K, RULESYNC_RELATIVE_DIR_PATH as Kn, fileExists as Kt, CODEXCLI_DIR as L, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Ln, assertDirectoryIfExists as Lt, AUGMENTCODE_DIR as M, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Mn, withWarnOnceScope as Mt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as N, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Nn, CLIError as Nt, COMMANDCODE_DIR as O, CURATED_RULES_FEATURE_SUBDIR as On, fallbackLogger as Ot, caseFoldIdentity as P, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Pn, ErrorCodes as Pt, RulesyncRuleFrontmatterSchema as Q, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Qn, isFileSystemError as Qt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as R, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Rn, assertNoSymlinkBelowRoot as Rt, QWENCODE_DIR as S, ALL_TOOL_TARGETS_WITH_WILDCARD as Sn, assertTargetsFeaturesExclusive as St, LETTACODE_SETTINGS_LOCAL_FILE_NAME as T, ALL_FEATURES as Tn, ConsoleLogger as Tt, CLAUDECODE_SKILLS_DIR_PATH as U, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Un, createTempDirectory as Ut, CLAUDECODE_MEMORIES_DIR_NAME as V, RULESYNC_MCP_RELATIVE_FILE_PATH as Vn, assertWritablePathInsideRoot as Vt, findProjectInstructionBudgetFindings as W, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Wn, directoryExists as Wt, RulesyncSkillFrontmatterSchema as X, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Xn, getHomeDirectory as Xt, RulesyncSkill as Y, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Yn, getFileSizeAndExecutableBit as Yt, RulesyncRule as Z, RULESYNC_USER_CONFIG_DIR_NAME as Zn, isFileNotFoundError as Zt, SubagentsProcessor as _, toPosixPath as _n, resolveEffectiveInputRoots as _t, convertFromTool as a, readFileContent as an, stripControlCharactersKeepingLineFeeds as ar, parseJsonc as at, CommandsProcessor as b, mapWithConcurrency as bn, GITIGNORE_DESTINATION_KEY as bt, parseCommaSeparatedList as c, removeDirectoryStrict as cn, RulesyncCheck as ct, shortenToWidth as d, removeFileWithoutFollowingSymlinks as dn, loadYaml as dt, listDirectoryEntryNames as en, truncateText as er, RulesyncMcp as et, McpProcessor as f, removeTempDirectory as fn, isRecord as ft, RulesProcessor as g, splitPathSegments as gn, mergeInputRootConfigs as gt, ChecksProcessor as h, runWithDirectoryRollback as hn, ConfigResolver as ht, inspectInputRoots as i, posixRelativePathEscapesRoot as in, stripControlCharacters as ir, resolveRulesyncSourceWritePath as it, CODEBUDDY_LOCAL_RULE_FILE_NAME as j, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as jn, resetRunWarningState as jt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as k, FEATURE_SOURCE_TREE_ENTRIES as kn, warnOnConflictingFlags as kt, ELLIPSIS_WIDTH as l, removeFile as ln, RulesyncCheckFrontmatterSchema as lt, HooksProcessor as m, resolvedRelativePath as mn, SKILL_FILE_NAME as mt, formatSourceLoadFailure as n, listSubdirectoryNames as nn, hasEnclosingMarkOutsideKeycap as nr, RulesyncHooks as nt, isPackagingToolTarget as o, readFileContentOrNull as on, stripControlCharactersKeepingLineFeedsAndTabs as or, RulesyncCommand as ot, IgnoreProcessor as p, resolvePath as pn, SHARED_USER_MANAGED_CONFIG_PATHS as pt, RulesyncSubagent as q, RULESYNC_RULES_RELATIVE_DIR_PATH as qn, fileExistsStrict as qt, generate as r, pathEscapesRoot as rn, quoteForLog as rr, getRulesyncSourceCandidates as rt, getProcessorRegistryEntry as s, removeDirectory as sn, stripHiddenCharacters as sr, RulesyncCommandFrontmatterSchema as st, importFromTool as t, listFilePathsRecursively as tn, hasDeceptiveHiddenCharacters as tr, RulesyncIgnore as tt, displayWidthOf as u, removeFileStrict as un, stringifyFrontmatter as ut, SkillsProcessor as v, writeFileBuffer as vn, CONFLICTING_TARGET_PAIRS as vt, LETTACODE_DIR as w, ToolTargetSchema as wn, findControlCharacter as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, ALL_TOOL_TARGETS as xn, SourceEntrySchema as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, writeFileContent as yn, ConfigFileSchema as yt, CLAUDECODE_DIR as z, RULESYNC_IGNORE_RELATIVE_FILE_PATH as zn, assertPathResolvesInsideRoot as zt };
 
-//# sourceMappingURL=import-COu_2AUF.js.map
+//# sourceMappingURL=import-D2uYjAdc.js.map