dyoshikawa/rulesync v39.0.0 on GitHub

Breaking Changes

Frontmatter: only YAML frontmatter is accepted. gray-matter picks a parser from the text right after the opening ---, and its javascript engine ran the block through eval(), so a file opening with ---js executed code as soon as Rulesync parsed it — including skills fetched with fetch / install and files read by the MCP server. Rulesync now refuses any fence language other than none, yaml or yml with an Unsupported frontmatter language error. This also refuses ---json frontmatter, which gray-matter used to parse; rewrite such files with plain --- YAML frontmatter (JSON objects are valid YAML). (#3553)
Hermes Agent: generated slash commands are renamed and no longer call delegate_task directly. Subagent commands are now /rulesync-subagent-<name> (was /rulesync_subagent_<slug>, which Hermes's gateway never resolved). Subagent and command plugins now queue their prompt as a user message through ctx.inject_message(), because a slash command has no parent agent for delegate_task. In gateway sessions (messaging platforms, the TUI and Desktop, and the classic CLI in current Hermes development builds), Hermes accepts that injection only when you set plugins.entries.<plugin>.allow_gateway_injection: true. Rulesync does not set it for you. Regenerate to pick up the new plugins. (#3565)

feat(androidstudio): add an Android Studio (Gemini) target — .aiexclude and .android-studio/skills/ (project and global skills) (#3559)
feat(firebender): add a Firebender target — rules, commands, subagents (registered in firebender.json), skills, hooks, MCP and ignore, in project and global scope (#3560)
feat(xum): add a Xum target — .xum/AGENTS.md rules, agents, skills and mcp.jsonc, in project and global scope (#3561)

fix(security): refuse executable frontmatter languages (#3553)
fix(hermesagent): make subagent and command slash commands reachable and runnable (#3565)
fix(zcode): import every oauth object as zcodeOauth, so a non-ZCode secret never reaches other targets' configs (#3555)

fix(ci): skip bot authors in the contributor policy (#3550)
test(ci): locate the contributor policy step by name (#3558)
test(pr-policy): tighten the policy test and document the bot exemption (#3564)
docs(skills): point draft-release at getVersion in src/cli/program.ts (#3554)
chore: update Homebrew formula to v38.0.0 (#3552)

Full Changelog: v38.0.0...v39.0.0