rulesync 6.6.1 → 6.6.3

package/README.md

@@ -120,6 +120,9 @@ Get-FileHash rulesync.exe -Algorithm SHA256 | ForEach-Object {
 ```bash
 # Create necessary directories, sample rule files, and configuration file
 npx rulesync init
+
+# Install official skills (recommended)
+npx rulesync fetch dyoshikawa/rulesync --features skills
 ```
 
 On the other hand, if you already have AI tool configurations:
@@ -231,7 +234,7 @@ npx rulesync generate --targets "*" --features rules
 # Generate simulated commands and subagents
 npx rulesync generate --targets copilot,cursor,codexcli --features commands,subagents --simulate-commands --simulate-subagents
 
-# Preview changes without writing files (dry-run mode)
+# Dry run: show changes without writing files
 npx rulesync generate --dry-run --targets claudecode --features rules
 
 # Check if files are up to date (for CI/CD pipelines)
@@ -250,13 +253,13 @@ npx rulesync update --check
 npx rulesync update --force
 ```
 
-## Preview Modes
+## Dry Run
 
-Rulesync provides two preview modes for the `generate` command that allow you to see what changes would be made without actually writing files:
+Rulesync provides two dry run options for the `generate` command that allow you to see what changes would be made without actually writing files:
 
 ### `--dry-run`
 
-Preview changes without writing any files. Shows what would be written or deleted with a `[PREVIEW]` prefix.
+Show what would be written or deleted without actually writing any files. Changes are displayed with a `[DRY RUN]` prefix.
 
 ```bash
 npx rulesync generate --dry-run --targets claudecode --features rules
@@ -333,6 +336,9 @@ npx rulesync fetch owner/repo@v1.0.0 --features rules,commands
 export GITHUB_TOKEN=ghp_xxxx
 npx rulesync fetch owner/private-repo
 
+# Or use GitHub CLI to get the token
+GITHUB_TOKEN=$(gh auth token) npx rulesync fetch owner/private-repo
+
 # Preserve existing files (skip conflicts)
 npx rulesync fetch owner/repo --conflict skip
 

package/dist/index.cjs

@@ -125,6 +125,7 @@ var Logger = class {
 var logger = new Logger();
 
 // src/lib/fetch.ts
+var import_promise = require("es-toolkit/promise");
 var import_node_path107 = require("path");
 
 // src/constants/rulesync-paths.ts
@@ -13546,6 +13547,17 @@ var GitHubClientError = class extends Error {
     this.name = "GitHubClientError";
   }
 };
+function logGitHubAuthHints(error) {
+  logger.error(`GitHub API Error: ${error.message}`);
+  if (error.statusCode === 401 || error.statusCode === 403) {
+    logger.info(
+      "Tip: Set GITHUB_TOKEN or GH_TOKEN environment variable for private repositories or better rate limits."
+    );
+    logger.info(
+      "Tip: If you use GitHub CLI, you can use `GITHUB_TOKEN=$(gh auth token) rulesync fetch ...`"
+    );
+  }
+}
 var GitHubClient = class {
   octokit;
   hasToken;
@@ -13863,6 +13875,15 @@ function parseSource(source) {
 var GITHUB_HOSTS = /* @__PURE__ */ new Set(["github.com", "www.github.com"]);
 var GITLAB_HOSTS = /* @__PURE__ */ new Set(["gitlab.com", "www.gitlab.com"]);
 var MAX_RECURSION_DEPTH = 15;
+var FETCH_CONCURRENCY_LIMIT = 10;
+async function withSemaphore(semaphore, fn) {
+  await semaphore.acquire();
+  try {
+    return await fn();
+  } finally {
+    semaphore.release();
+  }
+}
 function parseUrl(url) {
   const urlObj = new URL(url);
   const host = urlObj.hostname.toLowerCase();
@@ -14002,13 +14023,15 @@ async function fetchFiles(params) {
       conflictStrategy
     });
   }
+  const semaphore = new import_promise.Semaphore(FETCH_CONCURRENCY_LIMIT);
   const filesToFetch = await collectFeatureFiles({
     client,
     owner: parsed.owner,
     repo: parsed.repo,
     basePath: resolvedPath,
     ref,
-    enabledFeatures
+    enabledFeatures,
+    semaphore
   });
   if (filesToFetch.length === 0) {
     logger.warn(`No files found matching enabled features: ${enabledFeatures.join(", ")}`);
@@ -14021,9 +14044,8 @@ async function fetchFiles(params) {
       skipped: 0
     };
   }
-  const results = [];
   const outputBasePath = (0, import_node_path107.join)(baseDir, outputDir);
-  for (const { remotePath, relativePath, size } of filesToFetch) {
+  for (const { relativePath, size } of filesToFetch) {
     checkPathTraversal({
       relativePath,
       intendedRootDir: outputBasePath
@@ -14033,20 +14055,25 @@ async function fetchFiles(params) {
         `File "${relativePath}" exceeds maximum size limit (${(size / 1024 / 1024).toFixed(2)}MB > ${MAX_FILE_SIZE / 1024 / 1024}MB)`
       );
     }
-    const localPath = (0, import_node_path107.join)(outputBasePath, relativePath);
-    const exists = await fileExists(localPath);
-    let status;
-    if (exists && conflictStrategy === "skip") {
-      status = "skipped";
-      logger.debug(`Skipping existing file: ${relativePath}`);
-    } else {
-      const content = await client.getFileContent(parsed.owner, parsed.repo, remotePath, ref);
+  }
+  const results = await Promise.all(
+    filesToFetch.map(async ({ remotePath, relativePath }) => {
+      const localPath = (0, import_node_path107.join)(outputBasePath, relativePath);
+      const exists = await fileExists(localPath);
+      if (exists && conflictStrategy === "skip") {
+        logger.debug(`Skipping existing file: ${relativePath}`);
+        return { relativePath, status: "skipped" };
+      }
+      const content = await withSemaphore(
+        semaphore,
+        () => client.getFileContent(parsed.owner, parsed.repo, remotePath, ref)
+      );
       await writeFileContent(localPath, content);
-      status = exists ? "overwritten" : "created";
+      const status = exists ? "overwritten" : "created";
       logger.debug(`Wrote: ${relativePath} (${status})`);
-    }
-    results.push({ relativePath, status });
-  }
+      return { relativePath, status };
+    })
+  );
   const summary = {
     source: `${parsed.owner}/${parsed.repo}`,
     ref,
@@ -14058,24 +14085,29 @@ async function fetchFiles(params) {
   return summary;
 }
 async function collectFeatureFiles(params) {
-  const { client, owner, repo, basePath, ref, enabledFeatures } = params;
-  const filesToFetch = [];
-  for (const feature of enabledFeatures) {
-    const featurePaths = FEATURE_PATHS[feature];
-    for (const featurePath of featurePaths) {
+  const { client, owner, repo, basePath, ref, enabledFeatures, semaphore } = params;
+  const tasks = enabledFeatures.flatMap(
+    (feature) => FEATURE_PATHS[feature].map((featurePath) => ({ feature, featurePath }))
+  );
+  const results = await Promise.all(
+    tasks.map(async ({ featurePath }) => {
       const fullPath = basePath === "." || basePath === "" ? featurePath : (0, import_node_path107.join)(basePath, featurePath);
+      const collected = [];
       try {
         if (featurePath.includes(".")) {
           try {
-            const entries = await client.listDirectory(
-              owner,
-              repo,
-              basePath === "." || basePath === "" ? "." : basePath,
-              ref
+            const entries = await withSemaphore(
+              semaphore,
+              () => client.listDirectory(
+                owner,
+                repo,
+                basePath === "." || basePath === "" ? "." : basePath,
+                ref
+              )
             );
             const fileEntry = entries.find((e) => e.name === featurePath && e.type === "file");
             if (fileEntry) {
-              filesToFetch.push({
+              collected.push({
                 remotePath: fileEntry.path,
                 relativePath: featurePath,
                 size: fileEntry.size
@@ -14089,10 +14121,17 @@ async function collectFeatureFiles(params) {
             }
           }
         } else {
-          const dirFiles = await listDirectoryRecursive(client, owner, repo, fullPath, ref);
+          const dirFiles = await listDirectoryRecursive({
+            client,
+            owner,
+            repo,
+            path: fullPath,
+            ref,
+            semaphore
+          });
           for (const file of dirFiles) {
             const relativePath = basePath === "." || basePath === "" ? file.path : file.path.substring(basePath.length + 1);
-            filesToFetch.push({
+            collected.push({
               remotePath: file.path,
               relativePath,
               size: file.size
@@ -14102,38 +14141,49 @@ async function collectFeatureFiles(params) {
       } catch (error) {
         if (isNotFoundError(error)) {
           logger.debug(`Feature not found: ${fullPath}`);
-          continue;
+          return collected;
         }
         throw error;
       }
-    }
-  }
-  return filesToFetch;
+      return collected;
+    })
+  );
+  return results.flat();
 }
-async function listDirectoryRecursive(client, owner, repo, path4, ref, depth = 0) {
+async function listDirectoryRecursive(params) {
+  const { client, owner, repo, path: path4, ref, depth = 0, semaphore } = params;
   if (depth > MAX_RECURSION_DEPTH) {
     throw new Error(
       `Maximum recursion depth (${MAX_RECURSION_DEPTH}) exceeded while listing directory: ${path4}`
     );
   }
-  const entries = await client.listDirectory(owner, repo, path4, ref);
+  const entries = await withSemaphore(
+    semaphore,
+    () => client.listDirectory(owner, repo, path4, ref)
+  );
   const files = [];
+  const directories = [];
   for (const entry of entries) {
     if (entry.type === "file") {
       files.push(entry);
     } else if (entry.type === "dir") {
-      const subFiles = await listDirectoryRecursive(
+      directories.push(entry);
+    }
+  }
+  const subResults = await Promise.all(
+    directories.map(
+      (dir) => listDirectoryRecursive({
         client,
         owner,
         repo,
-        entry.path,
+        path: dir.path,
         ref,
-        depth + 1
-      );
-      files.push(...subFiles);
-    }
-  }
-  return files;
+        depth: depth + 1,
+        semaphore
+      })
+    )
+  );
+  return [...files, ...subResults.flat()];
 }
 async function fetchAndConvertToolFiles(params) {
   const {
@@ -14149,6 +14199,7 @@ async function fetchAndConvertToolFiles(params) {
   } = params;
   const tempDir = await createTempDirectory();
   logger.debug(`Created temp directory: ${tempDir}`);
+  const semaphore = new import_promise.Semaphore(FETCH_CONCURRENCY_LIMIT);
   try {
     const filesToFetch = await collectFeatureFiles({
       client,
@@ -14156,7 +14207,8 @@ async function fetchAndConvertToolFiles(params) {
       repo: parsed.repo,
       basePath: resolvedPath,
       ref,
-      enabledFeatures
+      enabledFeatures,
+      semaphore
     });
     if (filesToFetch.length === 0) {
       logger.warn(`No files found matching enabled features: ${enabledFeatures.join(", ")}`);
@@ -14169,25 +14221,31 @@ async function fetchAndConvertToolFiles(params) {
         skipped: 0
       };
     }
-    const toolPaths = getToolPathMapping(target);
-    const fetchedFiles = [];
-    for (const { remotePath, relativePath, size } of filesToFetch) {
+    for (const { relativePath, size } of filesToFetch) {
       if (size > MAX_FILE_SIZE) {
         throw new GitHubClientError(
           `File "${relativePath}" exceeds maximum size limit (${(size / 1024 / 1024).toFixed(2)}MB > ${MAX_FILE_SIZE / 1024 / 1024}MB)`
         );
       }
-      const toolRelativePath = mapToToolPath(relativePath, toolPaths);
-      checkPathTraversal({
-        relativePath: toolRelativePath,
-        intendedRootDir: tempDir
-      });
-      const localPath = (0, import_node_path107.join)(tempDir, toolRelativePath);
-      const content = await client.getFileContent(parsed.owner, parsed.repo, remotePath, ref);
-      await writeFileContent(localPath, content);
-      fetchedFiles.push(toolRelativePath);
-      logger.debug(`Fetched to temp: ${toolRelativePath}`);
     }
+    const toolPaths = getToolPathMapping(target);
+    await Promise.all(
+      filesToFetch.map(async ({ remotePath, relativePath }) => {
+        const toolRelativePath = mapToToolPath(relativePath, toolPaths);
+        checkPathTraversal({
+          relativePath: toolRelativePath,
+          intendedRootDir: tempDir
+        });
+        const localPath = (0, import_node_path107.join)(tempDir, toolRelativePath);
+        const content = await withSemaphore(
+          semaphore,
+          () => client.getFileContent(parsed.owner, parsed.repo, remotePath, ref)
+        );
+        await writeFileContent(localPath, content);
+        logger.debug(`Fetched to temp: ${toolRelativePath}`);
+        return toolRelativePath;
+      })
+    );
     const outputBasePath = (0, import_node_path107.join)(baseDir, outputDir);
     const { converted, convertedPaths } = await convertFetchedFilesToRulesync({
       tempDir,
@@ -14325,12 +14383,7 @@ async function fetchCommand(options) {
     }
   } catch (error) {
     if (error instanceof GitHubClientError) {
-      logger.error(`GitHub API Error: ${error.message}`);
-      if (error.statusCode === 401 || error.statusCode === 403) {
-        logger.info(
-          "Tip: Set GITHUB_TOKEN or GH_TOKEN environment variable for private repositories."
-        );
-      }
+      logGitHubAuthHints(error);
     } else {
       logger.error(formatError(error));
     }
@@ -17201,7 +17254,8 @@ var MAX_DOWNLOAD_SIZE = 500 * 1024 * 1024;
 var ALLOWED_DOWNLOAD_DOMAINS = [
   "github.com",
   "objects.githubusercontent.com",
-  "github-releases.githubusercontent.com"
+  "github-releases.githubusercontent.com",
+  "release-assets.githubusercontent.com"
 ];
 var UpdatePermissionError = class extends Error {
   constructor(message) {
@@ -17527,12 +17581,7 @@ async function updateCommand(currentVersion, options) {
     logger.success(message);
   } catch (error) {
     if (error instanceof GitHubClientError) {
-      logger.error(`GitHub API Error: ${error.message}`);
-      if (error.statusCode === 401 || error.statusCode === 403) {
-        logger.info(
-          "Tip: Set GITHUB_TOKEN or GH_TOKEN environment variable for better rate limits."
-        );
-      }
+      logGitHubAuthHints(error);
     } else if (error instanceof UpdatePermissionError) {
       logger.error(error.message);
       logger.info("Tip: Run with elevated privileges (e.g., sudo rulesync update)");
@@ -17544,7 +17593,7 @@ async function updateCommand(currentVersion, options) {
 }
 
 // src/cli/index.ts
-var getVersion = () => "6.6.1";
+var getVersion = () => "6.6.3";
 var main = async () => {
   const program = new import_commander.Command();
   const version = getVersion();
@@ -17644,7 +17693,7 @@ var main = async () => {
   ).option(
     "--modular-mcp",
     "Generate modular-mcp configuration for context compression (experimental)"
-  ).option("--dry-run", "Preview changes without writing files").option("--check", "Check if files are up to date (exits with code 1 if changes needed)").action(async (options) => {
+  ).option("--dry-run", "Dry run: show changes without writing files").option("--check", "Check if files are up to date (exits with code 1 if changes needed)").action(async (options) => {
     try {
       await generateCommand({
         targets: options.targets,

package/dist/index.js

@@ -102,6 +102,7 @@ var Logger = class {
 var logger = new Logger();
 
 // src/lib/fetch.ts
+import { Semaphore } from "es-toolkit/promise";
 import { join as join106 } from "path";
 
 // src/constants/rulesync-paths.ts
@@ -13523,6 +13524,17 @@ var GitHubClientError = class extends Error {
     this.name = "GitHubClientError";
   }
 };
+function logGitHubAuthHints(error) {
+  logger.error(`GitHub API Error: ${error.message}`);
+  if (error.statusCode === 401 || error.statusCode === 403) {
+    logger.info(
+      "Tip: Set GITHUB_TOKEN or GH_TOKEN environment variable for private repositories or better rate limits."
+    );
+    logger.info(
+      "Tip: If you use GitHub CLI, you can use `GITHUB_TOKEN=$(gh auth token) rulesync fetch ...`"
+    );
+  }
+}
 var GitHubClient = class {
   octokit;
   hasToken;
@@ -13840,6 +13852,15 @@ function parseSource(source) {
 var GITHUB_HOSTS = /* @__PURE__ */ new Set(["github.com", "www.github.com"]);
 var GITLAB_HOSTS = /* @__PURE__ */ new Set(["gitlab.com", "www.gitlab.com"]);
 var MAX_RECURSION_DEPTH = 15;
+var FETCH_CONCURRENCY_LIMIT = 10;
+async function withSemaphore(semaphore, fn) {
+  await semaphore.acquire();
+  try {
+    return await fn();
+  } finally {
+    semaphore.release();
+  }
+}
 function parseUrl(url) {
   const urlObj = new URL(url);
   const host = urlObj.hostname.toLowerCase();
@@ -13979,13 +14000,15 @@ async function fetchFiles(params) {
       conflictStrategy
     });
   }
+  const semaphore = new Semaphore(FETCH_CONCURRENCY_LIMIT);
   const filesToFetch = await collectFeatureFiles({
     client,
     owner: parsed.owner,
     repo: parsed.repo,
     basePath: resolvedPath,
     ref,
-    enabledFeatures
+    enabledFeatures,
+    semaphore
   });
   if (filesToFetch.length === 0) {
     logger.warn(`No files found matching enabled features: ${enabledFeatures.join(", ")}`);
@@ -13998,9 +14021,8 @@ async function fetchFiles(params) {
       skipped: 0
     };
   }
-  const results = [];
   const outputBasePath = join106(baseDir, outputDir);
-  for (const { remotePath, relativePath, size } of filesToFetch) {
+  for (const { relativePath, size } of filesToFetch) {
     checkPathTraversal({
       relativePath,
       intendedRootDir: outputBasePath
@@ -14010,20 +14032,25 @@ async function fetchFiles(params) {
         `File "${relativePath}" exceeds maximum size limit (${(size / 1024 / 1024).toFixed(2)}MB > ${MAX_FILE_SIZE / 1024 / 1024}MB)`
       );
     }
-    const localPath = join106(outputBasePath, relativePath);
-    const exists = await fileExists(localPath);
-    let status;
-    if (exists && conflictStrategy === "skip") {
-      status = "skipped";
-      logger.debug(`Skipping existing file: ${relativePath}`);
-    } else {
-      const content = await client.getFileContent(parsed.owner, parsed.repo, remotePath, ref);
+  }
+  const results = await Promise.all(
+    filesToFetch.map(async ({ remotePath, relativePath }) => {
+      const localPath = join106(outputBasePath, relativePath);
+      const exists = await fileExists(localPath);
+      if (exists && conflictStrategy === "skip") {
+        logger.debug(`Skipping existing file: ${relativePath}`);
+        return { relativePath, status: "skipped" };
+      }
+      const content = await withSemaphore(
+        semaphore,
+        () => client.getFileContent(parsed.owner, parsed.repo, remotePath, ref)
+      );
       await writeFileContent(localPath, content);
-      status = exists ? "overwritten" : "created";
+      const status = exists ? "overwritten" : "created";
       logger.debug(`Wrote: ${relativePath} (${status})`);
-    }
-    results.push({ relativePath, status });
-  }
+      return { relativePath, status };
+    })
+  );
   const summary = {
     source: `${parsed.owner}/${parsed.repo}`,
     ref,
@@ -14035,24 +14062,29 @@ async function fetchFiles(params) {
   return summary;
 }
 async function collectFeatureFiles(params) {
-  const { client, owner, repo, basePath, ref, enabledFeatures } = params;
-  const filesToFetch = [];
-  for (const feature of enabledFeatures) {
-    const featurePaths = FEATURE_PATHS[feature];
-    for (const featurePath of featurePaths) {
+  const { client, owner, repo, basePath, ref, enabledFeatures, semaphore } = params;
+  const tasks = enabledFeatures.flatMap(
+    (feature) => FEATURE_PATHS[feature].map((featurePath) => ({ feature, featurePath }))
+  );
+  const results = await Promise.all(
+    tasks.map(async ({ featurePath }) => {
       const fullPath = basePath === "." || basePath === "" ? featurePath : join106(basePath, featurePath);
+      const collected = [];
       try {
         if (featurePath.includes(".")) {
           try {
-            const entries = await client.listDirectory(
-              owner,
-              repo,
-              basePath === "." || basePath === "" ? "." : basePath,
-              ref
+            const entries = await withSemaphore(
+              semaphore,
+              () => client.listDirectory(
+                owner,
+                repo,
+                basePath === "." || basePath === "" ? "." : basePath,
+                ref
+              )
             );
             const fileEntry = entries.find((e) => e.name === featurePath && e.type === "file");
             if (fileEntry) {
-              filesToFetch.push({
+              collected.push({
                 remotePath: fileEntry.path,
                 relativePath: featurePath,
                 size: fileEntry.size
@@ -14066,10 +14098,17 @@ async function collectFeatureFiles(params) {
             }
           }
         } else {
-          const dirFiles = await listDirectoryRecursive(client, owner, repo, fullPath, ref);
+          const dirFiles = await listDirectoryRecursive({
+            client,
+            owner,
+            repo,
+            path: fullPath,
+            ref,
+            semaphore
+          });
           for (const file of dirFiles) {
             const relativePath = basePath === "." || basePath === "" ? file.path : file.path.substring(basePath.length + 1);
-            filesToFetch.push({
+            collected.push({
               remotePath: file.path,
               relativePath,
               size: file.size
@@ -14079,38 +14118,49 @@ async function collectFeatureFiles(params) {
       } catch (error) {
         if (isNotFoundError(error)) {
           logger.debug(`Feature not found: ${fullPath}`);
-          continue;
+          return collected;
         }
         throw error;
       }
-    }
-  }
-  return filesToFetch;
+      return collected;
+    })
+  );
+  return results.flat();
 }
-async function listDirectoryRecursive(client, owner, repo, path4, ref, depth = 0) {
+async function listDirectoryRecursive(params) {
+  const { client, owner, repo, path: path4, ref, depth = 0, semaphore } = params;
   if (depth > MAX_RECURSION_DEPTH) {
     throw new Error(
       `Maximum recursion depth (${MAX_RECURSION_DEPTH}) exceeded while listing directory: ${path4}`
     );
   }
-  const entries = await client.listDirectory(owner, repo, path4, ref);
+  const entries = await withSemaphore(
+    semaphore,
+    () => client.listDirectory(owner, repo, path4, ref)
+  );
   const files = [];
+  const directories = [];
   for (const entry of entries) {
     if (entry.type === "file") {
       files.push(entry);
     } else if (entry.type === "dir") {
-      const subFiles = await listDirectoryRecursive(
+      directories.push(entry);
+    }
+  }
+  const subResults = await Promise.all(
+    directories.map(
+      (dir) => listDirectoryRecursive({
         client,
         owner,
         repo,
-        entry.path,
+        path: dir.path,
         ref,
-        depth + 1
-      );
-      files.push(...subFiles);
-    }
-  }
-  return files;
+        depth: depth + 1,
+        semaphore
+      })
+    )
+  );
+  return [...files, ...subResults.flat()];
 }
 async function fetchAndConvertToolFiles(params) {
   const {
@@ -14126,6 +14176,7 @@ async function fetchAndConvertToolFiles(params) {
   } = params;
   const tempDir = await createTempDirectory();
   logger.debug(`Created temp directory: ${tempDir}`);
+  const semaphore = new Semaphore(FETCH_CONCURRENCY_LIMIT);
   try {
     const filesToFetch = await collectFeatureFiles({
       client,
@@ -14133,7 +14184,8 @@ async function fetchAndConvertToolFiles(params) {
       repo: parsed.repo,
       basePath: resolvedPath,
       ref,
-      enabledFeatures
+      enabledFeatures,
+      semaphore
     });
     if (filesToFetch.length === 0) {
       logger.warn(`No files found matching enabled features: ${enabledFeatures.join(", ")}`);
@@ -14146,25 +14198,31 @@ async function fetchAndConvertToolFiles(params) {
         skipped: 0
       };
     }
-    const toolPaths = getToolPathMapping(target);
-    const fetchedFiles = [];
-    for (const { remotePath, relativePath, size } of filesToFetch) {
+    for (const { relativePath, size } of filesToFetch) {
       if (size > MAX_FILE_SIZE) {
         throw new GitHubClientError(
           `File "${relativePath}" exceeds maximum size limit (${(size / 1024 / 1024).toFixed(2)}MB > ${MAX_FILE_SIZE / 1024 / 1024}MB)`
         );
       }
-      const toolRelativePath = mapToToolPath(relativePath, toolPaths);
-      checkPathTraversal({
-        relativePath: toolRelativePath,
-        intendedRootDir: tempDir
-      });
-      const localPath = join106(tempDir, toolRelativePath);
-      const content = await client.getFileContent(parsed.owner, parsed.repo, remotePath, ref);
-      await writeFileContent(localPath, content);
-      fetchedFiles.push(toolRelativePath);
-      logger.debug(`Fetched to temp: ${toolRelativePath}`);
     }
+    const toolPaths = getToolPathMapping(target);
+    await Promise.all(
+      filesToFetch.map(async ({ remotePath, relativePath }) => {
+        const toolRelativePath = mapToToolPath(relativePath, toolPaths);
+        checkPathTraversal({
+          relativePath: toolRelativePath,
+          intendedRootDir: tempDir
+        });
+        const localPath = join106(tempDir, toolRelativePath);
+        const content = await withSemaphore(
+          semaphore,
+          () => client.getFileContent(parsed.owner, parsed.repo, remotePath, ref)
+        );
+        await writeFileContent(localPath, content);
+        logger.debug(`Fetched to temp: ${toolRelativePath}`);
+        return toolRelativePath;
+      })
+    );
     const outputBasePath = join106(baseDir, outputDir);
     const { converted, convertedPaths } = await convertFetchedFilesToRulesync({
       tempDir,
@@ -14302,12 +14360,7 @@ async function fetchCommand(options) {
     }
   } catch (error) {
     if (error instanceof GitHubClientError) {
-      logger.error(`GitHub API Error: ${error.message}`);
-      if (error.statusCode === 401 || error.statusCode === 403) {
-        logger.info(
-          "Tip: Set GITHUB_TOKEN or GH_TOKEN environment variable for private repositories."
-        );
-      }
+      logGitHubAuthHints(error);
     } else {
       logger.error(formatError(error));
     }
@@ -17178,7 +17231,8 @@ var MAX_DOWNLOAD_SIZE = 500 * 1024 * 1024;
 var ALLOWED_DOWNLOAD_DOMAINS = [
   "github.com",
   "objects.githubusercontent.com",
-  "github-releases.githubusercontent.com"
+  "github-releases.githubusercontent.com",
+  "release-assets.githubusercontent.com"
 ];
 var UpdatePermissionError = class extends Error {
   constructor(message) {
@@ -17504,12 +17558,7 @@ async function updateCommand(currentVersion, options) {
     logger.success(message);
   } catch (error) {
     if (error instanceof GitHubClientError) {
-      logger.error(`GitHub API Error: ${error.message}`);
-      if (error.statusCode === 401 || error.statusCode === 403) {
-        logger.info(
-          "Tip: Set GITHUB_TOKEN or GH_TOKEN environment variable for better rate limits."
-        );
-      }
+      logGitHubAuthHints(error);
     } else if (error instanceof UpdatePermissionError) {
       logger.error(error.message);
       logger.info("Tip: Run with elevated privileges (e.g., sudo rulesync update)");
@@ -17521,7 +17570,7 @@ async function updateCommand(currentVersion, options) {
 }
 
 // src/cli/index.ts
-var getVersion = () => "6.6.1";
+var getVersion = () => "6.6.3";
 var main = async () => {
   const program = new Command();
   const version = getVersion();
@@ -17621,7 +17670,7 @@ var main = async () => {
   ).option(
     "--modular-mcp",
     "Generate modular-mcp configuration for context compression (experimental)"
-  ).option("--dry-run", "Preview changes without writing files").option("--check", "Check if files are up to date (exits with code 1 if changes needed)").action(async (options) => {
+  ).option("--dry-run", "Dry run: show changes without writing files").option("--check", "Check if files are up to date (exits with code 1 if changes needed)").action(async (options) => {
     try {
       await generateCommand({
         targets: options.targets,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulesync",
-  "version": "6.6.1",
+  "version": "6.6.3",
   "description": "Unified AI rules management CLI tool that generates configuration files for various AI development tools",
   "keywords": [
     "ai",
@@ -36,16 +36,16 @@
     "pre-commit": "pnpm exec lint-staged"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.25.3",
+    "@modelcontextprotocol/sdk": "1.26.0",
     "@octokit/request-error": "7.1.0",
     "@octokit/rest": "22.0.1",
     "@toon-format/toon": "2.1.0",
     "@valibot/to-json-schema": "1.5.0",
-    "commander": "14.0.2",
+    "commander": "14.0.3",
     "consola": "3.4.2",
-    "effect": "3.19.15",
+    "effect": "3.19.16",
     "es-toolkit": "1.44.0",
-    "fastmcp": "3.30.1",
+    "fastmcp": "3.31.0",
     "globby": "16.1.0",
     "gray-matter": "4.0.3",
     "js-yaml": "4.1.1",
@@ -55,26 +55,26 @@
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.2.23",
+    "@anthropic-ai/claude-agent-sdk": "0.2.31",
     "@eslint/js": "9.39.2",
     "@secretlint/secretlint-rule-preset-recommend": "11.3.1",
     "@tsconfig/node24": "24.0.4",
     "@types/js-yaml": "4.0.9",
-    "@types/node": "25.1.0",
-    "@typescript/native-preview": "7.0.0-dev.20260128.1",
+    "@types/node": "25.2.0",
+    "@typescript/native-preview": "7.0.0-dev.20260204.1",
     "@vitest/coverage-v8": "4.0.18",
-    "cspell": "9.6.2",
+    "cspell": "9.6.4",
     "eslint": "9.39.2",
     "eslint-plugin-import": "2.32.0",
     "eslint-plugin-no-type-assertion": "1.3.0",
-    "eslint-plugin-oxlint": "1.42.0",
+    "eslint-plugin-oxlint": "1.43.0",
     "eslint-plugin-strict-dependencies": "1.3.30",
     "eslint-plugin-zod-import": "0.3.0",
-    "knip": "5.82.1",
+    "knip": "5.83.0",
     "lint-staged": "16.2.7",
     "marked": "17.0.1",
-    "oxfmt": "0.27.0",
-    "oxlint": "1.42.0",
+    "oxfmt": "0.28.0",
+    "oxlint": "1.43.0",
     "repomix": "1.11.1",
     "secretlint": "11.3.1",
     "simple-git-hooks": "2.13.1",