rulesync 10.1.0 → 11.0.0

package/dist/{import-B02AyWkQ.js → import-AKytnIKl.js}

@@ -17428,7 +17428,11 @@ const CodexApprovalPolicySchema = z.enum([
 ]);
 /**
 * Codex CLI's classic sandbox mode. Serialized as a kebab-case string in
-* `.codex/config.toml`.
+* `.codex/config.toml`. Deprecated in favor of permission profiles
+* (`base_permission_profile`): Codex prioritizes these legacy sandbox keys
+* over permission profiles when both are present, so authoring one disables
+* the managed `[permissions.rulesync]` profile. Kept so existing configs
+* round-trip.
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
 */
 const CodexSandboxModeSchema = z.enum([
@@ -17448,6 +17452,18 @@ const CodexApprovalsReviewerSchema = z.enum([
 	"guardian_subagent"
 ]);
 /**
+* Codex CLI's built-in permission profiles that the managed
+* `[permissions.rulesync]` profile may extend. Codex ships three built-in
+* profiles (`:read-only`, `:workspace`, `:danger-full-access`; the leading
+* colon is reserved for built-ins), but `extends` rejects
+* `:danger-full-access` at config load time, so only the two extendable
+* baselines are accepted here. The value list is exported so the Codex CLI
+* translator derives its import-side baseline check from the same source.
+* @see https://learn.chatgpt.com/docs/permissions
+*/
+const CODEX_BASE_PERMISSION_PROFILES = [":read-only", ":workspace"];
+const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
+/**
 * Codex CLI-scoped permission override.
 *
 * Codex CLI's permission surface is richer than the canonical allow/ask/deny
@@ -17456,16 +17472,29 @@ const CodexApprovalsReviewerSchema = z.enum([
 * override whose fields are written verbatim as top-level `.codex/config.toml`
 * keys (the override wins per key; existing sibling keys the user set directly
 * are preserved):
+* - `base_permission_profile` — the built-in profile the managed
+*   `[permissions.rulesync]` profile extends (`:read-only` | `:workspace`).
+*   Unlike the other keys it is not a top-level config key: it is emitted as
+*   the profile's `extends` value. Defaults to `:workspace` when unspecified.
 * - `approval_policy` — `untrusted` | `on-request` (legacy alias `on-failure`) |
 *   `never`, or a `{ granular = { … } }` table (kept verbatim; the granular
 *   schema has required fields that are brittle to model as typed keys).
-* - `sandbox_mode` — `read-only` | `workspace-write` | `danger-full-access`,
-*   with the sibling `sandbox_workspace_write` table (`network_access`,
-*   `writable_roots`, …).
+*   Defaults to `on-request` when neither the override nor the existing
+*   config sets it.
+* - `sandbox_mode` — **deprecated.** `read-only` | `workspace-write` |
+*   `danger-full-access`, with the sibling `sandbox_workspace_write` table
+*   (`network_access`, `writable_roots`, …). Codex has superseded the classic
+*   sandbox system with permission profiles and prioritizes these legacy keys
+*   over profiles when both are present, so setting them disables the managed
+*   `[permissions.rulesync]` profile. Use `base_permission_profile` and the
+*   shared `permission` block instead. Still accepted so existing configs
+*   round-trip.
 * - `apps` — per-app tool gating (`apps.<id>.tools.<tool>.approval_mode` /
 *   `.enabled`, `apps.<id>.default_tools_approval_mode`).
 * - `approvals_reviewer` — the reviewer-approval surface (`user` | `auto_review`
 *   | `guardian_subagent`), or a table for the richer reviewer config.
+*   Defaults to `auto_review` when neither the override nor the existing
+*   config sets it.
 *
 * Two surfaces are deliberately NOT authorable here so the override can never
 * clobber a feature-owned key: `mcp_servers.*` per-MCP gating is owned by the
@@ -17484,8 +17513,11 @@ const CodexApprovalsReviewerSchema = z.enum([
 */
 const CodexcliPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
+	base_permission_profile: z.optional(CodexBasePermissionProfileSchema),
 	approval_policy: z.optional(z.union([CodexApprovalPolicySchema, z.looseObject({})])),
+	/** @deprecated Superseded by `base_permission_profile` (permission profiles). */
 	sandbox_mode: z.optional(CodexSandboxModeSchema),
+	/** @deprecated Superseded by `base_permission_profile` (permission profiles). */
 	sandbox_workspace_write: z.optional(z.looseObject({})),
 	apps: z.optional(z.looseObject({})),
 	approvals_reviewer: z.optional(z.union([CodexApprovalsReviewerSchema, z.looseObject({})]))
@@ -19457,13 +19489,10 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 const RULESYNC_PROFILE_NAME = "rulesync";
 const CODEX_WORKSPACE_ROOTS_KEY = ":workspace_roots";
 const CODEX_WORKSPACE_BASELINE = ":workspace";
+const CODEX_EXTENDABLE_BASELINES = new Set(CODEX_BASE_PERMISSION_PROFILES);
+const CODEX_DEFAULT_APPROVAL_POLICY = "on-request";
+const CODEX_DEFAULT_APPROVALS_REVIEWER = "auto_review";
 const CODEX_GLOB_SCAN_MAX_DEPTH = 8;
-const WORKSPACE_WIDE_WRITE_PATTERNS = /* @__PURE__ */ new Set([
-	".",
-	"./",
-	"**",
-	"./**"
-]);
 const CODEX_MINIMAL_KEY = ":minimal";
 const GLOBAL_WILDCARD_DOMAIN = "*";
 var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
@@ -19553,6 +19582,7 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			domainsHadUnknown
 		});
 		const override = extractCodexcliOverride(table);
+		if (typeof profile?.extends === "string" && CODEX_EXTENDABLE_BASELINES.has(profile.extends)) override.base_permission_profile = profile.extends;
 		const result = Object.keys(override).length > 0 ? {
 			...config,
 			codexcli: override
@@ -19635,14 +19665,14 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 		if (Object.keys(workspaceRootFilesystem).some((pattern) => pattern.includes("**"))) filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
 		filesystem[CODEX_WORKSPACE_ROOTS_KEY] = workspaceRootFilesystem;
 	}
-	const hasWorkspaceWideWrite = Object.entries(workspaceRootFilesystem).some(([pattern, access]) => access === "write" && WORKSPACE_WIDE_WRITE_PATTERNS.has(pattern));
+	const basePermissionProfile = config.codexcli?.base_permission_profile ?? CODEX_WORKSPACE_BASELINE;
 	const hasAllowDomain = Object.values(domains).some((action) => action === "allow");
 	const network = Object.keys(domains).length > 0 ? {
 		...hasAllowDomain ? { enabled: true } : {},
 		domains
 	} : void 0;
 	return {
-		...hasWorkspaceWideWrite ? { extends: CODEX_WORKSPACE_BASELINE } : {},
+		extends: basePermissionProfile,
 		filesystem,
 		...network ? { network } : {}
 	};
@@ -19661,10 +19691,6 @@ function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 			if (isCodexFilesystemRuleTable(access)) for (const [nestedPattern, nestedAccess] of Object.entries(access)) addRulesyncFilesystemRule(permission, nestedPattern, nestedAccess);
 		}
 	}
-	if (profile?.extends === CODEX_WORKSPACE_BASELINE) {
-		permission.edit ??= {};
-		permission.edit["."] ??= "allow";
-	}
 	if (profile?.network && profile.network.enabled !== false) {
 		const networkEnabled = profile.network.enabled === true;
 		const importedEntries = (profile.network.domains ? Object.entries(profile.network.domains) : []).filter(([, value]) => value === "deny" || networkEnabled);
@@ -19703,7 +19729,7 @@ function toCodexProfile(value) {
 	};
 }
 function warnAboutPreservedProfileState({ existingProfile, newProfile, existingDomainsHadUnknown, logger }) {
-	if (existingProfile?.extends !== void 0 && existingProfile.extends !== newProfile.extends) logger?.warn(`Existing "extends" value "${existingProfile.extends}" will be replaced by Rulesync-managed "${newProfile.extends ?? "(none)"}".`);
+	if (existingProfile !== void 0 && existingProfile.extends !== newProfile.extends) logger?.warn(`Existing "extends" value "${existingProfile.extends ?? "(none)"}" will be replaced by Rulesync-managed "${newProfile.extends ?? "(none)"}".`);
 	if (existingProfile?.network?.unix_sockets !== void 0) logger?.warn(`Preserving existing "network.unix_sockets" from config. Review these entries manually as they may grant broad system access.`);
 	if (existingProfile?.network?.mode !== void 0) logger?.warn(`Preserving existing "network.mode" from config. Review this value manually as it may grant broader network access than the Rulesync-managed domain rules.`);
 	if (existingDomainsHadUnknown) logger?.warn(`Existing "network.domains" contained unrecognized values. These entries were skipped and will not be imported.`);
@@ -19797,20 +19823,26 @@ function isPlainObject(value) {
 }
 function computeCodexcliOverridePatch({ existing, override, logger }) {
 	const patch = {};
-	if (!override) return patch;
 	const allowed = new Set(CODEXCLI_OVERRIDE_KEYS);
-	for (const [key, value] of Object.entries(override)) {
+	for (const [key, value] of Object.entries(override ?? {})) {
+		if (key === "base_permission_profile") continue;
 		if (!allowed.has(key)) {
 			logger?.warn(`Codex CLI permission override key "${key}" is not managed and was skipped. "permissions"/"default_permissions" are owned by the canonical permission model and "mcp_servers" gating by the MCP feature.`);
 			continue;
 		}
 		if (value === void 0) continue;
+		if (key === "sandbox_mode" || key === "sandbox_workspace_write") logger?.warn(`Codex CLI permission override key "${key}" is deprecated. Codex prioritizes the legacy sandbox settings over permission profiles when both are present, so it disables the generated "${RULESYNC_PROFILE_NAME}" permissions profile. Use "base_permission_profile" and the shared "permission" block instead.`);
 		const existingValue = existing[key];
 		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
 			...existingValue,
 			...value
 		} : value;
 	}
+	const defaults = {
+		approval_policy: CODEX_DEFAULT_APPROVAL_POLICY,
+		approvals_reviewer: CODEX_DEFAULT_APPROVALS_REVIEWER
+	};
+	for (const [key, value] of Object.entries(defaults)) if (patch[key] === void 0 && existing[key] === void 0) patch[key] = value;
 	return patch;
 }
 function extractCodexcliOverride(table) {
@@ -40388,4 +40420,4 @@ async function importPermissionsCore(params) {
 //#endregion
 export { removeFile as $, CLAUDECODE_SKILLS_DIR_PATH as A, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as At, ErrorCodes as B, RulesyncHooks as C, RULESYNC_PERMISSIONS_FILE_NAME as Ct, CLAUDECODE_LOCAL_RULE_FILE_NAME as D, RULESYNC_RELATIVE_DIR_PATH as Dt, CLAUDECODE_DIR as E, RULESYNC_PERMISSIONS_SCHEMA_URL as Et, ConfigResolver as F, fileExists as G, createTempDirectory as H, findControlCharacter as I, getHomeDirectory as J, findFilesByGlobs as K, ConsoleLogger as L, RulesyncCommandFrontmatterSchema as M, formatError as Mt, stringifyFrontmatter as N, ALL_FEATURES as Nt, CLAUDECODE_MEMORIES_DIR_NAME as O, RULESYNC_RULES_RELATIVE_DIR_PATH as Ot, loadYaml as P, ALL_FEATURES_WITH_WILDCARD as Pt, removeDirectory as Q, JsonLogger as R, HooksProcessor as S, RULESYNC_OVERVIEW_FILE_NAME as St, CODEXCLI_DIR as T, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Tt, directoryExists as U, checkPathTraversal as V, ensureDir as W, listDirectoryFiles as X, isSymlink as Y, readFileContent as Z, RulesyncPermissions as _, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as _t, convertFromTool as a, ToolTargetSchema as at, IgnoreProcessor as b, RULESYNC_MCP_RELATIVE_FILE_PATH as bt, RulesyncRuleFrontmatterSchema as c, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ct, RulesyncSubagentFrontmatterSchema as d, RULESYNC_CONFIG_SCHEMA_URL as dt, removeTempDirectory as et, SkillsProcessor as f, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as ft, SKILL_FILE_NAME as g, RULESYNC_IGNORE_RELATIVE_FILE_PATH as gt, RulesyncSkillFrontmatterSchema as h, RULESYNC_HOOKS_RELATIVE_FILE_PATH as ht, getProcessorRegistryEntry as i, ALL_TOOL_TARGETS_WITH_WILDCARD as it, RulesyncCommand as j, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as jt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as k, RULESYNC_SKILLS_RELATIVE_DIR_PATH as kt, SubagentsProcessor as l, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as lt, RulesyncSkill as m, RULESYNC_HOOKS_JSONC_FILE_NAME as mt, checkRulesyncDirExists as n, writeFileContent as nt, RulesProcessor as o, MAX_FILE_SIZE as ot, getLocalSkillDirNames as p, RULESYNC_HOOKS_FILE_NAME as pt, getFileSize as q, generate as r, ALL_TOOL_TARGETS as rt, RulesyncRule as s, RULESYNC_AIIGNORE_FILE_NAME as st, importFromTool as t, toPosixPath as tt, RulesyncSubagent as u, RULESYNC_CONFIG_RELATIVE_FILE_PATH as ut, McpProcessor as v, RULESYNC_MCP_FILE_NAME as vt, CommandsProcessor as w, RULESYNC_PERMISSIONS_JSONC_FILE_NAME as wt, RulesyncIgnore as x, RULESYNC_MCP_SCHEMA_URL as xt, RulesyncMcp as y, RULESYNC_MCP_JSONC_FILE_NAME as yt, CLIError as z };
 
-//# sourceMappingURL=import-B02AyWkQ.js.map
+//# sourceMappingURL=import-AKytnIKl.js.map