rulesync 7.3.0 → 7.5.0

package/dist/{chunk-NRNUPCXY.js → chunk-WZ7IUX6M.js}

@@ -605,7 +605,7 @@ import { intersection } from "es-toolkit";
 import { join as join109 } from "path";
 
 // src/features/commands/commands-processor.ts
-import { basename as basename16, join as join19 } from "path";
+import { basename as basename2, join as join19, relative as relative3 } from "path";
 import { z as z12 } from "zod/mini";
 
 // src/types/feature-processor.ts
@@ -671,7 +671,7 @@ var FeatureProcessor = class {
 };
 
 // src/features/commands/agentsmd-command.ts
-import { basename as basename2, join as join5 } from "path";
+import { join as join5 } from "path";
 
 // src/utils/frontmatter.ts
 import matter from "gray-matter";
@@ -724,7 +724,7 @@ function parseFrontmatter(content) {
 }
 
 // src/features/commands/simulated-command.ts
-import { basename, join as join4 } from "path";
+import { join as join4 } from "path";
 import { z as z4 } from "zod/mini";
 
 // src/types/ai-file.ts
@@ -972,7 +972,7 @@ var SimulatedCommand = class _SimulatedCommand extends ToolCommand {
     return {
       baseDir,
       relativeDirPath: _SimulatedCommand.getSettablePaths().relativeDirPath,
-      relativeFilePath: basename(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -1029,7 +1029,7 @@ var AgentsmdCommand = class _AgentsmdCommand extends SimulatedCommand {
     return new _AgentsmdCommand({
       baseDir,
       relativeDirPath: _AgentsmdCommand.getSettablePaths().relativeDirPath,
-      relativeFilePath: basename2(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -1053,7 +1053,7 @@ var AgentsmdCommand = class _AgentsmdCommand extends SimulatedCommand {
 };
 
 // src/features/commands/antigravity-command.ts
-import { basename as basename4, join as join7 } from "path";
+import { basename, join as join7 } from "path";
 import { z as z6 } from "zod/mini";
 
 // src/utils/type-guards.ts
@@ -1062,7 +1062,7 @@ function isRecord(value) {
 }
 
 // src/features/commands/rulesync-command.ts
-import { basename as basename3, join as join6 } from "path";
+import { join as join6 } from "path";
 import { z as z5 } from "zod/mini";
 
 // src/types/rulesync-file.ts
@@ -1106,6 +1106,16 @@ var RulesyncCommand = class _RulesyncCommand extends RulesyncFile {
   getBody() {
     return this.body;
   }
+  withRelativeFilePath(newRelativeFilePath) {
+    return new _RulesyncCommand({
+      baseDir: this.getBaseDir(),
+      relativeDirPath: this.getRelativeDirPath(),
+      relativeFilePath: newRelativeFilePath,
+      frontmatter: this.getFrontmatter(),
+      body: this.getBody(),
+      fileContent: this.getFileContent()
+    });
+  }
   validate() {
     if (!this.frontmatter) {
       return { success: true, error: null };
@@ -1136,11 +1146,10 @@ var RulesyncCommand = class _RulesyncCommand extends RulesyncFile {
     if (!result.success) {
       throw new Error(`Invalid frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
     }
-    const filename = basename3(relativeFilePath);
     return new _RulesyncCommand({
       baseDir: process.cwd(),
       relativeDirPath: _RulesyncCommand.getSettablePaths().relativeDirPath,
-      relativeFilePath: filename,
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       fileContent
@@ -1255,7 +1264,7 @@ ${body}${turboDirective}`;
     const antigravityTrigger = antigravityConfig && typeof antigravityConfig.trigger === "string" ? antigravityConfig.trigger : void 0;
     const rootTrigger = typeof rulesyncFrontmatter.trigger === "string" ? rulesyncFrontmatter.trigger : void 0;
     const bodyTriggerMatch = rulesyncCommand.getBody().match(/trigger:\s*(\/[\w-]+)/);
-    const filenameTrigger = `/${basename4(rulesyncCommand.getRelativeFilePath(), ".md")}`;
+    const filenameTrigger = `/${basename(rulesyncCommand.getRelativeFilePath(), ".md")}`;
     return antigravityTrigger || rootTrigger || (bodyTriggerMatch ? bodyTriggerMatch[1] : void 0) || filenameTrigger;
   }
   validate() {
@@ -1299,7 +1308,7 @@ ${body}${turboDirective}`;
     return new _AntigravityCommand({
       baseDir,
       relativeDirPath: _AntigravityCommand.getSettablePaths().relativeDirPath,
-      relativeFilePath: basename4(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       fileContent,
@@ -1324,7 +1333,7 @@ ${body}${turboDirective}`;
 };
 
 // src/features/commands/claudecode-command.ts
-import { basename as basename5, join as join8 } from "path";
+import { join as join8 } from "path";
 import { z as z7 } from "zod/mini";
 var ClaudecodeCommandFrontmatterSchema = z7.looseObject({
   description: z7.string(),
@@ -1445,7 +1454,7 @@ var ClaudecodeCommand = class _ClaudecodeCommand extends ToolCommand {
     return new _ClaudecodeCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename5(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -1468,7 +1477,7 @@ var ClaudecodeCommand = class _ClaudecodeCommand extends ToolCommand {
 };
 
 // src/features/commands/cline-command.ts
-import { basename as basename6, join as join9 } from "path";
+import { join as join9 } from "path";
 var ClineCommand = class _ClineCommand extends ToolCommand {
   static getSettablePaths({ global } = {}) {
     if (global) {
@@ -1535,7 +1544,7 @@ var ClineCommand = class _ClineCommand extends ToolCommand {
     return new _ClineCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename6(relativeFilePath),
+      relativeFilePath,
       fileContent: content.trim(),
       validate
     });
@@ -1556,7 +1565,7 @@ var ClineCommand = class _ClineCommand extends ToolCommand {
 };
 
 // src/features/commands/codexcli-command.ts
-import { basename as basename7, join as join10 } from "path";
+import { join as join10 } from "path";
 var CodexcliCommand = class _CodexcliCommand extends ToolCommand {
   static getSettablePaths({ global } = {}) {
     if (!global) {
@@ -1622,7 +1631,7 @@ var CodexcliCommand = class _CodexcliCommand extends ToolCommand {
     return new _CodexcliCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename7(relativeFilePath),
+      relativeFilePath,
       fileContent: content.trim(),
       validate
     });
@@ -1643,7 +1652,7 @@ var CodexcliCommand = class _CodexcliCommand extends ToolCommand {
 };
 
 // src/features/commands/copilot-command.ts
-import { basename as basename8, join as join11 } from "path";
+import { join as join11 } from "path";
 import { z as z8 } from "zod/mini";
 var CopilotCommandFrontmatterSchema = z8.looseObject({
   mode: z8.optional(z8.string()),
@@ -1755,7 +1764,7 @@ var CopilotCommand = class _CopilotCommand extends ToolCommand {
     return new _CopilotCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename8(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -1784,7 +1793,7 @@ var CopilotCommand = class _CopilotCommand extends ToolCommand {
 };
 
 // src/features/commands/cursor-command.ts
-import { basename as basename9, join as join12 } from "path";
+import { join as join12 } from "path";
 var CursorCommand = class _CursorCommand extends ToolCommand {
   static getSettablePaths(_options = {}) {
     return {
@@ -1847,7 +1856,7 @@ var CursorCommand = class _CursorCommand extends ToolCommand {
     return new _CursorCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename9(relativeFilePath),
+      relativeFilePath,
       fileContent: content.trim(),
       validate
     });
@@ -1868,7 +1877,7 @@ var CursorCommand = class _CursorCommand extends ToolCommand {
 };
 
 // src/features/commands/factorydroid-command.ts
-import { basename as basename10, join as join13 } from "path";
+import { join as join13 } from "path";
 var FactorydroidCommand = class _FactorydroidCommand extends SimulatedCommand {
   static getSettablePaths(_options) {
     return {
@@ -1902,7 +1911,7 @@ var FactorydroidCommand = class _FactorydroidCommand extends SimulatedCommand {
     return new _FactorydroidCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename10(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -1926,7 +1935,7 @@ var FactorydroidCommand = class _FactorydroidCommand extends SimulatedCommand {
 };
 
 // src/features/commands/geminicli-command.ts
-import { basename as basename11, join as join14 } from "path";
+import { join as join14 } from "path";
 import { parse as parseToml } from "smol-toml";
 import { z as z9 } from "zod/mini";
 var GeminiCliCommandFrontmatterSchema = z9.looseObject({
@@ -2034,7 +2043,7 @@ ${geminiFrontmatter.prompt}
     return new _GeminiCliCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename11(relativeFilePath),
+      relativeFilePath,
       fileContent,
       validate
     });
@@ -2071,7 +2080,7 @@ prompt = ""`;
 };
 
 // src/features/commands/kilo-command.ts
-import { basename as basename12, join as join15 } from "path";
+import { join as join15 } from "path";
 var KiloCommand = class _KiloCommand extends ToolCommand {
   static getSettablePaths(_options = {}) {
     return {
@@ -2131,7 +2140,7 @@ var KiloCommand = class _KiloCommand extends ToolCommand {
     return new _KiloCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename12(relativeFilePath),
+      relativeFilePath,
       fileContent: content.trim(),
       validate
     });
@@ -2152,7 +2161,7 @@ var KiloCommand = class _KiloCommand extends ToolCommand {
 };
 
 // src/features/commands/kiro-command.ts
-import { basename as basename13, join as join16 } from "path";
+import { join as join16 } from "path";
 var KiroCommand = class _KiroCommand extends ToolCommand {
   static getSettablePaths(_options = {}) {
     return {
@@ -2212,7 +2221,7 @@ var KiroCommand = class _KiroCommand extends ToolCommand {
     return new _KiroCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename13(relativeFilePath),
+      relativeFilePath,
       fileContent: content.trim(),
       validate
     });
@@ -2233,7 +2242,7 @@ var KiroCommand = class _KiroCommand extends ToolCommand {
 };
 
 // src/features/commands/opencode-command.ts
-import { basename as basename14, join as join17 } from "path";
+import { join as join17 } from "path";
 import { optional as optional2, z as z10 } from "zod/mini";
 var OpenCodeCommandFrontmatterSchema = z10.looseObject({
   description: z10.string(),
@@ -2344,7 +2353,7 @@ var OpenCodeCommand = class _OpenCodeCommand extends ToolCommand {
     return new _OpenCodeCommand({
       baseDir,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath: basename14(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -2373,7 +2382,7 @@ var OpenCodeCommand = class _OpenCodeCommand extends ToolCommand {
 };
 
 // src/features/commands/roo-command.ts
-import { basename as basename15, join as join18 } from "path";
+import { join as join18 } from "path";
 import { optional as optional3, z as z11 } from "zod/mini";
 var RooCommandFrontmatterSchema = z11.looseObject({
   description: z11.string(),
@@ -2489,7 +2498,7 @@ var RooCommand = class _RooCommand extends ToolCommand {
     return new _RooCommand({
       baseDir,
       relativeDirPath: _RooCommand.getSettablePaths().relativeDirPath,
-      relativeFilePath: basename15(relativeFilePath),
+      relativeFilePath,
       frontmatter: result.data,
       body: content.trim(),
       fileContent,
@@ -2536,42 +2545,78 @@ var toolCommandFactories = /* @__PURE__ */ new Map([
     "agentsmd",
     {
       class: AgentsmdCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: false, isSimulated: true }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: false,
+        isSimulated: true,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "antigravity",
     {
       class: AntigravityCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: false, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: false,
+        isSimulated: false,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "claudecode",
     {
       class: ClaudecodeCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: true
+      }
     }
   ],
   [
     "claudecode-legacy",
     {
       class: ClaudecodeCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: true
+      }
     }
   ],
   [
     "cline",
     {
       class: ClineCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "codexcli",
     {
       class: CodexcliCommand,
-      meta: { extension: "md", supportsProject: false, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: false,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
@@ -2582,7 +2627,8 @@ var toolCommandFactories = /* @__PURE__ */ new Map([
         extension: "prompt.md",
         supportsProject: true,
         supportsGlobal: false,
-        isSimulated: false
+        isSimulated: false,
+        supportsSubdirectory: false
       }
     }
   ],
@@ -2590,49 +2636,91 @@ var toolCommandFactories = /* @__PURE__ */ new Map([
     "cursor",
     {
       class: CursorCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "factorydroid",
     {
       class: FactorydroidCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: true }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: true,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "geminicli",
     {
       class: GeminiCliCommand,
-      meta: { extension: "toml", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "toml",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: true
+      }
     }
   ],
   [
     "kilo",
     {
       class: KiloCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "kiro",
     {
       class: KiroCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: false, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: false,
+        isSimulated: false,
+        supportsSubdirectory: false
+      }
     }
   ],
   [
     "opencode",
     {
       class: OpenCodeCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: true, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: true,
+        isSimulated: false,
+        supportsSubdirectory: true
+      }
     }
   ],
   [
     "roo",
     {
       class: RooCommand,
-      meta: { extension: "md", supportsProject: true, supportsGlobal: false, isSimulated: false }
+      meta: {
+        extension: "md",
+        supportsProject: true,
+        supportsGlobal: false,
+        isSimulated: false,
+        supportsSubdirectory: true
+      }
     }
   ]
 ]);
@@ -2685,13 +2773,27 @@ var CommandsProcessor = class extends FeatureProcessor {
       (file) => file instanceof RulesyncCommand
     );
     const factory = this.getFactory(this.toolTarget);
+    const flattenedPathOrigins = /* @__PURE__ */ new Map();
     const toolCommands = rulesyncCommands.map((rulesyncCommand) => {
       if (!factory.class.isTargetedByRulesyncCommand(rulesyncCommand)) {
         return null;
       }
+      const originalRelativePath = rulesyncCommand.getRelativeFilePath();
+      const commandToConvert = factory.meta.supportsSubdirectory ? rulesyncCommand : this.flattenRelativeFilePath(rulesyncCommand);
+      if (!factory.meta.supportsSubdirectory) {
+        const flattenedPath = commandToConvert.getRelativeFilePath();
+        const firstOrigin = flattenedPathOrigins.get(flattenedPath);
+        if (firstOrigin && firstOrigin !== originalRelativePath) {
+          logger.warn(
+            `Command path collision detected while flattening for ${this.toolTarget}: "${firstOrigin}" and "${originalRelativePath}" both map to "${flattenedPath}". The later command will overwrite the earlier one.`
+          );
+        } else if (!firstOrigin) {
+          flattenedPathOrigins.set(flattenedPath, originalRelativePath);
+        }
+      }
       return factory.class.fromRulesyncCommand({
         baseDir: this.baseDir,
-        rulesyncCommand,
+        rulesyncCommand: commandToConvert,
         global: this.global
       });
     }).filter((command) => command !== null);
@@ -2706,17 +2808,26 @@ var CommandsProcessor = class extends FeatureProcessor {
     });
     return rulesyncCommands;
   }
+  flattenRelativeFilePath(rulesyncCommand) {
+    const flatPath = basename2(rulesyncCommand.getRelativeFilePath());
+    if (flatPath === rulesyncCommand.getRelativeFilePath()) return rulesyncCommand;
+    return rulesyncCommand.withRelativeFilePath(flatPath);
+  }
+  safeRelativePath(basePath, fullPath) {
+    const rel = relative3(basePath, fullPath);
+    checkPathTraversal({ relativePath: rel, intendedRootDir: basePath });
+    return rel;
+  }
   /**
    * Implementation of abstract method from FeatureProcessor
    * Load and parse rulesync command files from .rulesync/commands/ directory
    */
   async loadRulesyncFiles() {
-    const rulesyncCommandPaths = await findFilesByGlobs(
-      join19(RulesyncCommand.getSettablePaths().relativeDirPath, "*.md")
-    );
+    const basePath = RulesyncCommand.getSettablePaths().relativeDirPath;
+    const rulesyncCommandPaths = await findFilesByGlobs(join19(basePath, "**", "*.md"));
     const rulesyncCommands = await Promise.all(
       rulesyncCommandPaths.map(
-        (path3) => RulesyncCommand.fromFile({ relativeFilePath: basename16(path3) })
+        (path3) => RulesyncCommand.fromFile({ relativeFilePath: this.safeRelativePath(basePath, path3) })
       )
     );
     logger.debug(`Successfully loaded ${rulesyncCommands.length} rulesync commands`);
@@ -2731,15 +2842,15 @@ var CommandsProcessor = class extends FeatureProcessor {
   } = {}) {
     const factory = this.getFactory(this.toolTarget);
     const paths = factory.class.getSettablePaths({ global: this.global });
-    const commandFilePaths = await findFilesByGlobs(
-      join19(this.baseDir, paths.relativeDirPath, `*.${factory.meta.extension}`)
-    );
+    const baseDirFull = join19(this.baseDir, paths.relativeDirPath);
+    const globPattern = factory.meta.supportsSubdirectory ? join19(baseDirFull, "**", `*.${factory.meta.extension}`) : join19(baseDirFull, `*.${factory.meta.extension}`);
+    const commandFilePaths = await findFilesByGlobs(globPattern);
     if (forDeletion) {
       const toolCommands2 = commandFilePaths.map(
         (path3) => factory.class.forDeletion({
           baseDir: this.baseDir,
           relativeDirPath: paths.relativeDirPath,
-          relativeFilePath: basename16(path3),
+          relativeFilePath: this.safeRelativePath(baseDirFull, path3),
           global: this.global
         })
       ).filter((cmd) => cmd.isDeletable());
@@ -2750,7 +2861,7 @@ var CommandsProcessor = class extends FeatureProcessor {
       commandFilePaths.map(
         (path3) => factory.class.fromFile({
           baseDir: this.baseDir,
-          relativeFilePath: basename16(path3),
+          relativeFilePath: this.safeRelativePath(baseDirFull, path3),
           global: this.global
         })
       )
@@ -6670,7 +6781,7 @@ var McpProcessor = class extends FeatureProcessor {
 
 // src/features/rules/rules-processor.ts
 import { encode } from "@toon-format/toon";
-import { basename as basename24, join as join108, relative as relative4 } from "path";
+import { basename as basename10, join as join108, relative as relative5 } from "path";
 import { z as z49 } from "zod/mini";
 
 // src/constants/general.ts
@@ -6687,7 +6798,7 @@ import { z as z20 } from "zod/mini";
 import { join as join52 } from "path";
 
 // src/types/ai-dir.ts
-import path2, { basename as basename17, join as join51, relative as relative3, resolve as resolve4 } from "path";
+import path2, { basename as basename3, join as join51, relative as relative4, resolve as resolve4 } from "path";
 var AiDir = class {
   /**
    * @example "."
@@ -6747,7 +6858,7 @@ var AiDir = class {
     const fullPath = path2.join(this.baseDir, this.relativeDirPath, this.dirName);
     const resolvedFull = resolve4(fullPath);
     const resolvedBase = resolve4(this.baseDir);
-    const rel = relative3(resolvedBase, resolvedFull);
+    const rel = relative4(resolvedBase, resolvedFull);
     if (rel.startsWith("..") || path2.isAbsolute(rel)) {
       throw new Error(
         `Path traversal detected: Final path escapes baseDir. baseDir="${this.baseDir}", relativeDirPath="${this.relativeDirPath}", dirName="${this.dirName}"`
@@ -6784,12 +6895,12 @@ var AiDir = class {
     const dirPath = join51(baseDir, relativeDirPath, dirName);
     const glob = join51(dirPath, "**", "*");
     const filePaths = await findFilesByGlobs(glob, { type: "file" });
-    const filteredPaths = filePaths.filter((filePath) => basename17(filePath) !== excludeFileName);
+    const filteredPaths = filePaths.filter((filePath) => basename3(filePath) !== excludeFileName);
     const files = await Promise.all(
       filteredPaths.map(async (filePath) => {
         const fileBuffer = await readFileBuffer(filePath);
         return {
-          relativeFilePathToDirPath: relative3(dirPath, filePath),
+          relativeFilePathToDirPath: relative4(dirPath, filePath),
           fileBuffer
         };
       })
@@ -7139,7 +7250,7 @@ var FactorydroidSkill = class _FactorydroidSkill extends SimulatedSkill {
 };
 
 // src/features/skills/skills-processor.ts
-import { basename as basename19, join as join71 } from "path";
+import { basename as basename5, join as join71 } from "path";
 import { z as z34 } from "zod/mini";
 
 // src/types/dir-feature-processor.ts
@@ -9346,7 +9457,7 @@ var RooSkill = class _RooSkill extends ToolSkill {
 };
 
 // src/features/skills/skills-utils.ts
-import { basename as basename18, join as join70 } from "path";
+import { basename as basename4, join as join70 } from "path";
 async function getLocalSkillDirNames(baseDir) {
   const skillsDir = join70(baseDir, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
   const names = /* @__PURE__ */ new Set();
@@ -9355,8 +9466,8 @@ async function getLocalSkillDirNames(baseDir) {
   }
   const dirPaths = await findFilesByGlobs(join70(skillsDir, "*"), { type: "dir" });
   for (const dirPath of dirPaths) {
-    const name = basename18(dirPath);
-    if (name === basename18(RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH)) continue;
+    const name = basename4(dirPath);
+    if (name === basename4(RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH)) continue;
     names.add(name);
   }
   return names;
@@ -9578,7 +9689,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
     let curatedSkills = [];
     if (await directoryExists(curatedDirPath)) {
       const curatedDirPaths = await findFilesByGlobs(join71(curatedDirPath, "*"), { type: "dir" });
-      const curatedDirNames = curatedDirPaths.map((path3) => basename19(path3));
+      const curatedDirNames = curatedDirPaths.map((path3) => basename5(path3));
       const nonConflicting = curatedDirNames.filter((name) => {
         if (localSkillNames.has(name)) {
           logger.debug(`Skipping curated skill "${name}": local skill takes precedence.`);
@@ -9613,7 +9724,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
     const paths = factory.class.getSettablePaths({ global: this.global });
     const skillsDirPath = join71(this.baseDir, paths.relativeDirPath);
     const dirPaths = await findFilesByGlobs(join71(skillsDirPath, "*"), { type: "dir" });
-    const dirNames = dirPaths.map((path3) => basename19(path3));
+    const dirNames = dirPaths.map((path3) => basename5(path3));
     const toolSkills = await Promise.all(
       dirNames.map(
         (dirName) => factory.class.fromDir({
@@ -9631,7 +9742,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
     const paths = factory.class.getSettablePaths({ global: this.global });
     const skillsDirPath = join71(this.baseDir, paths.relativeDirPath);
     const dirPaths = await findFilesByGlobs(join71(skillsDirPath, "*"), { type: "dir" });
-    const dirNames = dirPaths.map((path3) => basename19(path3));
+    const dirNames = dirPaths.map((path3) => basename5(path3));
     const toolSkills = dirNames.map(
       (dirName) => factory.class.forDeletion({
         baseDir: this.baseDir,
@@ -9695,7 +9806,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 import { join as join73 } from "path";
 
 // src/features/subagents/simulated-subagent.ts
-import { basename as basename20, join as join72 } from "path";
+import { basename as basename6, join as join72 } from "path";
 import { z as z35 } from "zod/mini";
 
 // src/features/subagents/tool-subagent.ts
@@ -9822,7 +9933,7 @@ var SimulatedSubagent = class extends ToolSubagent {
     return {
       baseDir,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
-      relativeFilePath: basename20(relativeFilePath),
+      relativeFilePath: basename6(relativeFilePath),
       frontmatter: result.data,
       body: content.trim(),
       validate
@@ -9979,7 +10090,7 @@ var RooSubagent = class _RooSubagent extends SimulatedSubagent {
 };
 
 // src/features/subagents/subagents-processor.ts
-import { basename as basename23, join as join84 } from "path";
+import { basename as basename9, join as join84 } from "path";
 import { z as z42 } from "zod/mini";
 
 // src/features/subagents/claudecode-subagent.ts
@@ -9987,7 +10098,7 @@ import { join as join79 } from "path";
 import { z as z37 } from "zod/mini";
 
 // src/features/subagents/rulesync-subagent.ts
-import { basename as basename21, join as join78 } from "path";
+import { basename as basename7, join as join78 } from "path";
 import { z as z36 } from "zod/mini";
 var RulesyncSubagentFrontmatterSchema = z36.looseObject({
   targets: z36._default(RulesyncTargetsSchema, ["*"]),
@@ -10050,7 +10161,7 @@ var RulesyncSubagent = class _RulesyncSubagent extends RulesyncFile {
     if (!result.success) {
       throw new Error(`Invalid frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
     }
-    const filename = basename21(relativeFilePath);
+    const filename = basename7(relativeFilePath);
     return new _RulesyncSubagent({
       baseDir: process.cwd(),
       relativeDirPath: this.getSettablePaths().relativeDirPath,
@@ -10669,7 +10780,7 @@ var KiroSubagent = class _KiroSubagent extends ToolSubagent {
 };
 
 // src/features/subagents/opencode-subagent.ts
-import { basename as basename22, join as join83 } from "path";
+import { basename as basename8, join as join83 } from "path";
 import { z as z41 } from "zod/mini";
 var OpenCodeSubagentFrontmatterSchema = z41.looseObject({
   description: z41.string(),
@@ -10711,7 +10822,7 @@ var OpenCodeSubagent = class _OpenCodeSubagent extends ToolSubagent {
     const { description, mode, name, ...opencodeSection } = this.frontmatter;
     const rulesyncFrontmatter = {
       targets: ["*"],
-      name: name ?? basename22(this.getRelativeFilePath(), ".md"),
+      name: name ?? basename8(this.getRelativeFilePath(), ".md"),
       description,
       opencode: { mode, ...opencodeSection }
     };
@@ -11044,7 +11155,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
         (path3) => factory.class.forDeletion({
           baseDir: this.baseDir,
           relativeDirPath: paths.relativeDirPath,
-          relativeFilePath: basename23(path3),
+          relativeFilePath: basename9(path3),
           global: this.global
         })
       ).filter((subagent) => subagent.isDeletable());
@@ -11057,7 +11168,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
       subagentFilePaths.map(
         (path3) => factory.class.fromFile({
           baseDir: this.baseDir,
-          relativeFilePath: basename23(path3),
+          relativeFilePath: basename9(path3),
           global: this.global
         })
       )
@@ -12440,14 +12551,22 @@ var CopilotRuleFrontmatterSchema = z47.object({
 var CopilotRule = class _CopilotRule extends ToolRule {
   frontmatter;
   body;
-  static getSettablePaths(_options = {}) {
+  static getSettablePaths(options = {}) {
+    if (options.global) {
+      return {
+        root: {
+          relativeDirPath: buildToolPath(".copilot", ".", options.excludeToolDir),
+          relativeFilePath: "copilot-instructions.md"
+        }
+      };
+    }
     return {
       root: {
-        relativeDirPath: buildToolPath(".github", ".", _options.excludeToolDir),
+        relativeDirPath: buildToolPath(".github", ".", options.excludeToolDir),
         relativeFilePath: "copilot-instructions.md"
       },
       nonRoot: {
-        relativeDirPath: buildToolPath(".github", "instructions", _options.excludeToolDir)
+        relativeDirPath: buildToolPath(".github", "instructions", options.excludeToolDir)
       }
     };
   }
@@ -12498,10 +12617,12 @@ var CopilotRule = class _CopilotRule extends ToolRule {
   static fromRulesyncRule({
     baseDir = process.cwd(),
     rulesyncRule,
-    validate = true
+    validate = true,
+    global = false
   }) {
     const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
     const root = rulesyncFrontmatter.root;
+    const paths = this.getSettablePaths({ global });
     const copilotFrontmatter = {
       description: rulesyncFrontmatter.description,
       applyTo: rulesyncFrontmatter.globs?.length ? rulesyncFrontmatter.globs.join(",") : void 0,
@@ -12513,12 +12634,15 @@ var CopilotRule = class _CopilotRule extends ToolRule {
         baseDir,
         frontmatter: copilotFrontmatter,
         body,
-        relativeDirPath: this.getSettablePaths().root.relativeDirPath,
-        relativeFilePath: this.getSettablePaths().root.relativeFilePath,
+        relativeDirPath: paths.root.relativeDirPath,
+        relativeFilePath: paths.root.relativeFilePath,
         validate,
         root
       });
     }
+    if (!paths.nonRoot) {
+      throw new Error(`nonRoot path is not set for ${rulesyncRule.getRelativeFilePath()}`);
+    }
     const originalFileName = rulesyncRule.getRelativeFilePath();
     const nameWithoutExt = originalFileName.replace(/\.md$/, "");
     const newFileName = `${nameWithoutExt}.instructions.md`;
@@ -12526,7 +12650,7 @@ var CopilotRule = class _CopilotRule extends ToolRule {
       baseDir,
       frontmatter: copilotFrontmatter,
       body,
-      relativeDirPath: this.getSettablePaths().nonRoot.relativeDirPath,
+      relativeDirPath: paths.nonRoot.relativeDirPath,
       relativeFilePath: newFileName,
       validate,
       root
@@ -12535,25 +12659,29 @@ var CopilotRule = class _CopilotRule extends ToolRule {
   static async fromFile({
     baseDir = process.cwd(),
     relativeFilePath,
-    validate = true
+    validate = true,
+    global = false
   }) {
-    const isRoot = relativeFilePath === "copilot-instructions.md";
-    const relativePath = isRoot ? join95(
-      this.getSettablePaths().root.relativeDirPath,
-      this.getSettablePaths().root.relativeFilePath
-    ) : join95(this.getSettablePaths().nonRoot.relativeDirPath, relativeFilePath);
-    const fileContent = await readFileContent(join95(baseDir, relativePath));
+    const paths = this.getSettablePaths({ global });
+    const isRoot = relativeFilePath === paths.root.relativeFilePath;
     if (isRoot) {
+      const relativePath2 = join95(paths.root.relativeDirPath, paths.root.relativeFilePath);
+      const fileContent2 = await readFileContent(join95(baseDir, relativePath2));
       return new _CopilotRule({
         baseDir,
-        relativeDirPath: this.getSettablePaths().root.relativeDirPath,
-        relativeFilePath: this.getSettablePaths().root.relativeFilePath,
+        relativeDirPath: paths.root.relativeDirPath,
+        relativeFilePath: paths.root.relativeFilePath,
         frontmatter: {},
-        body: fileContent.trim(),
+        body: fileContent2.trim(),
         validate,
         root: isRoot
       });
     }
+    if (!paths.nonRoot) {
+      throw new Error(`nonRoot path is not set for ${relativeFilePath}`);
+    }
+    const relativePath = join95(paths.nonRoot.relativeDirPath, relativeFilePath);
+    const fileContent = await readFileContent(join95(baseDir, relativePath));
     const { frontmatter, body: content } = parseFrontmatter(fileContent);
     const result = CopilotRuleFrontmatterSchema.safeParse(frontmatter);
     if (!result.success) {
@@ -12563,7 +12691,7 @@ var CopilotRule = class _CopilotRule extends ToolRule {
     }
     return new _CopilotRule({
       baseDir,
-      relativeDirPath: this.getSettablePaths().nonRoot.relativeDirPath,
+      relativeDirPath: paths.nonRoot.relativeDirPath,
       relativeFilePath: relativeFilePath.endsWith(".instructions.md") ? relativeFilePath : relativeFilePath.replace(/\.md$/, ".instructions.md"),
       frontmatter: result.data,
       body: content.trim(),
@@ -12574,9 +12702,11 @@ var CopilotRule = class _CopilotRule extends ToolRule {
   static forDeletion({
     baseDir = process.cwd(),
     relativeDirPath,
-    relativeFilePath
+    relativeFilePath,
+    global = false
   }) {
-    const isRoot = relativeFilePath === this.getSettablePaths().root.relativeFilePath;
+    const paths = this.getSettablePaths({ global });
+    const isRoot = relativeFilePath === paths.root.relativeFilePath;
     return new _CopilotRule({
       baseDir,
       relativeDirPath,
@@ -13256,46 +13386,78 @@ var KiroRule = class _KiroRule extends ToolRule {
 // src/features/rules/opencode-rule.ts
 import { join as join102 } from "path";
 var OpenCodeRule = class _OpenCodeRule extends ToolRule {
-  static getSettablePaths(_options = {}) {
+  static getSettablePaths({
+    global,
+    excludeToolDir
+  } = {}) {
+    if (global) {
+      return {
+        root: {
+          relativeDirPath: buildToolPath(".config/opencode", ".", excludeToolDir),
+          relativeFilePath: "AGENTS.md"
+        }
+      };
+    }
     return {
       root: {
         relativeDirPath: ".",
         relativeFilePath: "AGENTS.md"
       },
       nonRoot: {
-        relativeDirPath: buildToolPath(".opencode", "memories", _options.excludeToolDir)
+        relativeDirPath: buildToolPath(".opencode", "memories", excludeToolDir)
       }
     };
   }
   static async fromFile({
     baseDir = process.cwd(),
     relativeFilePath,
-    validate = true
+    validate = true,
+    global = false
   }) {
-    const isRoot = relativeFilePath === "AGENTS.md";
-    const relativePath = isRoot ? "AGENTS.md" : join102(".opencode", "memories", relativeFilePath);
+    const paths = this.getSettablePaths({ global });
+    const isRoot = relativeFilePath === paths.root.relativeFilePath;
+    if (isRoot) {
+      const relativePath2 = paths.root.relativeFilePath;
+      const fileContent2 = await readFileContent(
+        join102(baseDir, paths.root.relativeDirPath, relativePath2)
+      );
+      return new _OpenCodeRule({
+        baseDir,
+        relativeDirPath: paths.root.relativeDirPath,
+        relativeFilePath: paths.root.relativeFilePath,
+        fileContent: fileContent2,
+        validate,
+        root: true
+      });
+    }
+    if (!paths.nonRoot) {
+      throw new Error(`nonRoot path is not set for ${relativeFilePath}`);
+    }
+    const relativePath = join102(paths.nonRoot.relativeDirPath, relativeFilePath);
     const fileContent = await readFileContent(join102(baseDir, relativePath));
     return new _OpenCodeRule({
       baseDir,
-      relativeDirPath: isRoot ? this.getSettablePaths().root.relativeDirPath : this.getSettablePaths().nonRoot.relativeDirPath,
-      relativeFilePath: isRoot ? "AGENTS.md" : relativeFilePath,
+      relativeDirPath: paths.nonRoot.relativeDirPath,
+      relativeFilePath,
+      fileContent,
       validate,
-      root: isRoot,
-      fileContent
+      root: false
     });
   }
   static fromRulesyncRule({
     baseDir = process.cwd(),
     rulesyncRule,
-    validate = true
+    validate = true,
+    global = false
   }) {
+    const paths = this.getSettablePaths({ global });
     return new _OpenCodeRule(
       this.buildToolRuleParamsDefault({
         baseDir,
         rulesyncRule,
         validate,
-        rootPath: this.getSettablePaths().root,
-        nonRootPath: this.getSettablePaths().nonRoot
+        rootPath: paths.root,
+        nonRootPath: paths.nonRoot
       })
     );
   }
@@ -13308,9 +13470,11 @@ var OpenCodeRule = class _OpenCodeRule extends ToolRule {
   static forDeletion({
     baseDir = process.cwd(),
     relativeDirPath,
-    relativeFilePath
+    relativeFilePath,
+    global = false
   }) {
-    const isRoot = relativeFilePath === "AGENTS.md" && relativeDirPath === ".";
+    const paths = this.getSettablePaths({ global });
+    const isRoot = relativeFilePath === paths.root.relativeFilePath;
     return new _OpenCodeRule({
       baseDir,
       relativeDirPath,
@@ -13768,42 +13932,66 @@ var toolRuleFactories = /* @__PURE__ */ new Map([
     "antigravity",
     {
       class: AntigravityRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ],
   [
     "augmentcode",
     {
       class: AugmentcodeRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ],
   [
     "augmentcode-legacy",
     {
       class: AugmentcodeLegacyRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "toon" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "toon"
+      }
     }
   ],
   [
     "claudecode",
     {
       class: ClaudecodeRule,
-      meta: { extension: "md", supportsGlobal: true, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: true,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ],
   [
     "claudecode-legacy",
     {
       class: ClaudecodeLegacyRule,
-      meta: { extension: "md", supportsGlobal: true, ruleDiscoveryMode: "claudecode-legacy" }
+      meta: {
+        extension: "md",
+        supportsGlobal: true,
+        ruleDiscoveryMode: "claudecode-legacy"
+      }
     }
   ],
   [
     "cline",
     {
       class: ClineRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ],
   [
@@ -13826,7 +14014,7 @@ var toolRuleFactories = /* @__PURE__ */ new Map([
       class: CopilotRule,
       meta: {
         extension: "md",
-        supportsGlobal: false,
+        supportsGlobal: true,
         ruleDiscoveryMode: "auto"
       }
     }
@@ -13876,42 +14064,66 @@ var toolRuleFactories = /* @__PURE__ */ new Map([
     "junie",
     {
       class: JunieRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "toon" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "toon"
+      }
     }
   ],
   [
     "kilo",
     {
       class: KiloRule,
-      meta: { extension: "md", supportsGlobal: true, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: true,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ],
   [
     "kiro",
     {
       class: KiroRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "toon" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "toon"
+      }
     }
   ],
   [
     "opencode",
     {
       class: OpenCodeRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "toon" }
+      meta: {
+        extension: "md",
+        supportsGlobal: true,
+        ruleDiscoveryMode: "toon"
+      }
     }
   ],
   [
     "qwencode",
     {
       class: QwencodeRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "toon" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "toon"
+      }
     }
   ],
   [
     "replit",
     {
       class: ReplitRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ],
   [
@@ -13933,14 +14145,22 @@ var toolRuleFactories = /* @__PURE__ */ new Map([
     "warp",
     {
       class: WarpRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "toon" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "toon"
+      }
     }
   ],
   [
     "windsurf",
     {
       class: WindsurfRule,
-      meta: { extension: "md", supportsGlobal: false, ruleDiscoveryMode: "auto" }
+      meta: {
+        extension: "md",
+        supportsGlobal: false,
+        ruleDiscoveryMode: "auto"
+      }
     }
   ]
 ]);
@@ -14088,7 +14308,9 @@ var RulesProcessor = class extends FeatureProcessor {
         })
       );
     } else if (this.toolTarget === "claudecode-legacy") {
-      const paths = ClaudecodeLegacyRule.getSettablePaths({ global: this.global });
+      const paths = ClaudecodeLegacyRule.getSettablePaths({
+        global: this.global
+      });
       toolRules.push(
         new ClaudecodeLegacyRule({
           baseDir: this.baseDir,
@@ -14173,8 +14395,11 @@ var RulesProcessor = class extends FeatureProcessor {
     logger.debug(`Found ${files.length} rulesync files`);
     const rulesyncRules = await Promise.all(
       files.map((file) => {
-        const relativeFilePath = relative4(rulesyncBaseDir, file);
-        checkPathTraversal({ relativePath: relativeFilePath, intendedRootDir: rulesyncBaseDir });
+        const relativeFilePath = relative5(rulesyncBaseDir, file);
+        checkPathTraversal({
+          relativePath: relativeFilePath,
+          intendedRootDir: rulesyncBaseDir
+        });
         return RulesyncRule.fromFile({
           relativeFilePath
         });
@@ -14225,7 +14450,9 @@ var RulesProcessor = class extends FeatureProcessor {
   } = {}) {
     try {
       const factory = this.getFactory(this.toolTarget);
-      const settablePaths = factory.class.getSettablePaths({ global: this.global });
+      const settablePaths = factory.class.getSettablePaths({
+        global: this.global
+      });
       const rootToolRules = await (async () => {
         if (!settablePaths.root) {
           return [];
@@ -14242,7 +14469,7 @@ var RulesProcessor = class extends FeatureProcessor {
             (filePath) => factory.class.forDeletion({
               baseDir: this.baseDir,
               relativeDirPath: settablePaths.root?.relativeDirPath ?? ".",
-              relativeFilePath: basename24(filePath),
+              relativeFilePath: basename10(filePath),
               global: this.global
             })
           ).filter((rule) => rule.isDeletable());
@@ -14251,7 +14478,7 @@ var RulesProcessor = class extends FeatureProcessor {
           rootFilePaths.map(
             (filePath) => factory.class.fromFile({
               baseDir: this.baseDir,
-              relativeFilePath: basename24(filePath),
+              relativeFilePath: basename10(filePath),
               global: this.global
             })
           )
@@ -14275,7 +14502,7 @@ var RulesProcessor = class extends FeatureProcessor {
           (filePath) => factory.class.forDeletion({
             baseDir: this.baseDir,
             relativeDirPath: settablePaths.root?.relativeDirPath ?? ".",
-            relativeFilePath: basename24(filePath),
+            relativeFilePath: basename10(filePath),
             global: this.global
           })
         ).filter((rule) => rule.isDeletable());
@@ -14291,7 +14518,7 @@ var RulesProcessor = class extends FeatureProcessor {
         );
         if (forDeletion) {
           return nonRootFilePaths.map((filePath) => {
-            const relativeFilePath = relative4(nonRootBaseDir, filePath);
+            const relativeFilePath = relative5(nonRootBaseDir, filePath);
             checkPathTraversal({
               relativePath: relativeFilePath,
               intendedRootDir: nonRootBaseDir
@@ -14306,8 +14533,11 @@ var RulesProcessor = class extends FeatureProcessor {
         }
         return await Promise.all(
           nonRootFilePaths.map((filePath) => {
-            const relativeFilePath = relative4(nonRootBaseDir, filePath);
-            checkPathTraversal({ relativePath: relativeFilePath, intendedRootDir: nonRootBaseDir });
+            const relativeFilePath = relative5(nonRootBaseDir, filePath);
+            checkPathTraversal({
+              relativePath: relativeFilePath,
+              intendedRootDir: nonRootBaseDir
+            });
             return factory.class.fromFile({
               baseDir: this.baseDir,
               relativeFilePath,