dyoshikawa/rulesync v40.0.0 on GitHub

Breaking Changes

npm sources: tokens are only sent to trusted registries, and tokenEnv names are restricted. registry and tokenEnv come from the committed rulesync.jsonc, so a cloned repository could make rulesync install send any environment variable as a Bearer token to a registry of its choosing. tokenEnv must now be NPM_TOKEN or end with _NPM_TOKEN (e.g. ACME_NPM_TOKEN); rulesync doctor reports other names as config/token-env-not-allowed. A token is only sent to https://registry.npmjs.org or to a registry origin listed in the RULESYNC_NPM_TRUSTED_REGISTRIES environment variable (comma-separated). Private-registry users need to set that variable; unparseable entries are now reported with a warning. (#3557, #3582)
fetch, gh project-scope install and apm install refuse to write or remove through symbolic links that resolve outside the project. Setups such as .rulesync -> ~/dotfiles/rulesync keep working for generate, but those commands now fail with "Path resolves outside ... through a symbolic link" instead of writing outside the project. Under --frozen, an integrity mismatch now fails the source instead of only warning. (#3557, #3582)
Kiro CLI / Kiro IDE: generate --delete also sweeps nested agents. kiro-cli and kiro-ide now keep nested sources (.rulesync/subagents/team/planner.md → .kiro/agents/team/planner.json / .md), so hand-written nested .kiro/agents/** and ~/.kiro/agents/** files are now orphan candidates. Import them first to keep them. (#3583)
Google Antigravity: matcher-less hook events are written as flat handler lists. SessionStart, PreInvocation, PostInvocation and Stop are now written directly under the event key, as Antigravity documents; the canonical MCP type is no longer written. Import still reads the older wrapped shape. (#3584)

What's Changed

New Features

feat(hooks): honor matcher on copilot hooks (#3579)
feat(xum): write Xum skill frontmatter (xum: section, incl. path-scoped paths) and stdio MCP env (#3581)
feat(subagents): support nested agent directories for kiro-cli and kiro-ide (#3583)
feat(kimi-code): support [mcp] default_deferred and document the wider dangerousCommandGuard switch (#3585)
feat(zcode): pass the per-server MCP alwaysLoad flag through (#3586)
feat(permissions): accept the omp always-ask-cached approval mode (#3587)
feat(hermesagent): track Hermes Agent v0.22.3 hook events and MCP cost keys (#3589)
feat(reasonix): author tools.disabled and askOnExternalOrigin, warn on a shadowed nested config (#3590)

Bug Fixes

fix(security): guard npm tokens, symlinked writes and frozen integrity (#3557)
fix(security): follow up on the symlink and npm token hardening (#3582)
fix(claudecode): warn on sandbox.allowNestedUserNamespaces (#3577)
fix(hooks): stop the false skipped-matcher warning for copilotcli (#3578)
fix(deepagents): map MCP oauth to dcode's Slack-only client_id shape (#3580)
fix(antigravity): flat hook lists for matcher-less events, SessionStart, and no MCP type (#3584)
fix(takt): drop provider_options keys Takt rejects in config.yaml (#3588)

Other Changes

chore: update Homebrew formula to v39.0.0 (#3567)

Contributors

@dyoshikawa

Full Changelog: v39.0.0...v40.0.0