rulesync 10.0.0 → 11.0.0

package/dist/{import-Dcj5HiOE.cjs → import-ESr9cSFw.cjs}

@@ -17454,7 +17454,11 @@ const CodexApprovalPolicySchema = zod_mini.z.enum([
 ]);
 /**
 * Codex CLI's classic sandbox mode. Serialized as a kebab-case string in
-* `.codex/config.toml`.
+* `.codex/config.toml`. Deprecated in favor of permission profiles
+* (`base_permission_profile`): Codex prioritizes these legacy sandbox keys
+* over permission profiles when both are present, so authoring one disables
+* the managed `[permissions.rulesync]` profile. Kept so existing configs
+* round-trip.
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
 */
 const CodexSandboxModeSchema = zod_mini.z.enum([
@@ -17474,6 +17478,18 @@ const CodexApprovalsReviewerSchema = zod_mini.z.enum([
 	"guardian_subagent"
 ]);
 /**
+* Codex CLI's built-in permission profiles that the managed
+* `[permissions.rulesync]` profile may extend. Codex ships three built-in
+* profiles (`:read-only`, `:workspace`, `:danger-full-access`; the leading
+* colon is reserved for built-ins), but `extends` rejects
+* `:danger-full-access` at config load time, so only the two extendable
+* baselines are accepted here. The value list is exported so the Codex CLI
+* translator derives its import-side baseline check from the same source.
+* @see https://learn.chatgpt.com/docs/permissions
+*/
+const CODEX_BASE_PERMISSION_PROFILES = [":read-only", ":workspace"];
+const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_PROFILES);
+/**
 * Codex CLI-scoped permission override.
 *
 * Codex CLI's permission surface is richer than the canonical allow/ask/deny
@@ -17482,16 +17498,29 @@ const CodexApprovalsReviewerSchema = zod_mini.z.enum([
 * override whose fields are written verbatim as top-level `.codex/config.toml`
 * keys (the override wins per key; existing sibling keys the user set directly
 * are preserved):
+* - `base_permission_profile` — the built-in profile the managed
+*   `[permissions.rulesync]` profile extends (`:read-only` | `:workspace`).
+*   Unlike the other keys it is not a top-level config key: it is emitted as
+*   the profile's `extends` value. Defaults to `:workspace` when unspecified.
 * - `approval_policy` — `untrusted` | `on-request` (legacy alias `on-failure`) |
 *   `never`, or a `{ granular = { … } }` table (kept verbatim; the granular
 *   schema has required fields that are brittle to model as typed keys).
-* - `sandbox_mode` — `read-only` | `workspace-write` | `danger-full-access`,
-*   with the sibling `sandbox_workspace_write` table (`network_access`,
-*   `writable_roots`, …).
+*   Defaults to `on-request` when neither the override nor the existing
+*   config sets it.
+* - `sandbox_mode` — **deprecated.** `read-only` | `workspace-write` |
+*   `danger-full-access`, with the sibling `sandbox_workspace_write` table
+*   (`network_access`, `writable_roots`, …). Codex has superseded the classic
+*   sandbox system with permission profiles and prioritizes these legacy keys
+*   over profiles when both are present, so setting them disables the managed
+*   `[permissions.rulesync]` profile. Use `base_permission_profile` and the
+*   shared `permission` block instead. Still accepted so existing configs
+*   round-trip.
 * - `apps` — per-app tool gating (`apps.<id>.tools.<tool>.approval_mode` /
 *   `.enabled`, `apps.<id>.default_tools_approval_mode`).
 * - `approvals_reviewer` — the reviewer-approval surface (`user` | `auto_review`
 *   | `guardian_subagent`), or a table for the richer reviewer config.
+*   Defaults to `auto_review` when neither the override nor the existing
+*   config sets it.
 *
 * Two surfaces are deliberately NOT authorable here so the override can never
 * clobber a feature-owned key: `mcp_servers.*` per-MCP gating is owned by the
@@ -17510,8 +17539,11 @@ const CodexApprovalsReviewerSchema = zod_mini.z.enum([
 */
 const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	base_permission_profile: zod_mini.z.optional(CodexBasePermissionProfileSchema),
 	approval_policy: zod_mini.z.optional(zod_mini.z.union([CodexApprovalPolicySchema, zod_mini.z.looseObject({})])),
+	/** @deprecated Superseded by `base_permission_profile` (permission profiles). */
 	sandbox_mode: zod_mini.z.optional(CodexSandboxModeSchema),
+	/** @deprecated Superseded by `base_permission_profile` (permission profiles). */
 	sandbox_workspace_write: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	apps: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	approvals_reviewer: zod_mini.z.optional(zod_mini.z.union([CodexApprovalsReviewerSchema, zod_mini.z.looseObject({})]))
@@ -19483,13 +19515,10 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 const RULESYNC_PROFILE_NAME = "rulesync";
 const CODEX_WORKSPACE_ROOTS_KEY = ":workspace_roots";
 const CODEX_WORKSPACE_BASELINE = ":workspace";
+const CODEX_EXTENDABLE_BASELINES = new Set(CODEX_BASE_PERMISSION_PROFILES);
+const CODEX_DEFAULT_APPROVAL_POLICY = "on-request";
+const CODEX_DEFAULT_APPROVALS_REVIEWER = "auto_review";
 const CODEX_GLOB_SCAN_MAX_DEPTH = 8;
-const WORKSPACE_WIDE_WRITE_PATTERNS = /* @__PURE__ */ new Set([
-	".",
-	"./",
-	"**",
-	"./**"
-]);
 const CODEX_MINIMAL_KEY = ":minimal";
 const GLOBAL_WILDCARD_DOMAIN = "*";
 var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
@@ -19579,6 +19608,7 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			domainsHadUnknown
 		});
 		const override = extractCodexcliOverride(table);
+		if (typeof profile?.extends === "string" && CODEX_EXTENDABLE_BASELINES.has(profile.extends)) override.base_permission_profile = profile.extends;
 		const result = Object.keys(override).length > 0 ? {
 			...config,
 			codexcli: override
@@ -19661,14 +19691,14 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 		if (Object.keys(workspaceRootFilesystem).some((pattern) => pattern.includes("**"))) filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
 		filesystem[CODEX_WORKSPACE_ROOTS_KEY] = workspaceRootFilesystem;
 	}
-	const hasWorkspaceWideWrite = Object.entries(workspaceRootFilesystem).some(([pattern, access]) => access === "write" && WORKSPACE_WIDE_WRITE_PATTERNS.has(pattern));
+	const basePermissionProfile = config.codexcli?.base_permission_profile ?? CODEX_WORKSPACE_BASELINE;
 	const hasAllowDomain = Object.values(domains).some((action) => action === "allow");
 	const network = Object.keys(domains).length > 0 ? {
 		...hasAllowDomain ? { enabled: true } : {},
 		domains
 	} : void 0;
 	return {
-		...hasWorkspaceWideWrite ? { extends: CODEX_WORKSPACE_BASELINE } : {},
+		extends: basePermissionProfile,
 		filesystem,
 		...network ? { network } : {}
 	};
@@ -19687,10 +19717,6 @@ function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 			if (isCodexFilesystemRuleTable(access)) for (const [nestedPattern, nestedAccess] of Object.entries(access)) addRulesyncFilesystemRule(permission, nestedPattern, nestedAccess);
 		}
 	}
-	if (profile?.extends === CODEX_WORKSPACE_BASELINE) {
-		permission.edit ??= {};
-		permission.edit["."] ??= "allow";
-	}
 	if (profile?.network && profile.network.enabled !== false) {
 		const networkEnabled = profile.network.enabled === true;
 		const importedEntries = (profile.network.domains ? Object.entries(profile.network.domains) : []).filter(([, value]) => value === "deny" || networkEnabled);
@@ -19729,7 +19755,7 @@ function toCodexProfile(value) {
 	};
 }
 function warnAboutPreservedProfileState({ existingProfile, newProfile, existingDomainsHadUnknown, logger }) {
-	if (existingProfile?.extends !== void 0 && existingProfile.extends !== newProfile.extends) logger?.warn(`Existing "extends" value "${existingProfile.extends}" will be replaced by Rulesync-managed "${newProfile.extends ?? "(none)"}".`);
+	if (existingProfile !== void 0 && existingProfile.extends !== newProfile.extends) logger?.warn(`Existing "extends" value "${existingProfile.extends ?? "(none)"}" will be replaced by Rulesync-managed "${newProfile.extends ?? "(none)"}".`);
 	if (existingProfile?.network?.unix_sockets !== void 0) logger?.warn(`Preserving existing "network.unix_sockets" from config. Review these entries manually as they may grant broad system access.`);
 	if (existingProfile?.network?.mode !== void 0) logger?.warn(`Preserving existing "network.mode" from config. Review this value manually as it may grant broader network access than the Rulesync-managed domain rules.`);
 	if (existingDomainsHadUnknown) logger?.warn(`Existing "network.domains" contained unrecognized values. These entries were skipped and will not be imported.`);
@@ -19823,20 +19849,26 @@ function isPlainObject(value) {
 }
 function computeCodexcliOverridePatch({ existing, override, logger }) {
 	const patch = {};
-	if (!override) return patch;
 	const allowed = new Set(CODEXCLI_OVERRIDE_KEYS);
-	for (const [key, value] of Object.entries(override)) {
+	for (const [key, value] of Object.entries(override ?? {})) {
+		if (key === "base_permission_profile") continue;
 		if (!allowed.has(key)) {
 			logger?.warn(`Codex CLI permission override key "${key}" is not managed and was skipped. "permissions"/"default_permissions" are owned by the canonical permission model and "mcp_servers" gating by the MCP feature.`);
 			continue;
 		}
 		if (value === void 0) continue;
+		if (key === "sandbox_mode" || key === "sandbox_workspace_write") logger?.warn(`Codex CLI permission override key "${key}" is deprecated. Codex prioritizes the legacy sandbox settings over permission profiles when both are present, so it disables the generated "${RULESYNC_PROFILE_NAME}" permissions profile. Use "base_permission_profile" and the shared "permission" block instead.`);
 		const existingValue = existing[key];
 		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
 			...existingValue,
 			...value
 		} : value;
 	}
+	const defaults = {
+		approval_policy: CODEX_DEFAULT_APPROVAL_POLICY,
+		approvals_reviewer: CODEX_DEFAULT_APPROVALS_REVIEWER
+	};
+	for (const [key, value] of Object.entries(defaults)) if (patch[key] === void 0 && existing[key] === void 0) patch[key] = value;
 	return patch;
 }
 function extractCodexcliOverride(table) {

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_import = require("./import-Dcj5HiOE.cjs");
+const require_import = require("./import-ESr9cSFw.cjs");
 //#region src/index.ts
 async function generate(options = {}) {
 	const { silent = true, verbose = false, ...rest } = options;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { F as ConfigResolver, L as ConsoleLogger, Nt as ALL_FEATURES, a as convertFromTool$1, n as checkRulesyncDirExists, r as generate$1, rt as ALL_TOOL_TARGETS, t as importFromTool$1 } from "./import-B02AyWkQ.js";
+import { F as ConfigResolver, L as ConsoleLogger, Nt as ALL_FEATURES, a as convertFromTool$1, n as checkRulesyncDirExists, r as generate$1, rt as ALL_TOOL_TARGETS, t as importFromTool$1 } from "./import-AKytnIKl.js";
 //#region src/index.ts
 async function generate(options = {}) {
 	const { silent = true, verbose = false, ...rest } = options;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulesync",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Unified AI rules management CLI tool that generates configuration files for various AI development tools",
   "keywords": [
     "ai",