rulesync 8.16.0 → 8.17.0

package/dist/{chunk-DOWXY74I.js → chunk-RXCRO26Z.js}

@@ -7610,6 +7610,16 @@ var McpServerSchema = z24.looseObject({
   tools: z24.optional(z24.array(z24.string())),
   kiroAutoApprove: z24.optional(z24.array(z24.string())),
   kiroAutoBlock: z24.optional(z24.array(z24.string())),
+  // Codex CLI-specific: list of shell env var names that codex should pass
+  // through from the user's environment to the MCP server process.
+  // Distinct from `env` (a literal name→value map): `envVars` is a list of
+  // variable NAMES whose values come from the user's shell at runtime.
+  // Only honoured by the codex generator (renamed to `env_vars` in codex
+  // TOML output, matching codex's native field name — see the
+  // `enabledTools`→`enabled_tools` precedent in `codexcli-mcp.ts`).
+  // Stripped by `RulesyncMcp.getMcpServers()` so it does not leak into
+  // other tools' configs.
+  envVars: z24.optional(z24.array(z24.string())),
   headers: z24.optional(z24.record(z24.string(), z24.string())),
   enabledTools: z24.optional(z24.array(z24.string())),
   disabledTools: z24.optional(z24.array(z24.string()))
@@ -7712,10 +7722,11 @@ var RulesyncMcp = class _RulesyncMcp extends RulesyncFile {
     });
   }
   getMcpServers() {
-    const entries = Object.entries(this.json.mcpServers);
+    const mcpServers = this.json.mcpServers ?? {};
+    const entries = Object.entries(mcpServers);
     return Object.fromEntries(
       entries.map(([serverName, serverConfig]) => {
-        return [serverName, omit(serverConfig, ["targets", "description", "exposed"])];
+        return [serverName, omit(serverConfig, ["targets", "description", "exposed", "envVars"])];
       })
     );
   }
@@ -7934,11 +7945,17 @@ var ClineMcp = class _ClineMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
+    const json = rulesyncMcp.getJson();
+    const fileContent = JSON.stringify(
+      { ...json, mcpServers: rulesyncMcp.getMcpServers() },
+      null,
+      2
+    );
     return new _ClineMcp({
       outputRoot,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
       relativeFilePath: this.getSettablePaths().relativeFilePath,
-      fileContent: rulesyncMcp.getFileContent(),
+      fileContent,
       validate
     });
   }
@@ -7982,6 +7999,8 @@ function convertFromCodexFormat(codexMcp) {
         converted["enabledTools"] = value;
       } else if (key === "disabled_tools") {
         converted["disabledTools"] = value;
+      } else if (key === "env_vars") {
+        converted["envVars"] = value;
       } else {
         converted[key] = value;
       }
@@ -8003,6 +8022,8 @@ function convertToCodexFormat(mcpServers) {
         converted["enabled_tools"] = value;
       } else if (key === "disabledTools") {
         converted["disabled_tools"] = value;
+      } else if (key === "envVars") {
+        converted["env_vars"] = value;
       } else {
         converted[key] = value;
       }
@@ -8098,7 +8119,12 @@ var CodexcliMcp = class _CodexcliMcp extends ToolMcp {
     const filtered = {};
     for (const [key, value] of Object.entries(obj)) {
       if (value === null) continue;
-      if (typeof value === "object" && Object.keys(value).length === 0) continue;
+      if (typeof value === "object" && !Array.isArray(value)) {
+        const cleaned = this.removeEmptyEntries(value);
+        if (Object.keys(cleaned).length === 0) continue;
+        filtered[key] = cleaned;
+        continue;
+      }
       filtered[key] = value;
     }
     return filtered;
@@ -8475,8 +8501,7 @@ var CursorMcp = class _CursorMcp extends ToolMcp {
         { cause: error }
       );
     }
-    const rulesyncJson = rulesyncMcp.getJson();
-    const mcpServers = isMcpServers(rulesyncJson.mcpServers) ? rulesyncJson.mcpServers : {};
+    const mcpServers = rulesyncMcp.getMcpServers();
     const transformedServers = convertEnvToCursorFormat(mcpServers);
     const cursorConfig = { ...json, mcpServers: transformedServers };
     return new _CursorMcp({
@@ -8645,9 +8670,9 @@ var FactorydroidMcp = class _FactorydroidMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
-    const json = rulesyncMcp.getJson();
+    const mcpServers = rulesyncMcp.getMcpServers();
     const factorydroidConfig = {
-      mcpServers: json.mcpServers || {}
+      mcpServers
     };
     const fileContent = JSON.stringify(factorydroidConfig, null, 2);
     return new _FactorydroidMcp({
@@ -8733,7 +8758,7 @@ var GeminiCliMcp = class _GeminiCliMcp extends ToolMcp {
       JSON.stringify({ mcpServers: {} }, null, 2)
     );
     const json = JSON.parse(fileContent);
-    const newJson = { ...json, mcpServers: rulesyncMcp.getJson().mcpServers };
+    const newJson = { ...json, mcpServers: rulesyncMcp.getMcpServers() };
     return new _GeminiCliMcp({
       outputRoot,
       relativeDirPath: paths.relativeDirPath,
@@ -8814,11 +8839,17 @@ var JunieMcp = class _JunieMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
+    const json = rulesyncMcp.getJson();
+    const fileContent = JSON.stringify(
+      { ...json, mcpServers: rulesyncMcp.getMcpServers() },
+      null,
+      2
+    );
     return new _JunieMcp({
       outputRoot,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
       relativeFilePath: this.getSettablePaths().relativeFilePath,
-      fileContent: rulesyncMcp.getFileContent(),
+      fileContent,
       validate
     });
   }
@@ -9598,8 +9629,7 @@ var RovodevMcp = class _RovodevMcp extends ToolMcp {
       JSON.stringify({ mcpServers: {} }, null, 2)
     );
     const json = parseRovodevMcpJson(fileContent, paths.relativeDirPath, paths.relativeFilePath);
-    const rulesyncJson = rulesyncMcp.getJson();
-    const mcpServers = isMcpServers(rulesyncJson.mcpServers) ? rulesyncJson.mcpServers : {};
+    const mcpServers = rulesyncMcp.getMcpServers();
     const rovodevConfig = { ...json, mcpServers };
     return new _RovodevMcp({
       outputRoot,
@@ -11024,7 +11054,8 @@ function convertRulesyncToCodexProfile({
           filesystem,
           projectRootFilesystem,
           pattern,
-          access: mapReadAction(action)
+          access: mapReadAction(action),
+          logger
         });
       }
       continue;
@@ -11035,7 +11066,8 @@ function convertRulesyncToCodexProfile({
           filesystem,
           projectRootFilesystem,
           pattern,
-          access: mapWriteAction(action)
+          access: mapWriteAction(action),
+          logger
         });
       }
       continue;
@@ -11057,6 +11089,11 @@ function convertRulesyncToCodexProfile({
     );
   }
   if (Object.keys(projectRootFilesystem).length > 0) {
+    if (typeof filesystem[CODEX_PROJECT_ROOTS_KEY] === "string") {
+      logger?.warn(
+        `"${CODEX_PROJECT_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions, but it will be overwritten by project-root rules. Consider removing the direct "${CODEX_PROJECT_ROOTS_KEY}" entry.`
+      );
+    }
     if (Object.keys(projectRootFilesystem).some((pattern) => pattern.includes("**"))) {
       filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
     }
@@ -11107,8 +11144,13 @@ function addFilesystemRule({
   filesystem,
   projectRootFilesystem,
   pattern,
-  access
+  access,
+  logger
 }) {
+  if (pattern.trim() === "") {
+    logger?.warn("Skipping empty pattern in filesystem permissions.");
+    return;
+  }
   if (canBeCodexFilesystemRoot(pattern)) {
     filesystem[pattern] = access;
     return;

package/dist/cli/index.cjs

@@ -7643,6 +7643,16 @@ var McpServerSchema = import_mini24.z.looseObject({
   tools: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   kiroAutoApprove: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   kiroAutoBlock: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
+  // Codex CLI-specific: list of shell env var names that codex should pass
+  // through from the user's environment to the MCP server process.
+  // Distinct from `env` (a literal name→value map): `envVars` is a list of
+  // variable NAMES whose values come from the user's shell at runtime.
+  // Only honoured by the codex generator (renamed to `env_vars` in codex
+  // TOML output, matching codex's native field name — see the
+  // `enabledTools`→`enabled_tools` precedent in `codexcli-mcp.ts`).
+  // Stripped by `RulesyncMcp.getMcpServers()` so it does not leak into
+  // other tools' configs.
+  envVars: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   headers: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.string())),
   enabledTools: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   disabledTools: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string()))
@@ -7745,10 +7755,11 @@ var RulesyncMcp = class _RulesyncMcp extends RulesyncFile {
     });
   }
   getMcpServers() {
-    const entries = Object.entries(this.json.mcpServers);
+    const mcpServers = this.json.mcpServers ?? {};
+    const entries = Object.entries(mcpServers);
     return Object.fromEntries(
       entries.map(([serverName, serverConfig]) => {
-        return [serverName, (0, import_object.omit)(serverConfig, ["targets", "description", "exposed"])];
+        return [serverName, (0, import_object.omit)(serverConfig, ["targets", "description", "exposed", "envVars"])];
       })
     );
   }
@@ -7967,11 +7978,17 @@ var ClineMcp = class _ClineMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
+    const json = rulesyncMcp.getJson();
+    const fileContent = JSON.stringify(
+      { ...json, mcpServers: rulesyncMcp.getMcpServers() },
+      null,
+      2
+    );
     return new _ClineMcp({
       outputRoot,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
       relativeFilePath: this.getSettablePaths().relativeFilePath,
-      fileContent: rulesyncMcp.getFileContent(),
+      fileContent,
       validate
     });
   }
@@ -8015,6 +8032,8 @@ function convertFromCodexFormat(codexMcp) {
         converted["enabledTools"] = value;
       } else if (key === "disabled_tools") {
         converted["disabledTools"] = value;
+      } else if (key === "env_vars") {
+        converted["envVars"] = value;
       } else {
         converted[key] = value;
       }
@@ -8036,6 +8055,8 @@ function convertToCodexFormat(mcpServers) {
         converted["enabled_tools"] = value;
       } else if (key === "disabledTools") {
         converted["disabled_tools"] = value;
+      } else if (key === "envVars") {
+        converted["env_vars"] = value;
       } else {
         converted[key] = value;
       }
@@ -8131,7 +8152,12 @@ var CodexcliMcp = class _CodexcliMcp extends ToolMcp {
     const filtered = {};
     for (const [key, value] of Object.entries(obj)) {
       if (value === null) continue;
-      if (typeof value === "object" && Object.keys(value).length === 0) continue;
+      if (typeof value === "object" && !Array.isArray(value)) {
+        const cleaned = this.removeEmptyEntries(value);
+        if (Object.keys(cleaned).length === 0) continue;
+        filtered[key] = cleaned;
+        continue;
+      }
       filtered[key] = value;
     }
     return filtered;
@@ -8508,8 +8534,7 @@ var CursorMcp = class _CursorMcp extends ToolMcp {
         { cause: error }
       );
     }
-    const rulesyncJson = rulesyncMcp.getJson();
-    const mcpServers = isMcpServers(rulesyncJson.mcpServers) ? rulesyncJson.mcpServers : {};
+    const mcpServers = rulesyncMcp.getMcpServers();
     const transformedServers = convertEnvToCursorFormat(mcpServers);
     const cursorConfig = { ...json, mcpServers: transformedServers };
     return new _CursorMcp({
@@ -8678,9 +8703,9 @@ var FactorydroidMcp = class _FactorydroidMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
-    const json = rulesyncMcp.getJson();
+    const mcpServers = rulesyncMcp.getMcpServers();
     const factorydroidConfig = {
-      mcpServers: json.mcpServers || {}
+      mcpServers
     };
     const fileContent = JSON.stringify(factorydroidConfig, null, 2);
     return new _FactorydroidMcp({
@@ -8766,7 +8791,7 @@ var GeminiCliMcp = class _GeminiCliMcp extends ToolMcp {
       JSON.stringify({ mcpServers: {} }, null, 2)
     );
     const json = JSON.parse(fileContent);
-    const newJson = { ...json, mcpServers: rulesyncMcp.getJson().mcpServers };
+    const newJson = { ...json, mcpServers: rulesyncMcp.getMcpServers() };
     return new _GeminiCliMcp({
       outputRoot,
       relativeDirPath: paths.relativeDirPath,
@@ -8847,11 +8872,17 @@ var JunieMcp = class _JunieMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
+    const json = rulesyncMcp.getJson();
+    const fileContent = JSON.stringify(
+      { ...json, mcpServers: rulesyncMcp.getMcpServers() },
+      null,
+      2
+    );
     return new _JunieMcp({
       outputRoot,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
       relativeFilePath: this.getSettablePaths().relativeFilePath,
-      fileContent: rulesyncMcp.getFileContent(),
+      fileContent,
       validate
     });
   }
@@ -9631,8 +9662,7 @@ var RovodevMcp = class _RovodevMcp extends ToolMcp {
       JSON.stringify({ mcpServers: {} }, null, 2)
     );
     const json = parseRovodevMcpJson(fileContent, paths.relativeDirPath, paths.relativeFilePath);
-    const rulesyncJson = rulesyncMcp.getJson();
-    const mcpServers = isMcpServers(rulesyncJson.mcpServers) ? rulesyncJson.mcpServers : {};
+    const mcpServers = rulesyncMcp.getMcpServers();
     const rovodevConfig = { ...json, mcpServers };
     return new _RovodevMcp({
       outputRoot,
@@ -11057,7 +11087,8 @@ function convertRulesyncToCodexProfile({
           filesystem,
           projectRootFilesystem,
           pattern,
-          access: mapReadAction(action)
+          access: mapReadAction(action),
+          logger: logger5
         });
       }
       continue;
@@ -11068,7 +11099,8 @@ function convertRulesyncToCodexProfile({
           filesystem,
           projectRootFilesystem,
           pattern,
-          access: mapWriteAction(action)
+          access: mapWriteAction(action),
+          logger: logger5
         });
       }
       continue;
@@ -11090,6 +11122,11 @@ function convertRulesyncToCodexProfile({
     );
   }
   if (Object.keys(projectRootFilesystem).length > 0) {
+    if (typeof filesystem[CODEX_PROJECT_ROOTS_KEY] === "string") {
+      logger5?.warn(
+        `"${CODEX_PROJECT_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions, but it will be overwritten by project-root rules. Consider removing the direct "${CODEX_PROJECT_ROOTS_KEY}" entry.`
+      );
+    }
     if (Object.keys(projectRootFilesystem).some((pattern) => pattern.includes("**"))) {
       filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
     }
@@ -11140,8 +11177,13 @@ function addFilesystemRule({
   filesystem,
   projectRootFilesystem,
   pattern,
-  access
+  access,
+  logger: logger5
 }) {
+  if (pattern.trim() === "") {
+    logger5?.warn("Skipping empty pattern in filesystem permissions.");
+    return;
+  }
   if (canBeCodexFilesystemRoot(pattern)) {
     filesystem[pattern] = access;
     return;
@@ -31711,7 +31753,7 @@ function wrapCommand({
 }
 
 // src/cli/index.ts
-var getVersion = () => "8.16.0";
+var getVersion = () => "8.17.0";
 function wrapCommand2(name, errorCode, handler) {
   return wrapCommand({ name, errorCode, handler, getVersion });
 }

package/dist/cli/index.js

@@ -79,7 +79,7 @@ import {
   stringifyFrontmatter,
   toPosixPath,
   writeFileContent
-} from "../chunk-DOWXY74I.js";
+} from "../chunk-RXCRO26Z.js";
 
 // src/cli/index.ts
 import { Command } from "commander";
@@ -6485,7 +6485,7 @@ function wrapCommand({
 }
 
 // src/cli/index.ts
-var getVersion = () => "8.16.0";
+var getVersion = () => "8.17.0";
 function wrapCommand2(name, errorCode, handler) {
   return wrapCommand({ name, errorCode, handler, getVersion });
 }

package/dist/index.cjs

@@ -7516,6 +7516,16 @@ var McpServerSchema = import_mini24.z.looseObject({
   tools: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   kiroAutoApprove: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   kiroAutoBlock: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
+  // Codex CLI-specific: list of shell env var names that codex should pass
+  // through from the user's environment to the MCP server process.
+  // Distinct from `env` (a literal name→value map): `envVars` is a list of
+  // variable NAMES whose values come from the user's shell at runtime.
+  // Only honoured by the codex generator (renamed to `env_vars` in codex
+  // TOML output, matching codex's native field name — see the
+  // `enabledTools`→`enabled_tools` precedent in `codexcli-mcp.ts`).
+  // Stripped by `RulesyncMcp.getMcpServers()` so it does not leak into
+  // other tools' configs.
+  envVars: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   headers: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.string())),
   enabledTools: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string())),
   disabledTools: import_mini24.z.optional(import_mini24.z.array(import_mini24.z.string()))
@@ -7618,10 +7628,11 @@ var RulesyncMcp = class _RulesyncMcp extends RulesyncFile {
     });
   }
   getMcpServers() {
-    const entries = Object.entries(this.json.mcpServers);
+    const mcpServers = this.json.mcpServers ?? {};
+    const entries = Object.entries(mcpServers);
     return Object.fromEntries(
       entries.map(([serverName, serverConfig]) => {
-        return [serverName, (0, import_object.omit)(serverConfig, ["targets", "description", "exposed"])];
+        return [serverName, (0, import_object.omit)(serverConfig, ["targets", "description", "exposed", "envVars"])];
       })
     );
   }
@@ -7840,11 +7851,17 @@ var ClineMcp = class _ClineMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
+    const json = rulesyncMcp.getJson();
+    const fileContent = JSON.stringify(
+      { ...json, mcpServers: rulesyncMcp.getMcpServers() },
+      null,
+      2
+    );
     return new _ClineMcp({
       outputRoot,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
       relativeFilePath: this.getSettablePaths().relativeFilePath,
-      fileContent: rulesyncMcp.getFileContent(),
+      fileContent,
       validate
     });
   }
@@ -7888,6 +7905,8 @@ function convertFromCodexFormat(codexMcp) {
         converted["enabledTools"] = value;
       } else if (key === "disabled_tools") {
         converted["disabledTools"] = value;
+      } else if (key === "env_vars") {
+        converted["envVars"] = value;
       } else {
         converted[key] = value;
       }
@@ -7909,6 +7928,8 @@ function convertToCodexFormat(mcpServers) {
         converted["enabled_tools"] = value;
       } else if (key === "disabledTools") {
         converted["disabled_tools"] = value;
+      } else if (key === "envVars") {
+        converted["env_vars"] = value;
       } else {
         converted[key] = value;
       }
@@ -8004,7 +8025,12 @@ var CodexcliMcp = class _CodexcliMcp extends ToolMcp {
     const filtered = {};
     for (const [key, value] of Object.entries(obj)) {
       if (value === null) continue;
-      if (typeof value === "object" && Object.keys(value).length === 0) continue;
+      if (typeof value === "object" && !Array.isArray(value)) {
+        const cleaned = this.removeEmptyEntries(value);
+        if (Object.keys(cleaned).length === 0) continue;
+        filtered[key] = cleaned;
+        continue;
+      }
       filtered[key] = value;
     }
     return filtered;
@@ -8381,8 +8407,7 @@ var CursorMcp = class _CursorMcp extends ToolMcp {
         { cause: error }
       );
     }
-    const rulesyncJson = rulesyncMcp.getJson();
-    const mcpServers = isMcpServers(rulesyncJson.mcpServers) ? rulesyncJson.mcpServers : {};
+    const mcpServers = rulesyncMcp.getMcpServers();
     const transformedServers = convertEnvToCursorFormat(mcpServers);
     const cursorConfig = { ...json, mcpServers: transformedServers };
     return new _CursorMcp({
@@ -8551,9 +8576,9 @@ var FactorydroidMcp = class _FactorydroidMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
-    const json = rulesyncMcp.getJson();
+    const mcpServers = rulesyncMcp.getMcpServers();
     const factorydroidConfig = {
-      mcpServers: json.mcpServers || {}
+      mcpServers
     };
     const fileContent = JSON.stringify(factorydroidConfig, null, 2);
     return new _FactorydroidMcp({
@@ -8639,7 +8664,7 @@ var GeminiCliMcp = class _GeminiCliMcp extends ToolMcp {
       JSON.stringify({ mcpServers: {} }, null, 2)
     );
     const json = JSON.parse(fileContent);
-    const newJson = { ...json, mcpServers: rulesyncMcp.getJson().mcpServers };
+    const newJson = { ...json, mcpServers: rulesyncMcp.getMcpServers() };
     return new _GeminiCliMcp({
       outputRoot,
       relativeDirPath: paths.relativeDirPath,
@@ -8720,11 +8745,17 @@ var JunieMcp = class _JunieMcp extends ToolMcp {
     rulesyncMcp,
     validate = true
   }) {
+    const json = rulesyncMcp.getJson();
+    const fileContent = JSON.stringify(
+      { ...json, mcpServers: rulesyncMcp.getMcpServers() },
+      null,
+      2
+    );
     return new _JunieMcp({
       outputRoot,
       relativeDirPath: this.getSettablePaths().relativeDirPath,
       relativeFilePath: this.getSettablePaths().relativeFilePath,
-      fileContent: rulesyncMcp.getFileContent(),
+      fileContent,
       validate
     });
   }
@@ -9504,8 +9535,7 @@ var RovodevMcp = class _RovodevMcp extends ToolMcp {
       JSON.stringify({ mcpServers: {} }, null, 2)
     );
     const json = parseRovodevMcpJson(fileContent, paths.relativeDirPath, paths.relativeFilePath);
-    const rulesyncJson = rulesyncMcp.getJson();
-    const mcpServers = isMcpServers(rulesyncJson.mcpServers) ? rulesyncJson.mcpServers : {};
+    const mcpServers = rulesyncMcp.getMcpServers();
     const rovodevConfig = { ...json, mcpServers };
     return new _RovodevMcp({
       outputRoot,
@@ -10930,7 +10960,8 @@ function convertRulesyncToCodexProfile({
           filesystem,
           projectRootFilesystem,
           pattern,
-          access: mapReadAction(action)
+          access: mapReadAction(action),
+          logger
         });
       }
       continue;
@@ -10941,7 +10972,8 @@ function convertRulesyncToCodexProfile({
           filesystem,
           projectRootFilesystem,
           pattern,
-          access: mapWriteAction(action)
+          access: mapWriteAction(action),
+          logger
         });
       }
       continue;
@@ -10963,6 +10995,11 @@ function convertRulesyncToCodexProfile({
     );
   }
   if (Object.keys(projectRootFilesystem).length > 0) {
+    if (typeof filesystem[CODEX_PROJECT_ROOTS_KEY] === "string") {
+      logger?.warn(
+        `"${CODEX_PROJECT_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions, but it will be overwritten by project-root rules. Consider removing the direct "${CODEX_PROJECT_ROOTS_KEY}" entry.`
+      );
+    }
     if (Object.keys(projectRootFilesystem).some((pattern) => pattern.includes("**"))) {
       filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
     }
@@ -11013,8 +11050,13 @@ function addFilesystemRule({
   filesystem,
   projectRootFilesystem,
   pattern,
-  access
+  access,
+  logger
 }) {
+  if (pattern.trim() === "") {
+    logger?.warn("Skipping empty pattern in filesystem permissions.");
+    return;
+  }
   if (canBeCodexFilesystemRoot(pattern)) {
     filesystem[pattern] = access;
     return;

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   convertFromTool,
   generate,
   importFromTool
-} from "./chunk-DOWXY74I.js";
+} from "./chunk-RXCRO26Z.js";
 
 // src/index.ts
 async function generate2(options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulesync",
-  "version": "8.16.0",
+  "version": "8.17.0",
   "description": "Unified AI rules management CLI tool that generates configuration files for various AI development tools",
   "keywords": [
     "ai",