rulesync 8.31.0 → 9.0.0

package/dist/cli/index.js

@@ -16,7 +16,6 @@ import {
   ConsoleLogger,
   ErrorCodes,
   FETCH_CONCURRENCY_LIMIT,
-  GITIGNORE_DESTINATION_KEY,
   HooksProcessor,
   HooksProcessorToolTargetSchema,
   IgnoreProcessor,
@@ -83,7 +82,6 @@ import {
   getHomeDirectory,
   getLocalSkillDirNames,
   importFromTool,
-  isFeatureValueEnabled,
   isSymlink,
   listDirectoryFiles,
   readFileContent,
@@ -101,7 +99,7 @@ import {
   toolSkillFactories,
   toolSubagentFactories,
   writeFileContent
-} from "../chunk-NAO27T2K.js";
+} from "../chunk-JT4BB5RE.js";
 
 // src/cli/index.ts
 import { Command } from "commander";
@@ -1132,15 +1130,6 @@ async function fetchCommand(logger5, options) {
 }
 
 // src/cli/commands/generate.ts
-function sameDirSets(a, b) {
-  const aSet = new Set(a);
-  const bSet = new Set(b);
-  if (aSet.size !== bSet.size) return false;
-  for (const v of aSet) {
-    if (!bSet.has(v)) return false;
-  }
-  return true;
-}
 function logFeatureResult(logger5, params) {
   const { count, paths, featureName, isPreview, modePrefix } = params;
   if (count > 0) {
@@ -1154,23 +1143,50 @@ function logFeatureResult(logger5, params) {
     }
   }
 }
-async function generateCommand(logger5, options) {
-  const { baseDir, outputRoots, ...rest } = options;
-  if (baseDir !== void 0) {
-    logger5.warn(
-      "--base-dir is deprecated; use --output-roots instead. It will be removed in a future major release."
-    );
-  }
-  const outputRootsResolved = outputRoots !== void 0 && outputRoots.length > 0 ? outputRoots : baseDir;
-  if (baseDir !== void 0 && outputRoots !== void 0 && baseDir.length > 0 && outputRoots.length > 0 && !sameDirSets(outputRoots, baseDir)) {
-    logger5.warn(
-      `Both '--output-roots' and '--base-dir' were provided with differing values; using '--output-roots' (${JSON.stringify(outputRoots)}) and ignoring '--base-dir' (${JSON.stringify(baseDir)}).`
-    );
+var FEATURE_DEBUG_MESSAGES = {
+  ignore: "Generating ignore files...",
+  mcp: "Generating MCP files...",
+  commands: "Generating command files...",
+  subagents: "Generating subagent files...",
+  skills: "Generating skill files...",
+  hooks: "Generating hooks...",
+  rules: "Generating rule files..."
+};
+var FEATURE_DEBUG_ORDER = [
+  "ignore",
+  "mcp",
+  "commands",
+  "subagents",
+  "skills",
+  "hooks",
+  "rules"
+];
+function logFeatureDebugMessages(logger5, features) {
+  for (const feature of FEATURE_DEBUG_ORDER) {
+    if (features.includes(feature)) {
+      logger5.debug(FEATURE_DEBUG_MESSAGES[feature] ?? "");
+    }
+  }
+}
+function buildSummaryParts(result) {
+  const summarySpecs = [
+    { count: result.rulesCount, label: "rules" },
+    { count: result.ignoreCount, label: "ignore files" },
+    { count: result.mcpCount, label: "MCP files" },
+    { count: result.commandsCount, label: "commands" },
+    { count: result.subagentsCount, label: "subagents" },
+    { count: result.skillsCount, label: "skills" },
+    { count: result.hooksCount, label: "hooks" },
+    { count: result.permissionsCount, label: "permissions" }
+  ];
+  const parts = [];
+  for (const { count, label } of summarySpecs) {
+    if (count > 0) parts.push(`${count} ${label}`);
   }
-  const config = await ConfigResolver.resolve(
-    { ...rest, outputRoots: outputRootsResolved },
-    { logger: logger5 }
-  );
+  return parts;
+}
+async function generateCommand(logger5, options) {
+  const config = await ConfigResolver.resolve(options, { logger: logger5 });
   const check = config.getCheck();
   const isPreview = config.isPreviewMode();
   const modePrefix = isPreview ? "[DRY RUN]" : "";
@@ -1183,27 +1199,7 @@ async function generateCommand(logger5, options) {
   }
   logger5.debug(`Output roots: ${config.getOutputRoots().join(", ")}`);
   const features = config.getFeatures();
-  if (features.includes("ignore")) {
-    logger5.debug("Generating ignore files...");
-  }
-  if (features.includes("mcp")) {
-    logger5.debug("Generating MCP files...");
-  }
-  if (features.includes("commands")) {
-    logger5.debug("Generating command files...");
-  }
-  if (features.includes("subagents")) {
-    logger5.debug("Generating subagent files...");
-  }
-  if (features.includes("skills")) {
-    logger5.debug("Generating skill files...");
-  }
-  if (features.includes("hooks")) {
-    logger5.debug("Generating hooks...");
-  }
-  if (features.includes("rules")) {
-    logger5.debug("Generating rule files...");
-  }
+  logFeatureDebugMessages(logger5, features);
   const result = await generate({ config, logger: logger5 });
   const totalGenerated = calculateTotalCount(result);
   const featureResults = {
@@ -1256,15 +1252,7 @@ async function generateCommand(logger5, options) {
     logger5.info(`\u2713 All files are up to date (${enabledFeatures})`);
     return;
   }
-  const parts = [];
-  if (result.rulesCount > 0) parts.push(`${result.rulesCount} rules`);
-  if (result.ignoreCount > 0) parts.push(`${result.ignoreCount} ignore files`);
-  if (result.mcpCount > 0) parts.push(`${result.mcpCount} MCP files`);
-  if (result.commandsCount > 0) parts.push(`${result.commandsCount} commands`);
-  if (result.subagentsCount > 0) parts.push(`${result.subagentsCount} subagents`);
-  if (result.skillsCount > 0) parts.push(`${result.skillsCount} skills`);
-  if (result.hooksCount > 0) parts.push(`${result.hooksCount} hooks`);
-  if (result.permissionsCount > 0) parts.push(`${result.permissionsCount} permissions`);
+  const parts = buildSummaryParts(result);
   if (isPreview) {
     logger5.info(`${modePrefix} Would write ${totalGenerated} file(s) total (${parts.join(" + ")})`);
   } else {
@@ -1337,7 +1325,6 @@ var getProcessorRegistryEntry = (feature) => {
 // src/cli/commands/gitignore-derive.ts
 var TARGETS_NOT_DERIVED = /* @__PURE__ */ new Set([
   "agentsskills",
-  "antigravity",
   "augmentcode-legacy",
   "claudecode-legacy"
 ]);
@@ -1525,28 +1512,12 @@ var getSelectedGitignoreEntryTargets = (target, selectedTargets) => {
   }
   return targets.filter((candidate) => selectedTargets.includes(candidate));
 };
-var isFeatureSelectedForTarget = (feature, target, features) => {
+var isFeatureSelected = (feature, features) => {
   if (feature === "general") return true;
   if (!features) return true;
-  if (Array.isArray(features)) {
-    if (features.length === 0) return true;
-    if (features.includes("*")) return true;
-    return features.includes(feature);
-  }
-  if (target === "common") return true;
-  const targetFeatures = features[target];
-  if (!targetFeatures) return true;
-  if (Array.isArray(targetFeatures)) {
-    if (targetFeatures.includes("*")) return true;
-    return targetFeatures.includes(feature);
-  }
-  if (isFeatureValueEnabled(targetFeatures["*"])) return true;
-  return isFeatureValueEnabled(targetFeatures[feature]);
-};
-var isFeatureSelected = (feature, target, features) => {
-  return normalizeGitignoreEntryTargets(target).some(
-    (candidate) => isFeatureSelectedForTarget(feature, candidate, features)
-  );
+  if (features.length === 0) return true;
+  if (features.includes("*")) return true;
+  return features.includes(feature);
 };
 var warnInvalidTargets = (targets, logger5) => {
   const validTargets = new Set(ALL_TOOL_TARGETS_WITH_WILDCARD);
@@ -1561,32 +1532,13 @@ var warnInvalidTargets = (targets, logger5) => {
 var warnInvalidFeatures = (features, logger5) => {
   const validFeatures = new Set(ALL_FEATURES_WITH_WILDCARD);
   const warned = /* @__PURE__ */ new Set();
-  const warnOnce = (feature) => {
+  for (const feature of features) {
     if (!validFeatures.has(feature) && !warned.has(feature)) {
       warned.add(feature);
       logger5?.warn(
         `Unknown feature '${feature}'. Valid features: ${ALL_FEATURES_WITH_WILDCARD.join(", ")}`
       );
     }
-  };
-  if (Array.isArray(features)) {
-    for (const feature of features) {
-      warnOnce(feature);
-    }
-  } else {
-    for (const targetFeatures of Object.values(features)) {
-      if (!targetFeatures) continue;
-      if (Array.isArray(targetFeatures)) {
-        for (const feature of targetFeatures) {
-          warnOnce(feature);
-        }
-      } else {
-        for (const feature of Object.keys(targetFeatures)) {
-          if (feature === GITIGNORE_DESTINATION_KEY) continue;
-          warnOnce(feature);
-        }
-      }
-    }
   }
 };
 var resolveGitignoreEntries = (params) => {
@@ -1602,7 +1554,7 @@ var resolveGitignoreEntries = (params) => {
   for (const tag of GITIGNORE_ENTRY_REGISTRY) {
     if (!isTargetSelected(tag.target, targets)) continue;
     const selectedTagTargets = getSelectedGitignoreEntryTargets(tag.target, targets);
-    if (!isFeatureSelected(tag.feature, selectedTagTargets, features)) continue;
+    if (!isFeatureSelected(tag.feature, features)) continue;
     if (seen.has(tag.entry)) continue;
     seen.add(tag.entry);
     result.push({
@@ -1794,9 +1746,9 @@ ${rulesyncBlock}
     "\u{1F4A1} If you're using Google Antigravity, note that rules, workflows, and skills won't load if they're gitignored."
   );
   logger5.info("   You can add the following to .git/info/exclude instead:");
-  logger5.info("   **/.agent/rules/");
-  logger5.info("   **/.agent/workflows/");
-  logger5.info("   **/.agent/skills/");
+  logger5.info("   **/.agents/rules/");
+  logger5.info("   **/.agents/workflows/");
+  logger5.info("   **/.agents/skills/");
   logger5.info("   For more details: https://github.com/dyoshikawa/rulesync/issues/981");
 };
 
@@ -2211,7 +2163,7 @@ function findApmLockDependency(lock, repoUrl) {
 
 // src/lib/apm/apm-manifest.ts
 import { join as join5 } from "path";
-import { dump as dump2, load as load2 } from "js-yaml";
+import { load as load2 } from "js-yaml";
 import { optional as optional2, z as z5 } from "zod/mini";
 var APM_MANIFEST_FILE_NAME = "apm.yml";
 var ApmObjectDependencySchema = z5.looseObject({
@@ -2419,34 +2371,7 @@ async function installApm(params) {
   }
   const existingLock = await readApmLock(projectRoot);
   if (options.frozen) {
-    if (!existingLock) {
-      throw new Error(
-        "Frozen install failed: rulesync-apm.lock.yaml is missing. Run 'rulesync install --mode apm' to create it."
-      );
-    }
-    const missing = manifest.dependencies.filter(
-      (dep) => !findApmLockDependency(existingLock, canonicalRepoUrl(dep))
-    );
-    if (missing.length > 0) {
-      const names = missing.map((d) => d.gitUrl).join(", ");
-      throw new Error(
-        `Frozen install failed: rulesync-apm.lock.yaml is missing entries for: ${names}. Run 'rulesync install --mode apm' to update the lockfile.`
-      );
-    }
-    const drifted = manifest.dependencies.filter((dep) => {
-      if (dep.ref === void 0) return false;
-      const locked = findApmLockDependency(existingLock, canonicalRepoUrl(dep));
-      return locked?.resolved_ref !== void 0 && locked.resolved_ref !== dep.ref;
-    });
-    if (drifted.length > 0) {
-      const names = drifted.map((d) => {
-        const locked = findApmLockDependency(existingLock, canonicalRepoUrl(d));
-        return `${d.gitUrl} (manifest=${d.ref}, lock=${locked?.resolved_ref})`;
-      }).join(", ");
-      throw new Error(
-        `Frozen install failed: manifest ref does not match rulesync-apm.lock.yaml for: ${names}. Run 'rulesync install --mode apm' to update the lockfile.`
-      );
-    }
+    assertFrozenLockCoversManifest({ existingLock, dependencies: manifest.dependencies });
   }
   const token = GitHubClient.resolveToken(options.token);
   const client = new GitHubClient({ token });
@@ -2501,30 +2426,7 @@ async function installApm(params) {
     }
   }
   if (existingLock) {
-    const newDeployedFiles = new Set(newLock.dependencies.flatMap((d) => d.deployed_files));
-    const toDelete = [];
-    for (const prev of existingLock.dependencies) {
-      for (const deployed of prev.deployed_files) {
-        if (!newDeployedFiles.has(deployed)) {
-          toDelete.push(deployed);
-        }
-      }
-    }
-    for (const relativePath of toDelete) {
-      if (posix2.isAbsolute(relativePath) || relativePath.split(/[/\\]/).includes("..")) {
-        logger5.warn(`Refusing to remove stale apm file with suspicious path: "${relativePath}".`);
-        continue;
-      }
-      try {
-        checkPathTraversal({ relativePath, intendedRootDir: projectRoot });
-      } catch {
-        logger5.warn(`Refusing to remove stale apm file outside projectRoot: "${relativePath}".`);
-        continue;
-      }
-      const absolute = join6(projectRoot, relativePath);
-      await removeFile(absolute);
-      logger5.debug(`Removed stale apm file: ${relativePath}`);
-    }
+    await removeStaleApmFiles({ existingLock, newLock, projectRoot, logger: logger5 });
   }
   if (!frozen) {
     newLock.generated_at = (/* @__PURE__ */ new Date()).toISOString();
@@ -2543,6 +2445,64 @@ async function installApm(params) {
     failedDependencyCount: failedCount
   };
 }
+function assertFrozenLockCoversManifest(params) {
+  const { existingLock, dependencies } = params;
+  if (!existingLock) {
+    throw new Error(
+      "Frozen install failed: rulesync-apm.lock.yaml is missing. Run 'rulesync install --mode apm' to create it."
+    );
+  }
+  const missing = dependencies.filter(
+    (dep) => !findApmLockDependency(existingLock, canonicalRepoUrl(dep))
+  );
+  if (missing.length > 0) {
+    const names = missing.map((d) => d.gitUrl).join(", ");
+    throw new Error(
+      `Frozen install failed: rulesync-apm.lock.yaml is missing entries for: ${names}. Run 'rulesync install --mode apm' to update the lockfile.`
+    );
+  }
+  const drifted = dependencies.filter((dep) => {
+    if (dep.ref === void 0) return false;
+    const locked = findApmLockDependency(existingLock, canonicalRepoUrl(dep));
+    return locked?.resolved_ref !== void 0 && locked.resolved_ref !== dep.ref;
+  });
+  if (drifted.length > 0) {
+    const names = drifted.map((d) => {
+      const locked = findApmLockDependency(existingLock, canonicalRepoUrl(d));
+      return `${d.gitUrl} (manifest=${d.ref}, lock=${locked?.resolved_ref})`;
+    }).join(", ");
+    throw new Error(
+      `Frozen install failed: manifest ref does not match rulesync-apm.lock.yaml for: ${names}. Run 'rulesync install --mode apm' to update the lockfile.`
+    );
+  }
+}
+async function removeStaleApmFiles(params) {
+  const { existingLock, newLock, projectRoot, logger: logger5 } = params;
+  const newDeployedFiles = new Set(newLock.dependencies.flatMap((d) => d.deployed_files));
+  const toDelete = [];
+  for (const prev of existingLock.dependencies) {
+    for (const deployed of prev.deployed_files) {
+      if (!newDeployedFiles.has(deployed)) {
+        toDelete.push(deployed);
+      }
+    }
+  }
+  for (const relativePath of toDelete) {
+    if (posix2.isAbsolute(relativePath) || relativePath.split(/[/\\]/).includes("..")) {
+      logger5.warn(`Refusing to remove stale apm file with suspicious path: "${relativePath}".`);
+      continue;
+    }
+    try {
+      checkPathTraversal({ relativePath, intendedRootDir: projectRoot });
+    } catch {
+      logger5.warn(`Refusing to remove stale apm file outside projectRoot: "${relativePath}".`);
+      continue;
+    }
+    const absolute = join6(projectRoot, relativePath);
+    await removeFile(absolute);
+    logger5.debug(`Removed stale apm file: ${relativePath}`);
+  }
+}
 async function installDependency(params) {
   const { dep, client, semaphore, projectRoot, existingLock, frozen, update, logger: logger5 } = params;
   const repoUrl = canonicalRepoUrl(dep);
@@ -2571,58 +2531,25 @@ async function installDependency(params) {
       logger: logger5
     });
     if (files.length === 0) continue;
-    for (const file of files) {
-      if (file.size > MAX_FILE_SIZE) {
-        logger5.warn(
-          `Skipping "${file.path}" from ${repoUrl}: ${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
-        );
-        continue;
-      }
-      const relativeToBase = posix2.relative(remoteBase, toPosixPath(file.path));
-      if (!relativeToBase || relativeToBase.startsWith("..") || posix2.isAbsolute(relativeToBase)) {
-        logger5.warn(
-          `Skipping "${file.path}" from ${repoUrl}: resolved outside of "${remoteBase}".`
-        );
-        continue;
-      }
-      const deployRelative = toPosixPath(join6(primitive.deployDir, relativeToBase));
-      checkPathTraversal({
-        relativePath: deployRelative,
-        intendedRootDir: projectRoot
-      });
-      const content = await withSemaphore(
-        semaphore,
-        () => client.getFileContent(dep.owner, dep.repo, file.path, resolvedSha)
-      );
-      const byteLength = Buffer.byteLength(content, "utf8");
-      if (byteLength > MAX_FILE_SIZE) {
-        logger5.warn(
-          `Skipping "${file.path}" from ${repoUrl}: fetched ${(byteLength / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
-        );
-        continue;
-      }
-      deployed.push({ path: deployRelative, content });
-      if (!frozen) {
-        await writeFileContent(join6(projectRoot, deployRelative), content);
-      }
-    }
+    await collectPrimitiveDeployments({
+      dep,
+      client,
+      semaphore,
+      projectRoot,
+      primitive,
+      remoteBase,
+      files,
+      resolvedSha,
+      repoUrl,
+      frozen,
+      deployed,
+      logger: logger5
+    });
   }
   deployed.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const deployedFiles = deployed.map((d) => d.path);
   const contentHash = computeContentHash(deployed);
-  if (frozen && locked?.content_hash) {
-    if (RULESYNC_CONTENT_HASH_REGEX.test(locked.content_hash)) {
-      if (locked.content_hash !== contentHash) {
-        throw new Error(
-          `content_hash mismatch for ${repoUrl}: lock=${locked.content_hash} computed=${contentHash}. Refuse to trust the deployment under --frozen.`
-        );
-      }
-    } else {
-      logger5.debug(
-        `Skipping content_hash integrity check for ${repoUrl}: recorded hash "${locked.content_hash}" was not written by rulesync.`
-      );
-    }
-  }
+  assertFrozenContentHashMatches({ frozen, locked, contentHash, repoUrl, logger: logger5 });
   if (frozen) {
     for (const { path: deployRelative, content } of deployed) {
       await writeFileContent(join6(projectRoot, deployRelative), content);
@@ -2643,6 +2570,71 @@ async function installDependency(params) {
   logger5.info(`Installed ${deployedFiles.length} file(s) from ${repoUrl}@${shortSha(resolvedSha)}`);
   return { lockEntry, deployedFiles };
 }
+async function collectPrimitiveDeployments(params) {
+  const {
+    dep,
+    client,
+    semaphore,
+    projectRoot,
+    primitive,
+    remoteBase,
+    files,
+    resolvedSha,
+    repoUrl,
+    frozen,
+    deployed,
+    logger: logger5
+  } = params;
+  for (const file of files) {
+    if (file.size > MAX_FILE_SIZE) {
+      logger5.warn(
+        `Skipping "${file.path}" from ${repoUrl}: ${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+      );
+      continue;
+    }
+    const relativeToBase = posix2.relative(remoteBase, toPosixPath(file.path));
+    if (!relativeToBase || relativeToBase.startsWith("..") || posix2.isAbsolute(relativeToBase)) {
+      logger5.warn(`Skipping "${file.path}" from ${repoUrl}: resolved outside of "${remoteBase}".`);
+      continue;
+    }
+    const deployRelative = toPosixPath(join6(primitive.deployDir, relativeToBase));
+    checkPathTraversal({
+      relativePath: deployRelative,
+      intendedRootDir: projectRoot
+    });
+    const content = await withSemaphore(
+      semaphore,
+      () => client.getFileContent(dep.owner, dep.repo, file.path, resolvedSha)
+    );
+    const byteLength = Buffer.byteLength(content, "utf8");
+    if (byteLength > MAX_FILE_SIZE) {
+      logger5.warn(
+        `Skipping "${file.path}" from ${repoUrl}: fetched ${(byteLength / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+      );
+      continue;
+    }
+    deployed.push({ path: deployRelative, content });
+    if (!frozen) {
+      await writeFileContent(join6(projectRoot, deployRelative), content);
+    }
+  }
+}
+function assertFrozenContentHashMatches(params) {
+  const { frozen, locked, contentHash, repoUrl, logger: logger5 } = params;
+  if (frozen && locked?.content_hash) {
+    if (RULESYNC_CONTENT_HASH_REGEX.test(locked.content_hash)) {
+      if (locked.content_hash !== contentHash) {
+        throw new Error(
+          `content_hash mismatch for ${repoUrl}: lock=${locked.content_hash} computed=${contentHash}. Refuse to trust the deployment under --frozen.`
+        );
+      }
+    } else {
+      logger5.debug(
+        `Skipping content_hash integrity check for ${repoUrl}: recorded hash "${locked.content_hash}" was not written by rulesync.`
+      );
+    }
+  }
+}
 function computeContentHash(files) {
   const hash = createHash("sha256");
   for (const { path: path2, content } of files) {
@@ -2685,7 +2677,7 @@ import { basename, join as join9, posix as posix3 } from "path";
 import { Semaphore as Semaphore3 } from "es-toolkit/promise";
 
 // src/lib/gh/gh-frontmatter.ts
-import { dump as dump3, load as load3 } from "js-yaml";
+import { dump as dump2, load as load3 } from "js-yaml";
 var FRONTMATTER_FENCE = "---";
 function injectSourceMetadata(params) {
   const { content, source, repository, ref } = params;
@@ -2700,7 +2692,7 @@ function injectSourceMetadata(params) {
   } else if (content === FRONTMATTER_FENCE) {
     openFenceLen = 3;
   } else {
-    const yaml2 = dump3(provenance, { noRefs: true, lineWidth: -1, sortKeys: false });
+    const yaml2 = dump2(provenance, { noRefs: true, lineWidth: -1, sortKeys: false });
     return `${FRONTMATTER_FENCE}
 ${yaml2}${FRONTMATTER_FENCE}
 ${content}`;
@@ -2727,7 +2719,7 @@ ${content}`;
     throw new Error("invalid frontmatter");
   }
   if (loaded === null || loaded === void 0) {
-    const yaml2 = dump3(provenance, { noRefs: true, lineWidth: -1, sortKeys: false });
+    const yaml2 = dump2(provenance, { noRefs: true, lineWidth: -1, sortKeys: false });
     return `${FRONTMATTER_FENCE}
 ${yaml2}${FRONTMATTER_FENCE}
 ${rest}`;
@@ -2740,7 +2732,7 @@ ${rest}`;
     ...existing,
     ...provenance
   };
-  const yaml = dump3(merged, { noRefs: true, lineWidth: -1, sortKeys: false });
+  const yaml = dump2(merged, { noRefs: true, lineWidth: -1, sortKeys: false });
   return `${FRONTMATTER_FENCE}
 ${yaml}${FRONTMATTER_FENCE}
 ${rest}`;
@@ -2748,7 +2740,7 @@ ${rest}`;
 
 // src/lib/gh/gh-lock.ts
 import { join as join7 } from "path";
-import { dump as dump4, load as load4 } from "js-yaml";
+import { dump as dump3, load as load4 } from "js-yaml";
 import { optional as optional3, refine as refine2, z as z6 } from "zod/mini";
 var GH_LOCKFILE_FILE_NAME = "rulesync-gh.lock.yaml";
 var GH_LOCKFILE_VERSION = "1";
@@ -2820,7 +2812,7 @@ async function writeGhLock(params) {
   await writeFileContent(path2, content);
 }
 function serializeGhLock(lock) {
-  return dump4(lock, { noRefs: true, lineWidth: -1, sortKeys: false });
+  return dump3(lock, { noRefs: true, lineWidth: -1, sortKeys: false });
 }
 function findGhLockInstallation(lock, params) {
   const target = params.source.toLowerCase();
@@ -2871,39 +2863,7 @@ async function installGh(params) {
   if (sources.length === 0) {
     return { sourcesProcessed: 0, installedSkillCount: 0, failedSourceCount: 0 };
   }
-  const resolvedSources = sources.map((entry) => {
-    const parsed = parseSource(entry.source);
-    if (parsed.provider !== "github") {
-      throw new Error(
-        `--mode gh only supports GitHub sources. "${entry.source}" resolves to provider "${parsed.provider}".`
-      );
-    }
-    if (entry.transport !== void 0 && entry.transport !== "github") {
-      throw new Error(
-        `--mode gh: field "transport" is not supported (got "${entry.transport}" for source "${entry.source}"). Drop the field or switch to --mode rulesync.`
-      );
-    }
-    if (entry.path !== void 0) {
-      throw new Error(
-        `--mode gh: field "path" is not supported for source "${entry.source}". The remote layout is fixed to "skills/<name>/SKILL.md".`
-      );
-    }
-    const agent = entry.agent ?? "github-copilot";
-    if (!GH_AGENTS.includes(agent)) {
-      throw new Error(
-        `--mode gh: unknown agent "${agent}" for source "${entry.source}". Valid agents: ${GH_AGENTS.join(", ")}.`
-      );
-    }
-    const scope = entry.scope ?? "project";
-    return {
-      entry,
-      owner: parsed.owner,
-      repo: parsed.repo,
-      ref: entry.ref ?? parsed.ref,
-      agent,
-      scope
-    };
-  });
+  const resolvedSources = sources.map(resolveGhSource);
   const existingLock = await readGhLock(projectRoot);
   const frozen = options.frozen ?? false;
   const update = options.update ?? false;
@@ -2913,38 +2873,7 @@ async function installGh(params) {
     );
   }
   if (frozen && existingLock) {
-    const uncovered = [];
-    for (const rs of resolvedSources) {
-      const hasAny = existingLock.installations.some(
-        (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase() && i.agent === rs.agent && i.scope === rs.scope
-      );
-      if (!hasAny) {
-        uncovered.push(`${rs.entry.source} (agent=${rs.agent}, scope=${rs.scope})`);
-      }
-    }
-    if (uncovered.length > 0) {
-      throw new Error(
-        `Frozen install failed: rulesync-gh.lock.yaml is missing entries for: ${uncovered.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
-      );
-    }
-    const drifted = [];
-    for (const rs of resolvedSources) {
-      if (!rs.ref) continue;
-      const matches = existingLock.installations.filter(
-        (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase()
-      );
-      for (const m of matches) {
-        if (m.requested_ref !== void 0 && m.requested_ref !== rs.ref) {
-          drifted.push(`${rs.entry.source} (manifest=${rs.ref}, lock=${m.requested_ref})`);
-          break;
-        }
-      }
-    }
-    if (drifted.length > 0) {
-      throw new Error(
-        `Frozen install failed: manifest ref does not match rulesync-gh.lock.yaml for: ${drifted.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
-      );
-    }
+    assertFrozenLockCoversSources({ existingLock, resolvedSources });
   }
   const token = GitHubClient.resolveToken(options.token);
   const client = new GitHubClient({ token });
@@ -2980,49 +2909,11 @@ async function installGh(params) {
     })
   );
   if (frozen) {
-    for (const result of results) {
-      if (result.status !== "ok") continue;
-      for (const inst of result.installations) {
-        for (const d of inst.deployed) {
-          await writeFileContent(d.absolutePath, d.content);
-        }
-      }
-    }
-  }
-  let totalInstalled = 0;
-  let failedCount = 0;
-  for (const result of results) {
-    if (result.status === "ok") {
-      for (const inst of result.installations) {
-        newLock.installations.push(inst.installation);
-      }
-      totalInstalled += result.installations.length;
-    } else {
-      failedCount += 1;
-      for (const preserved of result.preserved) {
-        newLock.installations.push(preserved);
-      }
-    }
+    await writeDeferredFrozenFiles(results);
   }
+  const { totalInstalled, failedCount } = aggregateSourceResults({ results, newLock });
   if (existingLock) {
-    const newDeployed = /* @__PURE__ */ new Set();
-    for (const inst of newLock.installations) {
-      for (const file of inst.deployed_files) {
-        newDeployed.add(`${inst.scope}::${file}`);
-      }
-    }
-    for (const prev of existingLock.installations) {
-      for (const deployed of prev.deployed_files) {
-        const key = `${prev.scope}::${deployed}`;
-        if (newDeployed.has(key)) continue;
-        await removeStaleFile({
-          relativePath: deployed,
-          scope: prev.scope === "user" ? "user" : "project",
-          projectRoot,
-          logger: logger5
-        });
-      }
-    }
+    await removeStaleGhFiles({ existingLock, newLock, projectRoot, logger: logger5 });
   }
   if (!frozen) {
     newLock.generated_at = (/* @__PURE__ */ new Date()).toISOString();
@@ -3041,80 +2932,152 @@ async function installGh(params) {
     failedSourceCount: failedCount
   };
 }
-async function installSource(params) {
-  const { rs, client, semaphore, projectRoot, existingLock, frozen, update, logger: logger5 } = params;
-  const { entry, owner, repo, agent, scope } = rs;
-  const sourceKey = entry.source;
-  let resolvedRef;
-  let usedTag = false;
-  if (rs.ref) {
-    resolvedRef = rs.ref;
-  } else {
-    try {
-      const release = await client.getLatestRelease(owner, repo);
-      resolvedRef = release.tag_name;
-      usedTag = true;
-    } catch (error) {
-      if (is404(error)) {
-        resolvedRef = await client.getDefaultBranch(owner, repo);
-      } else {
-        throw error;
-      }
-    }
+function resolveGhSource(entry) {
+  const parsed = parseSource(entry.source);
+  if (parsed.provider !== "github") {
+    throw new Error(
+      `--mode gh only supports GitHub sources. "${entry.source}" resolves to provider "${parsed.provider}".`
+    );
   }
-  const resolvedSha = await client.resolveRefToSha(owner, repo, resolvedRef);
-  logger5.debug(`Resolved ${sourceKey} -> ref=${resolvedRef} sha=${resolvedSha}`);
-  let topLevel;
-  try {
-    topLevel = await client.listDirectory(owner, repo, SKILLS_REMOTE_DIR, resolvedSha);
-  } catch (error) {
-    if (is404(error)) {
-      logger5.warn(`No skills/ directory found in ${sourceKey}. Skipping.`);
-      return [];
+  if (entry.transport !== void 0 && entry.transport !== "github") {
+    throw new Error(
+      `--mode gh: field "transport" is not supported (got "${entry.transport}" for source "${entry.source}"). Drop the field or switch to --mode rulesync.`
+    );
+  }
+  if (entry.path !== void 0) {
+    throw new Error(
+      `--mode gh: field "path" is not supported for source "${entry.source}". The remote layout is fixed to "skills/<name>/SKILL.md".`
+    );
+  }
+  const agent = entry.agent ?? "github-copilot";
+  if (!GH_AGENTS.includes(agent)) {
+    throw new Error(
+      `--mode gh: unknown agent "${agent}" for source "${entry.source}". Valid agents: ${GH_AGENTS.join(", ")}.`
+    );
+  }
+  const scope = entry.scope ?? "project";
+  return {
+    entry,
+    owner: parsed.owner,
+    repo: parsed.repo,
+    ref: entry.ref ?? parsed.ref,
+    agent,
+    scope
+  };
+}
+function assertFrozenLockCoversSources(params) {
+  const { existingLock, resolvedSources } = params;
+  const uncovered = [];
+  for (const rs of resolvedSources) {
+    const hasAny = existingLock.installations.some(
+      (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase() && i.agent === rs.agent && i.scope === rs.scope
+    );
+    if (!hasAny) {
+      uncovered.push(`${rs.entry.source} (agent=${rs.agent}, scope=${rs.scope})`);
     }
-    throw error;
   }
-  const skillDirs = topLevel.filter((e) => e.type === "dir").map((e) => ({ name: e.name, path: e.path }));
-  const validatedSkills = [];
-  for (const sk of skillDirs) {
-    const info = await withSemaphore(
-      semaphore,
-      () => client.getFileInfo(owner, repo, posix3.join(sk.path, SKILL_FILE_NAME2), resolvedSha)
+  if (uncovered.length > 0) {
+    throw new Error(
+      `Frozen install failed: rulesync-gh.lock.yaml is missing entries for: ${uncovered.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
     );
-    if (info) {
-      validatedSkills.push(sk);
+  }
+  const drifted = [];
+  for (const rs of resolvedSources) {
+    if (!rs.ref) continue;
+    const matches = existingLock.installations.filter(
+      (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase()
+    );
+    for (const m of matches) {
+      if (m.requested_ref !== void 0 && m.requested_ref !== rs.ref) {
+        drifted.push(`${rs.entry.source} (manifest=${rs.ref}, lock=${m.requested_ref})`);
+        break;
+      }
     }
   }
-  let selected = validatedSkills;
-  if (entry.skills && entry.skills.length > 0) {
-    const requested = new Set(entry.skills);
-    selected = validatedSkills.filter((s) => requested.has(s.name));
-    const presentNames = new Set(validatedSkills.map((s) => s.name));
-    for (const want of entry.skills) {
-      if (!presentNames.has(want)) {
-        logger5.warn(`Requested skill "${want}" not found in ${sourceKey} under skills/. Skipping.`);
+  if (drifted.length > 0) {
+    throw new Error(
+      `Frozen install failed: manifest ref does not match rulesync-gh.lock.yaml for: ${drifted.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
+    );
+  }
+}
+async function writeDeferredFrozenFiles(results) {
+  for (const result of results) {
+    if (result.status !== "ok") continue;
+    for (const inst of result.installations) {
+      for (const d of inst.deployed) {
+        await writeFileContent(d.absolutePath, d.content);
       }
     }
   }
-  if (frozen && existingLock) {
-    const missing = [];
-    for (const sk of selected) {
-      const locked = findGhLockInstallation(existingLock, {
-        source: sourceKey,
-        agent,
-        scope,
-        skill: sk.name
-      });
-      if (!locked) {
-        missing.push(sk.name);
+}
+function aggregateSourceResults(params) {
+  const { results, newLock } = params;
+  let totalInstalled = 0;
+  let failedCount = 0;
+  for (const result of results) {
+    if (result.status === "ok") {
+      for (const inst of result.installations) {
+        newLock.installations.push(inst.installation);
+      }
+      totalInstalled += result.installations.length;
+    } else {
+      failedCount += 1;
+      for (const preserved of result.preserved) {
+        newLock.installations.push(preserved);
       }
     }
-    if (missing.length > 0) {
-      throw new Error(
-        `Frozen install failed: rulesync-gh.lock.yaml is missing entries for ${sourceKey} (agent=${agent}, scope=${scope}) skills: ${missing.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
-      );
+  }
+  return { totalInstalled, failedCount };
+}
+async function removeStaleGhFiles(params) {
+  const { existingLock, newLock, projectRoot, logger: logger5 } = params;
+  const newDeployed = /* @__PURE__ */ new Set();
+  for (const inst of newLock.installations) {
+    for (const file of inst.deployed_files) {
+      newDeployed.add(`${inst.scope}::${file}`);
+    }
+  }
+  for (const prev of existingLock.installations) {
+    for (const deployed of prev.deployed_files) {
+      const key = `${prev.scope}::${deployed}`;
+      if (newDeployed.has(key)) continue;
+      await removeStaleFile({
+        relativePath: deployed,
+        scope: prev.scope === "user" ? "user" : "project",
+        projectRoot,
+        logger: logger5
+      });
     }
   }
+}
+async function installSource(params) {
+  const { rs, client, semaphore, projectRoot, existingLock, frozen, update, logger: logger5 } = params;
+  const { entry, owner, repo, agent, scope } = rs;
+  const sourceKey = entry.source;
+  const { resolvedRef, resolvedSha, usedTag } = await resolveGhRef({
+    rs,
+    client,
+    owner,
+    repo,
+    sourceKey,
+    logger: logger5
+  });
+  const validatedSkills = await discoverValidatedSkills({
+    client,
+    semaphore,
+    owner,
+    repo,
+    resolvedSha,
+    sourceKey,
+    logger: logger5
+  });
+  if (validatedSkills === null) {
+    return [];
+  }
+  const selected = selectSkills({ validatedSkills, entry, sourceKey, logger: logger5 });
+  if (frozen && existingLock) {
+    assertFrozenSkillCoverage({ selected, existingLock, sourceKey, agent, scope });
+  }
   const results = [];
   const installRelDir = relativeInstallDirFor({ agent, scope });
   const scopeRoot = scope === "user" ? getHomeDirectory() : projectRoot;
@@ -3136,79 +3099,38 @@ async function installSource(params) {
       ref: resolvedSha,
       semaphore
     });
-    const deployed = [];
-    for (const file of allFiles) {
-      if (file.size > MAX_FILE_SIZE) {
-        logger5.warn(
-          `Skipping "${file.path}" from ${sourceKey}: ${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
-        );
-        continue;
-      }
-      const relativeToSkill = posix3.relative(sk.path, toPosixPath(file.path));
-      if (!relativeToSkill || relativeToSkill.startsWith("..") || posix3.isAbsolute(relativeToSkill)) {
-        logger5.warn(`Skipping "${file.path}" from ${sourceKey}: resolved outside of "${sk.path}".`);
-        continue;
-      }
-      const deployRelative = toPosixPath(join9(installRelDir, sk.name, relativeToSkill));
-      checkPathTraversal({ relativePath: deployRelative, intendedRootDir: scopeRoot });
-      const installAbs = join9(scopeRoot, installRelDir);
-      const withinInstallDir = toPosixPath(join9(sk.name, relativeToSkill));
-      checkPathTraversal({ relativePath: withinInstallDir, intendedRootDir: installAbs });
-      let content = await withSemaphore(
-        semaphore,
-        () => client.getFileContent(owner, repo, file.path, resolvedSha)
-      );
-      const byteLength = Buffer.byteLength(content, "utf8");
-      if (byteLength > MAX_FILE_SIZE) {
-        logger5.warn(
-          `Skipping "${file.path}" from ${sourceKey}: fetched ${(byteLength / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
-        );
-        continue;
-      }
-      if (basename(file.path) === SKILL_FILE_NAME2) {
-        try {
-          content = injectSourceMetadata({
-            content,
-            source: sourceUrl,
-            repository,
-            ref: provenanceRef
-          });
-        } catch {
-          logger5.warn(
-            `Frontmatter in ${file.path} (${sourceKey}) is invalid. Prepending a fresh provenance block.`
-          );
-          content = `---
-source: ${sourceUrl}
-repository: ${repository}
-ref: ${provenanceRef}
----
-${content}`;
-        }
-      }
-      const absolutePath = join9(scopeRoot, deployRelative);
-      deployed.push({ relativeToScopeRoot: deployRelative, absolutePath, content });
-      if (!frozen) {
-        await writeFileContent(absolutePath, content);
-      }
-    }
+    const deployed = await buildSkillDeployment({
+      sk,
+      allFiles,
+      client,
+      semaphore,
+      owner,
+      repo,
+      resolvedSha,
+      installRelDir,
+      scopeRoot,
+      sourceUrl,
+      repository,
+      provenanceRef,
+      sourceKey,
+      frozen,
+      logger: logger5
+    });
     deployed.sort(
       (a, b) => a.relativeToScopeRoot < b.relativeToScopeRoot ? -1 : a.relativeToScopeRoot > b.relativeToScopeRoot ? 1 : 0
     );
     const deployedFiles = deployed.map((d) => d.relativeToScopeRoot);
     const contentHash = computeContentHash2(deployed);
-    if (frozen && locked?.content_hash) {
-      if (RULESYNC_CONTENT_HASH_REGEX2.test(locked.content_hash)) {
-        if (locked.content_hash !== contentHash) {
-          throw new Error(
-            `content_hash mismatch for ${sourceKey} skill "${sk.name}" (agent=${agent}, scope=${scope}): lock=${locked.content_hash} computed=${contentHash}. Refuse to trust the deployment under --frozen.`
-          );
-        }
-      } else {
-        logger5.debug(
-          `Skipping content_hash integrity check for ${sourceKey} skill "${sk.name}": recorded hash "${locked.content_hash}" was not written by rulesync.`
-        );
-      }
-    }
+    assertFrozenSkillIntegrity({
+      frozen,
+      locked,
+      contentHash,
+      sourceKey,
+      skillName: sk.name,
+      agent,
+      scope,
+      logger: logger5
+    });
     const installation = {
       source: sourceKey,
       owner,
@@ -3232,6 +3154,180 @@ ${content}`;
   }
   return results;
 }
+async function resolveGhRef(params) {
+  const { rs, client, owner, repo, sourceKey, logger: logger5 } = params;
+  let resolvedRef;
+  let usedTag = false;
+  if (rs.ref) {
+    resolvedRef = rs.ref;
+  } else {
+    try {
+      const release = await client.getLatestRelease(owner, repo);
+      resolvedRef = release.tag_name;
+      usedTag = true;
+    } catch (error) {
+      if (is404(error)) {
+        resolvedRef = await client.getDefaultBranch(owner, repo);
+      } else {
+        throw error;
+      }
+    }
+  }
+  const resolvedSha = await client.resolveRefToSha(owner, repo, resolvedRef);
+  logger5.debug(`Resolved ${sourceKey} -> ref=${resolvedRef} sha=${resolvedSha}`);
+  return { resolvedRef, resolvedSha, usedTag };
+}
+async function discoverValidatedSkills(params) {
+  const { client, semaphore, owner, repo, resolvedSha, sourceKey, logger: logger5 } = params;
+  let topLevel;
+  try {
+    topLevel = await client.listDirectory(owner, repo, SKILLS_REMOTE_DIR, resolvedSha);
+  } catch (error) {
+    if (is404(error)) {
+      logger5.warn(`No skills/ directory found in ${sourceKey}. Skipping.`);
+      return null;
+    }
+    throw error;
+  }
+  const skillDirs = topLevel.filter((e) => e.type === "dir").map((e) => ({ name: e.name, path: e.path }));
+  const validatedSkills = [];
+  for (const sk of skillDirs) {
+    const info = await withSemaphore(
+      semaphore,
+      () => client.getFileInfo(owner, repo, posix3.join(sk.path, SKILL_FILE_NAME2), resolvedSha)
+    );
+    if (info) {
+      validatedSkills.push(sk);
+    }
+  }
+  return validatedSkills;
+}
+function selectSkills(params) {
+  const { validatedSkills, entry, sourceKey, logger: logger5 } = params;
+  if (!entry.skills || entry.skills.length === 0) {
+    return validatedSkills;
+  }
+  const requested = new Set(entry.skills);
+  const selected = validatedSkills.filter((s) => requested.has(s.name));
+  const presentNames = new Set(validatedSkills.map((s) => s.name));
+  for (const want of entry.skills) {
+    if (!presentNames.has(want)) {
+      logger5.warn(`Requested skill "${want}" not found in ${sourceKey} under skills/. Skipping.`);
+    }
+  }
+  return selected;
+}
+function assertFrozenSkillCoverage(params) {
+  const { selected, existingLock, sourceKey, agent, scope } = params;
+  const missing = [];
+  for (const sk of selected) {
+    const locked = findGhLockInstallation(existingLock, {
+      source: sourceKey,
+      agent,
+      scope,
+      skill: sk.name
+    });
+    if (!locked) {
+      missing.push(sk.name);
+    }
+  }
+  if (missing.length > 0) {
+    throw new Error(
+      `Frozen install failed: rulesync-gh.lock.yaml is missing entries for ${sourceKey} (agent=${agent}, scope=${scope}) skills: ${missing.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
+    );
+  }
+}
+async function buildSkillDeployment(params) {
+  const {
+    sk,
+    allFiles,
+    client,
+    semaphore,
+    owner,
+    repo,
+    resolvedSha,
+    installRelDir,
+    scopeRoot,
+    sourceUrl,
+    repository,
+    provenanceRef,
+    sourceKey,
+    frozen,
+    logger: logger5
+  } = params;
+  const deployed = [];
+  for (const file of allFiles) {
+    if (file.size > MAX_FILE_SIZE) {
+      logger5.warn(
+        `Skipping "${file.path}" from ${sourceKey}: ${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+      );
+      continue;
+    }
+    const relativeToSkill = posix3.relative(sk.path, toPosixPath(file.path));
+    if (!relativeToSkill || relativeToSkill.startsWith("..") || posix3.isAbsolute(relativeToSkill)) {
+      logger5.warn(`Skipping "${file.path}" from ${sourceKey}: resolved outside of "${sk.path}".`);
+      continue;
+    }
+    const deployRelative = toPosixPath(join9(installRelDir, sk.name, relativeToSkill));
+    checkPathTraversal({ relativePath: deployRelative, intendedRootDir: scopeRoot });
+    const installAbs = join9(scopeRoot, installRelDir);
+    const withinInstallDir = toPosixPath(join9(sk.name, relativeToSkill));
+    checkPathTraversal({ relativePath: withinInstallDir, intendedRootDir: installAbs });
+    let content = await withSemaphore(
+      semaphore,
+      () => client.getFileContent(owner, repo, file.path, resolvedSha)
+    );
+    const byteLength = Buffer.byteLength(content, "utf8");
+    if (byteLength > MAX_FILE_SIZE) {
+      logger5.warn(
+        `Skipping "${file.path}" from ${sourceKey}: fetched ${(byteLength / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+      );
+      continue;
+    }
+    if (basename(file.path) === SKILL_FILE_NAME2) {
+      try {
+        content = injectSourceMetadata({
+          content,
+          source: sourceUrl,
+          repository,
+          ref: provenanceRef
+        });
+      } catch {
+        logger5.warn(
+          `Frontmatter in ${file.path} (${sourceKey}) is invalid. Prepending a fresh provenance block.`
+        );
+        content = `---
+source: ${sourceUrl}
+repository: ${repository}
+ref: ${provenanceRef}
+---
+${content}`;
+      }
+    }
+    const absolutePath = join9(scopeRoot, deployRelative);
+    deployed.push({ relativeToScopeRoot: deployRelative, absolutePath, content });
+    if (!frozen) {
+      await writeFileContent(absolutePath, content);
+    }
+  }
+  return deployed;
+}
+function assertFrozenSkillIntegrity(params) {
+  const { frozen, locked, contentHash, sourceKey, skillName, agent, scope, logger: logger5 } = params;
+  if (frozen && locked?.content_hash) {
+    if (RULESYNC_CONTENT_HASH_REGEX2.test(locked.content_hash)) {
+      if (locked.content_hash !== contentHash) {
+        throw new Error(
+          `content_hash mismatch for ${sourceKey} skill "${skillName}" (agent=${agent}, scope=${scope}): lock=${locked.content_hash} computed=${contentHash}. Refuse to trust the deployment under --frozen.`
+        );
+      }
+    } else {
+      logger5.debug(
+        `Skipping content_hash integrity check for ${sourceKey} skill "${skillName}": recorded hash "${locked.content_hash}" was not written by rulesync.`
+      );
+    }
+  }
+}
 async function removeStaleFile(params) {
   const { relativePath, scope, projectRoot, logger: logger5 } = params;
   if (posix3.isAbsolute(relativePath) || relativePath.split(/[/\\]/).includes("..")) {
@@ -3623,18 +3719,7 @@ async function resolveAndFetchSources(params) {
   }
   let lock = options.updateSources ? createEmptyLock() : await readLockFile({ projectRoot, logger: logger5 });
   if (options.frozen) {
-    const missingKeys = [];
-    for (const source of sources) {
-      const locked = getLockedSource(lock, source.source);
-      if (!locked) {
-        missingKeys.push(source.source);
-      }
-    }
-    if (missingKeys.length > 0) {
-      throw new Error(
-        `Frozen install failed: lockfile is missing entries for: ${missingKeys.join(", ")}. Run 'rulesync install' to update the lockfile.`
-      );
-    }
+    assertFrozenLockCoversSources2({ lock, sources });
   }
   const originalLockJson = JSON.stringify(lock);
   const token = GitHubClient.resolveToken(options.token);
@@ -3644,31 +3729,17 @@ async function resolveAndFetchSources(params) {
   const allFetchedSkillNames = /* @__PURE__ */ new Set();
   for (const sourceEntry of sources) {
     try {
-      const transport = sourceEntry.transport ?? "github";
-      let result;
-      if (transport === "git") {
-        result = await fetchSourceViaGit({
-          sourceEntry,
-          projectRoot,
-          lock,
-          localSkillNames,
-          alreadyFetchedSkillNames: allFetchedSkillNames,
-          updateSources: options.updateSources ?? false,
-          frozen: options.frozen ?? false,
-          logger: logger5
-        });
-      } else {
-        result = await fetchSource({
-          sourceEntry,
-          client,
-          projectRoot,
-          lock,
-          localSkillNames,
-          alreadyFetchedSkillNames: allFetchedSkillNames,
-          updateSources: options.updateSources ?? false,
-          logger: logger5
-        });
-      }
+      const result = await fetchSourceByTransport({
+        sourceEntry,
+        client,
+        projectRoot,
+        lock,
+        localSkillNames,
+        alreadyFetchedSkillNames: allFetchedSkillNames,
+        updateSources: options.updateSources ?? false,
+        frozen: options.frozen ?? false,
+        logger: logger5
+      });
       const { skillCount, fetchedSkillNames, updatedLock } = result;
       lock = updatedLock;
       totalSkillCount += skillCount;
@@ -3684,16 +3755,7 @@ async function resolveAndFetchSources(params) {
       }
     }
   }
-  const sourceKeys = new Set(sources.map((s) => normalizeSourceKey(s.source)));
-  const prunedSources = {};
-  for (const [key, value] of Object.entries(lock.sources)) {
-    if (sourceKeys.has(normalizeSourceKey(key))) {
-      prunedSources[key] = value;
-    } else {
-      logger5.debug(`Pruned stale lockfile entry: ${key}`);
-    }
-  }
-  lock = { lockfileVersion: lock.lockfileVersion, sources: prunedSources };
+  lock = pruneStaleLockEntries({ lock, sources, logger: logger5 });
   if (!options.frozen && JSON.stringify(lock) !== originalLockJson) {
     await writeLockFile({ projectRoot, lock, logger: logger5 });
   } else {
@@ -3709,6 +3771,70 @@ function logGitClientHints(params) {
     logger5.info("Hint: Check your git credentials (SSH keys, credential helper, or access token).");
   }
 }
+function assertFrozenLockCoversSources2(params) {
+  const { lock, sources } = params;
+  const missingKeys = [];
+  for (const source of sources) {
+    const locked = getLockedSource(lock, source.source);
+    if (!locked) {
+      missingKeys.push(source.source);
+    }
+  }
+  if (missingKeys.length > 0) {
+    throw new Error(
+      `Frozen install failed: lockfile is missing entries for: ${missingKeys.join(", ")}. Run 'rulesync install' to update the lockfile.`
+    );
+  }
+}
+async function fetchSourceByTransport(params) {
+  const {
+    sourceEntry,
+    client,
+    projectRoot,
+    lock,
+    localSkillNames,
+    alreadyFetchedSkillNames,
+    updateSources,
+    frozen,
+    logger: logger5
+  } = params;
+  const transport = sourceEntry.transport ?? "github";
+  if (transport === "git") {
+    return fetchSourceViaGit({
+      sourceEntry,
+      projectRoot,
+      lock,
+      localSkillNames,
+      alreadyFetchedSkillNames,
+      updateSources,
+      frozen,
+      logger: logger5
+    });
+  }
+  return fetchSource({
+    sourceEntry,
+    client,
+    projectRoot,
+    lock,
+    localSkillNames,
+    alreadyFetchedSkillNames,
+    updateSources,
+    logger: logger5
+  });
+}
+function pruneStaleLockEntries(params) {
+  const { lock, sources, logger: logger5 } = params;
+  const sourceKeys = new Set(sources.map((s) => normalizeSourceKey(s.source)));
+  const prunedSources = {};
+  for (const [key, value] of Object.entries(lock.sources)) {
+    if (sourceKeys.has(normalizeSourceKey(key))) {
+      prunedSources[key] = value;
+    } else {
+      logger5.debug(`Pruned stale lockfile entry: ${key}`);
+    }
+  }
+  return { lockfileVersion: lock.lockfileVersion, sources: prunedSources };
+}
 async function checkLockedSkillsExist(curatedDir, skillNames) {
   if (skillNames.length === 0) return true;
   for (const name of skillNames) {
@@ -3840,7 +3966,189 @@ function groupRemoteFilesBySkillRoot(params) {
       grouped.set(singleSkillName, rootLevelFiles);
     }
   }
-  return grouped;
+  return grouped;
+}
+async function resolveGithubFetchRef(params) {
+  const { parsed, locked, updateSources, sourceKey, client, logger: logger5 } = params;
+  if (locked && !updateSources) {
+    logger5.debug(`Using locked ref for ${sourceKey}: ${locked.resolvedRef}`);
+    return {
+      ref: locked.resolvedRef,
+      resolvedSha: locked.resolvedRef,
+      requestedRef: locked.requestedRef
+    };
+  }
+  const requestedRef = parsed.ref ?? await client.getDefaultBranch(parsed.owner, parsed.repo);
+  const resolvedSha = await client.resolveRefToSha(parsed.owner, parsed.repo, requestedRef);
+  logger5.debug(`Resolved ${sourceKey} ref "${requestedRef}" to SHA: ${resolvedSha}`);
+  return { ref: resolvedSha, resolvedSha, requestedRef };
+}
+async function fetchRootLevelFallbackSkill(params) {
+  const {
+    entries,
+    parsed,
+    ref,
+    resolvedSha,
+    skillFilter,
+    isWildcard,
+    curatedDir,
+    locked,
+    sourceKey,
+    localSkillNames,
+    alreadyFetchedSkillNames,
+    client,
+    semaphore,
+    fetchedSkills,
+    logger: logger5
+  } = params;
+  const rootFiles = entries.filter((entry) => entry.type === "file");
+  const rootSkillFiles = [];
+  for (const file of rootFiles) {
+    if (file.size > MAX_FILE_SIZE) {
+      logger5.warn(
+        `Skipping file "${file.path}" (${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit).`
+      );
+      continue;
+    }
+    const content = await withSemaphore(
+      semaphore,
+      () => client.getFileContent(parsed.owner, parsed.repo, file.path, ref)
+    );
+    rootSkillFiles.push({ relativePath: file.name, content });
+  }
+  const groupedRootFiles = groupRemoteFilesBySkillRoot({
+    remoteFiles: rootSkillFiles,
+    skillFilter,
+    isWildcard
+  });
+  const [fallbackSkillName] = groupedRootFiles.keys();
+  if (fallbackSkillName === void 0) {
+    return { handled: false, remoteSkillNames: [] };
+  }
+  if (!shouldSkipSkill({
+    skillName: fallbackSkillName,
+    sourceKey,
+    localSkillNames,
+    alreadyFetchedSkillNames,
+    logger: logger5
+  })) {
+    fetchedSkills[fallbackSkillName] = await writeSkillAndComputeIntegrity({
+      skillName: fallbackSkillName,
+      files: groupedRootFiles.get(fallbackSkillName) ?? [],
+      curatedDir,
+      locked,
+      resolvedSha,
+      sourceKey,
+      logger: logger5
+    });
+    logger5.debug(`Fetched skill "${fallbackSkillName}" from ${sourceKey}`);
+  }
+  return { handled: true, remoteSkillNames: [fallbackSkillName] };
+}
+async function fetchGithubSkillDir(params) {
+  const {
+    skillDir,
+    parsed,
+    ref,
+    resolvedSha,
+    curatedDir,
+    locked,
+    sourceKey,
+    client,
+    semaphore,
+    logger: logger5
+  } = params;
+  const allFiles = await listDirectoryRecursive({
+    client,
+    owner: parsed.owner,
+    repo: parsed.repo,
+    path: skillDir.path,
+    ref,
+    semaphore
+  });
+  const files = allFiles.filter((file) => {
+    if (file.size > MAX_FILE_SIZE) {
+      logger5.warn(
+        `Skipping file "${file.path}" (${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit).`
+      );
+      return false;
+    }
+    return true;
+  });
+  const skillFiles = [];
+  for (const file of files) {
+    const relativeToSkill = file.path.substring(skillDir.path.length + 1);
+    const content = await withSemaphore(
+      semaphore,
+      () => client.getFileContent(parsed.owner, parsed.repo, file.path, ref)
+    );
+    skillFiles.push({ relativePath: relativeToSkill, content });
+  }
+  return writeSkillAndComputeIntegrity({
+    skillName: skillDir.name,
+    files: skillFiles,
+    curatedDir,
+    locked,
+    resolvedSha,
+    sourceKey,
+    logger: logger5
+  });
+}
+async function discoverGithubSkillDirs(params) {
+  const {
+    parsed,
+    ref,
+    resolvedSha,
+    skillFilter,
+    isWildcard,
+    curatedDir,
+    locked,
+    sourceKey,
+    localSkillNames,
+    alreadyFetchedSkillNames,
+    client,
+    semaphore,
+    fetchedSkills,
+    logger: logger5
+  } = params;
+  const skillsBasePath = parsed.path ?? "skills";
+  try {
+    const entries = await client.listDirectory(parsed.owner, parsed.repo, skillsBasePath, ref);
+    const remoteSkillDirs = entries.filter((e) => e.type === "dir").map((e) => ({ name: e.name, path: e.path }));
+    if (remoteSkillDirs.length === 0 && !isWildcard && skillFilter.length === 1) {
+      const fallback = await fetchRootLevelFallbackSkill({
+        entries,
+        parsed,
+        ref,
+        resolvedSha,
+        skillFilter,
+        isWildcard,
+        curatedDir,
+        locked,
+        sourceKey,
+        localSkillNames,
+        alreadyFetchedSkillNames,
+        client,
+        semaphore,
+        fetchedSkills,
+        logger: logger5
+      });
+      if (fallback.handled) {
+        return {
+          status: "ok",
+          remoteSkillDirs,
+          fallbackHandled: true,
+          remoteSkillNames: fallback.remoteSkillNames
+        };
+      }
+    }
+    return { status: "ok", remoteSkillDirs, fallbackHandled: false, remoteSkillNames: [] };
+  } catch (error) {
+    if (error instanceof GitHubClientError && error.statusCode === 404) {
+      return { status: "notFound" };
+    }
+    throw error;
+  }
 }
 async function fetchSource(params) {
   const {
@@ -3861,20 +4169,14 @@ async function fetchSource(params) {
   const sourceKey = sourceEntry.source;
   const locked = getLockedSource(lock, sourceKey);
   const lockedSkillNames = locked ? getLockedSkillNames(locked) : [];
-  let ref;
-  let resolvedSha;
-  let requestedRef;
-  if (locked && !updateSources) {
-    ref = locked.resolvedRef;
-    resolvedSha = locked.resolvedRef;
-    requestedRef = locked.requestedRef;
-    logger5.debug(`Using locked ref for ${sourceKey}: ${resolvedSha}`);
-  } else {
-    requestedRef = parsed.ref ?? await client.getDefaultBranch(parsed.owner, parsed.repo);
-    resolvedSha = await client.resolveRefToSha(parsed.owner, parsed.repo, requestedRef);
-    ref = resolvedSha;
-    logger5.debug(`Resolved ${sourceKey} ref "${requestedRef}" to SHA: ${resolvedSha}`);
-  }
+  const { ref, resolvedSha, requestedRef } = await resolveGithubFetchRef({
+    parsed,
+    locked,
+    updateSources,
+    sourceKey,
+    client,
+    logger: logger5
+  });
   const curatedDir = join12(projectRoot, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
   if (locked && resolvedSha === locked.resolvedRef && !updateSources) {
     const allExist = await checkLockedSkillsExist(curatedDir, lockedSkillNames);
@@ -3891,69 +4193,29 @@ async function fetchSource(params) {
   const isWildcard = skillFilter.length === 1 && skillFilter[0] === "*";
   const semaphore = new Semaphore4(FETCH_CONCURRENCY_LIMIT);
   const fetchedSkills = {};
-  const skillsBasePath = parsed.path ?? "skills";
-  let remoteSkillDirs;
-  let remoteSkillNames = [];
-  let fallbackHandled = false;
-  try {
-    const entries = await client.listDirectory(parsed.owner, parsed.repo, skillsBasePath, ref);
-    remoteSkillDirs = entries.filter((e) => e.type === "dir").map((e) => ({ name: e.name, path: e.path }));
-    if (remoteSkillDirs.length === 0 && !isWildcard && skillFilter.length === 1) {
-      const rootFiles = entries.filter((entry) => entry.type === "file");
-      const rootSkillFiles = [];
-      for (const file of rootFiles) {
-        if (file.size > MAX_FILE_SIZE) {
-          logger5.warn(
-            `Skipping file "${file.path}" (${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit).`
-          );
-          continue;
-        }
-        const content = await withSemaphore(
-          semaphore,
-          () => client.getFileContent(parsed.owner, parsed.repo, file.path, ref)
-        );
-        rootSkillFiles.push({ relativePath: file.name, content });
-      }
-      const groupedRootFiles = groupRemoteFilesBySkillRoot({
-        remoteFiles: rootSkillFiles,
-        skillFilter,
-        isWildcard
-      });
-      const [fallbackSkillName] = groupedRootFiles.keys();
-      if (fallbackSkillName !== void 0) {
-        fallbackHandled = true;
-        remoteSkillNames = [fallbackSkillName];
-        if (!shouldSkipSkill({
-          skillName: fallbackSkillName,
-          sourceKey,
-          localSkillNames,
-          alreadyFetchedSkillNames,
-          logger: logger5
-        })) {
-          fetchedSkills[fallbackSkillName] = await writeSkillAndComputeIntegrity({
-            skillName: fallbackSkillName,
-            files: groupedRootFiles.get(fallbackSkillName) ?? [],
-            curatedDir,
-            locked,
-            resolvedSha,
-            sourceKey,
-            logger: logger5
-          });
-          logger5.debug(`Fetched skill "${fallbackSkillName}" from ${sourceKey}`);
-        }
-      }
-    }
-  } catch (error) {
-    if (error instanceof GitHubClientError && error.statusCode === 404) {
-      logger5.warn(`No skills/ directory found in ${sourceKey}. Skipping.`);
-      return { skillCount: 0, fetchedSkillNames: [], updatedLock: lock };
-    }
-    throw error;
+  const discovery = await discoverGithubSkillDirs({
+    parsed,
+    ref,
+    resolvedSha,
+    skillFilter,
+    isWildcard,
+    curatedDir,
+    locked,
+    sourceKey,
+    localSkillNames,
+    alreadyFetchedSkillNames,
+    client,
+    semaphore,
+    fetchedSkills,
+    logger: logger5
+  });
+  if (discovery.status === "notFound") {
+    logger5.warn(`No skills/ directory found in ${sourceKey}. Skipping.`);
+    return { skillCount: 0, fetchedSkillNames: [], updatedLock: lock };
   }
+  const { remoteSkillDirs, fallbackHandled, remoteSkillNames: fallbackSkillNames } = discovery;
   const filteredDirs = isWildcard ? remoteSkillDirs : remoteSkillDirs.filter((d) => skillFilter.includes(d.name));
-  if (!fallbackHandled) {
-    remoteSkillNames = filteredDirs.map((d) => d.name);
-  }
+  const remoteSkillNames = fallbackHandled ? fallbackSkillNames : filteredDirs.map((d) => d.name);
   if (locked) {
     await cleanPreviousCuratedSkills({ curatedDir, lockedSkillNames, logger: logger5 });
   }
@@ -3967,39 +4229,16 @@ async function fetchSource(params) {
     })) {
       continue;
     }
-    const allFiles = await listDirectoryRecursive({
-      client,
-      owner: parsed.owner,
-      repo: parsed.repo,
-      path: skillDir.path,
+    fetchedSkills[skillDir.name] = await fetchGithubSkillDir({
+      skillDir,
+      parsed,
       ref,
-      semaphore
-    });
-    const files = allFiles.filter((file) => {
-      if (file.size > MAX_FILE_SIZE) {
-        logger5.warn(
-          `Skipping file "${file.path}" (${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit).`
-        );
-        return false;
-      }
-      return true;
-    });
-    const skillFiles = [];
-    for (const file of files) {
-      const relativeToSkill = file.path.substring(skillDir.path.length + 1);
-      const content = await withSemaphore(
-        semaphore,
-        () => client.getFileContent(parsed.owner, parsed.repo, file.path, ref)
-      );
-      skillFiles.push({ relativePath: relativeToSkill, content });
-    }
-    fetchedSkills[skillDir.name] = await writeSkillAndComputeIntegrity({
-      skillName: skillDir.name,
-      files: skillFiles,
+      resolvedSha,
       curatedDir,
       locked,
-      resolvedSha,
       sourceKey,
+      client,
+      semaphore,
       logger: logger5
     });
     logger5.debug(`Fetched skill "${skillDir.name}" from ${sourceKey}`);
@@ -5908,6 +6147,174 @@ function ensureBody({ body, feature, operation }) {
   }
   return body;
 }
+function requireContent({
+  content,
+  feature
+}) {
+  if (!content) {
+    throw new Error(`content is required for ${feature} put operation`);
+  }
+  return content;
+}
+function executeRule(parsed) {
+  if (parsed.operation === "list") {
+    return ruleTools.listRules.execute();
+  }
+  if (parsed.operation === "get") {
+    return ruleTools.getRule.execute({ relativePathFromCwd: requireTargetPath(parsed) });
+  }
+  if (parsed.operation === "put") {
+    return ruleTools.putRule.execute({
+      relativePathFromCwd: requireTargetPath(parsed),
+      frontmatter: parseFrontmatter({
+        feature: "rule",
+        frontmatter: parsed.frontmatter ?? {}
+      }),
+      body: ensureBody(parsed)
+    });
+  }
+  return ruleTools.deleteRule.execute({ relativePathFromCwd: requireTargetPath(parsed) });
+}
+function executeCommand(parsed) {
+  if (parsed.operation === "list") {
+    return commandTools.listCommands.execute();
+  }
+  if (parsed.operation === "get") {
+    return commandTools.getCommand.execute({
+      relativePathFromCwd: requireTargetPath(parsed)
+    });
+  }
+  if (parsed.operation === "put") {
+    return commandTools.putCommand.execute({
+      relativePathFromCwd: requireTargetPath(parsed),
+      frontmatter: parseFrontmatter({
+        feature: "command",
+        frontmatter: parsed.frontmatter ?? {}
+      }),
+      body: ensureBody(parsed)
+    });
+  }
+  return commandTools.deleteCommand.execute({
+    relativePathFromCwd: requireTargetPath(parsed)
+  });
+}
+function executeSubagent(parsed) {
+  if (parsed.operation === "list") {
+    return subagentTools.listSubagents.execute();
+  }
+  if (parsed.operation === "get") {
+    return subagentTools.getSubagent.execute({
+      relativePathFromCwd: requireTargetPath(parsed)
+    });
+  }
+  if (parsed.operation === "put") {
+    return subagentTools.putSubagent.execute({
+      relativePathFromCwd: requireTargetPath(parsed),
+      frontmatter: parseFrontmatter({
+        feature: "subagent",
+        frontmatter: parsed.frontmatter ?? {}
+      }),
+      body: ensureBody(parsed)
+    });
+  }
+  return subagentTools.deleteSubagent.execute({
+    relativePathFromCwd: requireTargetPath(parsed)
+  });
+}
+function executeSkill(parsed) {
+  if (parsed.operation === "list") {
+    return skillTools.listSkills.execute();
+  }
+  if (parsed.operation === "get") {
+    return skillTools.getSkill.execute({ relativeDirPathFromCwd: requireTargetPath(parsed) });
+  }
+  if (parsed.operation === "put") {
+    return skillTools.putSkill.execute({
+      relativeDirPathFromCwd: requireTargetPath(parsed),
+      frontmatter: parseFrontmatter({
+        feature: "skill",
+        frontmatter: parsed.frontmatter ?? {}
+      }),
+      body: ensureBody(parsed),
+      otherFiles: parsed.otherFiles ?? []
+    });
+  }
+  return skillTools.deleteSkill.execute({
+    relativeDirPathFromCwd: requireTargetPath(parsed)
+  });
+}
+function executeIgnore(parsed) {
+  if (parsed.operation === "get") {
+    return ignoreTools.getIgnoreFile.execute();
+  }
+  if (parsed.operation === "put") {
+    return ignoreTools.putIgnoreFile.execute({
+      content: requireContent({ content: parsed.content, feature: "ignore" })
+    });
+  }
+  return ignoreTools.deleteIgnoreFile.execute();
+}
+function executeMcp(parsed) {
+  if (parsed.operation === "get") {
+    return mcpTools.getMcpFile.execute();
+  }
+  if (parsed.operation === "put") {
+    return mcpTools.putMcpFile.execute({
+      content: requireContent({ content: parsed.content, feature: "mcp" })
+    });
+  }
+  return mcpTools.deleteMcpFile.execute();
+}
+function executePermissions(parsed) {
+  if (parsed.operation === "get") {
+    return permissionsTools.getPermissionsFile.execute();
+  }
+  if (parsed.operation === "put") {
+    return permissionsTools.putPermissionsFile.execute({
+      content: requireContent({ content: parsed.content, feature: "permissions" })
+    });
+  }
+  return permissionsTools.deletePermissionsFile.execute();
+}
+function executeHooks(parsed) {
+  if (parsed.operation === "get") {
+    return hooksTools.getHooksFile.execute();
+  }
+  if (parsed.operation === "put") {
+    return hooksTools.putHooksFile.execute({
+      content: requireContent({ content: parsed.content, feature: "hooks" })
+    });
+  }
+  return hooksTools.deleteHooksFile.execute();
+}
+function executeGenerate2(parsed) {
+  return generateTools.executeGenerate.execute(parsed.generateOptions ?? {});
+}
+function executeImport2(parsed) {
+  if (!parsed.importOptions) {
+    throw new Error("importOptions is required for import feature");
+  }
+  return importTools.executeImport.execute(parsed.importOptions);
+}
+function executeConvert2(parsed) {
+  if (!parsed.convertOptions) {
+    throw new Error("convertOptions is required for convert feature");
+  }
+  return convertTools.executeConvert.execute(parsed.convertOptions);
+}
+var featureExecutors = {
+  rule: executeRule,
+  command: executeCommand,
+  subagent: executeSubagent,
+  skill: executeSkill,
+  ignore: executeIgnore,
+  mcp: executeMcp,
+  permissions: executePermissions,
+  hooks: executeHooks,
+  generate: executeGenerate2,
+  import: executeImport2,
+  convert: executeConvert2
+};
 var rulesyncTool = {
   name: "rulesyncTool",
   description: "Manage Rulesync files through a single MCP tool. Features: rule/command/subagent/skill support list/get/put/delete; ignore/mcp/permissions/hooks support get/put/delete only; generate supports run only; import supports run only; convert supports run only. Parameters: list requires no targetPathFromCwd (lists all items); get/delete require targetPathFromCwd; put requires targetPathFromCwd, frontmatter, and body (or content for ignore/mcp/permissions/hooks); generate/run uses generateOptions to configure generation; import/run uses importOptions to configure import; convert/run uses convertOptions to configure conversion.",
@@ -5915,161 +6322,11 @@ var rulesyncTool = {
   execute: async (args) => {
     const parsed = rulesyncToolSchema.parse(args);
     assertSupported({ feature: parsed.feature, operation: parsed.operation });
-    switch (parsed.feature) {
-      case "rule": {
-        if (parsed.operation === "list") {
-          return ruleTools.listRules.execute();
-        }
-        if (parsed.operation === "get") {
-          return ruleTools.getRule.execute({ relativePathFromCwd: requireTargetPath(parsed) });
-        }
-        if (parsed.operation === "put") {
-          return ruleTools.putRule.execute({
-            relativePathFromCwd: requireTargetPath(parsed),
-            frontmatter: parseFrontmatter({
-              feature: "rule",
-              frontmatter: parsed.frontmatter ?? {}
-            }),
-            body: ensureBody(parsed)
-          });
-        }
-        return ruleTools.deleteRule.execute({ relativePathFromCwd: requireTargetPath(parsed) });
-      }
-      case "command": {
-        if (parsed.operation === "list") {
-          return commandTools.listCommands.execute();
-        }
-        if (parsed.operation === "get") {
-          return commandTools.getCommand.execute({
-            relativePathFromCwd: requireTargetPath(parsed)
-          });
-        }
-        if (parsed.operation === "put") {
-          return commandTools.putCommand.execute({
-            relativePathFromCwd: requireTargetPath(parsed),
-            frontmatter: parseFrontmatter({
-              feature: "command",
-              frontmatter: parsed.frontmatter ?? {}
-            }),
-            body: ensureBody(parsed)
-          });
-        }
-        return commandTools.deleteCommand.execute({
-          relativePathFromCwd: requireTargetPath(parsed)
-        });
-      }
-      case "subagent": {
-        if (parsed.operation === "list") {
-          return subagentTools.listSubagents.execute();
-        }
-        if (parsed.operation === "get") {
-          return subagentTools.getSubagent.execute({
-            relativePathFromCwd: requireTargetPath(parsed)
-          });
-        }
-        if (parsed.operation === "put") {
-          return subagentTools.putSubagent.execute({
-            relativePathFromCwd: requireTargetPath(parsed),
-            frontmatter: parseFrontmatter({
-              feature: "subagent",
-              frontmatter: parsed.frontmatter ?? {}
-            }),
-            body: ensureBody(parsed)
-          });
-        }
-        return subagentTools.deleteSubagent.execute({
-          relativePathFromCwd: requireTargetPath(parsed)
-        });
-      }
-      case "skill": {
-        if (parsed.operation === "list") {
-          return skillTools.listSkills.execute();
-        }
-        if (parsed.operation === "get") {
-          return skillTools.getSkill.execute({ relativeDirPathFromCwd: requireTargetPath(parsed) });
-        }
-        if (parsed.operation === "put") {
-          return skillTools.putSkill.execute({
-            relativeDirPathFromCwd: requireTargetPath(parsed),
-            frontmatter: parseFrontmatter({
-              feature: "skill",
-              frontmatter: parsed.frontmatter ?? {}
-            }),
-            body: ensureBody(parsed),
-            otherFiles: parsed.otherFiles ?? []
-          });
-        }
-        return skillTools.deleteSkill.execute({
-          relativeDirPathFromCwd: requireTargetPath(parsed)
-        });
-      }
-      case "ignore": {
-        if (parsed.operation === "get") {
-          return ignoreTools.getIgnoreFile.execute();
-        }
-        if (parsed.operation === "put") {
-          if (!parsed.content) {
-            throw new Error("content is required for ignore put operation");
-          }
-          return ignoreTools.putIgnoreFile.execute({ content: parsed.content });
-        }
-        return ignoreTools.deleteIgnoreFile.execute();
-      }
-      case "mcp": {
-        if (parsed.operation === "get") {
-          return mcpTools.getMcpFile.execute();
-        }
-        if (parsed.operation === "put") {
-          if (!parsed.content) {
-            throw new Error("content is required for mcp put operation");
-          }
-          return mcpTools.putMcpFile.execute({ content: parsed.content });
-        }
-        return mcpTools.deleteMcpFile.execute();
-      }
-      case "permissions": {
-        if (parsed.operation === "get") {
-          return permissionsTools.getPermissionsFile.execute();
-        }
-        if (parsed.operation === "put") {
-          if (!parsed.content) {
-            throw new Error("content is required for permissions put operation");
-          }
-          return permissionsTools.putPermissionsFile.execute({ content: parsed.content });
-        }
-        return permissionsTools.deletePermissionsFile.execute();
-      }
-      case "hooks": {
-        if (parsed.operation === "get") {
-          return hooksTools.getHooksFile.execute();
-        }
-        if (parsed.operation === "put") {
-          if (!parsed.content) {
-            throw new Error("content is required for hooks put operation");
-          }
-          return hooksTools.putHooksFile.execute({ content: parsed.content });
-        }
-        return hooksTools.deleteHooksFile.execute();
-      }
-      case "generate": {
-        return generateTools.executeGenerate.execute(parsed.generateOptions ?? {});
-      }
-      case "import": {
-        if (!parsed.importOptions) {
-          throw new Error("importOptions is required for import feature");
-        }
-        return importTools.executeImport.execute(parsed.importOptions);
-      }
-      case "convert": {
-        if (!parsed.convertOptions) {
-          throw new Error("convertOptions is required for convert feature");
-        }
-        return convertTools.executeConvert.execute(parsed.convertOptions);
-      }
-      default: {
-        throw new Error(`Unknown feature: ${parsed.feature}`);
-      }
+    const executor = featureExecutors[parsed.feature];
+    if (!executor) {
+      throw new Error(`Unknown feature: ${parsed.feature}`);
     }
+    return executor(parsed);
   }
 };
 
@@ -6288,103 +6545,150 @@ function parseSha256Sums(content) {
   }
   return result;
 }
-async function performBinaryUpdate(currentVersion, options = {}) {
-  const { force = false, token } = options;
-  const updateCheck = await checkForUpdate(currentVersion, token);
-  if (!updateCheck.hasUpdate && !force) {
-    return `Already at the latest version (${currentVersion})`;
-  }
+function resolveUpdateAssets(release) {
   const assetName = getPlatformAssetName();
   if (!assetName) {
     throw new Error(
       `Unsupported platform: ${os.platform()} ${os.arch()}. Please download manually from ${RELEASES_URL}`
     );
   }
-  const binaryAsset = findAsset(updateCheck.release, assetName);
+  const binaryAsset = findAsset(release, assetName);
   if (!binaryAsset) {
     throw new Error(
       `Binary for ${assetName} not found in release. Please download manually from ${RELEASES_URL}`
     );
   }
-  const checksumAsset = findAsset(updateCheck.release, "SHA256SUMS");
+  const checksumAsset = findAsset(release, "SHA256SUMS");
   if (!checksumAsset) {
     throw new Error(
       `SHA256SUMS not found in release. Cannot verify download integrity. Please download manually from ${RELEASES_URL}`
     );
   }
-  const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "rulesync-update-"));
-  let restoreFailed = false;
+  return { assetName, binaryAsset, checksumAsset };
+}
+async function downloadAndVerifyBinary(params) {
+  const { tempDir, assetName, binaryAsset, checksumAsset } = params;
+  const tempBinaryPath = path.join(tempDir, assetName);
+  await downloadFile(binaryAsset.browser_download_url, tempBinaryPath);
+  const checksumsPath = path.join(tempDir, "SHA256SUMS");
+  await downloadFile(checksumAsset.browser_download_url, checksumsPath);
+  const checksumsContent = await fs.promises.readFile(checksumsPath, "utf-8");
+  const checksums = parseSha256Sums(checksumsContent);
+  const expectedChecksum = checksums.get(assetName);
+  if (!expectedChecksum) {
+    throw new Error(
+      `Checksum entry for "${assetName}" not found in SHA256SUMS. Cannot verify download integrity.`
+    );
+  }
+  const actualChecksum = await calculateSha256(tempBinaryPath);
+  if (actualChecksum !== expectedChecksum) {
+    throw new Error(
+      `Checksum verification failed. Expected: ${expectedChecksum}, Got: ${actualChecksum}. The download may be corrupted.`
+    );
+  }
+  return tempBinaryPath;
+}
+async function replaceCurrentBinary(params) {
+  const { tempBinaryPath, currentExePath, currentDir } = params;
+  const tempInPlace = path.join(currentDir, `.rulesync-update-${crypto.randomUUID()}`);
   try {
+    await fs.promises.copyFile(tempBinaryPath, tempInPlace);
     if (os.platform() !== "win32") {
-      await fs.promises.chmod(tempDir, 448);
+      await fs.promises.chmod(tempInPlace, 493);
     }
-    const tempBinaryPath = path.join(tempDir, assetName);
-    await downloadFile(binaryAsset.browser_download_url, tempBinaryPath);
-    const checksumsPath = path.join(tempDir, "SHA256SUMS");
-    await downloadFile(checksumAsset.browser_download_url, checksumsPath);
-    const checksumsContent = await fs.promises.readFile(checksumsPath, "utf-8");
-    const checksums = parseSha256Sums(checksumsContent);
-    const expectedChecksum = checksums.get(assetName);
-    if (!expectedChecksum) {
-      throw new Error(
-        `Checksum entry for "${assetName}" not found in SHA256SUMS. Cannot verify download integrity.`
-      );
+    await fs.promises.rename(tempInPlace, currentExePath);
+  } catch {
+    try {
+      await fs.promises.unlink(tempInPlace);
+    } catch {
     }
-    const actualChecksum = await calculateSha256(tempBinaryPath);
-    if (actualChecksum !== expectedChecksum) {
-      throw new Error(
-        `Checksum verification failed. Expected: ${expectedChecksum}, Got: ${actualChecksum}. The download may be corrupted.`
-      );
+    await fs.promises.copyFile(tempBinaryPath, currentExePath);
+    if (os.platform() !== "win32") {
+      await fs.promises.chmod(currentExePath, 493);
     }
-    const currentExePath = await fs.promises.realpath(process.execPath);
-    const currentDir = path.dirname(currentExePath);
-    const backupPath = path.join(tempDir, "rulesync.backup");
-    try {
-      await fs.promises.copyFile(currentExePath, backupPath);
-    } catch (error) {
-      if (isPermissionError(error)) {
-        throw new UpdatePermissionError(
-          `Permission denied: Cannot read ${currentExePath}. Try running with sudo.`
-        );
-      }
-      throw error;
+  }
+}
+async function installVerifiedBinary(params) {
+  const { tempDir, tempBinaryPath, currentVersion, latestVersion } = params;
+  const currentExePath = await fs.promises.realpath(process.execPath);
+  const currentDir = path.dirname(currentExePath);
+  const backupPath = path.join(tempDir, "rulesync.backup");
+  try {
+    await fs.promises.copyFile(currentExePath, backupPath);
+  } catch (error) {
+    if (isPermissionError(error)) {
+      throw new UpdatePermissionError(
+        `Permission denied: Cannot read ${currentExePath}. Try running with sudo.`
+      );
     }
+    throw error;
+  }
+  try {
+    await replaceCurrentBinary({ tempBinaryPath, currentExePath, currentDir });
+    return {
+      message: `Successfully updated from ${currentVersion} to ${latestVersion}`,
+      restoreFailed: false
+    };
+  } catch (error) {
     try {
-      const tempInPlace = path.join(currentDir, `.rulesync-update-${crypto.randomUUID()}`);
-      try {
-        await fs.promises.copyFile(tempBinaryPath, tempInPlace);
-        if (os.platform() !== "win32") {
-          await fs.promises.chmod(tempInPlace, 493);
-        }
-        await fs.promises.rename(tempInPlace, currentExePath);
-      } catch {
-        try {
-          await fs.promises.unlink(tempInPlace);
-        } catch {
-        }
-        await fs.promises.copyFile(tempBinaryPath, currentExePath);
-        if (os.platform() !== "win32") {
-          await fs.promises.chmod(currentExePath, 493);
-        }
-      }
-      return `Successfully updated from ${currentVersion} to ${updateCheck.latestVersion}`;
-    } catch (error) {
-      try {
-        await fs.promises.copyFile(backupPath, currentExePath);
-      } catch {
-        restoreFailed = true;
-        throw new Error(
+      await fs.promises.copyFile(backupPath, currentExePath);
+    } catch {
+      throw new RestoreFailedError(
+        new Error(
           `Failed to replace binary and restore failed. Backup is preserved at: ${backupPath} (in ${tempDir}). Please manually copy it to ${currentExePath}. Original error: ${error instanceof Error ? error.message : String(error)}`,
           { cause: error }
-        );
-      }
-      if (isPermissionError(error)) {
-        throw new UpdatePermissionError(
-          `Permission denied: Cannot write to ${path.dirname(currentExePath)}. Try running with sudo.`
-        );
-      }
-      throw error;
+        )
+      );
+    }
+    if (isPermissionError(error)) {
+      throw new UpdatePermissionError(
+        `Permission denied: Cannot write to ${path.dirname(currentExePath)}. Try running with sudo.`
+      );
+    }
+    throw error;
+  }
+}
+var RestoreFailedError = class extends Error {
+  cause;
+  constructor(cause) {
+    super(cause.message);
+    this.name = "RestoreFailedError";
+    this.cause = cause;
+  }
+};
+async function performBinaryUpdate(currentVersion, options = {}) {
+  const { force = false, token } = options;
+  const updateCheck = await checkForUpdate(currentVersion, token);
+  if (!updateCheck.hasUpdate && !force) {
+    return `Already at the latest version (${currentVersion})`;
+  }
+  const { assetName, binaryAsset, checksumAsset } = resolveUpdateAssets(updateCheck.release);
+  const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "rulesync-update-"));
+  let restoreFailed = false;
+  try {
+    if (os.platform() !== "win32") {
+      await fs.promises.chmod(tempDir, 448);
+    }
+    const tempBinaryPath = await downloadAndVerifyBinary({
+      tempDir,
+      assetName,
+      binaryAsset,
+      checksumAsset
+    });
+    const installed = await installVerifiedBinary({
+      tempDir,
+      tempBinaryPath,
+      currentVersion,
+      latestVersion: updateCheck.latestVersion
+    });
+    restoreFailed = installed.restoreFailed;
+    return installed.message;
+  } catch (error) {
+    if (error instanceof RestoreFailedError) {
+      restoreFailed = true;
+      throw error.cause;
     }
+    throw error;
   } finally {
     if (!restoreFailed) {
       try {
@@ -6515,7 +6819,7 @@ function wrapCommand({
 }
 
 // src/cli/index.ts
-var getVersion = () => "8.31.0";
+var getVersion = () => "9.0.0";
 function wrapCommand2(name, errorCode, handler) {
   return wrapCommand({ name, errorCode, handler, getVersion });
 }
@@ -6629,10 +6933,6 @@ var main = async () => {
     "-o, --output-roots <paths>",
     "Output root directories to generate files into (comma-separated for multiple paths)",
     parseCommaSeparatedList
-  ).option(
-    "-b, --base-dir <paths>",
-    "[Deprecated] Use --output-roots instead. Output root directories (comma-separated for multiple paths)",
-    parseCommaSeparatedList
   ).option("-V, --verbose", "Verbose output").option("-s, --silent", "Suppress all output").option("-c, --config <path>", "Path to configuration file").option("-g, --global", "Generate for global(user scope) configuration files").option(
     "--simulate-commands",
     "Generate simulated commands. This feature is only available for copilot, cursor and codexcli."