Release v12.0.0 · dyoshikawa/rulesync

What's Changed

The generated Codex CLI [permissions.rulesync] profile now emits default .git write carve-outs in its :workspace_roots table: ".git/**" = "write" with ".git/config" = "read" kept read-only (a writable .git/config would allow core.fsmonitor / core.hooksPath sandbox escapes; Codex resolves the more specific path with priority). Codex's :workspace baseline keeps .git read-only, which denies basic git workflows (commit/stage writes to .git/index, .git/objects, refs, logs) — regenerating with an existing permissions.json therefore broadens the profile's grants. A user rule for the same pattern always wins, and the carve-outs are skipped for the ":read-only" baseline and when a direct ":workspace_roots" rule exists. Opt out with the new codexcli.git_write_rules: false override. by @dyoshikawa in #2274
Codex CLI regeneration now preserves a user-authored network.enabled (with a warning) when the canonical model computes no network table, instead of deleting it — network settings are user territory by design. An enabled sitting next to rulesync-managed allow domains is still treated as rulesync's own output and is removed together with the domains when the webfetch allow rules are removed, and replacing a user-authored enabled = false with a managed enabled = true now warns. by @dyoshikawa in #2274

Add Reasonix native subagents support (.reasonix/skills/<name>/SKILL.md with runAs: subagent), with marker-aware discovery and deletion so the skills and subagents features can safely share the same directory without deleting each other's files. by @dyoshikawa in #2249
Add a FAQ entry documenting the user-managed Codex CLI permission entries: SSH agent socket access (dangerously_allow_all_unix_sockets or a per-socket allow), temp-dir writes (:tmpdir / :slash_tmp), and ~/.codex config access with auth.json denied. Unknown user-authored network keys are preserved verbatim on regeneration. by @dyoshikawa in #2274

Guard the shared-directory collision warning against tools without scope support. by @dyoshikawa in #2249

The Homebrew tap formula (Formula/rulesync.rb) is now updated as a post-merge step of the /goal-release flow instead of a dedicated CI job in publish.yml, removing the separate auto-merge PR, its HOMEBREW_FORMULA_TOKEN dependency, and the out-of-band job complexity. No change to the published package. by @dyoshikawa in #2273

Full Changelog: v11.0.0...v12.0.0