rulesync 8.6.0 → 8.7.0

package/dist/cli/index.cjs

@@ -3079,7 +3079,7 @@ var CommandsProcessor = class extends FeatureProcessor {
 };
 
 // src/features/hooks/hooks-processor.ts
-var import_mini19 = require("zod/mini");
+var import_mini18 = require("zod/mini");
 
 // src/types/hooks.ts
 var import_mini15 = require("zod/mini");
@@ -3383,22 +3383,34 @@ function canonicalToToolHooks({
           `matcher "${matcherKey}" on "${eventName}" hook will be ignored \u2014 this event does not support matchers`
         );
       }
-      const hooks = defs.map((def) => {
+      const hooks = [];
+      for (const def of defs) {
+        const hookType = def.type ?? "command";
+        if (converterConfig.supportedHookTypes && !converterConfig.supportedHookTypes.has(hookType)) {
+          continue;
+        }
         const commandText = def.command;
         const trimmedCommand = typeof commandText === "string" ? commandText.trimStart() : void 0;
-        const shouldPrefix = typeof trimmedCommand === "string" && !trimmedCommand.startsWith("$") && (!converterConfig.prefixDotRelativeCommandsOnly || trimmedCommand.startsWith("."));
+        const shouldPrefix = converterConfig.projectDirVar !== "" && typeof trimmedCommand === "string" && !trimmedCommand.startsWith("$") && (!converterConfig.prefixDotRelativeCommandsOnly || trimmedCommand.startsWith("."));
         const command = shouldPrefix && typeof trimmedCommand === "string" ? `${converterConfig.projectDirVar}/${trimmedCommand.replace(/^\.\//, "")}` : def.command;
-        return {
-          type: def.type ?? "command",
+        hooks.push({
+          type: hookType,
           ...command !== void 0 && command !== null && { command },
           ...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout },
-          ...def.prompt !== void 0 && def.prompt !== null && { prompt: def.prompt }
-        };
-      });
+          ...def.prompt !== void 0 && def.prompt !== null && { prompt: def.prompt },
+          ...converterConfig.passthroughFields?.includes("name") && def.name !== void 0 && def.name !== null && { name: def.name },
+          ...converterConfig.passthroughFields?.includes("description") && def.description !== void 0 && def.description !== null && { description: def.description }
+        });
+      }
+      if (hooks.length === 0) {
+        continue;
+      }
       const includeMatcher = matcherKey && !isNoMatcherEvent;
       entries.push(includeMatcher ? { matcher: matcherKey, hooks } : { hooks });
     }
-    result[toolEventName] = entries;
+    if (entries.length > 0) {
+      result[toolEventName] = entries;
+    }
   }
   return result;
 }
@@ -3419,7 +3431,7 @@ function toolHooksToCanonical({
       const hookDefs = rawEntry.hooks ?? [];
       for (const h of hookDefs) {
         const cmd = typeof h.command === "string" ? h.command : void 0;
-        const command = typeof cmd === "string" && cmd.includes(`${converterConfig.projectDirVar}/`) ? cmd.replace(
+        const command = converterConfig.projectDirVar !== "" && typeof cmd === "string" && cmd.includes(`${converterConfig.projectDirVar}/`) ? cmd.replace(
           new RegExp(
             `^${converterConfig.projectDirVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\/?`
           ),
@@ -3433,6 +3445,8 @@ function toolHooksToCanonical({
           ...command !== void 0 && command !== null && { command },
           ...timeout !== void 0 && timeout !== null && { timeout },
           ...prompt !== void 0 && prompt !== null && { prompt },
+          ...converterConfig.passthroughFields?.includes("name") && typeof h.name === "string" && { name: h.name },
+          ...converterConfig.passthroughFields?.includes("description") && typeof h.description === "string" && { description: h.description },
           ...rawEntry.matcher !== void 0 && rawEntry.matcher !== null && rawEntry.matcher !== "" && { matcher: rawEntry.matcher }
         });
       }
@@ -3531,6 +3545,9 @@ var ToolHooks = class extends ToolFile {
   static forDeletion(_params) {
     throw new Error("Please implement this method in the subclass.");
   }
+  static async getAuxiliaryFiles(_params) {
+    return [];
+  }
 };
 
 // src/features/hooks/claudecode-hooks.ts
@@ -3652,89 +3669,28 @@ var ClaudecodeHooks = class _ClaudecodeHooks extends ToolHooks {
 // src/features/hooks/codexcli-hooks.ts
 var import_node_path24 = require("path");
 var smolToml2 = __toESM(require("smol-toml"), 1);
-var import_mini16 = require("zod/mini");
-function canonicalToCodexcliHooks(config) {
-  const codexSupported = new Set(CODEXCLI_HOOK_EVENTS);
-  const sharedHooks = {};
-  for (const [event, defs] of Object.entries(config.hooks)) {
-    if (codexSupported.has(event)) {
-      sharedHooks[event] = defs;
-    }
-  }
-  const effectiveHooks = {
-    ...sharedHooks,
-    ...config.codexcli?.hooks
-  };
-  const codex = {};
-  for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-    const codexEventName = CANONICAL_TO_CODEXCLI_EVENT_NAMES[eventName] ?? eventName;
-    const byMatcher = /* @__PURE__ */ new Map();
-    for (const def of definitions) {
-      const key = def.matcher ?? "";
-      const list = byMatcher.get(key);
-      if (list) list.push(def);
-      else byMatcher.set(key, [def]);
-    }
-    const entries = [];
-    for (const [matcherKey, defs] of byMatcher) {
-      const commandDefs = defs.filter((def) => !def.type || def.type === "command");
-      if (commandDefs.length === 0) continue;
-      const hooks = commandDefs.map((def) => ({
-        type: "command",
-        ...def.command !== void 0 && def.command !== null && { command: def.command },
-        ...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout }
-      }));
-      entries.push(matcherKey ? { matcher: matcherKey, hooks } : { hooks });
-    }
-    if (entries.length > 0) {
-      codex[codexEventName] = entries;
-    }
-  }
-  return codex;
-}
-var CodexHookEntrySchema = import_mini16.z.looseObject({
-  type: import_mini16.z.optional(import_mini16.z.string()),
-  command: import_mini16.z.optional(import_mini16.z.string()),
-  timeout: import_mini16.z.optional(import_mini16.z.number())
-});
-var CodexMatcherEntrySchema = import_mini16.z.looseObject({
-  matcher: import_mini16.z.optional(import_mini16.z.string()),
-  hooks: import_mini16.z.optional(import_mini16.z.array(CodexHookEntrySchema))
-});
-function codexcliHooksToCanonical(codexHooks) {
-  if (codexHooks === null || codexHooks === void 0 || typeof codexHooks !== "object") {
-    return {};
-  }
-  const canonical = {};
-  for (const [codexEventName, matcherEntries] of Object.entries(codexHooks)) {
-    const eventName = CODEXCLI_TO_CANONICAL_EVENT_NAMES[codexEventName] ?? codexEventName;
-    if (!Array.isArray(matcherEntries)) continue;
-    const defs = [];
-    for (const rawEntry of matcherEntries) {
-      const parseResult = CodexMatcherEntrySchema.safeParse(rawEntry);
-      if (!parseResult.success) continue;
-      const entry = parseResult.data;
-      const hooks = entry.hooks ?? [];
-      for (const h of hooks) {
-        const hookType = h.type === "command" || h.type === "prompt" ? h.type : "command";
-        defs.push({
-          type: hookType,
-          ...h.command !== void 0 && h.command !== null && { command: h.command },
-          ...h.timeout !== void 0 && h.timeout !== null && { timeout: h.timeout },
-          ...entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "" && { matcher: entry.matcher }
-        });
-      }
-    }
-    if (defs.length > 0) {
-      canonical[eventName] = defs;
-    }
-  }
-  return canonical;
-}
+var CODEXCLI_CONVERTER_CONFIG = {
+  supportedEvents: CODEXCLI_HOOK_EVENTS,
+  canonicalToToolEventNames: CANONICAL_TO_CODEXCLI_EVENT_NAMES,
+  toolToCanonicalEventNames: CODEXCLI_TO_CANONICAL_EVENT_NAMES,
+  projectDirVar: "",
+  supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+  passthroughFields: ["name", "description"]
+};
 async function buildCodexConfigTomlContent({ baseDir }) {
   const configPath = (0, import_node_path24.join)(baseDir, ".codex", "config.toml");
   const existingContent = await readFileContentOrNull(configPath) ?? smolToml2.stringify({});
-  const configToml = smolToml2.parse(existingContent);
+  let configToml;
+  try {
+    configToml = smolToml2.parse(existingContent);
+  } catch (error) {
+    throw new Error(
+      `Failed to parse existing Codex CLI config at ${configPath}: ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
   if (typeof configToml.features !== "object" || configToml.features === null) {
     configToml.features = {};
   }
@@ -3789,7 +3745,11 @@ var CodexcliHooks = class _CodexcliHooks extends ToolHooks {
   }) {
     const paths = _CodexcliHooks.getSettablePaths({ global });
     const config = rulesyncHooks.getJson();
-    const codexHooks = canonicalToCodexcliHooks(config);
+    const codexHooks = canonicalToToolHooks({
+      config,
+      toolOverrideHooks: config.codexcli?.hooks,
+      converterConfig: CODEXCLI_CONVERTER_CONFIG
+    });
     const fileContent = JSON.stringify({ hooks: codexHooks }, null, 2);
     return new _CodexcliHooks({
       baseDir,
@@ -3811,7 +3771,10 @@ var CodexcliHooks = class _CodexcliHooks extends ToolHooks {
         }
       );
     }
-    const hooks = codexcliHooksToCanonical(parsed.hooks);
+    const hooks = toolHooksToCanonical({
+      hooks: parsed.hooks,
+      converterConfig: CODEXCLI_CONVERTER_CONFIG
+    });
     return this.toRulesyncHooksDefault({
       fileContent: JSON.stringify({ version: 1, hooks }, null, 2)
     });
@@ -3832,16 +3795,21 @@ var CodexcliHooks = class _CodexcliHooks extends ToolHooks {
       validate: false
     });
   }
+  static async getAuxiliaryFiles({
+    baseDir = process.cwd()
+  } = {}) {
+    return [await CodexcliConfigToml.fromBaseDir({ baseDir })];
+  }
 };
 
 // src/features/hooks/copilot-hooks.ts
 var import_node_path25 = require("path");
-var import_mini17 = require("zod/mini");
-var CopilotHookEntrySchema = import_mini17.z.looseObject({
-  type: import_mini17.z.string(),
-  bash: import_mini17.z.optional(import_mini17.z.string()),
-  powershell: import_mini17.z.optional(import_mini17.z.string()),
-  timeoutSec: import_mini17.z.optional(import_mini17.z.number())
+var import_mini16 = require("zod/mini");
+var CopilotHookEntrySchema = import_mini16.z.looseObject({
+  type: import_mini16.z.string(),
+  bash: import_mini16.z.optional(import_mini16.z.string()),
+  powershell: import_mini16.z.optional(import_mini16.z.string()),
+  timeoutSec: import_mini16.z.optional(import_mini16.z.number())
 });
 function canonicalToCopilotHooks(config) {
   const canonicalSchemaKeys = Object.keys(HookDefinitionSchema.shape);
@@ -4372,7 +4340,7 @@ var FactorydroidHooks = class _FactorydroidHooks extends ToolHooks {
 
 // src/features/hooks/geminicli-hooks.ts
 var import_node_path29 = require("path");
-var import_mini18 = require("zod/mini");
+var import_mini17 = require("zod/mini");
 function canonicalToGeminicliHooks(config) {
   const geminiSupported = new Set(GEMINICLI_HOOK_EVENTS);
   const sharedHooks = {};
@@ -4416,16 +4384,16 @@ function canonicalToGeminicliHooks(config) {
   }
   return gemini;
 }
-var GeminiHookEntrySchema = import_mini18.z.looseObject({
-  type: import_mini18.z.optional(import_mini18.z.string()),
-  command: import_mini18.z.optional(import_mini18.z.string()),
-  timeout: import_mini18.z.optional(import_mini18.z.number()),
-  name: import_mini18.z.optional(import_mini18.z.string()),
-  description: import_mini18.z.optional(import_mini18.z.string())
+var GeminiHookEntrySchema = import_mini17.z.looseObject({
+  type: import_mini17.z.optional(import_mini17.z.string()),
+  command: import_mini17.z.optional(import_mini17.z.string()),
+  timeout: import_mini17.z.optional(import_mini17.z.number()),
+  name: import_mini17.z.optional(import_mini17.z.string()),
+  description: import_mini17.z.optional(import_mini17.z.string())
 });
-var GeminiMatcherEntrySchema = import_mini18.z.looseObject({
-  matcher: import_mini18.z.optional(import_mini18.z.string()),
-  hooks: import_mini18.z.optional(import_mini18.z.array(GeminiHookEntrySchema))
+var GeminiMatcherEntrySchema = import_mini17.z.looseObject({
+  matcher: import_mini17.z.optional(import_mini17.z.string()),
+  hooks: import_mini17.z.optional(import_mini17.z.array(GeminiHookEntrySchema))
 });
 function geminiHooksToCanonical(geminiHooks) {
   if (geminiHooks === null || geminiHooks === void 0 || typeof geminiHooks !== "object") {
@@ -4809,7 +4777,7 @@ var hooksProcessorToolTargetTuple = [
   "geminicli",
   "deepagents"
 ];
-var HooksProcessorToolTargetSchema = import_mini19.z.enum(hooksProcessorToolTargetTuple);
+var HooksProcessorToolTargetSchema = import_mini18.z.enum(hooksProcessorToolTargetTuple);
 var toolHooksFactories = /* @__PURE__ */ new Map([
   [
     "cursor",
@@ -5068,8 +5036,12 @@ var HooksProcessor = class extends FeatureProcessor {
       global: this.global
     });
     const result = [toolHooks];
-    if (this.toolTarget === "codexcli") {
-      result.push(await CodexcliConfigToml.fromBaseDir({ baseDir: this.baseDir }));
+    const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
+      baseDir: this.baseDir,
+      global: this.global
+    });
+    if (auxiliaryFiles && auxiliaryFiles.length > 0) {
+      result.push(...auxiliaryFiles);
     }
     return result;
   }
@@ -5089,7 +5061,7 @@ var HooksProcessor = class extends FeatureProcessor {
 };
 
 // src/features/ignore/ignore-processor.ts
-var import_mini21 = require("zod/mini");
+var import_mini20 = require("zod/mini");
 
 // src/features/ignore/augmentcode-ignore.ts
 var import_node_path33 = require("path");
@@ -5268,12 +5240,12 @@ var AugmentcodeIgnore = class _AugmentcodeIgnore extends ToolIgnore {
 // src/features/ignore/claudecode-ignore.ts
 var import_node_path34 = require("path");
 var import_es_toolkit2 = require("es-toolkit");
-var import_mini20 = require("zod/mini");
+var import_mini19 = require("zod/mini");
 var SHARED_SETTINGS_FILE = "settings.json";
 var LOCAL_SETTINGS_FILE = "settings.local.json";
 var DEFAULT_FILE_MODE = "shared";
-var ClaudecodeIgnoreOptionsSchema = import_mini20.z.looseObject({
-  fileMode: import_mini20.z.optional(import_mini20.z.enum(["shared", "local"]))
+var ClaudecodeIgnoreOptionsSchema = import_mini19.z.looseObject({
+  fileMode: import_mini19.z.optional(import_mini19.z.enum(["shared", "local"]))
 });
 var resolveFileMode = (options) => {
   if (!options) return DEFAULT_FILE_MODE;
@@ -6117,7 +6089,7 @@ var ignoreProcessorToolTargets = [
   "windsurf",
   "zed"
 ];
-var IgnoreProcessorToolTargetSchema = import_mini21.z.enum(ignoreProcessorToolTargets);
+var IgnoreProcessorToolTargetSchema = import_mini20.z.enum(ignoreProcessorToolTargets);
 var toolIgnoreFactories = /* @__PURE__ */ new Map([
   ["augmentcode", { class: AugmentcodeIgnore }],
   ["claudecode", { class: ClaudecodeIgnore }],
@@ -6260,7 +6232,7 @@ var IgnoreProcessor = class extends FeatureProcessor {
 };
 
 // src/features/mcp/mcp-processor.ts
-var import_mini26 = require("zod/mini");
+var import_mini25 = require("zod/mini");
 
 // src/features/mcp/claudecode-mcp.ts
 var import_node_path47 = require("path");
@@ -6268,47 +6240,47 @@ var import_node_path47 = require("path");
 // src/features/mcp/rulesync-mcp.ts
 var import_node_path46 = require("path");
 var import_object = require("es-toolkit/object");
-var import_mini23 = require("zod/mini");
+var import_mini22 = require("zod/mini");
 
 // src/types/mcp.ts
-var import_mini22 = require("zod/mini");
-var McpServerSchema = import_mini22.z.looseObject({
-  type: import_mini22.z.optional(import_mini22.z.enum(["local", "stdio", "sse", "http"])),
-  command: import_mini22.z.optional(import_mini22.z.union([import_mini22.z.string(), import_mini22.z.array(import_mini22.z.string())])),
-  args: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string())),
-  url: import_mini22.z.optional(import_mini22.z.string()),
-  httpUrl: import_mini22.z.optional(import_mini22.z.string()),
-  env: import_mini22.z.optional(import_mini22.z.record(import_mini22.z.string(), import_mini22.z.string())),
-  disabled: import_mini22.z.optional(import_mini22.z.boolean()),
-  networkTimeout: import_mini22.z.optional(import_mini22.z.number()),
-  timeout: import_mini22.z.optional(import_mini22.z.number()),
-  trust: import_mini22.z.optional(import_mini22.z.boolean()),
-  cwd: import_mini22.z.optional(import_mini22.z.string()),
-  transport: import_mini22.z.optional(import_mini22.z.enum(["local", "stdio", "sse", "http"])),
-  alwaysAllow: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string())),
-  tools: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string())),
-  kiroAutoApprove: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string())),
-  kiroAutoBlock: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string())),
-  headers: import_mini22.z.optional(import_mini22.z.record(import_mini22.z.string(), import_mini22.z.string())),
-  enabledTools: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string())),
-  disabledTools: import_mini22.z.optional(import_mini22.z.array(import_mini22.z.string()))
+var import_mini21 = require("zod/mini");
+var McpServerSchema = import_mini21.z.looseObject({
+  type: import_mini21.z.optional(import_mini21.z.enum(["local", "stdio", "sse", "http"])),
+  command: import_mini21.z.optional(import_mini21.z.union([import_mini21.z.string(), import_mini21.z.array(import_mini21.z.string())])),
+  args: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string())),
+  url: import_mini21.z.optional(import_mini21.z.string()),
+  httpUrl: import_mini21.z.optional(import_mini21.z.string()),
+  env: import_mini21.z.optional(import_mini21.z.record(import_mini21.z.string(), import_mini21.z.string())),
+  disabled: import_mini21.z.optional(import_mini21.z.boolean()),
+  networkTimeout: import_mini21.z.optional(import_mini21.z.number()),
+  timeout: import_mini21.z.optional(import_mini21.z.number()),
+  trust: import_mini21.z.optional(import_mini21.z.boolean()),
+  cwd: import_mini21.z.optional(import_mini21.z.string()),
+  transport: import_mini21.z.optional(import_mini21.z.enum(["local", "stdio", "sse", "http"])),
+  alwaysAllow: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string())),
+  tools: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string())),
+  kiroAutoApprove: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string())),
+  kiroAutoBlock: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string())),
+  headers: import_mini21.z.optional(import_mini21.z.record(import_mini21.z.string(), import_mini21.z.string())),
+  enabledTools: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string())),
+  disabledTools: import_mini21.z.optional(import_mini21.z.array(import_mini21.z.string()))
 });
-var McpServersSchema = import_mini22.z.record(import_mini22.z.string(), McpServerSchema);
+var McpServersSchema = import_mini21.z.record(import_mini21.z.string(), McpServerSchema);
 function isMcpServers(value) {
   return value !== void 0 && value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
 // src/features/mcp/rulesync-mcp.ts
-var RulesyncMcpServerSchema = import_mini23.z.extend(McpServerSchema, {
-  targets: import_mini23.z.optional(RulesyncTargetsSchema),
-  description: import_mini23.z.optional(import_mini23.z.string()),
-  exposed: import_mini23.z.optional(import_mini23.z.boolean())
+var RulesyncMcpServerSchema = import_mini22.z.extend(McpServerSchema, {
+  targets: import_mini22.z.optional(RulesyncTargetsSchema),
+  description: import_mini22.z.optional(import_mini22.z.string()),
+  exposed: import_mini22.z.optional(import_mini22.z.boolean())
 });
-var RulesyncMcpConfigSchema = import_mini23.z.object({
-  mcpServers: import_mini23.z.record(import_mini23.z.string(), RulesyncMcpServerSchema)
+var RulesyncMcpConfigSchema = import_mini22.z.object({
+  mcpServers: import_mini22.z.record(import_mini22.z.string(), RulesyncMcpServerSchema)
 });
-var RulesyncMcpFileSchema = import_mini23.z.looseObject({
-  $schema: import_mini23.z.optional(import_mini23.z.string()),
+var RulesyncMcpFileSchema = import_mini22.z.looseObject({
+  $schema: import_mini22.z.optional(import_mini22.z.string()),
   ...RulesyncMcpConfigSchema.shape
 });
 var RulesyncMcp = class _RulesyncMcp extends RulesyncFile {
@@ -7511,25 +7483,25 @@ var JunieMcp = class _JunieMcp extends ToolMcp {
 // src/features/mcp/kilo-mcp.ts
 var import_node_path57 = require("path");
 var import_jsonc_parser2 = require("jsonc-parser");
-var import_mini24 = require("zod/mini");
-var KiloMcpLocalServerSchema = import_mini24.z.object({
-  type: import_mini24.z.literal("local"),
-  command: import_mini24.z.array(import_mini24.z.string()),
-  environment: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.string())),
-  enabled: import_mini24.z._default(import_mini24.z.boolean(), true),
-  cwd: import_mini24.z.optional(import_mini24.z.string())
+var import_mini23 = require("zod/mini");
+var KiloMcpLocalServerSchema = import_mini23.z.object({
+  type: import_mini23.z.literal("local"),
+  command: import_mini23.z.array(import_mini23.z.string()),
+  environment: import_mini23.z.optional(import_mini23.z.record(import_mini23.z.string(), import_mini23.z.string())),
+  enabled: import_mini23.z._default(import_mini23.z.boolean(), true),
+  cwd: import_mini23.z.optional(import_mini23.z.string())
 });
-var KiloMcpRemoteServerSchema = import_mini24.z.object({
-  type: import_mini24.z.literal("remote"),
-  url: import_mini24.z.string(),
-  headers: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.string())),
-  enabled: import_mini24.z._default(import_mini24.z.boolean(), true)
+var KiloMcpRemoteServerSchema = import_mini23.z.object({
+  type: import_mini23.z.literal("remote"),
+  url: import_mini23.z.string(),
+  headers: import_mini23.z.optional(import_mini23.z.record(import_mini23.z.string(), import_mini23.z.string())),
+  enabled: import_mini23.z._default(import_mini23.z.boolean(), true)
 });
-var KiloMcpServerSchema = import_mini24.z.union([KiloMcpLocalServerSchema, KiloMcpRemoteServerSchema]);
-var KiloConfigSchema = import_mini24.z.looseObject({
-  $schema: import_mini24.z.optional(import_mini24.z.string()),
-  mcp: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), KiloMcpServerSchema)),
-  tools: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.boolean()))
+var KiloMcpServerSchema = import_mini23.z.union([KiloMcpLocalServerSchema, KiloMcpRemoteServerSchema]);
+var KiloConfigSchema = import_mini23.z.looseObject({
+  $schema: import_mini23.z.optional(import_mini23.z.string()),
+  mcp: import_mini23.z.optional(import_mini23.z.record(import_mini23.z.string(), KiloMcpServerSchema)),
+  tools: import_mini23.z.optional(import_mini23.z.record(import_mini23.z.string(), import_mini23.z.boolean()))
 });
 function convertFromKiloFormat(kiloMcp, tools) {
   return Object.fromEntries(
@@ -7826,28 +7798,28 @@ var KiroMcp = class _KiroMcp extends ToolMcp {
 // src/features/mcp/opencode-mcp.ts
 var import_node_path59 = require("path");
 var import_jsonc_parser3 = require("jsonc-parser");
-var import_mini25 = require("zod/mini");
-var OpencodeMcpLocalServerSchema = import_mini25.z.object({
-  type: import_mini25.z.literal("local"),
-  command: import_mini25.z.array(import_mini25.z.string()),
-  environment: import_mini25.z.optional(import_mini25.z.record(import_mini25.z.string(), import_mini25.z.string())),
-  enabled: import_mini25.z._default(import_mini25.z.boolean(), true),
-  cwd: import_mini25.z.optional(import_mini25.z.string())
+var import_mini24 = require("zod/mini");
+var OpencodeMcpLocalServerSchema = import_mini24.z.object({
+  type: import_mini24.z.literal("local"),
+  command: import_mini24.z.array(import_mini24.z.string()),
+  environment: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.string())),
+  enabled: import_mini24.z._default(import_mini24.z.boolean(), true),
+  cwd: import_mini24.z.optional(import_mini24.z.string())
 });
-var OpencodeMcpRemoteServerSchema = import_mini25.z.object({
-  type: import_mini25.z.literal("remote"),
-  url: import_mini25.z.string(),
-  headers: import_mini25.z.optional(import_mini25.z.record(import_mini25.z.string(), import_mini25.z.string())),
-  enabled: import_mini25.z._default(import_mini25.z.boolean(), true)
+var OpencodeMcpRemoteServerSchema = import_mini24.z.object({
+  type: import_mini24.z.literal("remote"),
+  url: import_mini24.z.string(),
+  headers: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.string())),
+  enabled: import_mini24.z._default(import_mini24.z.boolean(), true)
 });
-var OpencodeMcpServerSchema = import_mini25.z.union([
+var OpencodeMcpServerSchema = import_mini24.z.union([
   OpencodeMcpLocalServerSchema,
   OpencodeMcpRemoteServerSchema
 ]);
-var OpencodeConfigSchema = import_mini25.z.looseObject({
-  $schema: import_mini25.z.optional(import_mini25.z.string()),
-  mcp: import_mini25.z.optional(import_mini25.z.record(import_mini25.z.string(), OpencodeMcpServerSchema)),
-  tools: import_mini25.z.optional(import_mini25.z.record(import_mini25.z.string(), import_mini25.z.boolean()))
+var OpencodeConfigSchema = import_mini24.z.looseObject({
+  $schema: import_mini24.z.optional(import_mini24.z.string()),
+  mcp: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), OpencodeMcpServerSchema)),
+  tools: import_mini24.z.optional(import_mini24.z.record(import_mini24.z.string(), import_mini24.z.boolean()))
 });
 function convertFromOpencodeFormat(opencodeMcp, tools) {
   return Object.fromEntries(
@@ -8318,7 +8290,7 @@ var mcpProcessorToolTargetTuple = [
   "roo",
   "rovodev"
 ];
-var McpProcessorToolTargetSchema = import_mini26.z.enum(mcpProcessorToolTargetTuple);
+var McpProcessorToolTargetSchema = import_mini25.z.enum(mcpProcessorToolTargetTuple);
 var toolMcpFactories = /* @__PURE__ */ new Map([
   [
     "claudecode",
@@ -8659,7 +8631,7 @@ var McpProcessor = class extends FeatureProcessor {
 // src/features/rules/rules-processor.ts
 var import_node_path132 = require("path");
 var import_toon = require("@toon-format/toon");
-var import_mini66 = require("zod/mini");
+var import_mini65 = require("zod/mini");
 
 // src/constants/general.ts
 var SKILL_FILE_NAME = "SKILL.md";
@@ -8669,7 +8641,7 @@ var import_node_path65 = require("path");
 
 // src/features/skills/simulated-skill.ts
 var import_node_path64 = require("path");
-var import_mini27 = require("zod/mini");
+var import_mini26 = require("zod/mini");
 
 // src/features/skills/tool-skill.ts
 var import_node_path63 = require("path");
@@ -8906,9 +8878,9 @@ var ToolSkill = class extends AiDir {
 };
 
 // src/features/skills/simulated-skill.ts
-var SimulatedSkillFrontmatterSchema = import_mini27.z.looseObject({
-  name: import_mini27.z.string(),
-  description: import_mini27.z.string()
+var SimulatedSkillFrontmatterSchema = import_mini26.z.looseObject({
+  name: import_mini26.z.string(),
+  description: import_mini26.z.string()
 });
 var SimulatedSkill = class extends ToolSkill {
   frontmatter;
@@ -9135,49 +9107,49 @@ var FactorydroidSkill = class _FactorydroidSkill extends SimulatedSkill {
 
 // src/features/skills/rovodev-skill.ts
 var import_node_path68 = require("path");
-var import_mini29 = require("zod/mini");
+var import_mini28 = require("zod/mini");
 
 // src/features/skills/rulesync-skill.ts
 var import_node_path67 = require("path");
-var import_mini28 = require("zod/mini");
-var RulesyncSkillFrontmatterSchemaInternal = import_mini28.z.looseObject({
-  name: import_mini28.z.string(),
-  description: import_mini28.z.string(),
-  targets: import_mini28.z._default(RulesyncTargetsSchema, ["*"]),
-  claudecode: import_mini28.z.optional(
-    import_mini28.z.looseObject({
-      "allowed-tools": import_mini28.z.optional(import_mini28.z.array(import_mini28.z.string())),
-      model: import_mini28.z.optional(import_mini28.z.string()),
-      "disable-model-invocation": import_mini28.z.optional(import_mini28.z.boolean())
+var import_mini27 = require("zod/mini");
+var RulesyncSkillFrontmatterSchemaInternal = import_mini27.z.looseObject({
+  name: import_mini27.z.string(),
+  description: import_mini27.z.string(),
+  targets: import_mini27.z._default(RulesyncTargetsSchema, ["*"]),
+  claudecode: import_mini27.z.optional(
+    import_mini27.z.looseObject({
+      "allowed-tools": import_mini27.z.optional(import_mini27.z.array(import_mini27.z.string())),
+      model: import_mini27.z.optional(import_mini27.z.string()),
+      "disable-model-invocation": import_mini27.z.optional(import_mini27.z.boolean())
     })
   ),
-  codexcli: import_mini28.z.optional(
-    import_mini28.z.looseObject({
-      "short-description": import_mini28.z.optional(import_mini28.z.string())
+  codexcli: import_mini27.z.optional(
+    import_mini27.z.looseObject({
+      "short-description": import_mini27.z.optional(import_mini27.z.string())
     })
   ),
-  opencode: import_mini28.z.optional(
-    import_mini28.z.looseObject({
-      "allowed-tools": import_mini28.z.optional(import_mini28.z.array(import_mini28.z.string()))
+  opencode: import_mini27.z.optional(
+    import_mini27.z.looseObject({
+      "allowed-tools": import_mini27.z.optional(import_mini27.z.array(import_mini27.z.string()))
     })
   ),
-  kilo: import_mini28.z.optional(
-    import_mini28.z.looseObject({
-      "allowed-tools": import_mini28.z.optional(import_mini28.z.array(import_mini28.z.string()))
+  kilo: import_mini27.z.optional(
+    import_mini27.z.looseObject({
+      "allowed-tools": import_mini27.z.optional(import_mini27.z.array(import_mini27.z.string()))
     })
   ),
-  deepagents: import_mini28.z.optional(
-    import_mini28.z.looseObject({
-      "allowed-tools": import_mini28.z.optional(import_mini28.z.array(import_mini28.z.string()))
+  deepagents: import_mini27.z.optional(
+    import_mini27.z.looseObject({
+      "allowed-tools": import_mini27.z.optional(import_mini27.z.array(import_mini27.z.string()))
     })
   ),
-  copilot: import_mini28.z.optional(
-    import_mini28.z.looseObject({
-      license: import_mini28.z.optional(import_mini28.z.string())
+  copilot: import_mini27.z.optional(
+    import_mini27.z.looseObject({
+      license: import_mini27.z.optional(import_mini27.z.string())
     })
   ),
-  cline: import_mini28.z.optional(import_mini28.z.looseObject({})),
-  roo: import_mini28.z.optional(import_mini28.z.looseObject({}))
+  cline: import_mini27.z.optional(import_mini27.z.looseObject({})),
+  roo: import_mini27.z.optional(import_mini27.z.looseObject({}))
 });
 var RulesyncSkillFrontmatterSchema = RulesyncSkillFrontmatterSchemaInternal;
 var RulesyncSkill = class _RulesyncSkill extends AiDir {
@@ -9274,9 +9246,9 @@ var RulesyncSkill = class _RulesyncSkill extends AiDir {
 };
 
 // src/features/skills/rovodev-skill.ts
-var RovodevSkillFrontmatterSchema = import_mini29.z.looseObject({
-  name: import_mini29.z.string(),
-  description: import_mini29.z.string()
+var RovodevSkillFrontmatterSchema = import_mini28.z.looseObject({
+  name: import_mini28.z.string(),
+  description: import_mini28.z.string()
 });
 var RovodevSkill = class _RovodevSkill extends ToolSkill {
   constructor({
@@ -9448,7 +9420,7 @@ var RovodevSkill = class _RovodevSkill extends ToolSkill {
 
 // src/features/skills/skills-processor.ts
 var import_node_path87 = require("path");
-var import_mini46 = require("zod/mini");
+var import_mini45 = require("zod/mini");
 
 // src/types/dir-feature-processor.ts
 var import_node_path69 = require("path");
@@ -9587,10 +9559,10 @@ var DirFeatureProcessor = class {
 
 // src/features/skills/agentsskills-skill.ts
 var import_node_path70 = require("path");
-var import_mini30 = require("zod/mini");
-var AgentsSkillsSkillFrontmatterSchema = import_mini30.z.looseObject({
-  name: import_mini30.z.string(),
-  description: import_mini30.z.string()
+var import_mini29 = require("zod/mini");
+var AgentsSkillsSkillFrontmatterSchema = import_mini29.z.looseObject({
+  name: import_mini29.z.string(),
+  description: import_mini29.z.string()
 });
 var AgentsSkillsSkill = class _AgentsSkillsSkill extends ToolSkill {
   constructor({
@@ -9745,10 +9717,10 @@ var AgentsSkillsSkill = class _AgentsSkillsSkill extends ToolSkill {
 
 // src/features/skills/antigravity-skill.ts
 var import_node_path71 = require("path");
-var import_mini31 = require("zod/mini");
-var AntigravitySkillFrontmatterSchema = import_mini31.z.looseObject({
-  name: import_mini31.z.string(),
-  description: import_mini31.z.string()
+var import_mini30 = require("zod/mini");
+var AntigravitySkillFrontmatterSchema = import_mini30.z.looseObject({
+  name: import_mini30.z.string(),
+  description: import_mini30.z.string()
 });
 var AntigravitySkill = class _AntigravitySkill extends ToolSkill {
   constructor({
@@ -9906,13 +9878,13 @@ var AntigravitySkill = class _AntigravitySkill extends ToolSkill {
 
 // src/features/skills/claudecode-skill.ts
 var import_node_path72 = require("path");
-var import_mini32 = require("zod/mini");
-var ClaudecodeSkillFrontmatterSchema = import_mini32.z.looseObject({
-  name: import_mini32.z.string(),
-  description: import_mini32.z.string(),
-  "allowed-tools": import_mini32.z.optional(import_mini32.z.array(import_mini32.z.string())),
-  model: import_mini32.z.optional(import_mini32.z.string()),
-  "disable-model-invocation": import_mini32.z.optional(import_mini32.z.boolean())
+var import_mini31 = require("zod/mini");
+var ClaudecodeSkillFrontmatterSchema = import_mini31.z.looseObject({
+  name: import_mini31.z.string(),
+  description: import_mini31.z.string(),
+  "allowed-tools": import_mini31.z.optional(import_mini31.z.array(import_mini31.z.string())),
+  model: import_mini31.z.optional(import_mini31.z.string()),
+  "disable-model-invocation": import_mini31.z.optional(import_mini31.z.boolean())
 });
 var ClaudecodeSkill = class _ClaudecodeSkill extends ToolSkill {
   constructor({
@@ -10082,10 +10054,10 @@ var ClaudecodeSkill = class _ClaudecodeSkill extends ToolSkill {
 
 // src/features/skills/cline-skill.ts
 var import_node_path73 = require("path");
-var import_mini33 = require("zod/mini");
-var ClineSkillFrontmatterSchema = import_mini33.z.looseObject({
-  name: import_mini33.z.string(),
-  description: import_mini33.z.string()
+var import_mini32 = require("zod/mini");
+var ClineSkillFrontmatterSchema = import_mini32.z.looseObject({
+  name: import_mini32.z.string(),
+  description: import_mini32.z.string()
 });
 var ClineSkill = class _ClineSkill extends ToolSkill {
   constructor({
@@ -10255,13 +10227,13 @@ var ClineSkill = class _ClineSkill extends ToolSkill {
 
 // src/features/skills/codexcli-skill.ts
 var import_node_path74 = require("path");
-var import_mini34 = require("zod/mini");
-var CodexCliSkillFrontmatterSchema = import_mini34.z.looseObject({
-  name: import_mini34.z.string(),
-  description: import_mini34.z.string(),
-  metadata: import_mini34.z.optional(
-    import_mini34.z.looseObject({
-      "short-description": import_mini34.z.optional(import_mini34.z.string())
+var import_mini33 = require("zod/mini");
+var CodexCliSkillFrontmatterSchema = import_mini33.z.looseObject({
+  name: import_mini33.z.string(),
+  description: import_mini33.z.string(),
+  metadata: import_mini33.z.optional(
+    import_mini33.z.looseObject({
+      "short-description": import_mini33.z.optional(import_mini33.z.string())
     })
   )
 });
@@ -10426,11 +10398,11 @@ var CodexCliSkill = class _CodexCliSkill extends ToolSkill {
 
 // src/features/skills/copilot-skill.ts
 var import_node_path75 = require("path");
-var import_mini35 = require("zod/mini");
-var CopilotSkillFrontmatterSchema = import_mini35.z.looseObject({
-  name: import_mini35.z.string(),
-  description: import_mini35.z.string(),
-  license: import_mini35.z.optional(import_mini35.z.string())
+var import_mini34 = require("zod/mini");
+var CopilotSkillFrontmatterSchema = import_mini34.z.looseObject({
+  name: import_mini34.z.string(),
+  description: import_mini34.z.string(),
+  license: import_mini34.z.optional(import_mini34.z.string())
 });
 var CopilotSkill = class _CopilotSkill extends ToolSkill {
   constructor({
@@ -10591,10 +10563,10 @@ var CopilotSkill = class _CopilotSkill extends ToolSkill {
 
 // src/features/skills/cursor-skill.ts
 var import_node_path76 = require("path");
-var import_mini36 = require("zod/mini");
-var CursorSkillFrontmatterSchema = import_mini36.z.looseObject({
-  name: import_mini36.z.string(),
-  description: import_mini36.z.string()
+var import_mini35 = require("zod/mini");
+var CursorSkillFrontmatterSchema = import_mini35.z.looseObject({
+  name: import_mini35.z.string(),
+  description: import_mini35.z.string()
 });
 var CursorSkill = class _CursorSkill extends ToolSkill {
   constructor({
@@ -10746,11 +10718,11 @@ var CursorSkill = class _CursorSkill extends ToolSkill {
 
 // src/features/skills/deepagents-skill.ts
 var import_node_path77 = require("path");
-var import_mini37 = require("zod/mini");
-var DeepagentsSkillFrontmatterSchema = import_mini37.z.looseObject({
-  name: import_mini37.z.string(),
-  description: import_mini37.z.string(),
-  "allowed-tools": import_mini37.z.optional(import_mini37.z.array(import_mini37.z.string()))
+var import_mini36 = require("zod/mini");
+var DeepagentsSkillFrontmatterSchema = import_mini36.z.looseObject({
+  name: import_mini36.z.string(),
+  description: import_mini36.z.string(),
+  "allowed-tools": import_mini36.z.optional(import_mini36.z.array(import_mini36.z.string()))
 });
 var DeepagentsSkill = class _DeepagentsSkill extends ToolSkill {
   constructor({
@@ -10908,10 +10880,10 @@ var DeepagentsSkill = class _DeepagentsSkill extends ToolSkill {
 
 // src/features/skills/geminicli-skill.ts
 var import_node_path78 = require("path");
-var import_mini38 = require("zod/mini");
-var GeminiCliSkillFrontmatterSchema = import_mini38.z.looseObject({
-  name: import_mini38.z.string(),
-  description: import_mini38.z.string()
+var import_mini37 = require("zod/mini");
+var GeminiCliSkillFrontmatterSchema = import_mini37.z.looseObject({
+  name: import_mini37.z.string(),
+  description: import_mini37.z.string()
 });
 var GeminiCliSkill = class _GeminiCliSkill extends ToolSkill {
   constructor({
@@ -11065,10 +11037,10 @@ var GeminiCliSkill = class _GeminiCliSkill extends ToolSkill {
 
 // src/features/skills/junie-skill.ts
 var import_node_path79 = require("path");
-var import_mini39 = require("zod/mini");
-var JunieSkillFrontmatterSchema = import_mini39.z.looseObject({
-  name: import_mini39.z.string(),
-  description: import_mini39.z.string()
+var import_mini38 = require("zod/mini");
+var JunieSkillFrontmatterSchema = import_mini38.z.looseObject({
+  name: import_mini38.z.string(),
+  description: import_mini38.z.string()
 });
 var JunieSkill = class _JunieSkill extends ToolSkill {
   constructor({
@@ -11241,11 +11213,11 @@ var JunieSkill = class _JunieSkill extends ToolSkill {
 
 // src/features/skills/kilo-skill.ts
 var import_node_path80 = require("path");
-var import_mini40 = require("zod/mini");
-var KiloSkillFrontmatterSchema = import_mini40.z.looseObject({
-  name: import_mini40.z.string(),
-  description: import_mini40.z.string(),
-  "allowed-tools": import_mini40.z.optional(import_mini40.z.array(import_mini40.z.string()))
+var import_mini39 = require("zod/mini");
+var KiloSkillFrontmatterSchema = import_mini39.z.looseObject({
+  name: import_mini39.z.string(),
+  description: import_mini39.z.string(),
+  "allowed-tools": import_mini39.z.optional(import_mini39.z.array(import_mini39.z.string()))
 });
 var KiloSkill = class _KiloSkill extends ToolSkill {
   constructor({
@@ -11402,10 +11374,10 @@ var KiloSkill = class _KiloSkill extends ToolSkill {
 
 // src/features/skills/kiro-skill.ts
 var import_node_path81 = require("path");
-var import_mini41 = require("zod/mini");
-var KiroSkillFrontmatterSchema = import_mini41.z.looseObject({
-  name: import_mini41.z.string(),
-  description: import_mini41.z.string()
+var import_mini40 = require("zod/mini");
+var KiroSkillFrontmatterSchema = import_mini40.z.looseObject({
+  name: import_mini40.z.string(),
+  description: import_mini40.z.string()
 });
 var KiroSkill = class _KiroSkill extends ToolSkill {
   constructor({
@@ -11579,11 +11551,11 @@ var KiroSkill = class _KiroSkill extends ToolSkill {
 
 // src/features/skills/opencode-skill.ts
 var import_node_path82 = require("path");
-var import_mini42 = require("zod/mini");
-var OpenCodeSkillFrontmatterSchema = import_mini42.z.looseObject({
-  name: import_mini42.z.string(),
-  description: import_mini42.z.string(),
-  "allowed-tools": import_mini42.z.optional(import_mini42.z.array(import_mini42.z.string()))
+var import_mini41 = require("zod/mini");
+var OpenCodeSkillFrontmatterSchema = import_mini41.z.looseObject({
+  name: import_mini41.z.string(),
+  description: import_mini41.z.string(),
+  "allowed-tools": import_mini41.z.optional(import_mini41.z.array(import_mini41.z.string()))
 });
 var OpenCodeSkill = class _OpenCodeSkill extends ToolSkill {
   constructor({
@@ -11740,10 +11712,10 @@ var OpenCodeSkill = class _OpenCodeSkill extends ToolSkill {
 
 // src/features/skills/replit-skill.ts
 var import_node_path83 = require("path");
-var import_mini43 = require("zod/mini");
-var ReplitSkillFrontmatterSchema = import_mini43.z.looseObject({
-  name: import_mini43.z.string(),
-  description: import_mini43.z.string()
+var import_mini42 = require("zod/mini");
+var ReplitSkillFrontmatterSchema = import_mini42.z.looseObject({
+  name: import_mini42.z.string(),
+  description: import_mini42.z.string()
 });
 var ReplitSkill = class _ReplitSkill extends ToolSkill {
   constructor({
@@ -11898,10 +11870,10 @@ var ReplitSkill = class _ReplitSkill extends ToolSkill {
 
 // src/features/skills/roo-skill.ts
 var import_node_path84 = require("path");
-var import_mini44 = require("zod/mini");
-var RooSkillFrontmatterSchema = import_mini44.z.looseObject({
-  name: import_mini44.z.string(),
-  description: import_mini44.z.string()
+var import_mini43 = require("zod/mini");
+var RooSkillFrontmatterSchema = import_mini43.z.looseObject({
+  name: import_mini43.z.string(),
+  description: import_mini43.z.string()
 });
 var RooSkill = class _RooSkill extends ToolSkill {
   constructor({
@@ -12090,10 +12062,10 @@ async function getLocalSkillDirNames(baseDir) {
 
 // src/features/skills/windsurf-skill.ts
 var import_node_path86 = require("path");
-var import_mini45 = require("zod/mini");
-var WindsurfSkillFrontmatterSchema = import_mini45.z.looseObject({
-  name: import_mini45.z.string(),
-  description: import_mini45.z.string()
+var import_mini44 = require("zod/mini");
+var WindsurfSkillFrontmatterSchema = import_mini44.z.looseObject({
+  name: import_mini44.z.string(),
+  description: import_mini44.z.string()
 });
 var WindsurfSkill = class _WindsurfSkill extends ToolSkill {
   constructor({
@@ -12271,7 +12243,7 @@ var skillsProcessorToolTargetTuple = [
   "rovodev",
   "windsurf"
 ];
-var SkillsProcessorToolTargetSchema = import_mini46.z.enum(skillsProcessorToolTargetTuple);
+var SkillsProcessorToolTargetSchema = import_mini45.z.enum(skillsProcessorToolTargetTuple);
 var toolSkillFactories = /* @__PURE__ */ new Map([
   [
     "agentsmd",
@@ -12650,7 +12622,7 @@ var import_node_path89 = require("path");
 
 // src/features/subagents/simulated-subagent.ts
 var import_node_path88 = require("path");
-var import_mini47 = require("zod/mini");
+var import_mini46 = require("zod/mini");
 
 // src/features/subagents/tool-subagent.ts
 var ToolSubagent = class extends ToolFile {
@@ -12702,9 +12674,9 @@ var ToolSubagent = class extends ToolFile {
 };
 
 // src/features/subagents/simulated-subagent.ts
-var SimulatedSubagentFrontmatterSchema = import_mini47.z.object({
-  name: import_mini47.z.string(),
-  description: import_mini47.z.optional(import_mini47.z.string())
+var SimulatedSubagentFrontmatterSchema = import_mini46.z.object({
+  name: import_mini46.z.string(),
+  description: import_mini46.z.optional(import_mini46.z.string())
 });
 var SimulatedSubagent = class extends ToolSubagent {
   frontmatter;
@@ -12862,15 +12834,15 @@ var FactorydroidSubagent = class _FactorydroidSubagent extends SimulatedSubagent
 
 // src/features/subagents/geminicli-subagent.ts
 var import_node_path92 = require("path");
-var import_mini49 = require("zod/mini");
+var import_mini48 = require("zod/mini");
 
 // src/features/subagents/rulesync-subagent.ts
 var import_node_path91 = require("path");
-var import_mini48 = require("zod/mini");
-var RulesyncSubagentFrontmatterSchema = import_mini48.z.looseObject({
-  targets: import_mini48.z._default(RulesyncTargetsSchema, ["*"]),
-  name: import_mini48.z.string(),
-  description: import_mini48.z.optional(import_mini48.z.string())
+var import_mini47 = require("zod/mini");
+var RulesyncSubagentFrontmatterSchema = import_mini47.z.looseObject({
+  targets: import_mini47.z._default(RulesyncTargetsSchema, ["*"]),
+  name: import_mini47.z.string(),
+  description: import_mini47.z.optional(import_mini47.z.string())
 });
 var RulesyncSubagent = class _RulesyncSubagent extends RulesyncFile {
   frontmatter;
@@ -12939,9 +12911,9 @@ var RulesyncSubagent = class _RulesyncSubagent extends RulesyncFile {
 };
 
 // src/features/subagents/geminicli-subagent.ts
-var GeminiCliSubagentFrontmatterSchema = import_mini49.z.looseObject({
-  name: import_mini49.z.string(),
-  description: import_mini49.z.optional(import_mini49.z.string())
+var GeminiCliSubagentFrontmatterSchema = import_mini48.z.looseObject({
+  name: import_mini48.z.string(),
+  description: import_mini48.z.optional(import_mini48.z.string())
 });
 var GeminiCliSubagent = class _GeminiCliSubagent extends ToolSubagent {
   frontmatter;
@@ -13114,10 +13086,10 @@ var RooSubagent = class _RooSubagent extends SimulatedSubagent {
 
 // src/features/subagents/rovodev-subagent.ts
 var import_node_path94 = require("path");
-var import_mini50 = require("zod/mini");
-var RovodevSubagentFrontmatterSchema = import_mini50.z.looseObject({
-  name: import_mini50.z.string(),
-  description: import_mini50.z.optional(import_mini50.z.string())
+var import_mini49 = require("zod/mini");
+var RovodevSubagentFrontmatterSchema = import_mini49.z.looseObject({
+  name: import_mini49.z.string(),
+  description: import_mini49.z.optional(import_mini49.z.string())
 });
 var RovodevSubagent = class _RovodevSubagent extends ToolSubagent {
   frontmatter;
@@ -13259,18 +13231,18 @@ var RovodevSubagent = class _RovodevSubagent extends ToolSubagent {
 
 // src/features/subagents/subagents-processor.ts
 var import_node_path105 = require("path");
-var import_mini59 = require("zod/mini");
+var import_mini58 = require("zod/mini");
 
 // src/features/subagents/claudecode-subagent.ts
 var import_node_path95 = require("path");
-var import_mini51 = require("zod/mini");
-var ClaudecodeSubagentFrontmatterSchema = import_mini51.z.looseObject({
-  name: import_mini51.z.string(),
-  description: import_mini51.z.optional(import_mini51.z.string()),
-  model: import_mini51.z.optional(import_mini51.z.string()),
-  tools: import_mini51.z.optional(import_mini51.z.union([import_mini51.z.string(), import_mini51.z.array(import_mini51.z.string())])),
-  permissionMode: import_mini51.z.optional(import_mini51.z.string()),
-  skills: import_mini51.z.optional(import_mini51.z.union([import_mini51.z.string(), import_mini51.z.array(import_mini51.z.string())]))
+var import_mini50 = require("zod/mini");
+var ClaudecodeSubagentFrontmatterSchema = import_mini50.z.looseObject({
+  name: import_mini50.z.string(),
+  description: import_mini50.z.optional(import_mini50.z.string()),
+  model: import_mini50.z.optional(import_mini50.z.string()),
+  tools: import_mini50.z.optional(import_mini50.z.union([import_mini50.z.string(), import_mini50.z.array(import_mini50.z.string())])),
+  permissionMode: import_mini50.z.optional(import_mini50.z.string()),
+  skills: import_mini50.z.optional(import_mini50.z.union([import_mini50.z.string(), import_mini50.z.array(import_mini50.z.string())]))
 });
 var ClaudecodeSubagent = class _ClaudecodeSubagent extends ToolSubagent {
   frontmatter;
@@ -13426,16 +13398,16 @@ var ClaudecodeSubagent = class _ClaudecodeSubagent extends ToolSubagent {
 // src/features/subagents/codexcli-subagent.ts
 var import_node_path96 = require("path");
 var smolToml4 = __toESM(require("smol-toml"), 1);
-var import_mini52 = require("zod/mini");
-var CodexCliSubagentTomlSchema = import_mini52.z.looseObject({
-  name: import_mini52.z.string(),
-  description: import_mini52.z.optional(import_mini52.z.string()),
-  developer_instructions: import_mini52.z.optional(import_mini52.z.string()),
-  model: import_mini52.z.optional(import_mini52.z.string()),
-  model_reasoning_effort: import_mini52.z.optional(import_mini52.z.string()),
-  sandbox_mode: import_mini52.z.optional(import_mini52.z.string())
-});
-function stringifyCodexCliSubagentToml(tomlObj) {
+var import_mini51 = require("zod/mini");
+var CodexCliSubagentTomlSchema = import_mini51.z.looseObject({
+  name: import_mini51.z.string(),
+  description: import_mini51.z.optional(import_mini51.z.string()),
+  developer_instructions: import_mini51.z.optional(import_mini51.z.string()),
+  model: import_mini51.z.optional(import_mini51.z.string()),
+  model_reasoning_effort: import_mini51.z.optional(import_mini51.z.string()),
+  sandbox_mode: import_mini51.z.optional(import_mini51.z.string())
+});
+function stringifyCodexCliSubagentToml(tomlObj) {
   const { developer_instructions, ...restFields } = tomlObj;
   const restToml = smolToml4.stringify(restFields).trimEnd();
   if (developer_instructions === void 0) {
@@ -13599,12 +13571,12 @@ var CodexCliSubagent = class _CodexCliSubagent extends ToolSubagent {
 
 // src/features/subagents/copilot-subagent.ts
 var import_node_path97 = require("path");
-var import_mini53 = require("zod/mini");
+var import_mini52 = require("zod/mini");
 var REQUIRED_TOOL = "agent/runSubagent";
-var CopilotSubagentFrontmatterSchema = import_mini53.z.looseObject({
-  name: import_mini53.z.string(),
-  description: import_mini53.z.optional(import_mini53.z.string()),
-  tools: import_mini53.z.optional(import_mini53.z.union([import_mini53.z.string(), import_mini53.z.array(import_mini53.z.string())]))
+var CopilotSubagentFrontmatterSchema = import_mini52.z.looseObject({
+  name: import_mini52.z.string(),
+  description: import_mini52.z.optional(import_mini52.z.string()),
+  tools: import_mini52.z.optional(import_mini52.z.union([import_mini52.z.string(), import_mini52.z.array(import_mini52.z.string())]))
 });
 var normalizeTools = (tools) => {
   if (!tools) {
@@ -13616,6 +13588,21 @@ var ensureRequiredTool = (tools) => {
   const mergedTools = /* @__PURE__ */ new Set([REQUIRED_TOOL, ...tools]);
   return Array.from(mergedTools);
 };
+var toCopilotAgentFilePath = (relativeFilePath) => {
+  if (relativeFilePath.endsWith(".agent.md")) {
+    return relativeFilePath;
+  }
+  if (relativeFilePath.endsWith(".md")) {
+    return relativeFilePath.replace(/\.md$/, ".agent.md");
+  }
+  return relativeFilePath;
+};
+var toRulesyncFilePath = (relativeFilePath) => {
+  if (relativeFilePath.endsWith(".agent.md")) {
+    return relativeFilePath.replace(/\.agent\.md$/, ".md");
+  }
+  return relativeFilePath;
+};
 var CopilotSubagent = class _CopilotSubagent extends ToolSubagent {
   frontmatter;
   body;
@@ -13662,7 +13649,7 @@ var CopilotSubagent = class _CopilotSubagent extends ToolSubagent {
       frontmatter: rulesyncFrontmatter,
       body: this.body,
       relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
-      relativeFilePath: this.getRelativeFilePath(),
+      relativeFilePath: toRulesyncFilePath(this.getRelativeFilePath()),
       validate: true
     });
   }
@@ -13688,16 +13675,12 @@ var CopilotSubagent = class _CopilotSubagent extends ToolSubagent {
     const body = rulesyncSubagent.getBody();
     const fileContent = stringifyFrontmatter(body, copilotFrontmatter);
     const paths = this.getSettablePaths({ global });
-    let relativeFilePath = rulesyncSubagent.getRelativeFilePath();
-    if (!relativeFilePath.endsWith(".agent.md")) {
-      relativeFilePath = relativeFilePath.replace(/\.md$/, ".agent.md");
-    }
     return new _CopilotSubagent({
       baseDir,
       frontmatter: copilotFrontmatter,
       body,
       relativeDirPath: paths.relativeDirPath,
-      relativeFilePath,
+      relativeFilePath: toCopilotAgentFilePath(rulesyncSubagent.getRelativeFilePath()),
       fileContent,
       validate,
       global
@@ -13769,10 +13752,10 @@ var CopilotSubagent = class _CopilotSubagent extends ToolSubagent {
 
 // src/features/subagents/cursor-subagent.ts
 var import_node_path98 = require("path");
-var import_mini54 = require("zod/mini");
-var CursorSubagentFrontmatterSchema = import_mini54.z.looseObject({
-  name: import_mini54.z.string(),
-  description: import_mini54.z.optional(import_mini54.z.string())
+var import_mini53 = require("zod/mini");
+var CursorSubagentFrontmatterSchema = import_mini53.z.looseObject({
+  name: import_mini53.z.string(),
+  description: import_mini53.z.optional(import_mini53.z.string())
 });
 var CursorSubagent = class _CursorSubagent extends ToolSubagent {
   frontmatter;
@@ -13916,11 +13899,11 @@ var CursorSubagent = class _CursorSubagent extends ToolSubagent {
 
 // src/features/subagents/deepagents-subagent.ts
 var import_node_path99 = require("path");
-var import_mini55 = require("zod/mini");
-var DeepagentsSubagentFrontmatterSchema = import_mini55.z.looseObject({
-  name: import_mini55.z.string(),
-  description: import_mini55.z.optional(import_mini55.z.string()),
-  model: import_mini55.z.optional(import_mini55.z.string())
+var import_mini54 = require("zod/mini");
+var DeepagentsSubagentFrontmatterSchema = import_mini54.z.looseObject({
+  name: import_mini54.z.string(),
+  description: import_mini54.z.optional(import_mini54.z.string()),
+  model: import_mini54.z.optional(import_mini54.z.string())
 });
 var DeepagentsSubagent = class _DeepagentsSubagent extends ToolSubagent {
   frontmatter;
@@ -14069,10 +14052,10 @@ var DeepagentsSubagent = class _DeepagentsSubagent extends ToolSubagent {
 
 // src/features/subagents/junie-subagent.ts
 var import_node_path100 = require("path");
-var import_mini56 = require("zod/mini");
-var JunieSubagentFrontmatterSchema = import_mini56.z.looseObject({
-  name: import_mini56.z.optional(import_mini56.z.string()),
-  description: import_mini56.z.string()
+var import_mini55 = require("zod/mini");
+var JunieSubagentFrontmatterSchema = import_mini55.z.looseObject({
+  name: import_mini55.z.optional(import_mini55.z.string()),
+  description: import_mini55.z.string()
 });
 var JunieSubagent = class _JunieSubagent extends ToolSubagent {
   frontmatter;
@@ -14230,11 +14213,11 @@ var import_node_path102 = require("path");
 
 // src/features/subagents/opencode-style-subagent.ts
 var import_node_path101 = require("path");
-var import_mini57 = require("zod/mini");
-var OpenCodeStyleSubagentFrontmatterSchema = import_mini57.z.looseObject({
-  description: import_mini57.z.optional(import_mini57.z.string()),
-  mode: import_mini57.z._default(import_mini57.z.string(), "subagent"),
-  name: import_mini57.z.optional(import_mini57.z.string())
+var import_mini56 = require("zod/mini");
+var OpenCodeStyleSubagentFrontmatterSchema = import_mini56.z.looseObject({
+  description: import_mini56.z.optional(import_mini56.z.string()),
+  mode: import_mini56.z._default(import_mini56.z.string(), "subagent"),
+  name: import_mini56.z.optional(import_mini56.z.string())
 });
 var OpenCodeStyleSubagent = class extends ToolSubagent {
   frontmatter;
@@ -14383,22 +14366,22 @@ var KiloSubagent = class _KiloSubagent extends OpenCodeStyleSubagent {
 
 // src/features/subagents/kiro-subagent.ts
 var import_node_path103 = require("path");
-var import_mini58 = require("zod/mini");
-var KiroCliSubagentJsonSchema = import_mini58.z.looseObject({
-  name: import_mini58.z.string(),
-  description: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.string())),
-  prompt: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.string())),
-  tools: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.array(import_mini58.z.string()))),
-  toolAliases: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.record(import_mini58.z.string(), import_mini58.z.string()))),
-  toolSettings: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.unknown())),
-  toolSchema: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.unknown())),
-  hooks: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.record(import_mini58.z.string(), import_mini58.z.array(import_mini58.z.unknown())))),
-  model: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.string())),
-  mcpServers: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.record(import_mini58.z.string(), import_mini58.z.unknown()))),
-  useLegacyMcpJson: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.boolean())),
-  resources: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.array(import_mini58.z.string()))),
-  allowedTools: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.array(import_mini58.z.string()))),
-  includeMcpJson: import_mini58.z.optional(import_mini58.z.nullable(import_mini58.z.boolean()))
+var import_mini57 = require("zod/mini");
+var KiroCliSubagentJsonSchema = import_mini57.z.looseObject({
+  name: import_mini57.z.string(),
+  description: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.string())),
+  prompt: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.string())),
+  tools: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.array(import_mini57.z.string()))),
+  toolAliases: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.record(import_mini57.z.string(), import_mini57.z.string()))),
+  toolSettings: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.unknown())),
+  toolSchema: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.unknown())),
+  hooks: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.record(import_mini57.z.string(), import_mini57.z.array(import_mini57.z.unknown())))),
+  model: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.string())),
+  mcpServers: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.record(import_mini57.z.string(), import_mini57.z.unknown()))),
+  useLegacyMcpJson: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.boolean())),
+  resources: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.array(import_mini57.z.string()))),
+  allowedTools: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.array(import_mini57.z.string()))),
+  includeMcpJson: import_mini57.z.optional(import_mini57.z.nullable(import_mini57.z.boolean()))
 });
 var KiroSubagent = class _KiroSubagent extends ToolSubagent {
   body;
@@ -14659,7 +14642,7 @@ var subagentsProcessorToolTargetTuple = [
   "roo",
   "rovodev"
 ];
-var SubagentsProcessorToolTargetSchema = import_mini59.z.enum(subagentsProcessorToolTargetTuple);
+var SubagentsProcessorToolTargetSchema = import_mini58.z.enum(subagentsProcessorToolTargetTuple);
 var toolSubagentFactories = /* @__PURE__ */ new Map([
   [
     "agentsmd",
@@ -14969,42 +14952,42 @@ var import_node_path107 = require("path");
 
 // src/features/rules/rulesync-rule.ts
 var import_node_path106 = require("path");
-var import_mini60 = require("zod/mini");
-var RulesyncRuleFrontmatterSchema = import_mini60.z.object({
-  root: import_mini60.z.optional(import_mini60.z.boolean()),
-  localRoot: import_mini60.z.optional(import_mini60.z.boolean()),
-  targets: import_mini60.z._default(RulesyncTargetsSchema, ["*"]),
-  description: import_mini60.z.optional(import_mini60.z.string()),
-  globs: import_mini60.z.optional(import_mini60.z.array(import_mini60.z.string())),
-  agentsmd: import_mini60.z.optional(
-    import_mini60.z.looseObject({
+var import_mini59 = require("zod/mini");
+var RulesyncRuleFrontmatterSchema = import_mini59.z.object({
+  root: import_mini59.z.optional(import_mini59.z.boolean()),
+  localRoot: import_mini59.z.optional(import_mini59.z.boolean()),
+  targets: import_mini59.z._default(RulesyncTargetsSchema, ["*"]),
+  description: import_mini59.z.optional(import_mini59.z.string()),
+  globs: import_mini59.z.optional(import_mini59.z.array(import_mini59.z.string())),
+  agentsmd: import_mini59.z.optional(
+    import_mini59.z.looseObject({
       // @example "path/to/subproject"
-      subprojectPath: import_mini60.z.optional(import_mini60.z.string())
+      subprojectPath: import_mini59.z.optional(import_mini59.z.string())
     })
   ),
-  claudecode: import_mini60.z.optional(
-    import_mini60.z.looseObject({
+  claudecode: import_mini59.z.optional(
+    import_mini59.z.looseObject({
       // Glob patterns for conditional rules (takes precedence over globs)
       // @example ["src/**/*.ts", "tests/**/*.test.ts"]
-      paths: import_mini60.z.optional(import_mini60.z.array(import_mini60.z.string()))
+      paths: import_mini59.z.optional(import_mini59.z.array(import_mini59.z.string()))
     })
   ),
-  cursor: import_mini60.z.optional(
-    import_mini60.z.looseObject({
-      alwaysApply: import_mini60.z.optional(import_mini60.z.boolean()),
-      description: import_mini60.z.optional(import_mini60.z.string()),
-      globs: import_mini60.z.optional(import_mini60.z.array(import_mini60.z.string()))
+  cursor: import_mini59.z.optional(
+    import_mini59.z.looseObject({
+      alwaysApply: import_mini59.z.optional(import_mini59.z.boolean()),
+      description: import_mini59.z.optional(import_mini59.z.string()),
+      globs: import_mini59.z.optional(import_mini59.z.array(import_mini59.z.string()))
     })
   ),
-  copilot: import_mini60.z.optional(
-    import_mini60.z.looseObject({
-      excludeAgent: import_mini60.z.optional(import_mini60.z.union([import_mini60.z.literal("code-review"), import_mini60.z.literal("coding-agent")]))
+  copilot: import_mini59.z.optional(
+    import_mini59.z.looseObject({
+      excludeAgent: import_mini59.z.optional(import_mini59.z.union([import_mini59.z.literal("code-review"), import_mini59.z.literal("coding-agent")]))
     })
   ),
-  antigravity: import_mini60.z.optional(
-    import_mini60.z.looseObject({
-      trigger: import_mini60.z.optional(import_mini60.z.string()),
-      globs: import_mini60.z.optional(import_mini60.z.array(import_mini60.z.string()))
+  antigravity: import_mini59.z.optional(
+    import_mini59.z.looseObject({
+      trigger: import_mini59.z.optional(import_mini59.z.string()),
+      globs: import_mini59.z.optional(import_mini59.z.array(import_mini59.z.string()))
     })
   )
 });
@@ -15304,20 +15287,20 @@ var AgentsMdRule = class _AgentsMdRule extends ToolRule {
 
 // src/features/rules/antigravity-rule.ts
 var import_node_path109 = require("path");
-var import_mini61 = require("zod/mini");
-var AntigravityRuleFrontmatterSchema = import_mini61.z.looseObject({
-  trigger: import_mini61.z.optional(
-    import_mini61.z.union([
-      import_mini61.z.literal("always_on"),
-      import_mini61.z.literal("glob"),
-      import_mini61.z.literal("manual"),
-      import_mini61.z.literal("model_decision"),
-      import_mini61.z.string()
+var import_mini60 = require("zod/mini");
+var AntigravityRuleFrontmatterSchema = import_mini60.z.looseObject({
+  trigger: import_mini60.z.optional(
+    import_mini60.z.union([
+      import_mini60.z.literal("always_on"),
+      import_mini60.z.literal("glob"),
+      import_mini60.z.literal("manual"),
+      import_mini60.z.literal("model_decision"),
+      import_mini60.z.string()
       // accepts any string for forward compatibility
     ])
   ),
-  globs: import_mini61.z.optional(import_mini61.z.string()),
-  description: import_mini61.z.optional(import_mini61.z.string())
+  globs: import_mini60.z.optional(import_mini60.z.string()),
+  description: import_mini60.z.optional(import_mini60.z.string())
 });
 function parseGlobsString(globs) {
   if (!globs) {
@@ -15904,9 +15887,9 @@ var ClaudecodeLegacyRule = class _ClaudecodeLegacyRule extends ToolRule {
 
 // src/features/rules/claudecode-rule.ts
 var import_node_path113 = require("path");
-var import_mini62 = require("zod/mini");
-var ClaudecodeRuleFrontmatterSchema = import_mini62.z.object({
-  paths: import_mini62.z.optional(import_mini62.z.array(import_mini62.z.string()))
+var import_mini61 = require("zod/mini");
+var ClaudecodeRuleFrontmatterSchema = import_mini61.z.object({
+  paths: import_mini61.z.optional(import_mini61.z.array(import_mini61.z.string()))
 });
 var ClaudecodeRule = class _ClaudecodeRule extends ToolRule {
   frontmatter;
@@ -16122,9 +16105,9 @@ var ClaudecodeRule = class _ClaudecodeRule extends ToolRule {
 
 // src/features/rules/cline-rule.ts
 var import_node_path114 = require("path");
-var import_mini63 = require("zod/mini");
-var ClineRuleFrontmatterSchema = import_mini63.z.object({
-  description: import_mini63.z.string()
+var import_mini62 = require("zod/mini");
+var ClineRuleFrontmatterSchema = import_mini62.z.object({
+  description: import_mini62.z.string()
 });
 var ClineRule = class _ClineRule extends ToolRule {
   static getSettablePaths(_options = {}) {
@@ -16303,11 +16286,11 @@ var CodexcliRule = class _CodexcliRule extends ToolRule {
 
 // src/features/rules/copilot-rule.ts
 var import_node_path116 = require("path");
-var import_mini64 = require("zod/mini");
-var CopilotRuleFrontmatterSchema = import_mini64.z.object({
-  description: import_mini64.z.optional(import_mini64.z.string()),
-  applyTo: import_mini64.z.optional(import_mini64.z.string()),
-  excludeAgent: import_mini64.z.optional(import_mini64.z.union([import_mini64.z.literal("code-review"), import_mini64.z.literal("coding-agent")]))
+var import_mini63 = require("zod/mini");
+var CopilotRuleFrontmatterSchema = import_mini63.z.object({
+  description: import_mini63.z.optional(import_mini63.z.string()),
+  applyTo: import_mini63.z.optional(import_mini63.z.string()),
+  excludeAgent: import_mini63.z.optional(import_mini63.z.union([import_mini63.z.literal("code-review"), import_mini63.z.literal("coding-agent")]))
 });
 var CopilotRule = class _CopilotRule extends ToolRule {
   frontmatter;
@@ -16549,11 +16532,11 @@ var CopilotcliRule = class _CopilotcliRule extends CopilotRule {
 
 // src/features/rules/cursor-rule.ts
 var import_node_path117 = require("path");
-var import_mini65 = require("zod/mini");
-var CursorRuleFrontmatterSchema = import_mini65.z.object({
-  description: import_mini65.z.optional(import_mini65.z.string()),
-  globs: import_mini65.z.optional(import_mini65.z.string()),
-  alwaysApply: import_mini65.z.optional(import_mini65.z.boolean())
+var import_mini64 = require("zod/mini");
+var CursorRuleFrontmatterSchema = import_mini64.z.object({
+  description: import_mini64.z.optional(import_mini64.z.string()),
+  globs: import_mini64.z.optional(import_mini64.z.string()),
+  alwaysApply: import_mini64.z.optional(import_mini64.z.boolean())
 });
 var CursorRule = class _CursorRule extends ToolRule {
   frontmatter;
@@ -18213,11 +18196,11 @@ var rulesProcessorToolTargets = [
   "warp",
   "windsurf"
 ];
-var RulesProcessorToolTargetSchema = import_mini66.z.enum(rulesProcessorToolTargets);
+var RulesProcessorToolTargetSchema = import_mini65.z.enum(rulesProcessorToolTargets);
 var formatRulePaths = (rules) => rules.map((r) => (0, import_node_path132.join)(r.getRelativeDirPath(), r.getRelativeFilePath())).join(", ");
-var RulesFeatureOptionsSchema = import_mini66.z.looseObject({
-  ruleDiscoveryMode: import_mini66.z.optional(import_mini66.z.enum(["none", "explicit"])),
-  includeLocalRoot: import_mini66.z.optional(import_mini66.z.boolean())
+var RulesFeatureOptionsSchema = import_mini65.z.looseObject({
+  ruleDiscoveryMode: import_mini65.z.optional(import_mini65.z.enum(["none", "explicit"])),
+  includeLocalRoot: import_mini65.z.optional(import_mini65.z.boolean())
 });
 var resolveRuleDiscoveryMode = ({
   defaultMode,
@@ -18238,8 +18221,8 @@ var resolveRuleDiscoveryMode = ({
   }
   return parsed.data.ruleDiscoveryMode === "none" ? "auto" : "toon";
 };
-var IncludeLocalRootSchema = import_mini66.z.looseObject({
-  includeLocalRoot: import_mini66.z.optional(import_mini66.z.boolean())
+var IncludeLocalRootSchema = import_mini65.z.looseObject({
+  includeLocalRoot: import_mini65.z.optional(import_mini65.z.boolean())
 });
 var resolveIncludeLocalRoot = (options) => {
   if (!options) return true;
@@ -19182,51 +19165,51 @@ var import_request_error = require("@octokit/request-error");
 var import_rest = require("@octokit/rest");
 
 // src/types/fetch.ts
-var import_mini68 = require("zod/mini");
+var import_mini67 = require("zod/mini");
 
 // src/types/fetch-targets.ts
-var import_mini67 = require("zod/mini");
+var import_mini66 = require("zod/mini");
 var ALL_FETCH_TARGETS = ["rulesync", ...ALL_TOOL_TARGETS];
-var FetchTargetSchema = import_mini67.z.enum(ALL_FETCH_TARGETS);
+var FetchTargetSchema = import_mini66.z.enum(ALL_FETCH_TARGETS);
 
 // src/types/fetch.ts
-var ConflictStrategySchema = import_mini68.z.enum(["skip", "overwrite"]);
-var GitHubFileTypeSchema = import_mini68.z.enum(["file", "dir", "symlink", "submodule"]);
-var GitHubFileEntrySchema = import_mini68.z.looseObject({
-  name: import_mini68.z.string(),
-  path: import_mini68.z.string(),
-  sha: import_mini68.z.string(),
-  size: import_mini68.z.number(),
+var ConflictStrategySchema = import_mini67.z.enum(["skip", "overwrite"]);
+var GitHubFileTypeSchema = import_mini67.z.enum(["file", "dir", "symlink", "submodule"]);
+var GitHubFileEntrySchema = import_mini67.z.looseObject({
+  name: import_mini67.z.string(),
+  path: import_mini67.z.string(),
+  sha: import_mini67.z.string(),
+  size: import_mini67.z.number(),
   type: GitHubFileTypeSchema,
-  download_url: import_mini68.z.nullable(import_mini68.z.string())
+  download_url: import_mini67.z.nullable(import_mini67.z.string())
 });
-var FetchOptionsSchema = import_mini68.z.looseObject({
-  target: import_mini68.z.optional(FetchTargetSchema),
-  features: import_mini68.z.optional(import_mini68.z.array(import_mini68.z.enum(ALL_FEATURES_WITH_WILDCARD))),
-  ref: import_mini68.z.optional(import_mini68.z.string()),
-  path: import_mini68.z.optional(import_mini68.z.string()),
-  output: import_mini68.z.optional(import_mini68.z.string()),
-  conflict: import_mini68.z.optional(ConflictStrategySchema),
-  token: import_mini68.z.optional(import_mini68.z.string()),
-  verbose: import_mini68.z.optional(import_mini68.z.boolean()),
-  silent: import_mini68.z.optional(import_mini68.z.boolean())
+var FetchOptionsSchema = import_mini67.z.looseObject({
+  target: import_mini67.z.optional(FetchTargetSchema),
+  features: import_mini67.z.optional(import_mini67.z.array(import_mini67.z.enum(ALL_FEATURES_WITH_WILDCARD))),
+  ref: import_mini67.z.optional(import_mini67.z.string()),
+  path: import_mini67.z.optional(import_mini67.z.string()),
+  output: import_mini67.z.optional(import_mini67.z.string()),
+  conflict: import_mini67.z.optional(ConflictStrategySchema),
+  token: import_mini67.z.optional(import_mini67.z.string()),
+  verbose: import_mini67.z.optional(import_mini67.z.boolean()),
+  silent: import_mini67.z.optional(import_mini67.z.boolean())
 });
-var FetchFileStatusSchema = import_mini68.z.enum(["created", "overwritten", "skipped"]);
-var GitHubRepoInfoSchema = import_mini68.z.looseObject({
-  default_branch: import_mini68.z.string(),
-  private: import_mini68.z.boolean()
+var FetchFileStatusSchema = import_mini67.z.enum(["created", "overwritten", "skipped"]);
+var GitHubRepoInfoSchema = import_mini67.z.looseObject({
+  default_branch: import_mini67.z.string(),
+  private: import_mini67.z.boolean()
 });
-var GitHubReleaseAssetSchema = import_mini68.z.looseObject({
-  name: import_mini68.z.string(),
-  browser_download_url: import_mini68.z.string(),
-  size: import_mini68.z.number()
+var GitHubReleaseAssetSchema = import_mini67.z.looseObject({
+  name: import_mini67.z.string(),
+  browser_download_url: import_mini67.z.string(),
+  size: import_mini67.z.number()
 });
-var GitHubReleaseSchema = import_mini68.z.looseObject({
-  tag_name: import_mini68.z.string(),
-  name: import_mini68.z.nullable(import_mini68.z.string()),
-  prerelease: import_mini68.z.boolean(),
-  draft: import_mini68.z.boolean(),
-  assets: import_mini68.z.array(GitHubReleaseAssetSchema)
+var GitHubReleaseSchema = import_mini67.z.looseObject({
+  tag_name: import_mini67.z.string(),
+  name: import_mini67.z.nullable(import_mini67.z.string()),
+  prerelease: import_mini67.z.boolean(),
+  draft: import_mini67.z.boolean(),
+  assets: import_mini67.z.array(GitHubReleaseAssetSchema)
 });
 
 // src/lib/github-client.ts
@@ -19527,9 +19510,9 @@ async function listDirectoryRecursive(params) {
 }
 
 // src/types/git-provider.ts
-var import_mini69 = require("zod/mini");
+var import_mini68 = require("zod/mini");
 var ALL_GIT_PROVIDERS = ["github", "gitlab"];
-var GitProviderSchema = import_mini69.z.enum(ALL_GIT_PROVIDERS);
+var GitProviderSchema = import_mini68.z.enum(ALL_GIT_PROVIDERS);
 
 // src/lib/source-parser.ts
 var GITHUB_HOSTS = /* @__PURE__ */ new Set(["github.com", "www.github.com"]);
@@ -20152,7 +20135,7 @@ var import_jsonc_parser4 = require("jsonc-parser");
 
 // src/config/config.ts
 var import_node_path134 = require("path");
-var import_mini70 = require("zod/mini");
+var import_mini69 = require("zod/mini");
 
 // src/utils/validation.ts
 function findControlCharacter(value) {
@@ -20170,49 +20153,55 @@ function hasControlCharacters(value) {
 
 // src/config/config.ts
 var GITIGNORE_DESTINATION_KEY = "gitignoreDestination";
-var SourceEntrySchema = import_mini70.z.object({
-  source: import_mini70.z.string().check((0, import_mini70.minLength)(1, "source must be a non-empty string")),
-  skills: (0, import_mini70.optional)(import_mini70.z.array(import_mini70.z.string())),
-  transport: (0, import_mini70.optional)(import_mini70.z.enum(["github", "git"])),
-  ref: (0, import_mini70.optional)(
-    import_mini70.z.string().check(
-      (0, import_mini70.refine)((v) => !v.startsWith("-"), 'ref must not start with "-"'),
-      (0, import_mini70.refine)((v) => !hasControlCharacters(v), "ref must not contain control characters")
+var SourceEntrySchema = import_mini69.z.object({
+  source: import_mini69.z.string().check((0, import_mini69.minLength)(1, "source must be a non-empty string")),
+  skills: (0, import_mini69.optional)(import_mini69.z.array(import_mini69.z.string())),
+  transport: (0, import_mini69.optional)(import_mini69.z.enum(["github", "git"])),
+  ref: (0, import_mini69.optional)(
+    import_mini69.z.string().check(
+      (0, import_mini69.refine)((v) => !v.startsWith("-"), 'ref must not start with "-"'),
+      (0, import_mini69.refine)((v) => !hasControlCharacters(v), "ref must not contain control characters")
     )
   ),
-  path: (0, import_mini70.optional)(
-    import_mini70.z.string().check(
-      (0, import_mini70.refine)((v) => !v.includes(".."), 'path must not contain ".."'),
-      (0, import_mini70.refine)((v) => !(0, import_node_path134.isAbsolute)(v), "path must not be absolute"),
-      (0, import_mini70.refine)((v) => !hasControlCharacters(v), "path must not contain control characters")
+  path: (0, import_mini69.optional)(
+    import_mini69.z.string().check(
+      (0, import_mini69.refine)((v) => !v.includes(".."), 'path must not contain ".."'),
+      (0, import_mini69.refine)((v) => !(0, import_node_path134.isAbsolute)(v), "path must not be absolute"),
+      (0, import_mini69.refine)((v) => !hasControlCharacters(v), "path must not contain control characters")
     )
-  )
+  ),
+  // gh-mode-only fields. Ignored by --mode rulesync. Defaults applied at the
+  // gh install site (`agent` defaults to "github-copilot", `scope` to "project").
+  agent: (0, import_mini69.optional)(
+    import_mini69.z.enum(["github-copilot", "claude-code", "cursor", "codex", "gemini", "antigravity"])
+  ),
+  scope: (0, import_mini69.optional)(import_mini69.z.enum(["project", "user"]))
 });
-var ConfigParamsSchema = import_mini70.z.object({
-  baseDirs: import_mini70.z.array(import_mini70.z.string()),
+var ConfigParamsSchema = import_mini69.z.object({
+  baseDirs: import_mini69.z.array(import_mini69.z.string()),
   targets: RulesyncConfigTargetsSchema,
   features: RulesyncFeaturesSchema,
-  verbose: import_mini70.z.boolean(),
-  delete: import_mini70.z.boolean(),
+  verbose: import_mini69.z.boolean(),
+  delete: import_mini69.z.boolean(),
   // New non-experimental options
-  global: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  silent: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  simulateCommands: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  simulateSubagents: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  simulateSkills: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  gitignoreTargetsOnly: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  gitignoreDestination: (0, import_mini70.optional)(GitignoreDestinationSchema),
-  dryRun: (0, import_mini70.optional)(import_mini70.z.boolean()),
-  check: (0, import_mini70.optional)(import_mini70.z.boolean()),
+  global: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  silent: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  simulateCommands: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  simulateSubagents: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  simulateSkills: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  gitignoreTargetsOnly: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  gitignoreDestination: (0, import_mini69.optional)(GitignoreDestinationSchema),
+  dryRun: (0, import_mini69.optional)(import_mini69.z.boolean()),
+  check: (0, import_mini69.optional)(import_mini69.z.boolean()),
   // Declarative skill sources
-  sources: (0, import_mini70.optional)(import_mini70.z.array(SourceEntrySchema))
+  sources: (0, import_mini69.optional)(import_mini69.z.array(SourceEntrySchema))
 });
-var PartialConfigParamsSchema = import_mini70.z.partial(ConfigParamsSchema);
-var ConfigFileSchema = import_mini70.z.object({
-  $schema: (0, import_mini70.optional)(import_mini70.z.string()),
-  ...import_mini70.z.partial(ConfigParamsSchema).shape
+var PartialConfigParamsSchema = import_mini69.z.partial(ConfigParamsSchema);
+var ConfigFileSchema = import_mini69.z.object({
+  $schema: (0, import_mini69.optional)(import_mini69.z.string()),
+  ...import_mini69.z.partial(ConfigParamsSchema).shape
 });
-var RequiredConfigParamsSchema = import_mini70.z.required(ConfigParamsSchema);
+var RequiredConfigParamsSchema = import_mini69.z.required(ConfigParamsSchema);
 var CONFLICTING_TARGET_PAIRS = [
   ["augmentcode", "augmentcode-legacy"],
   ["claudecode", "claudecode-legacy"]
@@ -20702,7 +20691,7 @@ var import_node_path142 = require("path");
 var import_es_toolkit5 = require("es-toolkit");
 
 // src/features/permissions/permissions-processor.ts
-var import_mini75 = require("zod/mini");
+var import_mini74 = require("zod/mini");
 
 // src/features/permissions/claudecode-permissions.ts
 var import_node_path137 = require("path");
@@ -20712,14 +20701,14 @@ var import_es_toolkit4 = require("es-toolkit");
 var import_node_path136 = require("path");
 
 // src/types/permissions.ts
-var import_mini71 = require("zod/mini");
-var PermissionActionSchema = import_mini71.z.enum(["allow", "ask", "deny"]);
-var PermissionRulesSchema = import_mini71.z.record(import_mini71.z.string(), PermissionActionSchema);
-var PermissionsConfigSchema = import_mini71.z.looseObject({
-  permission: import_mini71.z.record(import_mini71.z.string(), PermissionRulesSchema)
+var import_mini70 = require("zod/mini");
+var PermissionActionSchema = import_mini70.z.enum(["allow", "ask", "deny"]);
+var PermissionRulesSchema = import_mini70.z.record(import_mini70.z.string(), PermissionActionSchema);
+var PermissionsConfigSchema = import_mini70.z.looseObject({
+  permission: import_mini70.z.record(import_mini70.z.string(), PermissionRulesSchema)
 });
-var RulesyncPermissionsFileSchema = import_mini71.z.looseObject({
-  $schema: import_mini71.z.optional(import_mini71.z.string()),
+var RulesyncPermissionsFileSchema = import_mini70.z.looseObject({
+  $schema: import_mini70.z.optional(import_mini70.z.string()),
   ...PermissionsConfigSchema.shape
 });
 
@@ -21289,7 +21278,7 @@ function mapBashActionToDecision(action) {
 // src/features/permissions/geminicli-permissions.ts
 var import_node_path139 = require("path");
 var smolToml6 = __toESM(require("smol-toml"), 1);
-var import_mini72 = require("zod/mini");
+var import_mini71 = require("zod/mini");
 
 // src/utils/logger.ts
 var BaseLogger = class {
@@ -21763,14 +21752,14 @@ function regexToGlobPattern(regex) {
   }
   return glob;
 }
-var GeminicliPolicyRuleSchema = import_mini72.z.looseObject({
-  toolName: import_mini72.z.string(),
-  decision: import_mini72.z.optional(import_mini72.z.unknown()),
-  commandPrefix: import_mini72.z.optional(import_mini72.z.string()),
-  argsPattern: import_mini72.z.optional(import_mini72.z.string())
+var GeminicliPolicyRuleSchema = import_mini71.z.looseObject({
+  toolName: import_mini71.z.string(),
+  decision: import_mini71.z.optional(import_mini71.z.unknown()),
+  commandPrefix: import_mini71.z.optional(import_mini71.z.string()),
+  argsPattern: import_mini71.z.optional(import_mini71.z.string())
 });
-var GeminicliPolicyFileSchema = import_mini72.z.looseObject({
-  rule: import_mini72.z.optional(import_mini72.z.array(import_mini72.z.looseObject({})))
+var GeminicliPolicyFileSchema = import_mini71.z.looseObject({
+  rule: import_mini71.z.optional(import_mini71.z.array(import_mini71.z.looseObject({})))
 });
 function extractRules(parsed, logger5) {
   const parsedFile = GeminicliPolicyFileSchema.safeParse(parsed);
@@ -21806,12 +21795,12 @@ function extractPattern(rule) {
 
 // src/features/permissions/kiro-permissions.ts
 var import_node_path140 = require("path");
-var import_mini73 = require("zod/mini");
-var KiroAgentSchema = import_mini73.z.looseObject({
-  allowedTools: import_mini73.z.optional(import_mini73.z.array(import_mini73.z.string())),
-  toolsSettings: import_mini73.z.optional(import_mini73.z.record(import_mini73.z.string(), import_mini73.z.unknown()))
+var import_mini72 = require("zod/mini");
+var KiroAgentSchema = import_mini72.z.looseObject({
+  allowedTools: import_mini72.z.optional(import_mini72.z.array(import_mini72.z.string())),
+  toolsSettings: import_mini72.z.optional(import_mini72.z.record(import_mini72.z.string(), import_mini72.z.unknown()))
 });
-var UnknownRecordSchema = import_mini73.z.record(import_mini73.z.string(), import_mini73.z.unknown());
+var UnknownRecordSchema = import_mini72.z.record(import_mini72.z.string(), import_mini72.z.unknown());
 var KiroPermissions = class _KiroPermissions extends ToolPermissions {
   static getSettablePaths(_options = {}) {
     return {
@@ -21964,8 +21953,12 @@ function buildKiroPermissionsFromRulesync({
           );
           continue;
         }
-        if (action === "allow")
-          nextAllowedTools.add(category === "webfetch" ? "web_fetch" : "web_search");
+        const toolName = category === "webfetch" ? "web_fetch" : "web_search";
+        if (action === "allow") {
+          nextAllowedTools.add(toolName);
+        } else {
+          nextAllowedTools.delete(toolName);
+        }
       } else {
         logger5?.warn(`Kiro permissions do not support category: ${category}. Skipping.`);
       }
@@ -21991,13 +21984,13 @@ function asStringArray(value) {
 // src/features/permissions/opencode-permissions.ts
 var import_node_path141 = require("path");
 var import_jsonc_parser5 = require("jsonc-parser");
-var import_mini74 = require("zod/mini");
-var OpencodePermissionSchema = import_mini74.z.union([
-  import_mini74.z.enum(["allow", "ask", "deny"]),
-  import_mini74.z.record(import_mini74.z.string(), import_mini74.z.enum(["allow", "ask", "deny"]))
+var import_mini73 = require("zod/mini");
+var OpencodePermissionSchema = import_mini73.z.union([
+  import_mini73.z.enum(["allow", "ask", "deny"]),
+  import_mini73.z.record(import_mini73.z.string(), import_mini73.z.enum(["allow", "ask", "deny"]))
 ]);
-var OpencodePermissionsConfigSchema = import_mini74.z.looseObject({
-  permission: import_mini74.z.optional(import_mini74.z.record(import_mini74.z.string(), OpencodePermissionSchema))
+var OpencodePermissionsConfigSchema = import_mini73.z.looseObject({
+  permission: import_mini73.z.optional(import_mini73.z.record(import_mini73.z.string(), OpencodePermissionSchema))
 });
 var OpencodePermissions = class _OpencodePermissions extends ToolPermissions {
   json;
@@ -22128,7 +22121,7 @@ var permissionsProcessorToolTargetTuple = [
   "kiro",
   "opencode"
 ];
-var PermissionsProcessorToolTargetSchema = import_mini75.z.enum(permissionsProcessorToolTargetTuple);
+var PermissionsProcessorToolTargetSchema = import_mini74.z.enum(permissionsProcessorToolTargetTuple);
 var toolPermissionsFactories = /* @__PURE__ */ new Map([
   [
     "claudecode",
@@ -23893,157 +23886,1315 @@ async function initCommand(logger5) {
   logger5.info("2. Run 'rulesync generate' to create configuration files");
 }
 
-// src/lib/sources.ts
+// src/lib/apm/apm-install.ts
+var import_node_crypto = require("crypto");
 var import_node_path147 = require("path");
 var import_promise2 = require("es-toolkit/promise");
 
-// src/lib/git-client.ts
-var import_node_child_process = require("child_process");
+// src/lib/apm/apm-lock.ts
 var import_node_path145 = require("path");
-var import_node_util2 = require("util");
-var execFileAsync = (0, import_node_util2.promisify)(import_node_child_process.execFile);
-var GIT_TIMEOUT_MS = 6e4;
-var ALLOWED_URL_SCHEMES = /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/\/).+$|^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9.-]+:[a-zA-Z0-9_.+/~-]+$/;
-var INSECURE_URL_SCHEMES = /^(git:\/\/|http:\/\/)/;
-var GitClientError = class extends Error {
-  constructor(message, cause) {
-    super(message, { cause });
-    this.name = "GitClientError";
+var import_js_yaml3 = require("js-yaml");
+var import_mini75 = require("zod/mini");
+var APM_LOCKFILE_FILE_NAME = "rulesync-apm.lock.yaml";
+var APM_LOCKFILE_VERSION = "1";
+var RULESYNC_CONTENT_HASH_REGEX = /^sha256:[0-9a-f]{64}$/;
+var ApmLockDependencySchema = import_mini75.z.looseObject({
+  repo_url: import_mini75.z.string(),
+  resolved_commit: (0, import_mini75.optional)(
+    import_mini75.z.string().check((0, import_mini75.refine)((v) => /^[0-9a-f]{40}$/.test(v), "resolved_commit must be a 40-char hex SHA"))
+  ),
+  resolved_ref: (0, import_mini75.optional)(import_mini75.z.string()),
+  version: (0, import_mini75.optional)(import_mini75.z.string()),
+  depth: import_mini75.z.int().check((0, import_mini75.nonnegative)()),
+  resolved_by: (0, import_mini75.optional)(import_mini75.z.string()),
+  package_type: import_mini75.z.string(),
+  // Intentionally loose: the upstream `apm` CLI may write content_hash values
+  // that do not match the strict rulesync format. We accept any string on read
+  // so that a lockfile produced by `apm` round-trips through rulesync without
+  // throwing. Rulesync itself always writes values matching
+  // `RULESYNC_CONTENT_HASH_REGEX`, and `--frozen` integrity checks only
+  // enforce the comparison when the recorded hash matches that shape.
+  content_hash: (0, import_mini75.optional)(import_mini75.z.string()),
+  is_dev: (0, import_mini75.optional)(import_mini75.z.boolean()),
+  deployed_files: import_mini75.z.array(import_mini75.z.string()),
+  source: (0, import_mini75.optional)(import_mini75.z.string()),
+  local_path: (0, import_mini75.optional)(import_mini75.z.string()),
+  virtual_path: (0, import_mini75.optional)(import_mini75.z.string()),
+  is_virtual: (0, import_mini75.optional)(import_mini75.z.boolean())
+});
+var ApmLockSchema = import_mini75.z.looseObject({
+  lockfile_version: import_mini75.z.literal("1"),
+  generated_at: import_mini75.z.string(),
+  apm_version: import_mini75.z.string(),
+  dependencies: import_mini75.z.array(ApmLockDependencySchema),
+  mcp_servers: (0, import_mini75.optional)(import_mini75.z.array(import_mini75.z.string()))
+});
+function getApmLockPath(baseDir) {
+  return (0, import_node_path145.join)(baseDir, APM_LOCKFILE_FILE_NAME);
+}
+function createEmptyApmLock(params) {
+  const base = params.existingLock ? { ...params.existingLock } : {};
+  return {
+    ...base,
+    lockfile_version: APM_LOCKFILE_VERSION,
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    apm_version: params.apmVersion,
+    dependencies: []
+  };
+}
+function parseApmLock(content) {
+  if (!content.trim()) {
+    return null;
   }
-};
-function validateGitUrl(url, options) {
-  const ctrl = findControlCharacter(url);
-  if (ctrl) {
-    throw new GitClientError(
-      `Git URL contains control character ${ctrl.hex} at position ${ctrl.position}`
-    );
+  let loaded;
+  try {
+    loaded = (0, import_js_yaml3.load)(content);
+  } catch {
+    return null;
   }
-  if (!ALLOWED_URL_SCHEMES.test(url)) {
-    throw new GitClientError(
-      `Unsupported or unsafe git URL: "${url}". Use https, ssh, git, or file schemes.`
+  if (!loaded || typeof loaded !== "object") {
+    return null;
+  }
+  const parsed = ApmLockSchema.safeParse(loaded);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => `  - ${issue.path.join(".") || "<root>"}: ${issue.message}`).join("\n");
+    throw new Error(`Invalid ${APM_LOCKFILE_FILE_NAME}:
+${issues}`);
+  }
+  return parsed.data;
+}
+async function readApmLock(baseDir) {
+  const path4 = getApmLockPath(baseDir);
+  if (!await fileExists(path4)) {
+    return null;
+  }
+  const content = await readFileContent(path4);
+  return parseApmLock(content);
+}
+async function writeApmLock(params) {
+  const path4 = getApmLockPath(params.baseDir);
+  const content = serializeApmLock(params.lock);
+  await writeFileContent(path4, content);
+}
+function serializeApmLock(lock) {
+  return (0, import_js_yaml3.dump)(lock, { noRefs: true, lineWidth: -1, sortKeys: false });
+}
+function findApmLockDependency(lock, repoUrl) {
+  const target = repoUrl.toLowerCase();
+  return lock.dependencies.find((d) => d.repo_url.toLowerCase() === target);
+}
+
+// src/lib/apm/apm-manifest.ts
+var import_node_path146 = require("path");
+var import_js_yaml4 = require("js-yaml");
+var import_mini76 = require("zod/mini");
+var APM_MANIFEST_FILE_NAME = "apm.yml";
+var ApmObjectDependencySchema = import_mini76.z.looseObject({
+  git: (0, import_mini76.optional)(import_mini76.z.string()),
+  source: (0, import_mini76.optional)(import_mini76.z.string()),
+  path: (0, import_mini76.optional)(import_mini76.z.string()),
+  ref: (0, import_mini76.optional)(import_mini76.z.string()),
+  alias: (0, import_mini76.optional)(import_mini76.z.string())
+});
+var ApmDependencyInputSchema = import_mini76.z.union([import_mini76.z.string(), ApmObjectDependencySchema]);
+var ApmManifestSchema = import_mini76.z.looseObject({
+  name: (0, import_mini76.optional)(import_mini76.z.string()),
+  version: (0, import_mini76.optional)(import_mini76.z.string()),
+  dependencies: (0, import_mini76.optional)(
+    import_mini76.z.looseObject({
+      apm: (0, import_mini76.optional)(import_mini76.z.array(ApmDependencyInputSchema))
+    })
+  )
+});
+function getApmManifestPath(baseDir) {
+  return (0, import_node_path146.join)(baseDir, APM_MANIFEST_FILE_NAME);
+}
+async function apmManifestExists(baseDir) {
+  return fileExists(getApmManifestPath(baseDir));
+}
+function parseApmManifest(content) {
+  const loaded = (0, import_js_yaml4.load)(content);
+  if (loaded === void 0 || loaded === null) {
+    return { dependencies: [] };
+  }
+  const parsed = ApmManifestSchema.safeParse(loaded);
+  if (!parsed.success) {
+    throw new Error(`Invalid apm.yml: ${parsed.error.message}`);
+  }
+  const raw = parsed.data;
+  const rawDeps = raw.dependencies?.apm ?? [];
+  const dependencies = rawDeps.map(
+    (entry, index) => normalizeDependency(entry, index)
+  );
+  return {
+    name: raw.name,
+    version: raw.version,
+    dependencies
+  };
+}
+async function readApmManifest(baseDir) {
+  const path4 = getApmManifestPath(baseDir);
+  const content = await readFileContent(path4);
+  return parseApmManifest(content);
+}
+function normalizeDependency(entry, index) {
+  if (typeof entry === "string") {
+    return normalizeStringDependency(entry, index);
+  }
+  const gitUrl = entry.git ?? entry.source;
+  if (!gitUrl) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: object form requires a "git" field. Received: ${JSON.stringify(entry)}.`
     );
   }
-  if (INSECURE_URL_SCHEMES.test(url)) {
-    options?.logger?.warn(
-      `URL "${url}" uses an unencrypted protocol. Consider using https:// or ssh:// instead.`
+  const parsedUrl = parseHttpsGitHubUrl(gitUrl);
+  if (!parsedUrl) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: unsupported git URL "${gitUrl}". Only HTTPS GitHub URLs (https://github.com/owner/repo[.git]) are supported in this version. SSH, GitLab, Bitbucket, and other hosts are not yet supported.`
     );
   }
+  if (entry.path !== void 0) {
+    validateSubPath(entry.path, index);
+  }
+  return {
+    gitUrl: parsedUrl.gitUrl,
+    owner: parsedUrl.owner,
+    repo: parsedUrl.repo,
+    ref: entry.ref,
+    path: entry.path,
+    alias: entry.alias
+  };
 }
-function validateRef(ref) {
-  if (ref.startsWith("-")) {
-    throw new GitClientError(`Ref must not start with "-": "${ref}"`);
+function validateSubPath(subPath, index) {
+  if (subPath === "" || subPath.startsWith("/") || subPath.startsWith("\\")) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: "path" must be a non-empty relative path without a leading slash. Received: ${JSON.stringify(subPath)}.`
+    );
   }
-  const ctrl = findControlCharacter(ref);
-  if (ctrl) {
-    throw new GitClientError(
-      `Ref contains control character ${ctrl.hex} at position ${ctrl.position}`
+  const segments = subPath.split(/[/\\]/);
+  if (segments.includes("..")) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: "path" must not contain ".." segments. Received: ${JSON.stringify(subPath)}.`
     );
   }
 }
-var gitChecked = false;
-async function checkGitAvailable() {
-  if (gitChecked) return;
-  try {
-    await execFileAsync("git", ["--version"], { timeout: GIT_TIMEOUT_MS });
-    gitChecked = true;
-  } catch {
-    throw new GitClientError("git is not installed or not found in PATH");
+function normalizeStringDependency(entry, index) {
+  const trimmed = entry.trim();
+  if (!trimmed) {
+    throw new Error(`apm.yml dependency #${index + 1}: entry must be a non-empty string.`);
+  }
+  rejectUnsupportedShorthand(trimmed, index);
+  if (trimmed.startsWith("https://")) {
+    const [urlPart, refPart2] = splitOnFirst(trimmed, "#");
+    const parsed = parseHttpsGitHubUrl(urlPart);
+    if (!parsed) {
+      throw new Error(
+        `apm.yml dependency #${index + 1}: unsupported URL "${urlPart}". Only HTTPS GitHub URLs (https://github.com/owner/repo[.git]) are supported in this version.`
+      );
+    }
+    return {
+      gitUrl: parsed.gitUrl,
+      owner: parsed.owner,
+      repo: parsed.repo,
+      ref: refPart2 || void 0
+    };
   }
-}
-async function resolveDefaultRef(url) {
-  validateGitUrl(url);
-  await checkGitAvailable();
-  try {
-    const { stdout } = await execFileAsync("git", ["ls-remote", "--symref", "--", url, "HEAD"], {
-      timeout: GIT_TIMEOUT_MS
-    });
-    const ref = stdout.match(/^ref: refs\/heads\/(.+)\tHEAD$/m)?.[1];
-    const sha = stdout.match(/^([0-9a-f]{40})\tHEAD$/m)?.[1];
-    if (!ref || !sha) throw new GitClientError(`Could not parse default branch from: ${url}`);
-    validateRef(ref);
-    return { ref, sha };
-  } catch (error) {
-    if (error instanceof GitClientError) throw error;
-    throw new GitClientError(`Failed to resolve default ref for ${url}`, error);
+  const [ownerRepo, refPart] = splitOnFirst(trimmed, "#");
+  const slashIndex = ownerRepo.indexOf("/");
+  if (slashIndex === -1 || slashIndex === 0 || slashIndex === ownerRepo.length - 1) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: shorthand "${entry}" must be in the form "owner/repo[#ref]".`
+    );
   }
-}
-async function resolveRefToSha(url, ref) {
-  validateGitUrl(url);
-  validateRef(ref);
-  await checkGitAvailable();
-  try {
-    const { stdout } = await execFileAsync("git", ["ls-remote", "--", url, ref], {
-      timeout: GIT_TIMEOUT_MS
-    });
-    const sha = stdout.match(/^([0-9a-f]{40})\t/m)?.[1];
-    if (!sha) throw new GitClientError(`Ref "${ref}" not found in ${url}`);
-    return sha;
-  } catch (error) {
-    if (error instanceof GitClientError) throw error;
-    throw new GitClientError(`Failed to resolve ref "${ref}" for ${url}`, error);
+  if (ownerRepo.includes("/", slashIndex + 1)) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: FQDN shorthand or sub-path shorthand ("${entry}") is not yet supported. Use the object form with an explicit "git" URL.`
+    );
   }
+  const owner = ownerRepo.substring(0, slashIndex).toLowerCase();
+  const repo = ownerRepo.substring(slashIndex + 1).toLowerCase();
+  return {
+    gitUrl: `https://github.com/${owner}/${repo}.git`,
+    owner,
+    repo,
+    ref: refPart || void 0
+  };
 }
-async function fetchSkillFiles(params) {
-  const { url, ref, skillsPath, logger: logger5 } = params;
-  validateGitUrl(url, { logger: logger5 });
-  validateRef(ref);
-  if (skillsPath.split(/[/\\]/).includes("..") || (0, import_node_path145.isAbsolute)(skillsPath)) {
-    throw new GitClientError(
-      `Invalid skillsPath "${skillsPath}": must be a relative path without ".."`
+function rejectUnsupportedShorthand(entry, index) {
+  if (entry.startsWith("./") || entry.startsWith("../") || entry.startsWith("/")) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: local path dependencies ("${entry}") are not yet supported by rulesync.`
     );
   }
-  const ctrl = findControlCharacter(skillsPath);
-  if (ctrl) {
-    throw new GitClientError(
-      `skillsPath contains control character ${ctrl.hex} at position ${ctrl.position}`
+  if (entry.startsWith("git@") || entry.startsWith("ssh://")) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: SSH URL dependencies ("${entry}") are not yet supported. Use an HTTPS GitHub URL.`
     );
   }
-  await checkGitAvailable();
-  const tmpDir = await createTempDirectory("rulesync-git-");
-  try {
-    await execFileAsync(
-      "git",
-      [
-        "clone",
-        "--depth",
-        "1",
-        "--branch",
-        ref,
-        "--no-checkout",
-        "--filter=blob:none",
-        "--",
-        url,
-        tmpDir
-      ],
-      { timeout: GIT_TIMEOUT_MS }
+  if (entry.includes("@marketplace")) {
+    throw new Error(
+      `apm.yml dependency #${index + 1}: APM marketplace dependencies ("${entry}") are not yet supported.`
     );
-    await execFileAsync("git", ["-C", tmpDir, "sparse-checkout", "set", "--", skillsPath], {
-      timeout: GIT_TIMEOUT_MS
-    });
-    await execFileAsync("git", ["-C", tmpDir, "checkout"], { timeout: GIT_TIMEOUT_MS });
-    const skillsDir = (0, import_node_path145.join)(tmpDir, skillsPath);
-    if (!await directoryExists(skillsDir)) return [];
-    return await walkDirectory(skillsDir, skillsDir, 0, { totalFiles: 0, totalSize: 0 }, logger5);
-  } catch (error) {
-    if (error instanceof GitClientError) throw error;
-    throw new GitClientError(`Failed to fetch skill files from ${url}`, error);
-  } finally {
-    await removeTempDirectory(tmpDir);
   }
 }
-var MAX_WALK_DEPTH = 20;
-var MAX_TOTAL_FILES = 1e4;
-var MAX_TOTAL_SIZE = 100 * 1024 * 1024;
-async function walkDirectory(dir, baseDir, depth = 0, ctx = { totalFiles: 0, totalSize: 0 }, logger5) {
-  if (depth > MAX_WALK_DEPTH) {
-    throw new GitClientError(
-      `Directory tree exceeds max depth of ${MAX_WALK_DEPTH}: "${dir}". Aborting to prevent resource exhaustion.`
+function parseHttpsGitHubUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (host !== "github.com" && host !== "www.github.com") {
+    return null;
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length < 2) {
+    return null;
+  }
+  const rawOwner = segments[0];
+  const rawRepo = segments[1];
+  if (!rawOwner || !rawRepo) {
+    return null;
+  }
+  const owner = rawOwner.toLowerCase();
+  const repo = rawRepo.replace(/\.git$/, "").toLowerCase();
+  return {
+    gitUrl: `https://github.com/${owner}/${repo}.git`,
+    owner,
+    repo
+  };
+}
+function splitOnFirst(input, separator) {
+  const idx = input.indexOf(separator);
+  if (idx === -1) return [input, void 0];
+  return [input.substring(0, idx), input.substring(idx + 1)];
+}
+
+// src/lib/apm/apm-install.ts
+var RULESYNC_APM_COMPAT_VERSION = "rulesync-compat/0.1";
+var APM_PRIMITIVES = [
+  {
+    sourceDir: ".apm/instructions",
+    deployDir: ".github/instructions",
+    packageType: "apm_package"
+  },
+  {
+    sourceDir: ".apm/skills",
+    deployDir: ".github/skills",
+    packageType: "apm_package"
+  }
+];
+async function installApm(params) {
+  const { baseDir, options = {}, logger: logger5 } = params;
+  const manifest = await readApmManifest(baseDir);
+  if (manifest.dependencies.length === 0) {
+    logger5.warn("apm.yml has no dependencies.apm entries. Nothing to install.");
+    return { dependenciesProcessed: 0, deployedFileCount: 0, failedDependencyCount: 0 };
+  }
+  const existingLock = await readApmLock(baseDir);
+  if (options.frozen) {
+    if (!existingLock) {
+      throw new Error(
+        "Frozen install failed: rulesync-apm.lock.yaml is missing. Run 'rulesync install --mode apm' to create it."
+      );
+    }
+    const missing = manifest.dependencies.filter(
+      (dep) => !findApmLockDependency(existingLock, canonicalRepoUrl(dep))
+    );
+    if (missing.length > 0) {
+      const names = missing.map((d) => d.gitUrl).join(", ");
+      throw new Error(
+        `Frozen install failed: rulesync-apm.lock.yaml is missing entries for: ${names}. Run 'rulesync install --mode apm' to update the lockfile.`
+      );
+    }
+    const drifted = manifest.dependencies.filter((dep) => {
+      if (dep.ref === void 0) return false;
+      const locked = findApmLockDependency(existingLock, canonicalRepoUrl(dep));
+      return locked?.resolved_ref !== void 0 && locked.resolved_ref !== dep.ref;
+    });
+    if (drifted.length > 0) {
+      const names = drifted.map((d) => {
+        const locked = findApmLockDependency(existingLock, canonicalRepoUrl(d));
+        return `${d.gitUrl} (manifest=${d.ref}, lock=${locked?.resolved_ref})`;
+      }).join(", ");
+      throw new Error(
+        `Frozen install failed: manifest ref does not match rulesync-apm.lock.yaml for: ${names}. Run 'rulesync install --mode apm' to update the lockfile.`
+      );
+    }
+  }
+  const token = GitHubClient.resolveToken(options.token);
+  const client = new GitHubClient({ token });
+  const semaphore = new import_promise2.Semaphore(FETCH_CONCURRENCY_LIMIT);
+  const newLock = createEmptyApmLock({
+    apmVersion: existingLock?.apm_version ?? RULESYNC_APM_COMPAT_VERSION,
+    existingLock
+  });
+  const frozen = options.frozen ?? false;
+  const runOne = async (dep) => {
+    const installed = await installDependency({
+      dep,
+      client,
+      semaphore,
+      baseDir,
+      existingLock,
+      frozen,
+      update: options.update ?? false,
+      logger: logger5
+    });
+    return {
+      status: "ok",
+      lockEntry: installed.lockEntry,
+      deployedCount: installed.deployedFiles.length
+    };
+  };
+  const results = frozen ? await Promise.all(manifest.dependencies.map(runOne)) : await Promise.all(
+    manifest.dependencies.map(async (dep) => {
+      try {
+        return await runOne(dep);
+      } catch (error) {
+        logger5.error(`Failed to install apm dependency "${dep.gitUrl}": ${formatError(error)}`);
+        if (error instanceof GitHubClientError) {
+          logGitHubAuthHints({ error, logger: logger5 });
+        }
+        const previous = existingLock ? findApmLockDependency(existingLock, canonicalRepoUrl(dep)) : void 0;
+        return { status: "failed", previous };
+      }
+    })
+  );
+  let totalDeployed = 0;
+  let failedCount = 0;
+  for (const result of results) {
+    if (result.status === "ok") {
+      newLock.dependencies.push(result.lockEntry);
+      totalDeployed += result.deployedCount;
+    } else {
+      failedCount += 1;
+      if (result.previous) {
+        newLock.dependencies.push(result.previous);
+      }
+    }
+  }
+  if (existingLock) {
+    const newDeployedFiles = new Set(newLock.dependencies.flatMap((d) => d.deployed_files));
+    const toDelete = [];
+    for (const prev of existingLock.dependencies) {
+      for (const deployed of prev.deployed_files) {
+        if (!newDeployedFiles.has(deployed)) {
+          toDelete.push(deployed);
+        }
+      }
+    }
+    for (const relativePath of toDelete) {
+      if (import_node_path147.posix.isAbsolute(relativePath) || relativePath.split(/[/\\]/).includes("..")) {
+        logger5.warn(`Refusing to remove stale apm file with suspicious path: "${relativePath}".`);
+        continue;
+      }
+      try {
+        checkPathTraversal({ relativePath, intendedRootDir: baseDir });
+      } catch {
+        logger5.warn(`Refusing to remove stale apm file outside baseDir: "${relativePath}".`);
+        continue;
+      }
+      const absolute = (0, import_node_path147.join)(baseDir, relativePath);
+      await removeFile(absolute);
+      logger5.debug(`Removed stale apm file: ${relativePath}`);
+    }
+  }
+  if (!frozen) {
+    newLock.generated_at = (/* @__PURE__ */ new Date()).toISOString();
+    await writeApmLock({ baseDir, lock: newLock });
+    if (failedCount === 0) {
+      logger5.debug("rulesync-apm.lock.yaml updated.");
+    } else {
+      logger5.warn(
+        `rulesync-apm.lock.yaml written with partially successful installs (${failedCount} dep(s) failed).`
+      );
+    }
+  }
+  return {
+    dependenciesProcessed: manifest.dependencies.length,
+    deployedFileCount: totalDeployed,
+    failedDependencyCount: failedCount
+  };
+}
+async function installDependency(params) {
+  const { dep, client, semaphore, baseDir, existingLock, frozen, update, logger: logger5 } = params;
+  const repoUrl = canonicalRepoUrl(dep);
+  const locked = existingLock ? findApmLockDependency(existingLock, repoUrl) : void 0;
+  let resolvedRef;
+  let resolvedSha;
+  if (locked && !update && locked.resolved_commit && locked.resolved_ref) {
+    resolvedRef = locked.resolved_ref;
+    resolvedSha = locked.resolved_commit;
+    logger5.debug(`Using locked commit for ${repoUrl}: ${resolvedSha}`);
+  } else {
+    resolvedRef = dep.ref ?? await client.getDefaultBranch(dep.owner, dep.repo);
+    resolvedSha = await client.resolveRefToSha(dep.owner, dep.repo, resolvedRef);
+    logger5.debug(`Resolved ${repoUrl} ref "${resolvedRef}" -> ${resolvedSha}`);
+  }
+  const deployed = [];
+  for (const primitive of APM_PRIMITIVES) {
+    const remoteBase = dep.path ? toPosixPath(import_node_path147.posix.join(dep.path, primitive.sourceDir)) : primitive.sourceDir;
+    const files = await listPrimitiveFiles({
+      client,
+      semaphore,
+      owner: dep.owner,
+      repo: dep.repo,
+      ref: resolvedSha,
+      remoteBase,
+      logger: logger5
+    });
+    if (files.length === 0) continue;
+    for (const file of files) {
+      if (file.size > MAX_FILE_SIZE) {
+        logger5.warn(
+          `Skipping "${file.path}" from ${repoUrl}: ${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+        );
+        continue;
+      }
+      const relativeToBase = import_node_path147.posix.relative(remoteBase, toPosixPath(file.path));
+      if (!relativeToBase || relativeToBase.startsWith("..") || import_node_path147.posix.isAbsolute(relativeToBase)) {
+        logger5.warn(
+          `Skipping "${file.path}" from ${repoUrl}: resolved outside of "${remoteBase}".`
+        );
+        continue;
+      }
+      const deployRelative = toPosixPath((0, import_node_path147.join)(primitive.deployDir, relativeToBase));
+      checkPathTraversal({
+        relativePath: deployRelative,
+        intendedRootDir: baseDir
+      });
+      const content = await withSemaphore(
+        semaphore,
+        () => client.getFileContent(dep.owner, dep.repo, file.path, resolvedSha)
+      );
+      const byteLength = Buffer.byteLength(content, "utf8");
+      if (byteLength > MAX_FILE_SIZE) {
+        logger5.warn(
+          `Skipping "${file.path}" from ${repoUrl}: fetched ${(byteLength / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+        );
+        continue;
+      }
+      deployed.push({ path: deployRelative, content });
+      if (!frozen) {
+        await writeFileContent((0, import_node_path147.join)(baseDir, deployRelative), content);
+      }
+    }
+  }
+  deployed.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const deployedFiles = deployed.map((d) => d.path);
+  const contentHash = computeContentHash(deployed);
+  if (frozen && locked?.content_hash) {
+    if (RULESYNC_CONTENT_HASH_REGEX.test(locked.content_hash)) {
+      if (locked.content_hash !== contentHash) {
+        throw new Error(
+          `content_hash mismatch for ${repoUrl}: lock=${locked.content_hash} computed=${contentHash}. Refuse to trust the deployment under --frozen.`
+        );
+      }
+    } else {
+      logger5.debug(
+        `Skipping content_hash integrity check for ${repoUrl}: recorded hash "${locked.content_hash}" was not written by rulesync.`
+      );
+    }
+  }
+  if (frozen) {
+    for (const { path: deployRelative, content } of deployed) {
+      await writeFileContent((0, import_node_path147.join)(baseDir, deployRelative), content);
+    }
+  }
+  const lockEntry = {
+    repo_url: repoUrl,
+    resolved_commit: resolvedSha,
+    resolved_ref: resolvedRef,
+    depth: 1,
+    package_type: "apm_package",
+    content_hash: contentHash,
+    deployed_files: deployedFiles
+  };
+  if (dep.path) {
+    lockEntry.virtual_path = dep.path;
+  }
+  logger5.info(`Installed ${deployedFiles.length} file(s) from ${repoUrl}@${shortSha(resolvedSha)}`);
+  return { lockEntry, deployedFiles };
+}
+function computeContentHash(files) {
+  const hash = (0, import_node_crypto.createHash)("sha256");
+  for (const { path: path4, content } of files) {
+    hash.update(path4);
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+async function listPrimitiveFiles(params) {
+  const { client, semaphore, owner, repo, ref, remoteBase, logger: logger5 } = params;
+  try {
+    return await listDirectoryRecursive({
+      client,
+      owner,
+      repo,
+      path: remoteBase,
+      ref,
+      semaphore
+    });
+  } catch (error) {
+    if (error instanceof GitHubClientError && error.statusCode === 404) {
+      logger5.debug(`No ${remoteBase}/ in ${owner}/${repo}, skipping.`);
+      return [];
+    }
+    throw error;
+  }
+}
+function canonicalRepoUrl(dep) {
+  return `https://github.com/${dep.owner}/${dep.repo}`;
+}
+function shortSha(sha) {
+  return sha.substring(0, 7);
+}
+
+// src/lib/gh/gh-install.ts
+var import_node_crypto2 = require("crypto");
+var import_node_path150 = require("path");
+var import_promise3 = require("es-toolkit/promise");
+
+// src/lib/gh/gh-frontmatter.ts
+var import_js_yaml5 = require("js-yaml");
+var FRONTMATTER_FENCE = "---";
+function injectSourceMetadata(params) {
+  const { content, source, repository, ref } = params;
+  const provenance = { source, repository, ref };
+  let openFenceLen;
+  if (content.startsWith(`${FRONTMATTER_FENCE}\r
+`)) {
+    openFenceLen = 5;
+  } else if (content.startsWith(`${FRONTMATTER_FENCE}
+`)) {
+    openFenceLen = 4;
+  } else if (content === FRONTMATTER_FENCE) {
+    openFenceLen = 3;
+  } else {
+    const yaml2 = (0, import_js_yaml5.dump)(provenance, { noRefs: true, lineWidth: -1, sortKeys: false });
+    return `${FRONTMATTER_FENCE}
+${yaml2}${FRONTMATTER_FENCE}
+${content}`;
+  }
+  const afterOpen = content.substring(openFenceLen);
+  let fmBody;
+  let rest;
+  if (afterOpen.startsWith("---\n") || afterOpen.startsWith("---\r\n") || afterOpen === "---") {
+    fmBody = "";
+    const fenceLen = afterOpen.startsWith("---\r\n") ? 5 : afterOpen === "---" ? 3 : 4;
+    rest = afterOpen.substring(fenceLen);
+  } else {
+    const match = /\n---(\r?\n|$)/.exec(afterOpen);
+    if (!match) {
+      throw new Error("invalid frontmatter");
+    }
+    fmBody = afterOpen.substring(0, match.index);
+    rest = afterOpen.substring(match.index + match[0].length);
+  }
+  let loaded;
+  try {
+    loaded = (0, import_js_yaml5.load)(fmBody);
+  } catch {
+    throw new Error("invalid frontmatter");
+  }
+  if (loaded === null || loaded === void 0) {
+    const yaml2 = (0, import_js_yaml5.dump)(provenance, { noRefs: true, lineWidth: -1, sortKeys: false });
+    return `${FRONTMATTER_FENCE}
+${yaml2}${FRONTMATTER_FENCE}
+${rest}`;
+  }
+  if (typeof loaded !== "object" || Array.isArray(loaded)) {
+    throw new Error("invalid frontmatter");
+  }
+  const existing = loaded;
+  const merged = {
+    ...existing,
+    ...provenance
+  };
+  const yaml = (0, import_js_yaml5.dump)(merged, { noRefs: true, lineWidth: -1, sortKeys: false });
+  return `${FRONTMATTER_FENCE}
+${yaml}${FRONTMATTER_FENCE}
+${rest}`;
+}
+
+// src/lib/gh/gh-lock.ts
+var import_node_path148 = require("path");
+var import_js_yaml6 = require("js-yaml");
+var import_mini77 = require("zod/mini");
+var GH_LOCKFILE_FILE_NAME = "rulesync-gh.lock.yaml";
+var GH_LOCKFILE_VERSION = "1";
+var RULESYNC_CONTENT_HASH_REGEX2 = /^sha256:[0-9a-f]{64}$/;
+var ScopeSchema = import_mini77.z.enum(["project", "user"]);
+var GhLockInstallationSchema = import_mini77.z.looseObject({
+  source: import_mini77.z.string(),
+  owner: import_mini77.z.string(),
+  repo: import_mini77.z.string(),
+  agent: import_mini77.z.string(),
+  scope: ScopeSchema,
+  skill: import_mini77.z.string(),
+  requested_ref: (0, import_mini77.optional)(import_mini77.z.string()),
+  resolved_ref: import_mini77.z.string(),
+  resolved_commit: import_mini77.z.string().check((0, import_mini77.refine)((v) => /^[0-9a-f]{40}$/.test(v), "resolved_commit must be a 40-char hex SHA")),
+  install_dir: import_mini77.z.string(),
+  deployed_files: import_mini77.z.array(import_mini77.z.string()),
+  content_hash: (0, import_mini77.optional)(import_mini77.z.string())
+});
+var GhLockSchema = import_mini77.z.looseObject({
+  lockfile_version: import_mini77.z.literal("1"),
+  generated_at: import_mini77.z.string(),
+  installations: import_mini77.z.array(GhLockInstallationSchema)
+});
+function getGhLockPath(baseDir) {
+  return (0, import_node_path148.join)(baseDir, GH_LOCKFILE_FILE_NAME);
+}
+function createEmptyGhLock(params) {
+  const base = params?.existingLock ? { ...params.existingLock } : {};
+  return {
+    ...base,
+    lockfile_version: GH_LOCKFILE_VERSION,
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    installations: []
+  };
+}
+function parseGhLock(content) {
+  if (!content.trim()) {
+    return null;
+  }
+  let loaded;
+  try {
+    loaded = (0, import_js_yaml6.load)(content);
+  } catch {
+    return null;
+  }
+  if (!loaded || typeof loaded !== "object") {
+    return null;
+  }
+  const parsed = GhLockSchema.safeParse(loaded);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => `  - ${issue.path.join(".") || "<root>"}: ${issue.message}`).join("\n");
+    throw new Error(`Invalid ${GH_LOCKFILE_FILE_NAME}:
+${issues}`);
+  }
+  return parsed.data;
+}
+async function readGhLock(baseDir) {
+  const path4 = getGhLockPath(baseDir);
+  if (!await fileExists(path4)) {
+    return null;
+  }
+  const content = await readFileContent(path4);
+  return parseGhLock(content);
+}
+async function writeGhLock(params) {
+  const path4 = getGhLockPath(params.baseDir);
+  const content = serializeGhLock(params.lock);
+  await writeFileContent(path4, content);
+}
+function serializeGhLock(lock) {
+  return (0, import_js_yaml6.dump)(lock, { noRefs: true, lineWidth: -1, sortKeys: false });
+}
+function findGhLockInstallation(lock, params) {
+  const target = params.source.toLowerCase();
+  return lock.installations.find(
+    (i) => i.source.toLowerCase() === target && i.agent === params.agent && i.scope === params.scope && i.skill === params.skill
+  );
+}
+
+// src/lib/gh/gh-paths.ts
+var import_node_path149 = require("path");
+var GH_AGENTS = [
+  "github-copilot",
+  "claude-code",
+  "cursor",
+  "codex",
+  "gemini",
+  "antigravity"
+];
+function relativeInstallDirFor(params) {
+  const { agent, scope } = params;
+  if (scope === "project") {
+    if (agent === "claude-code") {
+      return (0, import_node_path149.join)(".claude", "skills");
+    }
+    return (0, import_node_path149.join)(".agents", "skills");
+  }
+  switch (agent) {
+    case "github-copilot":
+      return (0, import_node_path149.join)(".copilot", "skills");
+    case "claude-code":
+      return (0, import_node_path149.join)(".claude", "skills");
+    case "cursor":
+      return (0, import_node_path149.join)(".cursor", "skills");
+    case "codex":
+      return (0, import_node_path149.join)(".codex", "skills");
+    case "gemini":
+      return (0, import_node_path149.join)(".gemini", "skills");
+    case "antigravity":
+      return (0, import_node_path149.join)(".gemini", "antigravity", "skills");
+  }
+}
+
+// src/lib/gh/gh-install.ts
+var SKILLS_REMOTE_DIR = "skills";
+var SKILL_FILE_NAME2 = "SKILL.md";
+async function installGh(params) {
+  const { baseDir, sources, options = {}, logger: logger5 } = params;
+  if (sources.length === 0) {
+    return { sourcesProcessed: 0, installedSkillCount: 0, failedSourceCount: 0 };
+  }
+  const resolvedSources = sources.map((entry) => {
+    const parsed = parseSource(entry.source);
+    if (parsed.provider !== "github") {
+      throw new Error(
+        `--mode gh only supports GitHub sources. "${entry.source}" resolves to provider "${parsed.provider}".`
+      );
+    }
+    if (entry.transport !== void 0 && entry.transport !== "github") {
+      throw new Error(
+        `--mode gh: field "transport" is not supported (got "${entry.transport}" for source "${entry.source}"). Drop the field or switch to --mode rulesync.`
+      );
+    }
+    if (entry.path !== void 0) {
+      throw new Error(
+        `--mode gh: field "path" is not supported for source "${entry.source}". The remote layout is fixed to "skills/<name>/SKILL.md".`
+      );
+    }
+    const agent = entry.agent ?? "github-copilot";
+    if (!GH_AGENTS.includes(agent)) {
+      throw new Error(
+        `--mode gh: unknown agent "${agent}" for source "${entry.source}". Valid agents: ${GH_AGENTS.join(", ")}.`
+      );
+    }
+    const scope = entry.scope ?? "project";
+    return {
+      entry,
+      owner: parsed.owner,
+      repo: parsed.repo,
+      ref: entry.ref ?? parsed.ref,
+      agent,
+      scope
+    };
+  });
+  const existingLock = await readGhLock(baseDir);
+  const frozen = options.frozen ?? false;
+  const update = options.update ?? false;
+  if (frozen && !existingLock) {
+    throw new Error(
+      "Frozen install failed: rulesync-gh.lock.yaml is missing. Run 'rulesync install --mode gh' to create it."
+    );
+  }
+  if (frozen && existingLock) {
+    const uncovered = [];
+    for (const rs of resolvedSources) {
+      const hasAny = existingLock.installations.some(
+        (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase() && i.agent === rs.agent && i.scope === rs.scope
+      );
+      if (!hasAny) {
+        uncovered.push(`${rs.entry.source} (agent=${rs.agent}, scope=${rs.scope})`);
+      }
+    }
+    if (uncovered.length > 0) {
+      throw new Error(
+        `Frozen install failed: rulesync-gh.lock.yaml is missing entries for: ${uncovered.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
+      );
+    }
+    const drifted = [];
+    for (const rs of resolvedSources) {
+      if (!rs.ref) continue;
+      const matches = existingLock.installations.filter(
+        (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase()
+      );
+      for (const m of matches) {
+        if (m.requested_ref !== void 0 && m.requested_ref !== rs.ref) {
+          drifted.push(`${rs.entry.source} (manifest=${rs.ref}, lock=${m.requested_ref})`);
+          break;
+        }
+      }
+    }
+    if (drifted.length > 0) {
+      throw new Error(
+        `Frozen install failed: manifest ref does not match rulesync-gh.lock.yaml for: ${drifted.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
+      );
+    }
+  }
+  const token = GitHubClient.resolveToken(options.token);
+  const client = new GitHubClient({ token });
+  const semaphore = new import_promise3.Semaphore(FETCH_CONCURRENCY_LIMIT);
+  const newLock = createEmptyGhLock({ existingLock });
+  const runOne = async (rs) => {
+    const installations = await installSource({
+      rs,
+      client,
+      semaphore,
+      baseDir,
+      existingLock,
+      frozen,
+      update,
+      logger: logger5
+    });
+    return { status: "ok", installations };
+  };
+  const results = frozen ? await Promise.all(resolvedSources.map(runOne)) : await Promise.all(
+    resolvedSources.map(async (rs) => {
+      try {
+        return await runOne(rs);
+      } catch (error) {
+        logger5.error(`Failed to install gh source "${rs.entry.source}": ${formatError(error)}`);
+        if (error instanceof GitHubClientError) {
+          logGitHubAuthHints({ error, logger: logger5 });
+        }
+        const preserved = existingLock ? existingLock.installations.filter(
+          (i) => i.source.toLowerCase() === rs.entry.source.toLowerCase()
+        ) : [];
+        return { status: "failed", preserved };
+      }
+    })
+  );
+  if (frozen) {
+    for (const result of results) {
+      if (result.status !== "ok") continue;
+      for (const inst of result.installations) {
+        for (const d of inst.deployed) {
+          await writeFileContent(d.absolutePath, d.content);
+        }
+      }
+    }
+  }
+  let totalInstalled = 0;
+  let failedCount = 0;
+  for (const result of results) {
+    if (result.status === "ok") {
+      for (const inst of result.installations) {
+        newLock.installations.push(inst.installation);
+      }
+      totalInstalled += result.installations.length;
+    } else {
+      failedCount += 1;
+      for (const preserved of result.preserved) {
+        newLock.installations.push(preserved);
+      }
+    }
+  }
+  if (existingLock) {
+    const newDeployed = /* @__PURE__ */ new Set();
+    for (const inst of newLock.installations) {
+      for (const file of inst.deployed_files) {
+        newDeployed.add(`${inst.scope}::${file}`);
+      }
+    }
+    for (const prev of existingLock.installations) {
+      for (const deployed of prev.deployed_files) {
+        const key = `${prev.scope}::${deployed}`;
+        if (newDeployed.has(key)) continue;
+        await removeStaleFile({
+          relativePath: deployed,
+          scope: prev.scope === "user" ? "user" : "project",
+          baseDir,
+          logger: logger5
+        });
+      }
+    }
+  }
+  if (!frozen) {
+    newLock.generated_at = (/* @__PURE__ */ new Date()).toISOString();
+    await writeGhLock({ baseDir, lock: newLock });
+    if (failedCount === 0) {
+      logger5.debug("rulesync-gh.lock.yaml updated.");
+    } else {
+      logger5.warn(
+        `rulesync-gh.lock.yaml written with partially successful installs (${failedCount} source(s) failed).`
+      );
+    }
+  }
+  return {
+    sourcesProcessed: sources.length,
+    installedSkillCount: totalInstalled,
+    failedSourceCount: failedCount
+  };
+}
+async function installSource(params) {
+  const { rs, client, semaphore, baseDir, existingLock, frozen, update, logger: logger5 } = params;
+  const { entry, owner, repo, agent, scope } = rs;
+  const sourceKey = entry.source;
+  let resolvedRef;
+  let usedTag = false;
+  if (rs.ref) {
+    resolvedRef = rs.ref;
+  } else {
+    try {
+      const release = await client.getLatestRelease(owner, repo);
+      resolvedRef = release.tag_name;
+      usedTag = true;
+    } catch (error) {
+      if (is404(error)) {
+        resolvedRef = await client.getDefaultBranch(owner, repo);
+      } else {
+        throw error;
+      }
+    }
+  }
+  const resolvedSha = await client.resolveRefToSha(owner, repo, resolvedRef);
+  logger5.debug(`Resolved ${sourceKey} -> ref=${resolvedRef} sha=${resolvedSha}`);
+  let topLevel;
+  try {
+    topLevel = await client.listDirectory(owner, repo, SKILLS_REMOTE_DIR, resolvedSha);
+  } catch (error) {
+    if (is404(error)) {
+      logger5.warn(`No skills/ directory found in ${sourceKey}. Skipping.`);
+      return [];
+    }
+    throw error;
+  }
+  const skillDirs = topLevel.filter((e) => e.type === "dir").map((e) => ({ name: e.name, path: e.path }));
+  const validatedSkills = [];
+  for (const sk of skillDirs) {
+    const info = await withSemaphore(
+      semaphore,
+      () => client.getFileInfo(owner, repo, import_node_path150.posix.join(sk.path, SKILL_FILE_NAME2), resolvedSha)
+    );
+    if (info) {
+      validatedSkills.push(sk);
+    }
+  }
+  let selected = validatedSkills;
+  if (entry.skills && entry.skills.length > 0) {
+    const requested = new Set(entry.skills);
+    selected = validatedSkills.filter((s) => requested.has(s.name));
+    const presentNames = new Set(validatedSkills.map((s) => s.name));
+    for (const want of entry.skills) {
+      if (!presentNames.has(want)) {
+        logger5.warn(`Requested skill "${want}" not found in ${sourceKey} under skills/. Skipping.`);
+      }
+    }
+  }
+  if (frozen && existingLock) {
+    const missing = [];
+    for (const sk of selected) {
+      const locked = findGhLockInstallation(existingLock, {
+        source: sourceKey,
+        agent,
+        scope,
+        skill: sk.name
+      });
+      if (!locked) {
+        missing.push(sk.name);
+      }
+    }
+    if (missing.length > 0) {
+      throw new Error(
+        `Frozen install failed: rulesync-gh.lock.yaml is missing entries for ${sourceKey} (agent=${agent}, scope=${scope}) skills: ${missing.join(", ")}. Run 'rulesync install --mode gh' to update the lockfile.`
+      );
+    }
+  }
+  const results = [];
+  const installRelDir = relativeInstallDirFor({ agent, scope });
+  const scopeRoot = scope === "user" ? getHomeDirectory() : baseDir;
+  const sourceUrl = `https://github.com/${owner}/${repo}`;
+  const repository = `${owner}/${repo}`;
+  const provenanceRef = usedTag ? resolvedRef : resolvedSha;
+  for (const sk of selected) {
+    const locked = existingLock && !update ? findGhLockInstallation(existingLock, {
+      source: sourceKey,
+      agent,
+      scope,
+      skill: sk.name
+    }) : void 0;
+    const allFiles = await listDirectoryRecursive({
+      client,
+      owner,
+      repo,
+      path: sk.path,
+      ref: resolvedSha,
+      semaphore
+    });
+    const deployed = [];
+    for (const file of allFiles) {
+      if (file.size > MAX_FILE_SIZE) {
+        logger5.warn(
+          `Skipping "${file.path}" from ${sourceKey}: ${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+        );
+        continue;
+      }
+      const relativeToSkill = import_node_path150.posix.relative(sk.path, toPosixPath(file.path));
+      if (!relativeToSkill || relativeToSkill.startsWith("..") || import_node_path150.posix.isAbsolute(relativeToSkill)) {
+        logger5.warn(`Skipping "${file.path}" from ${sourceKey}: resolved outside of "${sk.path}".`);
+        continue;
+      }
+      const deployRelative = toPosixPath((0, import_node_path150.join)(installRelDir, sk.name, relativeToSkill));
+      checkPathTraversal({ relativePath: deployRelative, intendedRootDir: scopeRoot });
+      const installAbs = (0, import_node_path150.join)(scopeRoot, installRelDir);
+      const withinInstallDir = toPosixPath((0, import_node_path150.join)(sk.name, relativeToSkill));
+      checkPathTraversal({ relativePath: withinInstallDir, intendedRootDir: installAbs });
+      let content = await withSemaphore(
+        semaphore,
+        () => client.getFileContent(owner, repo, file.path, resolvedSha)
+      );
+      const byteLength = Buffer.byteLength(content, "utf8");
+      if (byteLength > MAX_FILE_SIZE) {
+        logger5.warn(
+          `Skipping "${file.path}" from ${sourceKey}: fetched ${(byteLength / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit.`
+        );
+        continue;
+      }
+      if ((0, import_node_path150.basename)(file.path) === SKILL_FILE_NAME2) {
+        try {
+          content = injectSourceMetadata({
+            content,
+            source: sourceUrl,
+            repository,
+            ref: provenanceRef
+          });
+        } catch {
+          logger5.warn(
+            `Frontmatter in ${file.path} (${sourceKey}) is invalid. Prepending a fresh provenance block.`
+          );
+          content = `---
+source: ${sourceUrl}
+repository: ${repository}
+ref: ${provenanceRef}
+---
+${content}`;
+        }
+      }
+      const absolutePath = (0, import_node_path150.join)(scopeRoot, deployRelative);
+      deployed.push({ relativeToScopeRoot: deployRelative, absolutePath, content });
+      if (!frozen) {
+        await writeFileContent(absolutePath, content);
+      }
+    }
+    deployed.sort(
+      (a, b) => a.relativeToScopeRoot < b.relativeToScopeRoot ? -1 : a.relativeToScopeRoot > b.relativeToScopeRoot ? 1 : 0
+    );
+    const deployedFiles = deployed.map((d) => d.relativeToScopeRoot);
+    const contentHash = computeContentHash2(deployed);
+    if (frozen && locked?.content_hash) {
+      if (RULESYNC_CONTENT_HASH_REGEX2.test(locked.content_hash)) {
+        if (locked.content_hash !== contentHash) {
+          throw new Error(
+            `content_hash mismatch for ${sourceKey} skill "${sk.name}" (agent=${agent}, scope=${scope}): lock=${locked.content_hash} computed=${contentHash}. Refuse to trust the deployment under --frozen.`
+          );
+        }
+      } else {
+        logger5.debug(
+          `Skipping content_hash integrity check for ${sourceKey} skill "${sk.name}": recorded hash "${locked.content_hash}" was not written by rulesync.`
+        );
+      }
+    }
+    const installation = {
+      source: sourceKey,
+      owner,
+      repo,
+      agent,
+      scope,
+      skill: sk.name,
+      resolved_ref: resolvedRef,
+      resolved_commit: resolvedSha,
+      install_dir: toPosixPath(installRelDir),
+      deployed_files: deployedFiles,
+      content_hash: contentHash
+    };
+    if (rs.ref !== void 0) {
+      installation.requested_ref = rs.ref;
+    }
+    results.push({ installation, deployed });
+    logger5.info(
+      `Installed gh skill "${sk.name}" from ${sourceKey} (agent=${agent}, scope=${scope}, ref=${resolvedRef})`
+    );
+  }
+  return results;
+}
+async function removeStaleFile(params) {
+  const { relativePath, scope, baseDir, logger: logger5 } = params;
+  if (import_node_path150.posix.isAbsolute(relativePath) || relativePath.split(/[/\\]/).includes("..")) {
+    logger5.warn(`Refusing to remove stale gh file with suspicious path: "${relativePath}".`);
+    return;
+  }
+  const scopeRoot = scope === "user" ? getHomeDirectory() : baseDir;
+  try {
+    checkPathTraversal({ relativePath, intendedRootDir: scopeRoot });
+  } catch {
+    logger5.warn(`Refusing to remove stale gh file outside ${scope} root: "${relativePath}".`);
+    return;
+  }
+  const absolute = (0, import_node_path150.join)(scopeRoot, relativePath);
+  await removeFile(absolute);
+  logger5.debug(`Removed stale gh file: ${relativePath}`);
+}
+function is404(error) {
+  if (error instanceof GitHubClientError && error.statusCode === 404) {
+    return true;
+  }
+  if (typeof error === "object" && error !== null && "statusCode" in error && error.statusCode === 404) {
+    return true;
+  }
+  return false;
+}
+function computeContentHash2(files) {
+  const hash = (0, import_node_crypto2.createHash)("sha256");
+  for (const { relativeToScopeRoot, content } of files) {
+    hash.update(relativeToScopeRoot);
+    hash.update("\0");
+    hash.update(content);
+    hash.update("\0");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+
+// src/lib/sources.ts
+var import_node_path153 = require("path");
+var import_promise4 = require("es-toolkit/promise");
+
+// src/lib/git-client.ts
+var import_node_child_process = require("child_process");
+var import_node_path151 = require("path");
+var import_node_util2 = require("util");
+var execFileAsync = (0, import_node_util2.promisify)(import_node_child_process.execFile);
+var GIT_TIMEOUT_MS = 6e4;
+var ALLOWED_URL_SCHEMES = /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/\/).+$|^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9.-]+:[a-zA-Z0-9_.+/~-]+$/;
+var INSECURE_URL_SCHEMES = /^(git:\/\/|http:\/\/)/;
+var GitClientError = class extends Error {
+  constructor(message, cause) {
+    super(message, { cause });
+    this.name = "GitClientError";
+  }
+};
+function validateGitUrl(url, options) {
+  const ctrl = findControlCharacter(url);
+  if (ctrl) {
+    throw new GitClientError(
+      `Git URL contains control character ${ctrl.hex} at position ${ctrl.position}`
+    );
+  }
+  if (!ALLOWED_URL_SCHEMES.test(url)) {
+    throw new GitClientError(
+      `Unsupported or unsafe git URL: "${url}". Use https, ssh, git, or file schemes.`
+    );
+  }
+  if (INSECURE_URL_SCHEMES.test(url)) {
+    options?.logger?.warn(
+      `URL "${url}" uses an unencrypted protocol. Consider using https:// or ssh:// instead.`
+    );
+  }
+}
+function validateRef(ref) {
+  if (ref.startsWith("-")) {
+    throw new GitClientError(`Ref must not start with "-": "${ref}"`);
+  }
+  const ctrl = findControlCharacter(ref);
+  if (ctrl) {
+    throw new GitClientError(
+      `Ref contains control character ${ctrl.hex} at position ${ctrl.position}`
+    );
+  }
+}
+var gitChecked = false;
+async function checkGitAvailable() {
+  if (gitChecked) return;
+  try {
+    await execFileAsync("git", ["--version"], { timeout: GIT_TIMEOUT_MS });
+    gitChecked = true;
+  } catch {
+    throw new GitClientError("git is not installed or not found in PATH");
+  }
+}
+async function resolveDefaultRef(url) {
+  validateGitUrl(url);
+  await checkGitAvailable();
+  try {
+    const { stdout } = await execFileAsync("git", ["ls-remote", "--symref", "--", url, "HEAD"], {
+      timeout: GIT_TIMEOUT_MS
+    });
+    const ref = stdout.match(/^ref: refs\/heads\/(.+)\tHEAD$/m)?.[1];
+    const sha = stdout.match(/^([0-9a-f]{40})\tHEAD$/m)?.[1];
+    if (!ref || !sha) throw new GitClientError(`Could not parse default branch from: ${url}`);
+    validateRef(ref);
+    return { ref, sha };
+  } catch (error) {
+    if (error instanceof GitClientError) throw error;
+    throw new GitClientError(`Failed to resolve default ref for ${url}`, error);
+  }
+}
+async function resolveRefToSha(url, ref) {
+  validateGitUrl(url);
+  validateRef(ref);
+  await checkGitAvailable();
+  try {
+    const { stdout } = await execFileAsync("git", ["ls-remote", "--", url, ref], {
+      timeout: GIT_TIMEOUT_MS
+    });
+    const sha = stdout.match(/^([0-9a-f]{40})\t/m)?.[1];
+    if (!sha) throw new GitClientError(`Ref "${ref}" not found in ${url}`);
+    return sha;
+  } catch (error) {
+    if (error instanceof GitClientError) throw error;
+    throw new GitClientError(`Failed to resolve ref "${ref}" for ${url}`, error);
+  }
+}
+async function fetchSkillFiles(params) {
+  const { url, ref, skillsPath, logger: logger5 } = params;
+  validateGitUrl(url, { logger: logger5 });
+  validateRef(ref);
+  if (skillsPath.split(/[/\\]/).includes("..") || (0, import_node_path151.isAbsolute)(skillsPath)) {
+    throw new GitClientError(
+      `Invalid skillsPath "${skillsPath}": must be a relative path without ".."`
+    );
+  }
+  const ctrl = findControlCharacter(skillsPath);
+  if (ctrl) {
+    throw new GitClientError(
+      `skillsPath contains control character ${ctrl.hex} at position ${ctrl.position}`
+    );
+  }
+  await checkGitAvailable();
+  const tmpDir = await createTempDirectory("rulesync-git-");
+  try {
+    await execFileAsync(
+      "git",
+      [
+        "clone",
+        "--depth",
+        "1",
+        "--branch",
+        ref,
+        "--no-checkout",
+        "--filter=blob:none",
+        "--",
+        url,
+        tmpDir
+      ],
+      { timeout: GIT_TIMEOUT_MS }
+    );
+    await execFileAsync("git", ["-C", tmpDir, "sparse-checkout", "set", "--", skillsPath], {
+      timeout: GIT_TIMEOUT_MS
+    });
+    await execFileAsync("git", ["-C", tmpDir, "checkout"], { timeout: GIT_TIMEOUT_MS });
+    const skillsDir = (0, import_node_path151.join)(tmpDir, skillsPath);
+    if (!await directoryExists(skillsDir)) return [];
+    return await walkDirectory(skillsDir, skillsDir, 0, { totalFiles: 0, totalSize: 0 }, logger5);
+  } catch (error) {
+    if (error instanceof GitClientError) throw error;
+    throw new GitClientError(`Failed to fetch skill files from ${url}`, error);
+  } finally {
+    await removeTempDirectory(tmpDir);
+  }
+}
+var MAX_WALK_DEPTH = 20;
+var MAX_TOTAL_FILES = 1e4;
+var MAX_TOTAL_SIZE = 100 * 1024 * 1024;
+async function walkDirectory(dir, baseDir, depth = 0, ctx = { totalFiles: 0, totalSize: 0 }, logger5) {
+  if (depth > MAX_WALK_DEPTH) {
+    throw new GitClientError(
+      `Directory tree exceeds max depth of ${MAX_WALK_DEPTH}: "${dir}". Aborting to prevent resource exhaustion.`
     );
   }
   const results = [];
   for (const name of await listDirectoryFiles(dir)) {
     if (name === ".git") continue;
-    const fullPath = (0, import_node_path145.join)(dir, name);
+    const fullPath = (0, import_node_path151.join)(dir, name);
     if (await isSymlink(fullPath)) {
       logger5?.warn(`Skipping symlink "${fullPath}".`);
       continue;
@@ -24071,36 +25222,36 @@ async function walkDirectory(dir, baseDir, depth = 0, ctx = { totalFiles: 0, tot
         );
       }
       const content = await readFileContent(fullPath);
-      results.push({ relativePath: (0, import_node_path145.relative)(baseDir, fullPath), content, size });
+      results.push({ relativePath: (0, import_node_path151.relative)(baseDir, fullPath), content, size });
     }
   }
   return results;
 }
 
 // src/lib/sources-lock.ts
-var import_node_crypto = require("crypto");
-var import_node_path146 = require("path");
-var import_mini76 = require("zod/mini");
+var import_node_crypto3 = require("crypto");
+var import_node_path152 = require("path");
+var import_mini78 = require("zod/mini");
 var LOCKFILE_VERSION = 1;
-var LockedSkillSchema = import_mini76.z.object({
-  integrity: import_mini76.z.string()
+var LockedSkillSchema = import_mini78.z.object({
+  integrity: import_mini78.z.string()
 });
-var LockedSourceSchema = import_mini76.z.object({
-  requestedRef: (0, import_mini76.optional)(import_mini76.z.string()),
-  resolvedRef: import_mini76.z.string().check((0, import_mini76.refine)((v) => /^[0-9a-f]{40}$/.test(v), "resolvedRef must be a 40-character hex SHA")),
-  resolvedAt: (0, import_mini76.optional)(import_mini76.z.string()),
-  skills: import_mini76.z.record(import_mini76.z.string(), LockedSkillSchema)
+var LockedSourceSchema = import_mini78.z.object({
+  requestedRef: (0, import_mini78.optional)(import_mini78.z.string()),
+  resolvedRef: import_mini78.z.string().check((0, import_mini78.refine)((v) => /^[0-9a-f]{40}$/.test(v), "resolvedRef must be a 40-character hex SHA")),
+  resolvedAt: (0, import_mini78.optional)(import_mini78.z.string()),
+  skills: import_mini78.z.record(import_mini78.z.string(), LockedSkillSchema)
 });
-var SourcesLockSchema = import_mini76.z.object({
-  lockfileVersion: import_mini76.z.number(),
-  sources: import_mini76.z.record(import_mini76.z.string(), LockedSourceSchema)
+var SourcesLockSchema = import_mini78.z.object({
+  lockfileVersion: import_mini78.z.number(),
+  sources: import_mini78.z.record(import_mini78.z.string(), LockedSourceSchema)
 });
-var LegacyLockedSourceSchema = import_mini76.z.object({
-  resolvedRef: import_mini76.z.string(),
-  skills: import_mini76.z.array(import_mini76.z.string())
+var LegacyLockedSourceSchema = import_mini78.z.object({
+  resolvedRef: import_mini78.z.string(),
+  skills: import_mini78.z.array(import_mini78.z.string())
 });
-var LegacySourcesLockSchema = import_mini76.z.object({
-  sources: import_mini76.z.record(import_mini76.z.string(), LegacyLockedSourceSchema)
+var LegacySourcesLockSchema = import_mini78.z.object({
+  sources: import_mini78.z.record(import_mini78.z.string(), LegacyLockedSourceSchema)
 });
 function migrateLegacyLock(params) {
   const { legacy, logger: logger5 } = params;
@@ -24125,7 +25276,7 @@ function createEmptyLock() {
 }
 async function readLockFile(params) {
   const { logger: logger5 } = params;
-  const lockPath = (0, import_node_path146.join)(params.baseDir, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH);
+  const lockPath = (0, import_node_path152.join)(params.baseDir, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH);
   if (!await fileExists(lockPath)) {
     logger5.debug("No sources lockfile found, starting fresh.");
     return createEmptyLock();
@@ -24154,13 +25305,13 @@ async function readLockFile(params) {
 }
 async function writeLockFile(params) {
   const { logger: logger5 } = params;
-  const lockPath = (0, import_node_path146.join)(params.baseDir, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH);
+  const lockPath = (0, import_node_path152.join)(params.baseDir, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH);
   const content = JSON.stringify(params.lock, null, 2) + "\n";
   await writeFileContent(lockPath, content);
   logger5.debug(`Wrote sources lockfile to ${lockPath}`);
 }
 function computeSkillIntegrity(files) {
-  const hash = (0, import_node_crypto.createHash)("sha256");
+  const hash = (0, import_node_crypto3.createHash)("sha256");
   const sorted = files.toSorted((a, b) => a.path.localeCompare(b.path));
   for (const file of sorted) {
     hash.update(file.path);
@@ -24328,7 +25479,7 @@ function logGitClientHints(params) {
 async function checkLockedSkillsExist(curatedDir, skillNames) {
   if (skillNames.length === 0) return true;
   for (const name of skillNames) {
-    if (!await directoryExists((0, import_node_path147.join)(curatedDir, name))) {
+    if (!await directoryExists((0, import_node_path153.join)(curatedDir, name))) {
       return false;
     }
   }
@@ -24336,10 +25487,10 @@ async function checkLockedSkillsExist(curatedDir, skillNames) {
 }
 async function cleanPreviousCuratedSkills(params) {
   const { curatedDir, lockedSkillNames, logger: logger5 } = params;
-  const resolvedCuratedDir = (0, import_node_path147.resolve)(curatedDir);
+  const resolvedCuratedDir = (0, import_node_path153.resolve)(curatedDir);
   for (const prevSkill of lockedSkillNames) {
-    const prevDir = (0, import_node_path147.join)(curatedDir, prevSkill);
-    if (!(0, import_node_path147.resolve)(prevDir).startsWith(resolvedCuratedDir + import_node_path147.sep)) {
+    const prevDir = (0, import_node_path153.join)(curatedDir, prevSkill);
+    if (!(0, import_node_path153.resolve)(prevDir).startsWith(resolvedCuratedDir + import_node_path153.sep)) {
       logger5.warn(
         `Skipping removal of "${prevSkill}": resolved path is outside the curated directory.`
       );
@@ -24378,9 +25529,9 @@ async function writeSkillAndComputeIntegrity(params) {
   for (const file of files) {
     checkPathTraversal({
       relativePath: file.relativePath,
-      intendedRootDir: (0, import_node_path147.join)(curatedDir, skillName)
+      intendedRootDir: (0, import_node_path153.join)(curatedDir, skillName)
     });
-    await writeFileContent((0, import_node_path147.join)(curatedDir, skillName, file.relativePath), file.content);
+    await writeFileContent((0, import_node_path153.join)(curatedDir, skillName, file.relativePath), file.content);
     written.push({ path: file.relativePath, content: file.content });
   }
   const integrity = computeSkillIntegrity(written);
@@ -24424,6 +25575,40 @@ function buildLockUpdate(params) {
   );
   return { updatedLock, fetchedNames };
 }
+function getFirstPathSeparatorIndex(path4) {
+  const slashIndex = path4.indexOf("/");
+  const backslashIndex = path4.indexOf("\\");
+  if (slashIndex === -1) return backslashIndex;
+  if (backslashIndex === -1) return slashIndex;
+  return Math.min(slashIndex, backslashIndex);
+}
+function groupRemoteFilesBySkillRoot(params) {
+  const { remoteFiles, skillFilter, isWildcard } = params;
+  const grouped = /* @__PURE__ */ new Map();
+  const rootLevelFiles = [];
+  for (const file of remoteFiles) {
+    const separatorIndex = getFirstPathSeparatorIndex(file.relativePath);
+    if (separatorIndex === -1) {
+      rootLevelFiles.push(file);
+      continue;
+    }
+    const skillName = file.relativePath.substring(0, separatorIndex);
+    if (skillName.length === 0) {
+      continue;
+    }
+    const innerPath = file.relativePath.substring(separatorIndex + 1);
+    const groupedFiles = grouped.get(skillName) ?? [];
+    groupedFiles.push({ relativePath: innerPath, content: file.content });
+    grouped.set(skillName, groupedFiles);
+  }
+  if (grouped.size === 0 && !isWildcard && skillFilter.length === 1) {
+    const [singleSkillName] = skillFilter;
+    if (singleSkillName !== void 0 && rootLevelFiles.length > 0) {
+      grouped.set(singleSkillName, rootLevelFiles);
+    }
+  }
+  return grouped;
+}
 async function fetchSource(params) {
   const {
     sourceEntry,
@@ -24457,7 +25642,7 @@ async function fetchSource(params) {
     ref = resolvedSha;
     logger5.debug(`Resolved ${sourceKey} ref "${requestedRef}" to SHA: ${resolvedSha}`);
   }
-  const curatedDir = (0, import_node_path147.join)(baseDir, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
+  const curatedDir = (0, import_node_path153.join)(baseDir, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
   if (locked && resolvedSha === locked.resolvedRef && !updateSources) {
     const allExist = await checkLockedSkillsExist(curatedDir, lockedSkillNames);
     if (allExist) {
@@ -24471,11 +25656,60 @@ async function fetchSource(params) {
   }
   const skillFilter = sourceEntry.skills ?? ["*"];
   const isWildcard = skillFilter.length === 1 && skillFilter[0] === "*";
+  const semaphore = new import_promise4.Semaphore(FETCH_CONCURRENCY_LIMIT);
+  const fetchedSkills = {};
   const skillsBasePath = parsed.path ?? "skills";
   let remoteSkillDirs;
+  let remoteSkillNames = [];
+  let fallbackHandled = false;
   try {
     const entries = await client.listDirectory(parsed.owner, parsed.repo, skillsBasePath, ref);
     remoteSkillDirs = entries.filter((e) => e.type === "dir").map((e) => ({ name: e.name, path: e.path }));
+    if (remoteSkillDirs.length === 0 && !isWildcard && skillFilter.length === 1) {
+      const rootFiles = entries.filter((entry) => entry.type === "file");
+      const rootSkillFiles = [];
+      for (const file of rootFiles) {
+        if (file.size > MAX_FILE_SIZE) {
+          logger5.warn(
+            `Skipping file "${file.path}" (${(file.size / 1024 / 1024).toFixed(2)}MB exceeds ${MAX_FILE_SIZE / 1024 / 1024}MB limit).`
+          );
+          continue;
+        }
+        const content = await withSemaphore(
+          semaphore,
+          () => client.getFileContent(parsed.owner, parsed.repo, file.path, ref)
+        );
+        rootSkillFiles.push({ relativePath: file.name, content });
+      }
+      const groupedRootFiles = groupRemoteFilesBySkillRoot({
+        remoteFiles: rootSkillFiles,
+        skillFilter,
+        isWildcard
+      });
+      const [fallbackSkillName] = groupedRootFiles.keys();
+      if (fallbackSkillName !== void 0) {
+        fallbackHandled = true;
+        remoteSkillNames = [fallbackSkillName];
+        if (!shouldSkipSkill({
+          skillName: fallbackSkillName,
+          sourceKey,
+          localSkillNames,
+          alreadyFetchedSkillNames,
+          logger: logger5
+        })) {
+          fetchedSkills[fallbackSkillName] = await writeSkillAndComputeIntegrity({
+            skillName: fallbackSkillName,
+            files: groupedRootFiles.get(fallbackSkillName) ?? [],
+            curatedDir,
+            locked,
+            resolvedSha,
+            sourceKey,
+            logger: logger5
+          });
+          logger5.debug(`Fetched skill "${fallbackSkillName}" from ${sourceKey}`);
+        }
+      }
+    }
   } catch (error) {
     if (error instanceof GitHubClientError && error.statusCode === 404) {
       logger5.warn(`No skills/ directory found in ${sourceKey}. Skipping.`);
@@ -24484,8 +25718,9 @@ async function fetchSource(params) {
     throw error;
   }
   const filteredDirs = isWildcard ? remoteSkillDirs : remoteSkillDirs.filter((d) => skillFilter.includes(d.name));
-  const semaphore = new import_promise2.Semaphore(FETCH_CONCURRENCY_LIMIT);
-  const fetchedSkills = {};
+  if (!fallbackHandled) {
+    remoteSkillNames = filteredDirs.map((d) => d.name);
+  }
   if (locked) {
     await cleanPreviousCuratedSkills({ curatedDir, lockedSkillNames, logger: logger5 });
   }
@@ -24543,7 +25778,7 @@ async function fetchSource(params) {
     locked,
     requestedRef,
     resolvedSha,
-    remoteSkillNames: filteredDirs.map((d) => d.name),
+    remoteSkillNames,
     logger: logger5
   });
   return {
@@ -24582,7 +25817,7 @@ async function fetchSourceViaGit(params) {
     requestedRef = def.ref;
     resolvedSha = def.sha;
   }
-  const curatedDir = (0, import_node_path147.join)(baseDir, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
+  const curatedDir = (0, import_node_path153.join)(baseDir, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
   if (locked && resolvedSha === locked.resolvedRef && !updateSources) {
     if (await checkLockedSkillsExist(curatedDir, lockedSkillNames)) {
       return { skillCount: 0, fetchedSkillNames: lockedSkillNames, updatedLock: lock };
@@ -24605,28 +25840,7 @@ async function fetchSourceViaGit(params) {
     ref: requestedRef,
     skillsPath: sourceEntry.path ?? "skills"
   });
-  const skillFileMap = /* @__PURE__ */ new Map();
-  for (const file of remoteFiles) {
-    const idx = file.relativePath.indexOf("/");
-    if (idx === -1) continue;
-    const name = file.relativePath.substring(0, idx);
-    const inner = file.relativePath.substring(idx + 1);
-    const arr = skillFileMap.get(name) ?? [];
-    arr.push({ relativePath: inner, content: file.content });
-    skillFileMap.set(name, arr);
-  }
-  if (skillFileMap.size === 0 && !isWildcard && skillFilter.length === 1) {
-    const [singleSkillName] = skillFilter;
-    if (singleSkillName !== void 0) {
-      const rootFiles = remoteFiles.filter((f) => f.relativePath.indexOf("/") === -1);
-      if (rootFiles.length > 0) {
-        skillFileMap.set(
-          singleSkillName,
-          rootFiles.map((f) => ({ relativePath: f.relativePath, content: f.content }))
-        );
-      }
-    }
-  }
+  const skillFileMap = groupRemoteFilesBySkillRoot({ remoteFiles, skillFilter, isWildcard });
   const allNames = [...skillFileMap.keys()];
   const filteredNames = isWildcard ? allNames : allNames.filter((n) => skillFilter.includes(n));
   if (locked) {
@@ -24671,21 +25885,47 @@ async function fetchSourceViaGit(params) {
 }
 
 // src/cli/commands/install.ts
+var INSTALL_MODES = ["rulesync", "apm", "gh"];
 async function installCommand(logger5, options) {
+  const mode = options.mode ?? "rulesync";
+  if (mode === "gh") {
+    await runGhInstall(logger5, options);
+    return;
+  }
+  if (mode === "apm") {
+    await runApmInstall(logger5, options);
+    return;
+  }
+  await runRulesyncInstall(logger5, options);
+}
+async function runRulesyncInstall(logger5, options) {
+  const baseDir = process.cwd();
+  const apmExists = await apmManifestExists(baseDir);
   const config = await ConfigResolver.resolve({
     configPath: options.configPath,
     verbose: options.verbose,
     silent: options.silent
   });
   const sources = config.getSources();
+  if (apmExists && sources.length > 0) {
+    throw new Error(
+      "Both apm.yml and rulesync.jsonc `sources` are defined. Pass --mode apm or --mode rulesync to disambiguate."
+    );
+  }
   if (sources.length === 0) {
+    if (apmExists) {
+      logger5.warn(
+        "No sources defined in rulesync.jsonc, but apm.yml is present. Did you mean --mode apm?"
+      );
+      return;
+    }
     logger5.warn("No sources defined in configuration. Nothing to install.");
     return;
   }
   logger5.debug(`Installing skills from ${sources.length} source(s)...`);
   const result = await resolveAndFetchSources({
     sources,
-    baseDir: process.cwd(),
+    baseDir,
     options: {
       updateSources: options.update,
       frozen: options.frozen,
@@ -24705,21 +25945,95 @@ async function installCommand(logger5, options) {
     logger5.success(`All skills up to date (${result.sourcesProcessed} source(s) checked).`);
   }
 }
+async function runApmInstall(logger5, options) {
+  const baseDir = process.cwd();
+  if (!await apmManifestExists(baseDir)) {
+    throw new Error(
+      "--mode apm requires an apm.yml at the project root. Create one or drop --mode apm to fall back to rulesync mode."
+    );
+  }
+  const result = await installApm({
+    baseDir,
+    options: {
+      update: options.update,
+      frozen: options.frozen,
+      token: options.token
+    },
+    logger: logger5
+  });
+  if (logger5.jsonMode) {
+    logger5.captureData("dependenciesProcessed", result.dependenciesProcessed);
+    logger5.captureData("deployedFileCount", result.deployedFileCount);
+    logger5.captureData("failedDependencyCount", result.failedDependencyCount);
+  }
+  if (result.failedDependencyCount > 0) {
+    throw new Error(
+      `Failed to install ${result.failedDependencyCount} of ${result.dependenciesProcessed} apm dependency(ies). See the log above for details.`
+    );
+  }
+  if (result.deployedFileCount > 0) {
+    logger5.success(
+      `Installed ${result.deployedFileCount} file(s) from ${result.dependenciesProcessed} apm dependency(ies).`
+    );
+  } else {
+    logger5.success(`All apm dependencies up to date (${result.dependenciesProcessed} checked).`);
+  }
+}
+async function runGhInstall(logger5, options) {
+  const baseDir = process.cwd();
+  const config = await ConfigResolver.resolve({
+    configPath: options.configPath,
+    verbose: options.verbose,
+    silent: options.silent
+  });
+  const sources = config.getSources();
+  if (sources.length === 0) {
+    logger5.warn("No sources defined in configuration. Nothing to install.");
+    return;
+  }
+  const result = await installGh({
+    baseDir,
+    sources,
+    options: {
+      update: options.update,
+      frozen: options.frozen,
+      token: options.token
+    },
+    logger: logger5
+  });
+  if (logger5.jsonMode) {
+    logger5.captureData("sourcesProcessed", result.sourcesProcessed);
+    logger5.captureData("installedSkillCount", result.installedSkillCount);
+    logger5.captureData("failedSourceCount", result.failedSourceCount);
+  }
+  if (result.failedSourceCount > 0) {
+    throw new Error(
+      `Failed to install ${result.failedSourceCount} of ${result.sourcesProcessed} gh source(s). See the log above for details.`
+    );
+  }
+  if (result.installedSkillCount > 0) {
+    logger5.success(
+      `Installed ${result.installedSkillCount} skill(s) from ${result.sourcesProcessed} gh source(s).`
+    );
+  } else {
+    logger5.success(`All gh sources up to date (${result.sourcesProcessed} checked).`);
+  }
+}
 
 // src/cli/commands/mcp.ts
 var import_fastmcp = require("fastmcp");
 
 // src/mcp/tools.ts
-var import_mini85 = require("zod/mini");
+var import_mini89 = require("zod/mini");
 
 // src/mcp/commands.ts
-var import_node_path148 = require("path");
-var import_mini77 = require("zod/mini");
+var import_node_path154 = require("path");
+var import_mini79 = require("zod/mini");
 var logger = new ConsoleLogger({ verbose: false, silent: true });
 var maxCommandSizeBytes = 1024 * 1024;
 var maxCommandsCount = 1e3;
 async function listCommands() {
-  const commandsDir = (0, import_node_path148.join)(process.cwd(), RULESYNC_COMMANDS_RELATIVE_DIR_PATH);
+  const commandsDir = (0, import_node_path154.join)(process.cwd(), RULESYNC_COMMANDS_RELATIVE_DIR_PATH);
   try {
     const files = await listDirectoryFiles(commandsDir);
     const mdFiles = files.filter((file) => file.endsWith(".md"));
@@ -24735,7 +26049,7 @@ async function listCommands() {
           });
           const frontmatter = command.getFrontmatter();
           return {
-            relativePathFromCwd: (0, import_node_path148.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, file),
+            relativePathFromCwd: (0, import_node_path154.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, file),
             frontmatter
           };
         } catch (error) {
@@ -24757,13 +26071,13 @@ async function getCommand({ relativePathFromCwd }) {
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path148.basename)(relativePathFromCwd);
+  const filename = (0, import_node_path154.basename)(relativePathFromCwd);
   try {
     const command = await RulesyncCommand.fromFile({
       relativeFilePath: filename
     });
     return {
-      relativePathFromCwd: (0, import_node_path148.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename),
+      relativePathFromCwd: (0, import_node_path154.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename),
       frontmatter: command.getFrontmatter(),
       body: command.getBody()
     };
@@ -24782,7 +26096,7 @@ async function putCommand({
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path148.basename)(relativePathFromCwd);
+  const filename = (0, import_node_path154.basename)(relativePathFromCwd);
   const estimatedSize = JSON.stringify(frontmatter).length + body.length;
   if (estimatedSize > maxCommandSizeBytes) {
     throw new Error(
@@ -24792,7 +26106,7 @@ async function putCommand({
   try {
     const existingCommands = await listCommands();
     const isUpdate = existingCommands.some(
-      (command2) => command2.relativePathFromCwd === (0, import_node_path148.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename)
+      (command2) => command2.relativePathFromCwd === (0, import_node_path154.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename)
     );
     if (!isUpdate && existingCommands.length >= maxCommandsCount) {
       throw new Error(
@@ -24809,11 +26123,11 @@ async function putCommand({
       fileContent,
       validate: true
     });
-    const commandsDir = (0, import_node_path148.join)(process.cwd(), RULESYNC_COMMANDS_RELATIVE_DIR_PATH);
+    const commandsDir = (0, import_node_path154.join)(process.cwd(), RULESYNC_COMMANDS_RELATIVE_DIR_PATH);
     await ensureDir(commandsDir);
     await writeFileContent(command.getFilePath(), command.getFileContent());
     return {
-      relativePathFromCwd: (0, import_node_path148.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename),
+      relativePathFromCwd: (0, import_node_path154.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename),
       frontmatter: command.getFrontmatter(),
       body: command.getBody()
     };
@@ -24828,12 +26142,12 @@ async function deleteCommand({ relativePathFromCwd }) {
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path148.basename)(relativePathFromCwd);
-  const fullPath = (0, import_node_path148.join)(process.cwd(), RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename);
+  const filename = (0, import_node_path154.basename)(relativePathFromCwd);
+  const fullPath = (0, import_node_path154.join)(process.cwd(), RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename);
   try {
     await removeFile(fullPath);
     return {
-      relativePathFromCwd: (0, import_node_path148.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename)
+      relativePathFromCwd: (0, import_node_path154.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, filename)
     };
   } catch (error) {
     throw new Error(`Failed to delete command file ${relativePathFromCwd}: ${formatError(error)}`, {
@@ -24842,23 +26156,23 @@ async function deleteCommand({ relativePathFromCwd }) {
   }
 }
 var commandToolSchemas = {
-  listCommands: import_mini77.z.object({}),
-  getCommand: import_mini77.z.object({
-    relativePathFromCwd: import_mini77.z.string()
+  listCommands: import_mini79.z.object({}),
+  getCommand: import_mini79.z.object({
+    relativePathFromCwd: import_mini79.z.string()
   }),
-  putCommand: import_mini77.z.object({
-    relativePathFromCwd: import_mini77.z.string(),
+  putCommand: import_mini79.z.object({
+    relativePathFromCwd: import_mini79.z.string(),
     frontmatter: RulesyncCommandFrontmatterSchema,
-    body: import_mini77.z.string()
+    body: import_mini79.z.string()
   }),
-  deleteCommand: import_mini77.z.object({
-    relativePathFromCwd: import_mini77.z.string()
+  deleteCommand: import_mini79.z.object({
+    relativePathFromCwd: import_mini79.z.string()
   })
 };
 var commandTools = {
   listCommands: {
     name: "listCommands",
-    description: `List all commands from ${(0, import_node_path148.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, "*.md")} with their frontmatter.`,
+    description: `List all commands from ${(0, import_node_path154.join)(RULESYNC_COMMANDS_RELATIVE_DIR_PATH, "*.md")} with their frontmatter.`,
     parameters: commandToolSchemas.listCommands,
     execute: async () => {
       const commands = await listCommands();
@@ -24900,15 +26214,15 @@ var commandTools = {
 };
 
 // src/mcp/generate.ts
-var import_mini78 = require("zod/mini");
-var generateOptionsSchema = import_mini78.z.object({
-  targets: import_mini78.z.optional(import_mini78.z.array(import_mini78.z.string())),
-  features: import_mini78.z.optional(import_mini78.z.array(import_mini78.z.string())),
-  delete: import_mini78.z.optional(import_mini78.z.boolean()),
-  global: import_mini78.z.optional(import_mini78.z.boolean()),
-  simulateCommands: import_mini78.z.optional(import_mini78.z.boolean()),
-  simulateSubagents: import_mini78.z.optional(import_mini78.z.boolean()),
-  simulateSkills: import_mini78.z.optional(import_mini78.z.boolean())
+var import_mini80 = require("zod/mini");
+var generateOptionsSchema = import_mini80.z.object({
+  targets: import_mini80.z.optional(import_mini80.z.array(import_mini80.z.string())),
+  features: import_mini80.z.optional(import_mini80.z.array(import_mini80.z.string())),
+  delete: import_mini80.z.optional(import_mini80.z.boolean()),
+  global: import_mini80.z.optional(import_mini80.z.boolean()),
+  simulateCommands: import_mini80.z.optional(import_mini80.z.boolean()),
+  simulateSubagents: import_mini80.z.optional(import_mini80.z.boolean()),
+  simulateSkills: import_mini80.z.optional(import_mini80.z.boolean())
 });
 async function executeGenerate(options = {}) {
   try {
@@ -24986,12 +26300,139 @@ var generateTools = {
   }
 };
 
+// src/mcp/hooks.ts
+var import_node_path155 = require("path");
+var import_mini81 = require("zod/mini");
+var maxHooksSizeBytes = 1024 * 1024;
+async function getHooksFile() {
+  try {
+    const rulesyncHooks = await RulesyncHooks.fromFile({
+      validate: true
+    });
+    const relativePathFromCwd = (0, import_node_path155.join)(
+      rulesyncHooks.getRelativeDirPath(),
+      rulesyncHooks.getRelativeFilePath()
+    );
+    return {
+      relativePathFromCwd,
+      content: rulesyncHooks.getFileContent()
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to read hooks file (${RULESYNC_HOOKS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+}
+async function putHooksFile({ content }) {
+  if (content.length > maxHooksSizeBytes) {
+    throw new Error(
+      `Hooks file size ${content.length} bytes exceeds maximum ${maxHooksSizeBytes} bytes (1MB) for ${RULESYNC_HOOKS_RELATIVE_FILE_PATH}`
+    );
+  }
+  try {
+    JSON.parse(content);
+  } catch (error) {
+    throw new Error(
+      `Invalid JSON format in hooks file (${RULESYNC_HOOKS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+  try {
+    const baseDir = process.cwd();
+    const paths = RulesyncHooks.getSettablePaths();
+    const relativeDirPath = paths.relativeDirPath;
+    const relativeFilePath = paths.relativeFilePath;
+    const fullPath = (0, import_node_path155.join)(baseDir, relativeDirPath, relativeFilePath);
+    const rulesyncHooks = new RulesyncHooks({
+      baseDir,
+      relativeDirPath,
+      relativeFilePath,
+      fileContent: content,
+      validate: true
+    });
+    await ensureDir((0, import_node_path155.join)(baseDir, relativeDirPath));
+    await writeFileContent(fullPath, content);
+    const relativePathFromCwd = (0, import_node_path155.join)(relativeDirPath, relativeFilePath);
+    return {
+      relativePathFromCwd,
+      content: rulesyncHooks.getFileContent()
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to write hooks file (${RULESYNC_HOOKS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+}
+async function deleteHooksFile() {
+  try {
+    const baseDir = process.cwd();
+    const paths = RulesyncHooks.getSettablePaths();
+    const filePath = (0, import_node_path155.join)(baseDir, paths.relativeDirPath, paths.relativeFilePath);
+    await removeFile(filePath);
+    const relativePathFromCwd = (0, import_node_path155.join)(paths.relativeDirPath, paths.relativeFilePath);
+    return {
+      relativePathFromCwd
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to delete hooks file (${RULESYNC_HOOKS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+}
+var hooksToolSchemas = {
+  getHooksFile: import_mini81.z.object({}),
+  putHooksFile: import_mini81.z.object({
+    content: import_mini81.z.string()
+  }),
+  deleteHooksFile: import_mini81.z.object({})
+};
+var hooksTools = {
+  getHooksFile: {
+    name: "getHooksFile",
+    description: `Get the hooks configuration file (${RULESYNC_HOOKS_RELATIVE_FILE_PATH}).`,
+    parameters: hooksToolSchemas.getHooksFile,
+    execute: async () => {
+      const result = await getHooksFile();
+      return JSON.stringify(result, null, 2);
+    }
+  },
+  putHooksFile: {
+    name: "putHooksFile",
+    description: "Create or update the hooks configuration file (upsert operation). content parameter is required and must be valid JSON.",
+    parameters: hooksToolSchemas.putHooksFile,
+    execute: async (args) => {
+      const result = await putHooksFile({ content: args.content });
+      return JSON.stringify(result, null, 2);
+    }
+  },
+  deleteHooksFile: {
+    name: "deleteHooksFile",
+    description: "Delete the hooks configuration file.",
+    parameters: hooksToolSchemas.deleteHooksFile,
+    execute: async () => {
+      const result = await deleteHooksFile();
+      return JSON.stringify(result, null, 2);
+    }
+  }
+};
+
 // src/mcp/ignore.ts
-var import_node_path149 = require("path");
-var import_mini79 = require("zod/mini");
+var import_node_path156 = require("path");
+var import_mini82 = require("zod/mini");
 var maxIgnoreFileSizeBytes = 100 * 1024;
 async function getIgnoreFile() {
-  const ignoreFilePath = (0, import_node_path149.join)(process.cwd(), RULESYNC_AIIGNORE_RELATIVE_FILE_PATH);
+  const ignoreFilePath = (0, import_node_path156.join)(process.cwd(), RULESYNC_AIIGNORE_RELATIVE_FILE_PATH);
   try {
     const content = await readFileContent(ignoreFilePath);
     return {
@@ -25008,7 +26449,7 @@ async function getIgnoreFile() {
   }
 }
 async function putIgnoreFile({ content }) {
-  const ignoreFilePath = (0, import_node_path149.join)(process.cwd(), RULESYNC_AIIGNORE_RELATIVE_FILE_PATH);
+  const ignoreFilePath = (0, import_node_path156.join)(process.cwd(), RULESYNC_AIIGNORE_RELATIVE_FILE_PATH);
   const contentSizeBytes = Buffer.byteLength(content, "utf8");
   if (contentSizeBytes > maxIgnoreFileSizeBytes) {
     throw new Error(
@@ -25032,8 +26473,8 @@ async function putIgnoreFile({ content }) {
   }
 }
 async function deleteIgnoreFile() {
-  const aiignorePath = (0, import_node_path149.join)(process.cwd(), RULESYNC_AIIGNORE_RELATIVE_FILE_PATH);
-  const legacyIgnorePath = (0, import_node_path149.join)(process.cwd(), RULESYNC_IGNORE_RELATIVE_FILE_PATH);
+  const aiignorePath = (0, import_node_path156.join)(process.cwd(), RULESYNC_AIIGNORE_RELATIVE_FILE_PATH);
+  const legacyIgnorePath = (0, import_node_path156.join)(process.cwd(), RULESYNC_IGNORE_RELATIVE_FILE_PATH);
   try {
     await Promise.all([removeFile(aiignorePath), removeFile(legacyIgnorePath)]);
     return {
@@ -25051,11 +26492,11 @@ async function deleteIgnoreFile() {
   }
 }
 var ignoreToolSchemas = {
-  getIgnoreFile: import_mini79.z.object({}),
-  putIgnoreFile: import_mini79.z.object({
-    content: import_mini79.z.string()
+  getIgnoreFile: import_mini82.z.object({}),
+  putIgnoreFile: import_mini82.z.object({
+    content: import_mini82.z.string()
   }),
-  deleteIgnoreFile: import_mini79.z.object({})
+  deleteIgnoreFile: import_mini82.z.object({})
 };
 var ignoreTools = {
   getIgnoreFile: {
@@ -25088,11 +26529,11 @@ var ignoreTools = {
 };
 
 // src/mcp/import.ts
-var import_mini80 = require("zod/mini");
-var importOptionsSchema = import_mini80.z.object({
-  target: import_mini80.z.string(),
-  features: import_mini80.z.optional(import_mini80.z.array(import_mini80.z.string())),
-  global: import_mini80.z.optional(import_mini80.z.boolean())
+var import_mini83 = require("zod/mini");
+var importOptionsSchema = import_mini83.z.object({
+  target: import_mini83.z.string(),
+  features: import_mini83.z.optional(import_mini83.z.array(import_mini83.z.string())),
+  global: import_mini83.z.optional(import_mini83.z.boolean())
 });
 async function executeImport(options) {
   try {
@@ -25163,15 +26604,15 @@ var importTools = {
 };
 
 // src/mcp/mcp.ts
-var import_node_path150 = require("path");
-var import_mini81 = require("zod/mini");
+var import_node_path157 = require("path");
+var import_mini84 = require("zod/mini");
 var maxMcpSizeBytes = 1024 * 1024;
 async function getMcpFile() {
   try {
     const rulesyncMcp = await RulesyncMcp.fromFile({
       validate: true
     });
-    const relativePathFromCwd = (0, import_node_path150.join)(
+    const relativePathFromCwd = (0, import_node_path157.join)(
       rulesyncMcp.getRelativeDirPath(),
       rulesyncMcp.getRelativeFilePath()
     );
@@ -25209,7 +26650,7 @@ async function putMcpFile({ content }) {
     const paths = RulesyncMcp.getSettablePaths();
     const relativeDirPath = paths.recommended.relativeDirPath;
     const relativeFilePath = paths.recommended.relativeFilePath;
-    const fullPath = (0, import_node_path150.join)(baseDir, relativeDirPath, relativeFilePath);
+    const fullPath = (0, import_node_path157.join)(baseDir, relativeDirPath, relativeFilePath);
     const rulesyncMcp = new RulesyncMcp({
       baseDir,
       relativeDirPath,
@@ -25217,9 +26658,9 @@ async function putMcpFile({ content }) {
       fileContent: content,
       validate: true
     });
-    await ensureDir((0, import_node_path150.join)(baseDir, relativeDirPath));
+    await ensureDir((0, import_node_path157.join)(baseDir, relativeDirPath));
     await writeFileContent(fullPath, content);
-    const relativePathFromCwd = (0, import_node_path150.join)(relativeDirPath, relativeFilePath);
+    const relativePathFromCwd = (0, import_node_path157.join)(relativeDirPath, relativeFilePath);
     return {
       relativePathFromCwd,
       content: rulesyncMcp.getFileContent()
@@ -25237,15 +26678,15 @@ async function deleteMcpFile() {
   try {
     const baseDir = process.cwd();
     const paths = RulesyncMcp.getSettablePaths();
-    const recommendedPath = (0, import_node_path150.join)(
+    const recommendedPath = (0, import_node_path157.join)(
       baseDir,
       paths.recommended.relativeDirPath,
       paths.recommended.relativeFilePath
     );
-    const legacyPath = (0, import_node_path150.join)(baseDir, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
+    const legacyPath = (0, import_node_path157.join)(baseDir, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
     await removeFile(recommendedPath);
     await removeFile(legacyPath);
-    const relativePathFromCwd = (0, import_node_path150.join)(
+    const relativePathFromCwd = (0, import_node_path157.join)(
       paths.recommended.relativeDirPath,
       paths.recommended.relativeFilePath
     );
@@ -25262,11 +26703,11 @@ async function deleteMcpFile() {
   }
 }
 var mcpToolSchemas = {
-  getMcpFile: import_mini81.z.object({}),
-  putMcpFile: import_mini81.z.object({
-    content: import_mini81.z.string()
+  getMcpFile: import_mini84.z.object({}),
+  putMcpFile: import_mini84.z.object({
+    content: import_mini84.z.string()
   }),
-  deleteMcpFile: import_mini81.z.object({})
+  deleteMcpFile: import_mini84.z.object({})
 };
 var mcpTools = {
   getMcpFile: {
@@ -25298,14 +26739,141 @@ var mcpTools = {
   }
 };
 
+// src/mcp/permissions.ts
+var import_node_path158 = require("path");
+var import_mini85 = require("zod/mini");
+var maxPermissionsSizeBytes = 1024 * 1024;
+async function getPermissionsFile() {
+  try {
+    const rulesyncPermissions = await RulesyncPermissions.fromFile({
+      validate: true
+    });
+    const relativePathFromCwd = (0, import_node_path158.join)(
+      rulesyncPermissions.getRelativeDirPath(),
+      rulesyncPermissions.getRelativeFilePath()
+    );
+    return {
+      relativePathFromCwd,
+      content: rulesyncPermissions.getFileContent()
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to read permissions file (${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+}
+async function putPermissionsFile({ content }) {
+  if (content.length > maxPermissionsSizeBytes) {
+    throw new Error(
+      `Permissions file size ${content.length} bytes exceeds maximum ${maxPermissionsSizeBytes} bytes (1MB) for ${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}`
+    );
+  }
+  try {
+    JSON.parse(content);
+  } catch (error) {
+    throw new Error(
+      `Invalid JSON format in permissions file (${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+  try {
+    const baseDir = process.cwd();
+    const paths = RulesyncPermissions.getSettablePaths();
+    const relativeDirPath = paths.relativeDirPath;
+    const relativeFilePath = paths.relativeFilePath;
+    const fullPath = (0, import_node_path158.join)(baseDir, relativeDirPath, relativeFilePath);
+    const rulesyncPermissions = new RulesyncPermissions({
+      baseDir,
+      relativeDirPath,
+      relativeFilePath,
+      fileContent: content,
+      validate: true
+    });
+    await ensureDir((0, import_node_path158.join)(baseDir, relativeDirPath));
+    await writeFileContent(fullPath, content);
+    const relativePathFromCwd = (0, import_node_path158.join)(relativeDirPath, relativeFilePath);
+    return {
+      relativePathFromCwd,
+      content: rulesyncPermissions.getFileContent()
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to write permissions file (${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+}
+async function deletePermissionsFile() {
+  try {
+    const baseDir = process.cwd();
+    const paths = RulesyncPermissions.getSettablePaths();
+    const filePath = (0, import_node_path158.join)(baseDir, paths.relativeDirPath, paths.relativeFilePath);
+    await removeFile(filePath);
+    const relativePathFromCwd = (0, import_node_path158.join)(paths.relativeDirPath, paths.relativeFilePath);
+    return {
+      relativePathFromCwd
+    };
+  } catch (error) {
+    throw new Error(
+      `Failed to delete permissions file (${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}): ${formatError(error)}`,
+      {
+        cause: error
+      }
+    );
+  }
+}
+var permissionsToolSchemas = {
+  getPermissionsFile: import_mini85.z.object({}),
+  putPermissionsFile: import_mini85.z.object({
+    content: import_mini85.z.string()
+  }),
+  deletePermissionsFile: import_mini85.z.object({})
+};
+var permissionsTools = {
+  getPermissionsFile: {
+    name: "getPermissionsFile",
+    description: `Get the permissions configuration file (${RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH}).`,
+    parameters: permissionsToolSchemas.getPermissionsFile,
+    execute: async () => {
+      const result = await getPermissionsFile();
+      return JSON.stringify(result, null, 2);
+    }
+  },
+  putPermissionsFile: {
+    name: "putPermissionsFile",
+    description: "Create or update the permissions configuration file (upsert operation). content parameter is required and must be valid JSON.",
+    parameters: permissionsToolSchemas.putPermissionsFile,
+    execute: async (args) => {
+      const result = await putPermissionsFile({ content: args.content });
+      return JSON.stringify(result, null, 2);
+    }
+  },
+  deletePermissionsFile: {
+    name: "deletePermissionsFile",
+    description: "Delete the permissions configuration file.",
+    parameters: permissionsToolSchemas.deletePermissionsFile,
+    execute: async () => {
+      const result = await deletePermissionsFile();
+      return JSON.stringify(result, null, 2);
+    }
+  }
+};
+
 // src/mcp/rules.ts
-var import_node_path151 = require("path");
-var import_mini82 = require("zod/mini");
+var import_node_path159 = require("path");
+var import_mini86 = require("zod/mini");
 var logger2 = new ConsoleLogger({ verbose: false, silent: true });
 var maxRuleSizeBytes = 1024 * 1024;
 var maxRulesCount = 1e3;
 async function listRules() {
-  const rulesDir = (0, import_node_path151.join)(process.cwd(), RULESYNC_RULES_RELATIVE_DIR_PATH);
+  const rulesDir = (0, import_node_path159.join)(process.cwd(), RULESYNC_RULES_RELATIVE_DIR_PATH);
   try {
     const files = await listDirectoryFiles(rulesDir);
     const mdFiles = files.filter((file) => file.endsWith(".md"));
@@ -25318,7 +26886,7 @@ async function listRules() {
           });
           const frontmatter = rule.getFrontmatter();
           return {
-            relativePathFromCwd: (0, import_node_path151.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, file),
+            relativePathFromCwd: (0, import_node_path159.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, file),
             frontmatter
           };
         } catch (error) {
@@ -25340,14 +26908,14 @@ async function getRule({ relativePathFromCwd }) {
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path151.basename)(relativePathFromCwd);
+  const filename = (0, import_node_path159.basename)(relativePathFromCwd);
   try {
     const rule = await RulesyncRule.fromFile({
       relativeFilePath: filename,
       validate: true
     });
     return {
-      relativePathFromCwd: (0, import_node_path151.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename),
+      relativePathFromCwd: (0, import_node_path159.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename),
       frontmatter: rule.getFrontmatter(),
       body: rule.getBody()
     };
@@ -25366,7 +26934,7 @@ async function putRule({
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path151.basename)(relativePathFromCwd);
+  const filename = (0, import_node_path159.basename)(relativePathFromCwd);
   const estimatedSize = JSON.stringify(frontmatter).length + body.length;
   if (estimatedSize > maxRuleSizeBytes) {
     throw new Error(
@@ -25376,7 +26944,7 @@ async function putRule({
   try {
     const existingRules = await listRules();
     const isUpdate = existingRules.some(
-      (rule2) => rule2.relativePathFromCwd === (0, import_node_path151.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename)
+      (rule2) => rule2.relativePathFromCwd === (0, import_node_path159.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename)
     );
     if (!isUpdate && existingRules.length >= maxRulesCount) {
       throw new Error(
@@ -25391,11 +26959,11 @@ async function putRule({
       body,
       validate: true
     });
-    const rulesDir = (0, import_node_path151.join)(process.cwd(), RULESYNC_RULES_RELATIVE_DIR_PATH);
+    const rulesDir = (0, import_node_path159.join)(process.cwd(), RULESYNC_RULES_RELATIVE_DIR_PATH);
     await ensureDir(rulesDir);
     await writeFileContent(rule.getFilePath(), rule.getFileContent());
     return {
-      relativePathFromCwd: (0, import_node_path151.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename),
+      relativePathFromCwd: (0, import_node_path159.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename),
       frontmatter: rule.getFrontmatter(),
       body: rule.getBody()
     };
@@ -25410,12 +26978,12 @@ async function deleteRule({ relativePathFromCwd }) {
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path151.basename)(relativePathFromCwd);
-  const fullPath = (0, import_node_path151.join)(process.cwd(), RULESYNC_RULES_RELATIVE_DIR_PATH, filename);
+  const filename = (0, import_node_path159.basename)(relativePathFromCwd);
+  const fullPath = (0, import_node_path159.join)(process.cwd(), RULESYNC_RULES_RELATIVE_DIR_PATH, filename);
   try {
     await removeFile(fullPath);
     return {
-      relativePathFromCwd: (0, import_node_path151.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename)
+      relativePathFromCwd: (0, import_node_path159.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, filename)
     };
   } catch (error) {
     throw new Error(`Failed to delete rule file ${relativePathFromCwd}: ${formatError(error)}`, {
@@ -25424,23 +26992,23 @@ async function deleteRule({ relativePathFromCwd }) {
   }
 }
 var ruleToolSchemas = {
-  listRules: import_mini82.z.object({}),
-  getRule: import_mini82.z.object({
-    relativePathFromCwd: import_mini82.z.string()
+  listRules: import_mini86.z.object({}),
+  getRule: import_mini86.z.object({
+    relativePathFromCwd: import_mini86.z.string()
   }),
-  putRule: import_mini82.z.object({
-    relativePathFromCwd: import_mini82.z.string(),
+  putRule: import_mini86.z.object({
+    relativePathFromCwd: import_mini86.z.string(),
     frontmatter: RulesyncRuleFrontmatterSchema,
-    body: import_mini82.z.string()
+    body: import_mini86.z.string()
   }),
-  deleteRule: import_mini82.z.object({
-    relativePathFromCwd: import_mini82.z.string()
+  deleteRule: import_mini86.z.object({
+    relativePathFromCwd: import_mini86.z.string()
   })
 };
 var ruleTools = {
   listRules: {
     name: "listRules",
-    description: `List all rules from ${(0, import_node_path151.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, "*.md")} with their frontmatter.`,
+    description: `List all rules from ${(0, import_node_path159.join)(RULESYNC_RULES_RELATIVE_DIR_PATH, "*.md")} with their frontmatter.`,
     parameters: ruleToolSchemas.listRules,
     execute: async () => {
       const rules = await listRules();
@@ -25482,8 +27050,8 @@ var ruleTools = {
 };
 
 // src/mcp/skills.ts
-var import_node_path152 = require("path");
-var import_mini83 = require("zod/mini");
+var import_node_path160 = require("path");
+var import_mini87 = require("zod/mini");
 var logger3 = new ConsoleLogger({ verbose: false, silent: true });
 var maxSkillSizeBytes = 1024 * 1024;
 var maxSkillsCount = 1e3;
@@ -25500,19 +27068,19 @@ function mcpSkillFileToAiDirFile(file) {
   };
 }
 function extractDirName(relativeDirPathFromCwd) {
-  const dirName = (0, import_node_path152.basename)(relativeDirPathFromCwd);
+  const dirName = (0, import_node_path160.basename)(relativeDirPathFromCwd);
   if (!dirName) {
     throw new Error(`Invalid path: ${relativeDirPathFromCwd}`);
   }
   return dirName;
 }
 async function listSkills() {
-  const skillsDir = (0, import_node_path152.join)(process.cwd(), RULESYNC_SKILLS_RELATIVE_DIR_PATH);
+  const skillsDir = (0, import_node_path160.join)(process.cwd(), RULESYNC_SKILLS_RELATIVE_DIR_PATH);
   try {
-    const skillDirPaths = await findFilesByGlobs((0, import_node_path152.join)(skillsDir, "*"), { type: "dir" });
+    const skillDirPaths = await findFilesByGlobs((0, import_node_path160.join)(skillsDir, "*"), { type: "dir" });
     const skills = await Promise.all(
       skillDirPaths.map(async (dirPath) => {
-        const dirName = (0, import_node_path152.basename)(dirPath);
+        const dirName = (0, import_node_path160.basename)(dirPath);
         if (!dirName) return null;
         try {
           const skill = await RulesyncSkill.fromDir({
@@ -25520,7 +27088,7 @@ async function listSkills() {
           });
           const frontmatter = skill.getFrontmatter();
           return {
-            relativeDirPathFromCwd: (0, import_node_path152.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName),
+            relativeDirPathFromCwd: (0, import_node_path160.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName),
             frontmatter
           };
         } catch (error) {
@@ -25548,7 +27116,7 @@ async function getSkill({ relativeDirPathFromCwd }) {
       dirName
     });
     return {
-      relativeDirPathFromCwd: (0, import_node_path152.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName),
+      relativeDirPathFromCwd: (0, import_node_path160.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName),
       frontmatter: skill.getFrontmatter(),
       body: skill.getBody(),
       otherFiles: skill.getOtherFiles().map(aiDirFileToMcpSkillFile)
@@ -25582,7 +27150,7 @@ async function putSkill({
   try {
     const existingSkills = await listSkills();
     const isUpdate = existingSkills.some(
-      (skill2) => skill2.relativeDirPathFromCwd === (0, import_node_path152.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName)
+      (skill2) => skill2.relativeDirPathFromCwd === (0, import_node_path160.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName)
     );
     if (!isUpdate && existingSkills.length >= maxSkillsCount) {
       throw new Error(
@@ -25599,9 +27167,9 @@ async function putSkill({
       otherFiles: aiDirFiles,
       validate: true
     });
-    const skillDirPath = (0, import_node_path152.join)(process.cwd(), RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName);
+    const skillDirPath = (0, import_node_path160.join)(process.cwd(), RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName);
     await ensureDir(skillDirPath);
-    const skillFilePath = (0, import_node_path152.join)(skillDirPath, SKILL_FILE_NAME);
+    const skillFilePath = (0, import_node_path160.join)(skillDirPath, SKILL_FILE_NAME);
     const skillFileContent = stringifyFrontmatter(body, frontmatter);
     await writeFileContent(skillFilePath, skillFileContent);
     for (const file of otherFiles) {
@@ -25609,15 +27177,15 @@ async function putSkill({
         relativePath: file.name,
         intendedRootDir: skillDirPath
       });
-      const filePath = (0, import_node_path152.join)(skillDirPath, file.name);
-      const fileDir = (0, import_node_path152.join)(skillDirPath, (0, import_node_path152.dirname)(file.name));
+      const filePath = (0, import_node_path160.join)(skillDirPath, file.name);
+      const fileDir = (0, import_node_path160.join)(skillDirPath, (0, import_node_path160.dirname)(file.name));
       if (fileDir !== skillDirPath) {
         await ensureDir(fileDir);
       }
       await writeFileContent(filePath, file.body);
     }
     return {
-      relativeDirPathFromCwd: (0, import_node_path152.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName),
+      relativeDirPathFromCwd: (0, import_node_path160.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName),
       frontmatter: skill.getFrontmatter(),
       body: skill.getBody(),
       otherFiles: skill.getOtherFiles().map(aiDirFileToMcpSkillFile)
@@ -25639,13 +27207,13 @@ async function deleteSkill({
     intendedRootDir: process.cwd()
   });
   const dirName = extractDirName(relativeDirPathFromCwd);
-  const skillDirPath = (0, import_node_path152.join)(process.cwd(), RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName);
+  const skillDirPath = (0, import_node_path160.join)(process.cwd(), RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName);
   try {
     if (await directoryExists(skillDirPath)) {
       await removeDirectory(skillDirPath);
     }
     return {
-      relativeDirPathFromCwd: (0, import_node_path152.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName)
+      relativeDirPathFromCwd: (0, import_node_path160.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, dirName)
     };
   } catch (error) {
     throw new Error(
@@ -25656,29 +27224,29 @@ async function deleteSkill({
     );
   }
 }
-var McpSkillFileSchema = import_mini83.z.object({
-  name: import_mini83.z.string(),
-  body: import_mini83.z.string()
+var McpSkillFileSchema = import_mini87.z.object({
+  name: import_mini87.z.string(),
+  body: import_mini87.z.string()
 });
 var skillToolSchemas = {
-  listSkills: import_mini83.z.object({}),
-  getSkill: import_mini83.z.object({
-    relativeDirPathFromCwd: import_mini83.z.string()
+  listSkills: import_mini87.z.object({}),
+  getSkill: import_mini87.z.object({
+    relativeDirPathFromCwd: import_mini87.z.string()
   }),
-  putSkill: import_mini83.z.object({
-    relativeDirPathFromCwd: import_mini83.z.string(),
+  putSkill: import_mini87.z.object({
+    relativeDirPathFromCwd: import_mini87.z.string(),
     frontmatter: RulesyncSkillFrontmatterSchema,
-    body: import_mini83.z.string(),
-    otherFiles: import_mini83.z.optional(import_mini83.z.array(McpSkillFileSchema))
+    body: import_mini87.z.string(),
+    otherFiles: import_mini87.z.optional(import_mini87.z.array(McpSkillFileSchema))
   }),
-  deleteSkill: import_mini83.z.object({
-    relativeDirPathFromCwd: import_mini83.z.string()
+  deleteSkill: import_mini87.z.object({
+    relativeDirPathFromCwd: import_mini87.z.string()
   })
 };
 var skillTools = {
   listSkills: {
     name: "listSkills",
-    description: `List all skills from ${(0, import_node_path152.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, "*", SKILL_FILE_NAME)} with their frontmatter.`,
+    description: `List all skills from ${(0, import_node_path160.join)(RULESYNC_SKILLS_RELATIVE_DIR_PATH, "*", SKILL_FILE_NAME)} with their frontmatter.`,
     parameters: skillToolSchemas.listSkills,
     execute: async () => {
       const skills = await listSkills();
@@ -25721,13 +27289,13 @@ var skillTools = {
 };
 
 // src/mcp/subagents.ts
-var import_node_path153 = require("path");
-var import_mini84 = require("zod/mini");
+var import_node_path161 = require("path");
+var import_mini88 = require("zod/mini");
 var logger4 = new ConsoleLogger({ verbose: false, silent: true });
 var maxSubagentSizeBytes = 1024 * 1024;
 var maxSubagentsCount = 1e3;
 async function listSubagents() {
-  const subagentsDir = (0, import_node_path153.join)(process.cwd(), RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH);
+  const subagentsDir = (0, import_node_path161.join)(process.cwd(), RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH);
   try {
     const files = await listDirectoryFiles(subagentsDir);
     const mdFiles = files.filter((file) => file.endsWith(".md"));
@@ -25740,7 +27308,7 @@ async function listSubagents() {
           });
           const frontmatter = subagent.getFrontmatter();
           return {
-            relativePathFromCwd: (0, import_node_path153.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, file),
+            relativePathFromCwd: (0, import_node_path161.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, file),
             frontmatter
           };
         } catch (error) {
@@ -25764,14 +27332,14 @@ async function getSubagent({ relativePathFromCwd }) {
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path153.basename)(relativePathFromCwd);
+  const filename = (0, import_node_path161.basename)(relativePathFromCwd);
   try {
     const subagent = await RulesyncSubagent.fromFile({
       relativeFilePath: filename,
       validate: true
     });
     return {
-      relativePathFromCwd: (0, import_node_path153.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename),
+      relativePathFromCwd: (0, import_node_path161.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename),
       frontmatter: subagent.getFrontmatter(),
       body: subagent.getBody()
     };
@@ -25790,7 +27358,7 @@ async function putSubagent({
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path153.basename)(relativePathFromCwd);
+  const filename = (0, import_node_path161.basename)(relativePathFromCwd);
   const estimatedSize = JSON.stringify(frontmatter).length + body.length;
   if (estimatedSize > maxSubagentSizeBytes) {
     throw new Error(
@@ -25800,7 +27368,7 @@ async function putSubagent({
   try {
     const existingSubagents = await listSubagents();
     const isUpdate = existingSubagents.some(
-      (subagent2) => subagent2.relativePathFromCwd === (0, import_node_path153.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename)
+      (subagent2) => subagent2.relativePathFromCwd === (0, import_node_path161.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename)
     );
     if (!isUpdate && existingSubagents.length >= maxSubagentsCount) {
       throw new Error(
@@ -25815,11 +27383,11 @@ async function putSubagent({
       body,
       validate: true
     });
-    const subagentsDir = (0, import_node_path153.join)(process.cwd(), RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH);
+    const subagentsDir = (0, import_node_path161.join)(process.cwd(), RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH);
     await ensureDir(subagentsDir);
     await writeFileContent(subagent.getFilePath(), subagent.getFileContent());
     return {
-      relativePathFromCwd: (0, import_node_path153.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename),
+      relativePathFromCwd: (0, import_node_path161.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename),
       frontmatter: subagent.getFrontmatter(),
       body: subagent.getBody()
     };
@@ -25834,12 +27402,12 @@ async function deleteSubagent({ relativePathFromCwd }) {
     relativePath: relativePathFromCwd,
     intendedRootDir: process.cwd()
   });
-  const filename = (0, import_node_path153.basename)(relativePathFromCwd);
-  const fullPath = (0, import_node_path153.join)(process.cwd(), RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename);
+  const filename = (0, import_node_path161.basename)(relativePathFromCwd);
+  const fullPath = (0, import_node_path161.join)(process.cwd(), RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename);
   try {
     await removeFile(fullPath);
     return {
-      relativePathFromCwd: (0, import_node_path153.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename)
+      relativePathFromCwd: (0, import_node_path161.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, filename)
     };
   } catch (error) {
     throw new Error(
@@ -25851,23 +27419,23 @@ async function deleteSubagent({ relativePathFromCwd }) {
   }
 }
 var subagentToolSchemas = {
-  listSubagents: import_mini84.z.object({}),
-  getSubagent: import_mini84.z.object({
-    relativePathFromCwd: import_mini84.z.string()
+  listSubagents: import_mini88.z.object({}),
+  getSubagent: import_mini88.z.object({
+    relativePathFromCwd: import_mini88.z.string()
   }),
-  putSubagent: import_mini84.z.object({
-    relativePathFromCwd: import_mini84.z.string(),
+  putSubagent: import_mini88.z.object({
+    relativePathFromCwd: import_mini88.z.string(),
     frontmatter: RulesyncSubagentFrontmatterSchema,
-    body: import_mini84.z.string()
+    body: import_mini88.z.string()
   }),
-  deleteSubagent: import_mini84.z.object({
-    relativePathFromCwd: import_mini84.z.string()
+  deleteSubagent: import_mini88.z.object({
+    relativePathFromCwd: import_mini88.z.string()
   })
 };
 var subagentTools = {
   listSubagents: {
     name: "listSubagents",
-    description: `List all subagents from ${(0, import_node_path153.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, "*.md")} with their frontmatter.`,
+    description: `List all subagents from ${(0, import_node_path161.join)(RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, "*.md")} with their frontmatter.`,
     parameters: subagentToolSchemas.listSubagents,
     execute: async () => {
       const subagents = await listSubagents();
@@ -25909,31 +27477,33 @@ var subagentTools = {
 };
 
 // src/mcp/tools.ts
-var rulesyncFeatureSchema = import_mini85.z.enum([
+var rulesyncFeatureSchema = import_mini89.z.enum([
   "rule",
   "command",
   "subagent",
   "skill",
   "ignore",
   "mcp",
+  "permissions",
+  "hooks",
   "generate",
   "import"
 ]);
-var rulesyncOperationSchema = import_mini85.z.enum(["list", "get", "put", "delete", "run"]);
-var skillFileSchema = import_mini85.z.object({
-  name: import_mini85.z.string(),
-  body: import_mini85.z.string()
+var rulesyncOperationSchema = import_mini89.z.enum(["list", "get", "put", "delete", "run"]);
+var skillFileSchema = import_mini89.z.object({
+  name: import_mini89.z.string(),
+  body: import_mini89.z.string()
 });
-var rulesyncToolSchema = import_mini85.z.object({
+var rulesyncToolSchema = import_mini89.z.object({
   feature: rulesyncFeatureSchema,
   operation: rulesyncOperationSchema,
-  targetPathFromCwd: import_mini85.z.optional(import_mini85.z.string()),
-  frontmatter: import_mini85.z.optional(import_mini85.z.unknown()),
-  body: import_mini85.z.optional(import_mini85.z.string()),
-  otherFiles: import_mini85.z.optional(import_mini85.z.array(skillFileSchema)),
-  content: import_mini85.z.optional(import_mini85.z.string()),
-  generateOptions: import_mini85.z.optional(generateOptionsSchema),
-  importOptions: import_mini85.z.optional(importOptionsSchema)
+  targetPathFromCwd: import_mini89.z.optional(import_mini89.z.string()),
+  frontmatter: import_mini89.z.optional(import_mini89.z.unknown()),
+  body: import_mini89.z.optional(import_mini89.z.string()),
+  otherFiles: import_mini89.z.optional(import_mini89.z.array(skillFileSchema)),
+  content: import_mini89.z.optional(import_mini89.z.string()),
+  generateOptions: import_mini89.z.optional(generateOptionsSchema),
+  importOptions: import_mini89.z.optional(importOptionsSchema)
 });
 var supportedOperationsByFeature = {
   rule: ["list", "get", "put", "delete"],
@@ -25942,6 +27512,8 @@ var supportedOperationsByFeature = {
   skill: ["list", "get", "put", "delete"],
   ignore: ["get", "put", "delete"],
   mcp: ["get", "put", "delete"],
+  permissions: ["get", "put", "delete"],
+  hooks: ["get", "put", "delete"],
   generate: ["run"],
   import: ["run"]
 };
@@ -25991,7 +27563,7 @@ function ensureBody({ body, feature, operation }) {
 }
 var rulesyncTool = {
   name: "rulesyncTool",
-  description: "Manage Rulesync files through a single MCP tool. Features: rule/command/subagent/skill support list/get/put/delete; ignore/mcp support get/put/delete only; generate supports run only; import supports run only. Parameters: list requires no targetPathFromCwd (lists all items); get/delete require targetPathFromCwd; put requires targetPathFromCwd, frontmatter, and body (or content for ignore/mcp); generate/run uses generateOptions to configure generation; import/run uses importOptions to configure import.",
+  description: "Manage Rulesync files through a single MCP tool. Features: rule/command/subagent/skill support list/get/put/delete; ignore/mcp/permissions/hooks support get/put/delete only; generate supports run only; import supports run only. Parameters: list requires no targetPathFromCwd (lists all items); get/delete require targetPathFromCwd; put requires targetPathFromCwd, frontmatter, and body (or content for ignore/mcp/permissions/hooks); generate/run uses generateOptions to configure generation; import/run uses importOptions to configure import.",
   parameters: rulesyncToolSchema,
   execute: async (args) => {
     const parsed = rulesyncToolSchema.parse(args);
@@ -26108,6 +27680,30 @@ var rulesyncTool = {
         }
         return mcpTools.deleteMcpFile.execute();
       }
+      case "permissions": {
+        if (parsed.operation === "get") {
+          return permissionsTools.getPermissionsFile.execute();
+        }
+        if (parsed.operation === "put") {
+          if (!parsed.content) {
+            throw new Error("content is required for permissions put operation");
+          }
+          return permissionsTools.putPermissionsFile.execute({ content: parsed.content });
+        }
+        return permissionsTools.deletePermissionsFile.execute();
+      }
+      case "hooks": {
+        if (parsed.operation === "get") {
+          return hooksTools.getHooksFile.execute();
+        }
+        if (parsed.operation === "put") {
+          if (!parsed.content) {
+            throw new Error("content is required for hooks put operation");
+          }
+          return hooksTools.putHooksFile.execute({ content: parsed.content });
+        }
+        return hooksTools.deleteHooksFile.execute();
+      }
       case "generate": {
         return generateTools.executeGenerate.execute(parsed.generateOptions ?? {});
       }
@@ -26140,7 +27736,7 @@ async function mcpCommand(logger5, { version }) {
 }
 
 // src/cli/commands/resolve-gitignore-targets.ts
-var import_node_path154 = require("path");
+var import_node_path162 = require("path");
 var resolveGitignoreTargets = async ({
   cliTargets,
   cwd = process.cwd()
@@ -26148,8 +27744,8 @@ var resolveGitignoreTargets = async ({
   if (cliTargets !== void 0) {
     return cliTargets;
   }
-  const baseConfigPath = (0, import_node_path154.join)(cwd, RULESYNC_CONFIG_RELATIVE_FILE_PATH);
-  const localConfigPath = (0, import_node_path154.join)(cwd, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH);
+  const baseConfigPath = (0, import_node_path162.join)(cwd, RULESYNC_CONFIG_RELATIVE_FILE_PATH);
+  const localConfigPath = (0, import_node_path162.join)(cwd, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH);
   const [hasBase, hasLocal] = await Promise.all([
     fileExists(baseConfigPath),
     fileExists(localConfigPath)
@@ -26570,7 +28166,7 @@ function wrapCommand({
 }
 
 // src/cli/index.ts
-var getVersion = () => "8.6.0";
+var getVersion = () => "8.7.0";
 function wrapCommand2(name, errorCode, handler) {
   return wrapCommand({ name, errorCode, handler, getVersion });
 }
@@ -26636,12 +28232,18 @@ var main = async () => {
       await mcpCommand(logger5, { version });
     })
   );
-  program.command("install").description("Install skills from declarative sources in rulesync.jsonc").option("--update", "Force re-resolve all source refs, ignoring lockfile").option(
+  program.command("install").description("Install skills/primitives from declarative sources (rulesync.jsonc) or apm.yml").option(
+    "--mode <mode>",
+    `Install layout to produce (${INSTALL_MODES.join("|")}). Default: rulesync`
+  ).option("--update", "Force re-resolve all source refs, ignoring lockfile").option(
     "--frozen",
     "Fail if lockfile is missing or out of sync (for CI); fetches missing skills using locked refs"
   ).option("--token <token>", "GitHub token for private repos").option("-c, --config <path>", "Path to configuration file").option("-V, --verbose", "Verbose output").option("-s, --silent", "Suppress all output").action(
     wrapCommand2("install", "INSTALL_FAILED", async (logger5, options) => {
+      const rawMode = options.mode;
+      const mode = parseInstallMode(rawMode);
       await installCommand(logger5, {
+        mode,
         // eslint-disable-next-line no-type-assertion/no-type-assertion
         update: options.update,
         // eslint-disable-next-line no-type-assertion/no-type-assertion
@@ -26690,6 +28292,14 @@ var main = async () => {
   );
   program.parse();
 };
+function parseInstallMode(raw) {
+  if (raw === void 0) return void 0;
+  const match = INSTALL_MODES.find((m) => m === raw);
+  if (!match) {
+    throw new Error(`Invalid --mode value "${raw}". Expected one of: ${INSTALL_MODES.join(", ")}.`);
+  }
+  return match;
+}
 main().catch((error) => {
   console.error(formatError(error));
   process.exit(1);