dyoshikawa/rulesync v37.0.0 on GitHub

Breaking Changes

install --frozen now verifies installed curated skills against rulesync.lock. A locked skill whose files were edited, added or removed is fetched again at its locked ref and restored, the same way rules already were, so local edits to a curated skill under .rulesync/skills/.curated/ are overwritten. The lockfile is still not written under --frozen. A skill name that an earlier source already installed, and a lock entry with an empty legacy integrity, are only checked for presence. (#3512)
Copilot CLI: a disabled MCP server is now actually disabled. It is no longer written with a disabled key in .github/mcp.json (which Copilot CLI ignores, so the server kept running). Its name goes into disabledMcpServers in .github/copilot/settings.json (project) or ~/.copilot/settings.json (global), and import maps that list back to disabled: true. Only server names Rulesync writes are managed. (#3513)
rulesync mcp runs on @modelcontextprotocol/sdk instead of fastmcp. The server name, version, instructions and the single rulesyncTool are unchanged, but arguments that fail the tool schema now come back as an isError tool result rather than a JSON-RPC -32602 error, and the tool's input schema no longer sets additionalProperties: false (unknown keys are still dropped). (#3501)

feat(hooks): support preserveUnownedHooks for Qwen Code (.qwen/settings.json, with .qwen/.rulesync-hooks-lock.json); a preserved group is merged into a generated group only when its group-level keys such as sequential agree (#3509)
feat(copilotcli): route disabled MCP servers to disabledMcpServers (#3513)
feat(permissions): warn that the Cline command-permissions output is deprecated, since current Cline no longer reads CLINE_COMMAND_PERMISSIONS; the file is still written (#3510)

fix(install): verify curated skill content against the lockfile integrity under install --frozen (#3512)
fix(codexcli): the AGENTS.md size warning honors project_doc_max_bytes from .codex/config.toml and names the limit it checked (#3508)

refactor(mcp): drop fastmcp (and the effect, sury and @valibot/to-json-schema peers kept only for it) and serve the MCP server with @modelcontextprotocol/sdk directly (#3501)

docs(hooks): clarify which old hooks a new hooks ownership lock can retract (#3507)

Full Changelog: v36.0.2...v37.0.0