rulesync 16.12.0 → 16.13.0

package/dist/{import-BwdPcfzS.cjs → import-ChnrtxiJ.cjs}

@@ -134,27 +134,27 @@ const isFeatureValueEnabled = (value) => {
 };
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$288 } = node_path.posix;
+const { join: join$289 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$288(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "checks");
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$288(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "rules");
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$289(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "commands");
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "subagents");
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "checks");
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$289(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$288(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "skills");
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$289(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -437,6 +437,7 @@ const permissionsProcessorToolTargetTuple = [
 	"kiro-cli",
 	"kiro-ide",
 	"opencode",
+	"pi",
 	"qwencode",
 	"reasonix",
 	"rovodev",
@@ -1928,7 +1929,7 @@ function isPlainObject$1(value) {
 /**
 * Type guard to check if a value is an array of strings.
 */
-function isStringArray$1(value) {
+function isStringArray$2(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 //#endregion
@@ -2296,6 +2297,7 @@ const HOOK_EVENTS = [
 	"todoCreated",
 	"todoCompleted",
 	"stopFailure",
+	"stopCancelled",
 	"instructionsLoaded",
 	"userPromptExpansion",
 	"postToolBatch",
@@ -2871,6 +2873,7 @@ const GROKCLI_HOOK_EVENTS = [
 	"permissionDenied",
 	"stop",
 	"stopFailure",
+	"stopCancelled",
 	"notification",
 	"subagentStart",
 	"subagentStop",
@@ -2946,16 +2949,10 @@ const KIMI_CODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CAN
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set:
-* `pre_tool_call`, `post_tool_call`, `pre_llm_call`, `post_llm_call`,
-* `pre_verify`, `pre_api_request`, `post_api_request`, `api_request_error`,
-* `on_session_start`, `on_session_end`, `on_session_finalize`,
-* `on_session_reset`, `subagent_start`, `subagent_stop`, `pre_gateway_dispatch`,
-* `pre_approval_request`, `post_approval_response`, `transform_tool_result`,
-* `transform_terminal_output`, `transform_llm_output`, and the three
-* `kanban_task_*` events. Only the events with a clean 1:1 canonical equivalent
-* are mapped here. All other native events round-trip through
-* `hermesagent.hooks`.
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 37 entries as
+* of v0.20.2 (`v2026.8.16`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* full list. Only the events with a clean 1:1 canonical equivalent are mapped
+* here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
 */
 const HERMESAGENT_HOOK_EVENTS = [
@@ -2968,6 +2965,21 @@ const HERMESAGENT_HOOK_EVENTS = [
 	"subagentStart",
 	"subagentStop"
 ];
+/**
+* Hermes Agent's native `VALID_HOOKS` set, in upstream source order.
+*
+* The authority is `hermes_cli/plugins.py`'s `VALID_HOOKS`, not the docs: at
+* v0.20.2 `website/docs/user-guide/features/plugins.md` says "26 lifecycle
+* events" and then lists 30, omitting the five `on_kanban_*` worker/task/dispatch
+* observers, `gateway_platform_event` and `transform_api_error_classification`.
+* Shell hooks are gated on the same set.
+*
+* Verified against the tag `v2026.8.16` (v0.20.2): `VALID_HOOKS` holds 37
+* entries, grown from 23 at `v2026.8.3` (v0.20.0). This list holds 36 of them —
+* see {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
+*
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py
+*/
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
 	"post_tool_call",
@@ -2976,6 +2988,10 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"transform_llm_output",
 	"pre_llm_call",
 	"post_llm_call",
+	"on_stream_start",
+	"on_stream_delta",
+	"on_stream_end",
+	"on_interim_message",
 	"pre_verify",
 	"pre_api_request",
 	"post_api_request",
@@ -2984,16 +3000,39 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_session_end",
 	"on_session_finalize",
 	"on_session_reset",
+	"on_skill_lifecycle",
 	"subagent_start",
 	"subagent_stop",
 	"pre_gateway_dispatch",
 	"pre_approval_request",
 	"post_approval_response",
+	"pre_transcription",
 	"kanban_task_claimed",
 	"kanban_task_completed",
-	"kanban_task_blocked"
+	"kanban_task_blocked",
+	"on_kanban_worker_spawned",
+	"on_kanban_worker_exited",
+	"on_kanban_worker_stale_claim",
+	"on_kanban_task_updated",
+	"on_kanban_dispatch_tick",
+	"gateway_platform_event",
+	"pre_command"
 ];
 /**
+* `VALID_HOOKS` entries a SHELL hook may not register for. `VALID_HOOKS` doubles
+* as the shell-hook allow-list, but `SHELL_UNSUPPORTED_HOOKS` is subtracted from
+* it first: shell hooks cannot return these events' directives, so
+* `_parse_hooks_block` refuses the registration with a warning rather than
+* accepting it and dropping the return value.
+*
+* rulesync only ever writes shell hooks, so these are excluded from
+* {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
+*
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/agent/shell_hooks.py — `_parse_hooks_block`
+*/
+const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
+/**
 * Map canonical camelCase event names to Hermes Agent's native `VALID_HOOKS`
 * snake_case keys under the `hooks:` block of `~/.hermes/config.yaml`.
 */
@@ -3610,6 +3649,7 @@ const CANONICAL_TO_GROKCLI_EVENT_NAMES = {
 	permissionDenied: "PermissionDenied",
 	stop: "Stop",
 	stopFailure: "StopFailure",
+	stopCancelled: "StopCancelled",
 	notification: "Notification",
 	subagentStart: "SubagentStart",
 	subagentStop: "SubagentStop",
@@ -3884,6 +3924,25 @@ const McpServerSchema = zod_mini.z.looseObject({
 	kiroAutoApprove: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	kiroAutoBlock: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
+	/**
+	* The canonical per-server tool allowlist.
+	*
+	* **Collision rule for adapters.** Several tools spell an allowlist natively
+	* under a name that also exists here, so a single server entry can carry both
+	* a canonical field and its native counterpart. What the *native* key means
+	* decides the resolution — not which one was written first:
+	*
+	* - Native key is a redundant spelling of the same concept, and both lists are
+	*   additive → **merge** them, so a config that already spells the field
+	*   natively keeps working (`kiroAutoApprove`/`kiroAutoBlock` in
+	*   `kiro-mcp.ts`).
+	* - Native key is the same concept but rulesync owns the generated value, so
+	*   keeping both would be ambiguous → the **canonical value wins** and the
+	*   native one is dropped with a warning (`tools` in `copilotcli-mcp.ts`).
+	* - Native key of the same name means something else entirely → **refuse the
+	*   canonical value** rather than write a shape the tool misreads (`tools` in
+	*   `codexcli-mcp.ts`, where Codex reads it as a per-tool approval table).
+	*/
 	enabledTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	disabledTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
@@ -4726,8 +4785,65 @@ const AmpPermissionsOverrideSchema = zod_mini.z.looseObject({
 	dangerouslyAllowAll: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
+* Tool-scoped override block for Pi Coding Agent. Pi has no allow/ask/deny rule
+* surface: the only repository-syncable tool gate is `defaultTools`, the list of
+* built-in tools enabled at startup (added in v0.84.2). It is an enable-list
+* rather than a canonical allow/deny rule set, so it is authored here rather
+* than mapped onto `permission`, mirroring `KimiCodePermissionsOverrideSchema`'s
+* `tools.enabled` and `VibePermissionsOverrideSchema`'s `enabled_tools`.
+*
+* An empty array is meaningful upstream — it starts Pi with no built-in tools
+* while keeping extension and SDK custom tools — so it is emitted as written.
+* CLI flags (`--tools`, `--no-tools`, `--no-builtin-tools`, `--exclude-tools`)
+* outrank the setting, and a project array **replaces** the global one rather
+* than merging with it.
+*
+* @example
+* { "defaultTools": ["bash", "edit", "write"] }
+* @see https://pi.dev/docs/latest/settings
+*/
+const PiPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	defaultTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+});
+/**
+* The Antigravity CLI's four documented `toolPermission` autonomy presets.
+* Exported so the import side of `antigravity-cli-permissions.ts` filters
+* against exactly the values the enum below accepts — an unrecognized value
+* carried in verbatim would fail validation of the *whole*
+* `.rulesync/permissions.jsonc`, not just that key.
+* @see https://antigravity.google/docs/cli/reference
+*/
+const ANTIGRAVITY_CLI_TOOL_PERMISSIONS = [
+	"request-review",
+	"proceed-in-sandbox",
+	"always-proceed",
+	"strict"
+];
+/**
+* The Antigravity CLI's three documented `artifactReviewPolicy` values. Shared
+* with the import filter for the same reason as
+* {@link ANTIGRAVITY_CLI_TOOL_PERMISSIONS}.
+* @see https://antigravity.google/docs/cli/settings
+*/
+const ANTIGRAVITY_CLI_ARTIFACT_REVIEW_POLICIES = [
+	"asks-for-review",
+	"agent-decides",
+	"always-proceed"
+];
+/**
+* The baseline execution modes the CLI persists as `agentMode`. Shared with the
+* import filter for the same reason as {@link ANTIGRAVITY_CLI_TOOL_PERMISSIONS}.
+* @see https://antigravity.google/docs/cli/modes
+*/
+const ANTIGRAVITY_CLI_AGENT_MODES = [
+	"default",
+	"accept-edits",
+	"plan"
+];
+/**
 * Tool-scoped override block for the Google Antigravity CLI. Antigravity's CLI
-* `settings.json` carries four global autonomy/sandbox knobs outside the
+* `settings.json` carries five global autonomy/sandbox knobs outside the
 * `permissions.allow/ask/deny` arrays rulesync manages: `toolPermission` (the
 * global autonomy preset — `request-review` (default) / `proceed-in-sandbox` /
 * `always-proceed` / `strict`), `enableTerminalSandbox` (a boolean confining
@@ -4735,7 +4851,8 @@ const AmpPermissionsOverrideSchema = zod_mini.z.looseObject({
 * agent's artifact changes are gated on a review prompt — `asks-for-review`
 * (default) / `agent-decides` / `always-proceed`) and `allowNonWorkspaceAccess`
 * (a boolean, off by default, letting the agent read or write files outside the
-* active workspace roots). Antigravity applies the allow/deny
+* active workspace roots), and `agentMode` (the baseline execution mode a session
+* starts in — `default` / `accept-edits` / `plan`). Antigravity applies the allow/deny
 * lists as per-rule exceptions to the preset at runtime, so rulesync only
 * authors these keys verbatim — no precedence modeling is needed on our side.
 * Fields placed here are merged onto the top level of
@@ -4743,27 +4860,27 @@ const AmpPermissionsOverrideSchema = zod_mini.z.looseObject({
 * the CLI. The Antigravity IDE exposes the same concepts through a GUI (no
 * documented JSON schema), so this override does NOT apply to `antigravity-ide`.
 * Verified against https://antigravity.google/docs/cli/reference,
-* https://antigravity.google/docs/cli/sandbox and
-* https://antigravity.google/docs/cli/settings.
+* https://antigravity.google/docs/cli/sandbox,
+* https://antigravity.google/docs/cli/settings and
+* https://antigravity.google/docs/cli/modes.
 *
 * @example
 * { "toolPermission": "strict", "enableTerminalSandbox": true }
 */
 const AntigravityCliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	toolPermission: zod_mini.z.optional(zod_mini.z.enum([
-		"request-review",
-		"proceed-in-sandbox",
-		"always-proceed",
-		"strict"
-	])),
+	toolPermission: zod_mini.z.optional(zod_mini.z.enum(ANTIGRAVITY_CLI_TOOL_PERMISSIONS)),
 	enableTerminalSandbox: zod_mini.z.optional(zod_mini.z.boolean()),
-	artifactReviewPolicy: zod_mini.z.optional(zod_mini.z.enum([
-		"asks-for-review",
-		"agent-decides",
-		"always-proceed"
-	])),
-	allowNonWorkspaceAccess: zod_mini.z.optional(zod_mini.z.boolean())
+	artifactReviewPolicy: zod_mini.z.optional(zod_mini.z.enum(ANTIGRAVITY_CLI_ARTIFACT_REVIEW_POLICIES)),
+	allowNonWorkspaceAccess: zod_mini.z.optional(zod_mini.z.boolean()),
+	/**
+	* The baseline execution mode the CLI starts a session in (Agent Mode), the
+	* persisted form of the `/settings` panel's Agent Mode row. Only
+	* `~/.gemini/antigravity-cli/settings.json` is read for it, which is why this
+	* override stays global-only.
+	* @see https://antigravity.google/docs/cli/modes
+	*/
+	agentMode: zod_mini.z.optional(zod_mini.z.enum(ANTIGRAVITY_CLI_AGENT_MODES))
 });
 /**
 * Tool-scoped override block for AugmentCode. AugmentCode's `toolPermissions[]`
@@ -5073,6 +5190,7 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	takt: zod_mini.z.optional(TaktPermissionsOverrideSchema),
 	amp: zod_mini.z.optional(AmpPermissionsOverrideSchema),
 	"antigravity-cli": zod_mini.z.optional(AntigravityCliPermissionsOverrideSchema),
+	pi: zod_mini.z.optional(PiPermissionsOverrideSchema),
 	augmentcode: zod_mini.z.optional(AugmentcodePermissionsOverrideSchema),
 	kiro: zod_mini.z.optional(KiroPermissionsOverrideSchema),
 	codexcli: zod_mini.z.optional(CodexcliPermissionsOverrideSchema),
@@ -5554,6 +5672,7 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	cursor: zod_mini.z.optional(zod_mini.z.looseObject({
 		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	})),
 	factorydroid: zod_mini.z.optional(zod_mini.z.looseObject({
@@ -5778,6 +5897,11 @@ async function getLocalSkillDirNames(outputRoot) {
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
+* `devin` also consumes the root-level value — it maps `true` onto a user-only
+* `triggers` list (see `devin-skill.ts`) — but has no section key of the same
+* name, so it does not go through this helper. A `devin.triggers` section value
+* still overrides it.
+*
 * @returns The resolved boolean, or `undefined` when neither value is set.
 */
 function resolveDisableModelInvocation({ rootFrontmatter, section }) {
@@ -5788,10 +5912,15 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
+* copilotcli, cursor, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
+* `devin` also consumes the root-level value — it maps `false` onto a
+* model-only `triggers` list (see `devin-skill.ts`) — but has no section key of
+* the same name, so it does not go through this helper. A `devin.triggers`
+* section value still overrides it.
+*
 * @returns The resolved boolean, or `undefined` when neither value is set.
 */
 function resolveUserInvocable({ rootFrontmatter, section }) {
@@ -7641,6 +7770,22 @@ const SHARED_CONFIG_OWNERSHIP = {
 			}
 		}
 	},
+	".pi/settings.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["defaultTools"]
+		} }
+	},
+	".pi/agent/settings.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["defaultTools"]
+		} }
+	},
 	".github/copilot/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -12227,6 +12372,8 @@ const PI_RULE_FILE_NAME = "AGENTS.md";
 const PI_RULE_OVERRIDE_FILE_NAME = "AGENTS.override.md";
 const PI_APPEND_SYSTEM_FILE_NAME = "APPEND_SYSTEM.md";
 const PI_HOOKS_FILE_NAME = "rulesync-hooks.ts";
+const PI_SETTINGS_FILE_NAME = "settings.json";
+const PI_AGENT_DIR_PATH = PI_AGENT_DIR;
 //#endregion
 //#region src/features/commands/pi-command.ts
 /**
@@ -14151,7 +14298,7 @@ const isBooleanValue = ({ value }) => typeof value === "boolean";
 const isFiniteNumber = ({ value }) => Number.isFinite(value);
 const isNonEmptyString = (value) => typeof value === "string" && value !== "";
 const isEmittableString = ({ value }) => isNonEmptyString(value);
-const isEmittableArray = ({ value }) => isStringArray(value);
+const isEmittableArray = ({ value }) => isStringArray$1(value);
 const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
 const isImportableArray = ({ value }) => isSafeStringArray(value);
 /**
@@ -14460,7 +14607,7 @@ function isStringRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	return Object.values(value).every((v) => typeof v === "string");
 }
-function isStringArray(value) {
+function isStringArray$1(value) {
 	return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
 /** Compare object values without letting key order decide the answer. */
@@ -14492,7 +14639,7 @@ function isSafeStringRecord(value) {
 * skipped wholesale when that read fails.
 */
 function isSafeStringArray(value) {
-	return isStringArray(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
+	return isStringArray$1(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
 }
 /**
 * A raw string kept only if the canonical field it would land in accepts it,
@@ -14534,7 +14681,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 		return {
 			...url !== void 0 && { url },
 			...isStringRecord(headers) && { headers },
-			...isStringArray(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
+			...isStringArray$1(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
 		};
 	}
 	if (hookType === "mcp_tool") {
@@ -15517,7 +15664,7 @@ const MANAGED_EVENT_NAMES = new Set(Object.values(CANONICAL_TO_CLINE_EVENT_NAMES
 function parseManifest(fileContent) {
 	try {
 		const parsed = JSON.parse(fileContent);
-		if (!isRecord$1(parsed) || !isStringArray$1(parsed.events)) return null;
+		if (!isRecord$1(parsed) || !isStringArray$2(parsed.events)) return null;
 		return {
 			generatedBy: "rulesync",
 			events: parsed.events.filter((event) => MANAGED_EVENT_NAMES.has(event))
@@ -17152,6 +17299,7 @@ const HERMESAGENT_MATCHER_EVENTS = /* @__PURE__ */ new Set(["pre_tool_call", "po
 const HERMESAGENT_FAIL_CLOSED_EVENT = "pre_tool_call";
 const HERMESAGENT_CANONICAL_EVENTS = new Set(HERMESAGENT_HOOK_EVENTS);
 const HERMESAGENT_NATIVE_EVENTS = new Set(HERMESAGENT_NATIVE_HOOK_EVENTS);
+const HERMESAGENT_SHELL_UNSUPPORTED_EVENTS = new Set(HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS);
 /**
 * Whether an entry of the `hooks:` mapping is a hook-event list rather than one
 * of its non-event siblings.
@@ -17240,7 +17388,8 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	}
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
-		if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.0; preserving it for forward compatibility.`);
+		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.2; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -22364,7 +22513,7 @@ function isCodexStdioServer(config) {
 * @see https://learn.chatgpt.com/docs/extend/mcp
 */
 function isValidRenamedArray(key, value) {
-	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$1(value);
+	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$2(value);
 }
 /**
 * Translate a server's `oauth` table from the canonical rulesync shape (Claude
@@ -22884,6 +23033,49 @@ const resolveCopilotcliServerType = (server) => {
 	return isRemoteMcpServer(server) ? "http" : "stdio";
 };
 /**
+* Copilot CLI's per-server tool allowlist. `tools` selects which of the
+* server's tools are exposed — `["*"]` (the default) for all, or a list of
+* names — so the canonical `enabledTools` is written under that name rather
+* than passed through as a key the CLI ignores.
+*
+* When a server carries both, the canonical `enabledTools` wins and the native
+* `tools` is dropped with a warning. rulesync owns the generated allowlist, and
+* the `tools` value most likely present is the upstream default `["*"]` — left
+* to win, it would silently discard a real allowlist in favour of "expose every
+* tool", which is the failure this mapping exists to prevent. That is the
+* "canonical wins" branch of the collision rule documented on `enabledTools` in
+* `src/types/mcp.ts`; `kiro-mcp.ts` merges instead (its native names are
+* redundant spellings of additive lists) and `codexcli-mcp.ts` refuses instead
+* (Codex's same-named key means a different thing).
+*
+* `disabledTools` has no counterpart upstream (expressing it would need the
+* server's full tool list), so the target keeps `supportsDisabledTools: false`
+* and the processor strips it before it reaches here.
+*
+* @see https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-mcp-servers
+*/
+function renameEnabledToolsToTools({ server, serverName, logger }) {
+	const { enabledTools, ...rest } = server;
+	if (enabledTools === void 0) return rest;
+	if (rest.tools !== void 0) logger?.warn(`[CopilotcliMcp] MCP server "${serverName}" declares both 'tools' and 'enabledTools'; keeping 'enabledTools' and dropping 'tools'.`);
+	return {
+		...rest,
+		tools: enabledTools
+	};
+}
+/**
+* Copilot CLI's `tools` accepts more than the canonical `enabledTools` shape:
+* `--tools` documents `*`, a comma-separated list, or `""`, so a hand-written or
+* CLI-written entry can be a bare string. Canonical `enabledTools` is
+* `string[]`, and `RulesyncMcp` throws on a schema failure — carrying a string
+* through would reject the WHOLE imported MCP file rather than one key. Anything
+* that is not a string array is therefore left under `tools` untouched, matching
+* `codexcli-mcp.ts`'s `isValidRenamedArray` guard on the same class of rename.
+*/
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+/**
 * Resolves and sets the transport type for each MCP server config.
 * GitHub Copilot CLI requires the "type" field for each server. A server it
 * cannot express — one that names no transport, or names one it carries no way
@@ -22927,7 +23119,11 @@ function addTypeField(mcpServers, logger) {
 			}
 			const { httpUrl: _httpUrl, ...rest } = parsed;
 			result[name] = {
-				...rest,
+				...renameEnabledToolsToTools({
+					server: rest,
+					serverName: name,
+					logger
+				}),
 				type,
 				url
 			};
@@ -22945,7 +23141,11 @@ function addTypeField(mcpServers, logger) {
 			continue;
 		}
 		result[name] = {
-			...local,
+			...renameEnabledToolsToTools({
+				server: local,
+				serverName: name,
+				logger
+			}),
 			type,
 			command: head,
 			...tail.length > 0 && { args: tail }
@@ -22959,11 +23159,19 @@ function addTypeField(mcpServers, logger) {
 function removeTypeField(config) {
 	const result = {};
 	for (const [name, server] of Object.entries(config.mcpServers ?? {})) {
-		if (server.type !== "stdio") {
-			result[name] = server;
+		const { tools, ...withoutTools } = server;
+		const restored = isStringArray(tools) ? {
+			...withoutTools,
+			enabledTools: tools
+		} : {
+			...withoutTools,
+			...tools !== void 0 && { tools }
+		};
+		if (restored.type !== "stdio") {
+			result[name] = restored;
 			continue;
 		}
-		const { type: _, ...rest } = server;
+		const { type: _, ...rest } = restored;
 		result[name] = rest;
 	}
 	return result;
@@ -23615,11 +23823,11 @@ function applyGooseStdioFields(ext, config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") ext.cmd = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$1(config.args) ? config.args : [];
+		const args = isStringArray$2(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) ext.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		ext.cmd = command;
-		if (isStringArray$1(config.args)) ext.args = config.args;
+		if (isStringArray$2(config.args)) ext.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) ext.envs = omitPrototypePollutionKeys(config.env);
 }
@@ -23721,7 +23929,7 @@ function convertFromGooseFormat(extensions) {
 		else if (type === "streamable_http") server.type = "http";
 		else server.type = "stdio";
 		if (typeof ext.cmd === "string") server.command = ext.cmd;
-		if (isStringArray$1(ext.args)) server.args = ext.args;
+		if (isStringArray$2(ext.args)) server.args = ext.args;
 		if (isPlainObject$1(ext.envs)) server.env = omitPrototypePollutionKeys(ext.envs);
 		if (typeof ext.uri === "string") server.url = ext.uri;
 		if (isPlainObject$1(ext.headers)) server.headers = omitPrototypePollutionKeys(ext.headers);
@@ -23742,11 +23950,11 @@ function buildGoosePluginStdioServer(config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") server.command = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$1(config.args) ? config.args : [];
+		const args = isStringArray$2(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) server.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		server.command = command;
-		if (isStringArray$1(config.args)) server.args = config.args;
+		if (isStringArray$2(config.args)) server.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -24078,7 +24286,7 @@ function copyHermesOauth(source) {
 		"client_secret"
 	]) if (typeof source[key] === "string") oauth[key] = source[key];
 	if (typeof source.redirect_port === "number") oauth.redirect_port = source.redirect_port;
-	if (isStringArray$1(source.scopes)) oauth.scopes = source.scopes;
+	if (isStringArray$2(source.scopes)) oauth.scopes = source.scopes;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
 function copyHermesAdvancedFields(source, target) {
@@ -24087,7 +24295,7 @@ function copyHermesAdvancedFields(source, target) {
 		target.auth = source.auth;
 		copied = true;
 	}
-	if (typeof source.client_cert === "string" || isStringArray$1(source.client_cert)) {
+	if (typeof source.client_cert === "string" || isStringArray$2(source.client_cert)) {
 		target.client_cert = source.client_cert;
 		copied = true;
 	}
@@ -24156,8 +24364,8 @@ function copyHermesAdvancedFields(source, target) {
 */
 function buildHermesToolsBlock(config) {
 	const tools = {};
-	if (isStringArray$1(config.enabledTools)) tools.include = config.enabledTools;
-	if (isStringArray$1(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (isStringArray$2(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray$2(config.disabledTools)) tools.exclude = config.disabledTools;
 	if (typeof config.promptsEnabled === "boolean") tools.prompts = config.promptsEnabled;
 	if (typeof config.resourcesEnabled === "boolean") tools.resources = config.resourcesEnabled;
 	return tools;
@@ -24169,8 +24377,8 @@ function buildHermesToolsBlock(config) {
 * `promptsEnabled`/`resourcesEnabled` top-level toggles.
 */
 function applyHermesToolsBlock(hermesTools, server) {
-	if (isStringArray$1(hermesTools.include)) server.enabledTools = hermesTools.include;
-	if (isStringArray$1(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
+	if (isStringArray$2(hermesTools.include)) server.enabledTools = hermesTools.include;
+	if (isStringArray$2(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
 	if (typeof hermesTools.prompts === "boolean") server.promptsEnabled = hermesTools.prompts;
 	if (typeof hermesTools.resources === "boolean") server.resourcesEnabled = hermesTools.resources;
 }
@@ -24196,11 +24404,11 @@ function convertServerToHermes(config) {
 		if (Array.isArray(command)) {
 			if (typeof command[0] === "string") out.command = command[0];
 			const rest = command.slice(1).filter((c) => typeof c === "string");
-			const args = isStringArray$1(config.args) ? config.args : [];
+			const args = isStringArray$2(config.args) ? config.args : [];
 			if (rest.length > 0 || args.length > 0) out.args = [...rest, ...args];
 		} else if (typeof command === "string") {
 			out.command = command;
-			if (isStringArray$1(config.args)) out.args = config.args;
+			if (isStringArray$2(config.args)) out.args = config.args;
 		}
 		if (isPlainObject$1(config.env)) out.env = omitPrototypePollutionKeys(config.env);
 	} else if (url !== void 0) {
@@ -24250,7 +24458,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const server = {};
 		if (typeof config.command === "string") server.command = config.command;
-		if (isStringArray$1(config.args)) server.args = config.args;
+		if (isStringArray$2(config.args)) server.args = config.args;
 		if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 		if (typeof config.url === "string") server.url = config.url;
 		if (isPlainObject$1(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
@@ -25208,13 +25416,17 @@ function mergeToolLists(...lists) {
 *
 * Both native names are documented per-server fields, so a config that already
 * spells them natively keeps working: the two lists are merged rather than
-* one overwriting the other.
+* one overwriting the other. That is the "merge" branch of the collision rule
+* documented on `enabledTools` in `src/types/mcp.ts` — it applies here because
+* the native names are redundant spellings of the same additive lists;
+* `copilotcli-mcp.ts` lets the canonical value win instead, and
+* `codexcli-mcp.ts` refuses the canonical value instead.
 * @see https://kiro.dev/docs/mcp/configuration/
 */
 function toKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		const { kiroAutoApprove, kiroAutoBlock, disabledTools, ...rest } = server;
-		const autoApprove = mergeToolLists(isStringArray$1(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
+		const autoApprove = mergeToolLists(isStringArray$2(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
 		const disabled = mergeToolLists(disabledTools, kiroAutoBlock);
 		return [name, {
 			...rest,
@@ -25238,7 +25450,7 @@ function fromKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		if (server === null || typeof server !== "object" || Array.isArray(server)) return [name, server];
 		const { autoApprove, ...rest } = server;
-		if (!isStringArray$1(autoApprove)) return [name, server];
+		if (!isStringArray$2(autoApprove)) return [name, server];
 		return [name, {
 			...rest,
 			kiroAutoApprove: autoApprove
@@ -26380,7 +26592,7 @@ async function readRovodevConfigYaml({ outputRoot }) {
 }
 function disabledNamesOf(config) {
 	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
-	return isStringArray$1(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
+	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
 * Auxiliary writer for the `mcp:` block of `.rovodev/config.yml` (project) /
@@ -26513,7 +26725,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			return [];
 		}
 		const existingMcp = isRecord$1(existingParsed.mcp) ? { ...existingParsed.mcp } : {};
-		const existingDisabled = isStringArray$1(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
+		const existingDisabled = isStringArray$2(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
 		if (reEnabled.length > 0) logger?.warn(`Rovo Dev MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
@@ -27355,7 +27567,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		meta: {
 			supportsProject: true,
 			supportsGlobal: true,
-			supportsEnabledTools: false,
+			supportsEnabledTools: true,
 			supportsDisabledTools: false
 		}
 	}],
@@ -28179,6 +28391,34 @@ function convertAmpToRulesync({ disable, permissions }) {
 //#endregion
 //#region src/features/permissions/antigravity-cli-permissions.ts
 /**
+* Top-level `~/.gemini/antigravity-cli/settings.json` keys the `antigravity-cli`
+* permissions override may author. They are siblings of `permissions`, passed
+* through verbatim in both directions.
+*/
+const ANTIGRAVITY_CLI_OVERRIDE_KEYS = [
+	"toolPermission",
+	"enableTerminalSandbox",
+	"artifactReviewPolicy",
+	"allowNonWorkspaceAccess",
+	"agentMode"
+];
+const moduleLogger$2 = fallbackLogger;
+/**
+* Narrow an imported `settings.json` value to one of the documented values of
+* an enum-typed override key. The override schema declares `toolPermission`,
+* `artifactReviewPolicy` and `agentMode` as `z.enum`, so carrying an
+* unrecognized value through — a hand-written typo, or a preset a newer
+* Antigravity release added — would fail validation of the whole imported
+* `.rulesync/permissions.jsonc` instead of dropping just that key. A dropped
+* value is warned about rather than discarded silently, so a preset rulesync
+* does not know about yet is visible instead of quietly missing.
+*/
+function pickDocumentedValue({ key, value, documented }) {
+	if (typeof value !== "string") return void 0;
+	if (documented.includes(value)) return value;
+	moduleLogger$2.warn(`Antigravity CLI permissions: dropping '${key}: ${value}' on import — it is not one of the documented values (${documented.join(", ")}), and carrying it through would fail validation of the whole permissions file. Author it under the 'antigravity-cli' override by hand once rulesync supports it.`);
+}
+/**
 * Deliberate mapping from rulesync canonical permission categories to the
 * Antigravity CLI Fine-Grained Permissions Engine action vocabulary
 * (`read_file`, `write_file`, `read_url`, `command`, `mcp`, plus `execute_url` /
@@ -28253,9 +28493,10 @@ function buildPermissionEntry$1(toolName, pattern) {
 * file (global scope only). The file holds other CLI settings besides
 * permissions, so it is never deleted.
 *
-* Four CLI-only autonomy/sandbox knobs outside the allow/ask/deny arrays —
+* Five CLI-only autonomy/sandbox knobs outside the allow/ask/deny arrays —
 * `toolPermission` (the global autonomy preset), `enableTerminalSandbox`,
-* `artifactReviewPolicy` and `allowNonWorkspaceAccess` — are authored and
+* `artifactReviewPolicy`, `allowNonWorkspaceAccess` and `agentMode` (the
+* baseline execution mode) — are authored and
 * round-tripped through the `antigravity-cli` permissions override (see
 * `AntigravityCliPermissionsOverrideSchema`).
 */
@@ -28319,10 +28560,10 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			permissions: mergedPermissions
 		};
 		const override = config["antigravity-cli"];
-		if (override?.toolPermission !== void 0) merged.toolPermission = override.toolPermission;
-		if (override?.enableTerminalSandbox !== void 0) merged.enableTerminalSandbox = override.enableTerminalSandbox;
-		if (override?.artifactReviewPolicy !== void 0) merged.artifactReviewPolicy = override.artifactReviewPolicy;
-		if (override?.allowNonWorkspaceAccess !== void 0) merged.allowNonWorkspaceAccess = override.allowNonWorkspaceAccess;
+		for (const key of ANTIGRAVITY_CLI_OVERRIDE_KEYS) {
+			const value = override?.[key];
+			if (value !== void 0) merged[key] = value;
+		}
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new AntigravityCliPermissions({
 			outputRoot,
@@ -28347,10 +28588,26 @@ var AntigravityCliPermissions = class AntigravityCliPermissions extends ToolPerm
 			deny: permissions.deny ?? []
 		});
 		const override = {};
-		if (typeof settings.toolPermission === "string") override.toolPermission = settings.toolPermission;
+		const toolPermission = pickDocumentedValue({
+			key: "toolPermission",
+			value: settings.toolPermission,
+			documented: ANTIGRAVITY_CLI_TOOL_PERMISSIONS
+		});
+		if (toolPermission !== void 0) override.toolPermission = toolPermission;
 		if (typeof settings.enableTerminalSandbox === "boolean") override.enableTerminalSandbox = settings.enableTerminalSandbox;
-		if (typeof settings.artifactReviewPolicy === "string") override.artifactReviewPolicy = settings.artifactReviewPolicy;
+		const artifactReviewPolicy = pickDocumentedValue({
+			key: "artifactReviewPolicy",
+			value: settings.artifactReviewPolicy,
+			documented: ANTIGRAVITY_CLI_ARTIFACT_REVIEW_POLICIES
+		});
+		if (artifactReviewPolicy !== void 0) override.artifactReviewPolicy = artifactReviewPolicy;
 		if (typeof settings.allowNonWorkspaceAccess === "boolean") override.allowNonWorkspaceAccess = settings.allowNonWorkspaceAccess;
+		const agentMode = pickDocumentedValue({
+			key: "agentMode",
+			value: settings.agentMode,
+			documented: ANTIGRAVITY_CLI_AGENT_MODES
+		});
+		if (agentMode !== void 0) override.agentMode = agentMode;
 		const result = { ...config };
 		if (Object.keys(override).length > 0) result["antigravity-cli"] = override;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
@@ -29176,6 +29433,119 @@ function deepMergeRecords(base, patch) {
 	}
 	return merged;
 }
+/**
+* `sandbox.*` paths Claude Code honors only from user settings, managed settings
+* and the `--settings` CLI flag. Written into a project `.claude/settings.json`
+* they are silently ignored, so a committed file would read as though it
+* enforced a sandbox policy while doing nothing — security-relevant for
+* `network.strictAllowlist` and the credential-masking keys in particular.
+* Generation therefore drops them at project scope with a per-key warning and
+* emits them only under `--global`.
+*
+* Deliberately NOT listed:
+* - `bwrapPath` / `socatPath`: v2.1.232 added them to the managed-settings
+*   approval dialog, which is a consent prompt, not a project-scope rejection.
+* - `credentials.envVars` / `credentials.files`: the ignored-at-project-scope
+*   unit is the individual entry's mode, not the settings key, and the same
+*   lists carry `deny` entries that project settings *do* honor — dropping a
+*   whole list would remove real restrictions. `stripProjectIgnoredMaskEntries`
+*   filters those lists per entry instead.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+* @see https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md — v2.1.232 scoped `sandbox.ripgrep`
+*/
+const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
+	["filesystem", "disabled"],
+	["network", "strictAllowlist"],
+	["network", "tlsTerminate"],
+	["credentials", "allowPlaintextInject"],
+	["credentials", "awsPairs"],
+	["credentials", "sigv4"],
+	["allowAppleEvents"],
+	["ripgrep"]
+];
+/**
+* Copy of the authored `sandbox` override with the user/managed-only paths
+* removed, warning once per dropped path. Only the override copy is filtered —
+* a value already hand-written in the target file is left untouched, matching
+* the `qwencode` `security.allowPrivateNetworkHooks` precedent.
+*/
+function stripGlobalOnlySandboxPaths({ sandbox, relativeFilePath, logger }) {
+	const filtered = structuredClone(sandbox);
+	for (const path of CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS) {
+		const leaf = path.at(-1);
+		if (leaf === void 0) continue;
+		const parentPath = path.slice(0, -1);
+		let parent = filtered;
+		for (const segment of parentPath) {
+			const next = parent[segment];
+			if (!isPlainRecord(next)) {
+				parent = {};
+				break;
+			}
+			parent = next;
+		}
+		if (parent[leaf] === void 0) continue;
+		delete parent[leaf];
+		const [container] = parentPath;
+		if (container !== void 0 && isPlainRecord(filtered[container])) {
+			if (Object.keys(filtered[container]).length === 0) delete filtered[container];
+		}
+		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+	}
+	return filtered;
+}
+/** The `sandbox.credentials` lists whose entries accept `"mode": "mask"`. */
+const CLAUDECODE_MASKABLE_CREDENTIAL_LISTS = ["envVars", "files"];
+/**
+* Copy of the authored `sandbox` override with the `credentials.envVars` /
+* `credentials.files` entries whose `mode` is `"mask"` removed, warning once per
+* list.
+*
+* Masking authorizes the sandbox proxy to send the real credential to the listed
+* hosts, so Claude Code honors it only from user settings, managed settings and
+* the `--settings` CLI flag; a `mask` entry in a repository's
+* `.claude/settings.json` is ignored outright. Keeping it would read as though
+* the credential were masked while nothing protects it — the one project-scope
+* gap whose consequence is a live credential leaving the sandbox unmasked.
+*
+* Filtered per entry rather than per key, because the same lists carry `deny`
+* entries that project settings *do* honor. `mode` is matched exactly: an entry
+* Claude Code cannot read as `mask` is not treated as one either (it degrades
+* such entries to `deny`), so the "reads as masked but isn't" state this guards
+* against cannot slip through a differently-spelled value.
+*
+* Like `stripGlobalOnlySandboxPaths`, only the override copy is filtered — a
+* value already in the target file is left untouched, which is why the warning
+* points at it.
+*
+* @see https://code.claude.com/docs/en/sandboxing — "`mask` entries … are all
+*   ignored in a repository's `.claude/settings.json` or
+*   `.claude/settings.local.json`"; the file-entry section states the same
+*   settings-source restriction applies there.
+*/
+function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
+	const credentials = sandbox.credentials;
+	if (!isPlainRecord(credentials)) return sandbox;
+	const filteredCredentials = { ...credentials };
+	let changed = false;
+	for (const listKey of CLAUDECODE_MASKABLE_CREDENTIAL_LISTS) {
+		const list = filteredCredentials[listKey];
+		if (!Array.isArray(list)) continue;
+		const kept = list.filter((entry) => !(isPlainRecord(entry) && entry.mode === "mask"));
+		if (kept.length === list.length) continue;
+		changed = true;
+		const dropped = list.length - kept.length;
+		logger?.warn(`Claude Code permissions: 'sandbox.credentials.${listKey}' entries with 'mode: "mask"' are only honored in user/managed/--settings settings, so ${dropped} of them ${dropped === 1 ? "was" : "were"} not written to the project-scoped ${relativeFilePath}. Author them in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+		if (kept.length === 0) delete filteredCredentials[listKey];
+		else filteredCredentials[listKey] = kept;
+	}
+	if (!changed) return sandbox;
+	const filtered = { ...sandbox };
+	if (Object.keys(filteredCredentials).length === 0) delete filtered.credentials;
+	else filtered.credentials = filteredCredentials;
+	return filtered;
+}
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -29229,7 +29599,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			validate
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
 		const paths = ClaudecodePermissions.getSettablePaths();
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
@@ -29253,7 +29623,18 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			};
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
-		if (isPlainRecord(overrideSandbox)) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, overrideSandbox);
+		if (isPlainRecord(overrideSandbox)) {
+			const scopedSandbox = global ? overrideSandbox : stripProjectIgnoredMaskEntries({
+				sandbox: stripGlobalOnlySandboxPaths({
+					sandbox: overrideSandbox,
+					relativeFilePath: paths.relativeFilePath,
+					logger
+				}),
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
+			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
+		}
 		const managedToolNames = managedClaudeToolNames(config);
 		const merged = applyPermissions({
 			settings,
@@ -31430,7 +31811,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 function convertGoosePermissionConfigToRulesync(userPermission) {
 	const permission = {};
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
-		const toolNames = isStringArray$1(userPermission[key]) ? userPermission[key] : [];
+		const toolNames = isStringArray$2(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) {
 			const category = GOOSE_TO_RULESYNC_TOOL_NAME[toolName] ?? toolName;
@@ -31723,7 +32104,7 @@ const ACTION_RANK = {
 * (mirrors the Cursor adapter's preservation of unmanaged types).
 */
 function unmanagedEntries(existingPermission, key) {
-	return (isStringArray$1(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+	return (isStringArray$2(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
 }
 /**
 * Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
@@ -31766,9 +32147,9 @@ function buildGrokPermissionArrays(config, existingPermission, logger) {
 * described more than once resolves to the strictest action.
 */
 function parseGrokPermissionArrays(permission) {
-	const allow = isStringArray$1(permission.allow) ? permission.allow : void 0;
-	const deny = isStringArray$1(permission.deny) ? permission.deny : void 0;
-	const ask = isStringArray$1(permission.ask) ? permission.ask : void 0;
+	const allow = isStringArray$2(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray$2(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray$2(permission.ask) ? permission.ask : void 0;
 	const rules = Array.isArray(permission[GROKCLI_PERMISSION_RULES_KEY]) ? permission[GROKCLI_PERMISSION_RULES_KEY] : void 0;
 	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
@@ -31950,20 +32331,20 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		const permission = clonePermissionBlock(provenance.permission);
 		reconcileCommandAllowlist({
 			permission,
-			commandAllowlist: isStringArray$1(config.command_allowlist) ? config.command_allowlist : []
+			commandAllowlist: isStringArray$2(config.command_allowlist) ? config.command_allowlist : []
 		});
 		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
 			category: "bash",
-			patterns: isStringArray$1(approvals.deny) ? approvals.deny : []
+			patterns: isStringArray$2(approvals.deny) ? approvals.deny : []
 		});
 		const security = isRecord$1(config.security) ? config.security : {};
 		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
 			category: "webfetch",
-			patterns: websiteBlocklist.enabled === true && isStringArray$1(websiteBlocklist.domains) ? websiteBlocklist.domains : []
+			patterns: websiteBlocklist.enabled === true && isStringArray$2(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
 		const { permission: _permission, hermes: _hermes, ...otherProvenance } = provenance;
@@ -33391,6 +33772,115 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 	}
 };
 //#endregion
+//#region src/features/permissions/pi-permissions.ts
+/** The one `settings.json` key this feature owns. */
+const DEFAULT_TOOLS_KEY = "defaultTools";
+/**
+* Permissions generator for Pi Coding Agent.
+*
+* Pi exposes no allow/ask/deny rule surface, so no canonical permission
+* category maps onto it. Its one repository-syncable tool gate is `defaultTools` —
+* the built-in tools enabled at startup (v0.84.2) — authored through the `pi`
+* permissions override.
+*
+* Scope semantics are the **opposite** of the union-merge most targets use:
+* a project `defaultTools` array *replaces* the global array rather than adding
+* to it, so the two scopes are written independently and never combined.
+* Project scope writes `.pi/settings.json`; global scope writes
+* `~/.pi/agent/settings.json`.
+*
+* The file is hand-edited and holds many unrelated keys (`theme`,
+* `defaultModel`, `packages`, `sessionDir`, ...), so writes go through the
+* shared-config gateway with `defaultTools` as the only owned key, and the file
+* is never deleted.
+*
+* @see https://pi.dev/docs/latest/settings
+*/
+var PiPermissions = class PiPermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	/** `settings.json` holds unrelated user settings, so it must not be deleted. */
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? PI_AGENT_DIR_PATH : ".pi",
+			relativeFilePath: PI_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = PiPermissions.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new PiPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false }) {
+		const paths = PiPermissions.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const defaultTools = rulesyncPermissions.getJson().pi?.defaultTools;
+		const patch = {};
+		if (defaultTools !== void 0) patch[DEFAULT_TOOLS_KEY] = defaultTools;
+		return new PiPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const defaultTools = this.parseSettings()[DEFAULT_TOOLS_KEY];
+		const config = { permission: {} };
+		if (Array.isArray(defaultTools) && defaultTools.every((tool) => typeof tool === "string")) config.pi = { [DEFAULT_TOOLS_KEY]: defaultTools };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+	}
+	parseSettings() {
+		try {
+			return parseSharedConfig({
+				format: "json",
+				fileContent: this.getFileContent()
+			});
+		} catch (error) {
+			throw new Error(`Failed to parse Pi settings in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+		}
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new PiPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/permissions/qwencode-permissions.ts
 /**
 * Qwen Code uses a settings.json file in `.qwen/` (project) or `~/.qwen/` (global).
@@ -34454,7 +34944,7 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 		permission[category] ??= {};
 		permission[category][CATCH_ALL_PATTERN$1] = levels.reduce((strictest, level) => strictestAction(strictest, level ?? implicitLevel), permission[category][CATCH_ALL_PATTERN$1]);
 	}
-	if (isStringArray$1(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
+	if (isStringArray$2(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
 		permission.read[path] ??= "allow";
 	}
@@ -35431,8 +35921,8 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		const executionProfiles = isRecord$1(agents[EXECUTION_PROFILES_KEY]) ? agents[EXECUTION_PROFILES_KEY] : void 0;
 		const defaultProfile = executionProfiles && isRecord$1(executionProfiles[DEFAULT_PROFILE_KEY]) ? executionProfiles[DEFAULT_PROFILE_KEY] : void 0;
 		const config = convertWarpToRulesyncPermissions({
-			allow: defaultProfile ? isStringArray$1(defaultProfile[PROFILE_ALLOWLIST_KEY]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$1(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
-			deny: defaultProfile ? isStringArray$1(defaultProfile[PROFILE_DENYLIST_KEY]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$1(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
+			allow: defaultProfile ? isStringArray$2(defaultProfile[PROFILE_ALLOWLIST_KEY]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$2(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
+			deny: defaultProfile ? isStringArray$2(defaultProfile[PROFILE_DENYLIST_KEY]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$2(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
 		const warpOverride = {};
 		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
@@ -36144,6 +36634,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["pi", {
+		class: PiPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodePermissions,
 		meta: {
@@ -38455,6 +38953,7 @@ const CursorSkillFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.string(),
 	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
 	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 });
 /**
@@ -38509,6 +39008,7 @@ var CursorSkill = class CursorSkill extends ToolSkill {
 		const cursorSection = {
 			...frontmatter.paths !== void 0 && { paths: frontmatter.paths },
 			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
 			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
 		};
 		const rulesyncFrontmatter = {
@@ -38536,11 +39036,16 @@ var CursorSkill = class CursorSkill extends ToolSkill {
 			rootFrontmatter: rulesyncFrontmatter,
 			section: cursorSection
 		});
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: cursorSection
+		});
 		const cursorFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...cursorSection?.paths !== void 0 && { paths: cursorSection.paths },
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
 			...cursorSection?.metadata !== void 0 && { metadata: cursorSection.metadata }
 		};
 		return new CursorSkill({
@@ -46543,6 +47048,23 @@ var TaktSubagent = class TaktSubagent extends ToolSubagent {
 };
 //#endregion
 //#region src/features/subagents/vibe-subagent.ts
+/**
+* Where Vibe reads a custom system prompt from: `.vibe/prompts/<id>.md`
+* (project) and `~/.vibe/prompts/<id>.md` (user), with the custom directories
+* winning over the builtins. The id must be a bare file name with no path
+* separators.
+* @see vibe/core/prompts/__init__.py
+*/
+const VIBE_PROMPTS_DIR_PATH = (0, node_path.join)(".vibe", "prompts");
+/**
+* Vibe resolves a `system_prompt_id` by file name, and
+* `VibeConfigSchema._check_system_prompt` evaluates it during validation — an
+* unresolvable id raises and the agent is dropped at discovery. The id must
+* therefore stay a bare slug with no path separators.
+*/
+function promptSlug(relativeFilePath) {
+	return (0, node_path.basename)(relativeFilePath).replace(/\.(md|toml)$/, "").replace(/[^a-zA-Z0-9_-]/g, "_");
+}
 const VibeSubagentTomlSchema = zod_mini.z.looseObject({
 	agent_type: zod_mini.z.enum(["agent", "subagent"]),
 	display_name: zod_mini.z.optional(zod_mini.z.string()),
@@ -46559,14 +47081,22 @@ const VibeSubagentTomlSchema = zod_mini.z.looseObject({
 });
 var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	body;
-	constructor({ body, ...rest }) {
-		if (rest.validate !== false) try {
+	promptFile;
+	resolvedSystemPrompt;
+	constructor({ body, promptFile = false, resolvedSystemPrompt, ...rest }) {
+		if (rest.validate !== false && !promptFile) try {
 			VibeSubagentTomlSchema.parse(smol_toml.parse(body));
 		} catch (error) {
 			throw new Error(`Invalid TOML in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(error)}`, { cause: error });
 		}
 		super({ ...rest });
 		this.body = body;
+		this.promptFile = promptFile;
+		this.resolvedSystemPrompt = resolvedSystemPrompt;
+	}
+	/** True for the companion `.vibe/prompts/<id>.md` file. */
+	isPromptFile() {
+		return this.promptFile;
 	}
 	static getSettablePaths(_options = {}) {
 		return { relativeDirPath: (0, node_path.join)(".vibe", "agents") };
@@ -46581,7 +47111,9 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 		} catch (error) {
 			throw new Error(`Failed to parse TOML in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const { system_prompt, description, display_name, ...vibeSection } = parsed;
+		const { system_prompt, system_prompt_id, description, display_name, ...vibeSection } = parsed;
+		const resolvedBody = this.resolvedSystemPrompt ?? system_prompt;
+		const unresolvedPromptId = this.resolvedSystemPrompt === void 0 ? system_prompt_id : void 0;
 		const fileStem = (0, node_path.basename)(this.getRelativeFilePath(), ".toml");
 		const rulesyncFrontmatter = {
 			targets: ["vibe"],
@@ -46590,13 +47122,14 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 			vibe: {
 				...display_name !== void 0 && { display_name },
 				...description !== void 0 && { description },
+				...unresolvedPromptId !== void 0 && { system_prompt_id: unresolvedPromptId },
 				...vibeSection
 			}
 		};
 		return new RulesyncSubagent({
 			outputRoot: this.outputRoot,
 			frontmatter: rulesyncFrontmatter,
-			body: system_prompt ?? "",
+			body: resolvedBody ?? "",
 			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
 			relativeFilePath: this.getRelativeFilePath().replace(/\.toml$/, ".md"),
 			validate: true
@@ -46611,12 +47144,14 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 			"description",
 			"system_prompt"
 		]);
+		const promptBody = rulesyncSubagent.getBody();
+		const slug = promptSlug(rulesyncSubagent.getRelativeFilePath());
 		const tomlObj = {
 			agent_type: rawSection.agent_type === "agent" ? "agent" : "subagent",
 			display_name: typeof rawSection.display_name === "string" ? rawSection.display_name : frontmatter.name,
 			...frontmatter.description ? { description: frontmatter.description } : {},
-			...rulesyncSubagent.getBody() ? { system_prompt: rulesyncSubagent.getBody() } : {},
-			...vibeSection
+			...vibeSection,
+			...promptBody ? { system_prompt_id: slug } : {}
 		};
 		const body = smol_toml.stringify(tomlObj);
 		const paths = this.getSettablePaths({ global });
@@ -46631,6 +47166,36 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 			global
 		});
 	}
+	/**
+	* Emits the agent TOML plus its companion prompt file. The prompt file MUST
+	* be written together with the id: `VibeConfigSchema._check_system_prompt`
+	* evaluates the property during validation, so an unresolvable
+	* `system_prompt_id` raises and `AgentRegistry._try_load` drops the agent
+	* with a warning.
+	*/
+	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false }) {
+		return rulesyncSubagents.flatMap((rulesyncSubagent) => {
+			const agentFile = VibeSubagent.fromRulesyncSubagent({
+				outputRoot,
+				relativeDirPath: VibeSubagent.getSettablePaths({ global }).relativeDirPath,
+				rulesyncSubagent,
+				global
+			});
+			const promptBody = rulesyncSubagent.getBody();
+			if (!promptBody) return [agentFile];
+			const slug = promptSlug(rulesyncSubagent.getRelativeFilePath());
+			return [agentFile, new VibeSubagent({
+				outputRoot,
+				body: promptBody,
+				relativeDirPath: VIBE_PROMPTS_DIR_PATH,
+				relativeFilePath: `${slug}.md`,
+				fileContent: promptBody,
+				promptFile: true,
+				validate: false,
+				global
+			})];
+		});
+	}
 	validate() {
 		try {
 			VibeSubagentTomlSchema.parse(smol_toml.parse(this.body));
@@ -46655,6 +47220,10 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
+		const resolvedSystemPrompt = await VibeSubagent.readSystemPrompt({
+			outputRoot,
+			fileContent
+		});
 		const subagent = new VibeSubagent({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -46662,7 +47231,8 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 			body: fileContent.trim(),
 			fileContent,
 			validate,
-			global
+			global,
+			...resolvedSystemPrompt !== void 0 && { resolvedSystemPrompt }
 		});
 		if (validate) {
 			const result = subagent.validate();
@@ -46670,6 +47240,21 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 		}
 		return subagent;
 	}
+	/**
+	* Read `.vibe/prompts/<id>.md` for an agent that names a `system_prompt_id`.
+	* Returns `undefined` when there is no id or the file is missing, in which
+	* case import falls back to the legacy `system_prompt` key.
+	*/
+	static async readSystemPrompt({ outputRoot, fileContent }) {
+		let promptId;
+		try {
+			promptId = VibeSubagentTomlSchema.parse(smol_toml.parse(fileContent)).system_prompt_id;
+		} catch {
+			return;
+		}
+		if (typeof promptId !== "string" || promptId === "" || /[\\/]/.test(promptId)) return;
+		return await readFileContentOrNull((0, node_path.join)(outputRoot, VIBE_PROMPTS_DIR_PATH, `${promptId}.md`)) ?? void 0;
+	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		return new VibeSubagent({
 			outputRoot,
@@ -46712,7 +47297,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const zoocodeSection = isRecord$1(frontmatter.zoocode) ? frontmatter.zoocode : {};
-		if (isStringArray$1(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
+		if (isStringArray$2(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
 		return mode;
 	}
 	toRulesyncSubagents() {
@@ -46724,7 +47309,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 				targets: ["zoocode"],
 				roo: restRooSection
 			};
-			if (isStringArray$1(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
+			if (isStringArray$2(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
 			return new RulesyncSubagent({
 				outputRoot: ".",
 				frontmatter: rebuilt,
@@ -49627,8 +50212,13 @@ const STRATEGIES = [
 *   file per rule under `.devin/rules/*.md` (Devin Desktop Cascade) with YAML
 *   frontmatter carrying a `trigger` (always_on | glob | manual | model_decision)
 *   plus companion `globs`/`description` fields.
-* - Global scope: a single plain-markdown, always-on file (no frontmatter) at
-*   `~/.config/devin/AGENTS.md` (Devin Local global always-on rules).
+* - Global scope: mirrors the project layout. The root rule is a single
+*   plain-markdown, always-on file (no frontmatter) at
+*   `~/.config/devin/AGENTS.md`; non-root rules are one file per rule under
+*   `~/.devin/rules/*.md` with the same `trigger`/`globs` frontmatter as project
+*   scope. Note the directory split — the per-rule global directory is the home
+*   `~/.devin/`, not the `~/.config/devin/` tree every other Devin global
+*   surface uses. That is what the rules page documents.
 *
 * Trigger inference (when no explicit devin trigger is persisted):
 * - Specific globs (non wildcard) → glob
@@ -49659,19 +50249,32 @@ var DevinRule = class DevinRule extends ToolRule {
 			relativeFilePath: DEVIN_GLOBAL_AGENTS_FILE_NAME
 		};
 	}
+	/**
+	* The always-on root rule file for a scope: the project-root `AGENTS.md`
+	* Devin CLI / Devin Local reads, or `~/.config/devin/AGENTS.md` in global
+	* scope. Single-sourced so `getSettablePaths`, `fromFile` and
+	* `fromRulesyncRule` cannot disagree about it.
+	*/
+	static getRootPath(global, excludeToolDir) {
+		return global ? DevinRule.getGlobalRootPath(excludeToolDir) : {
+			relativeDirPath: ".",
+			relativeFilePath: "AGENTS.md"
+		};
+	}
 	static getSettablePaths({ global = false, excludeToolDir } = {}) {
-		if (global) return { root: DevinRule.getGlobalRootPath(excludeToolDir) };
+		if (global) return {
+			root: DevinRule.getRootPath(true, excludeToolDir),
+			nonRoot: { relativeDirPath: buildToolPath(DEVIN_DIR, "rules", excludeToolDir) }
+		};
 		return {
-			root: {
-				relativeDirPath: ".",
-				relativeFilePath: "AGENTS.md"
-			},
+			root: DevinRule.getRootPath(false, excludeToolDir),
 			nonRoot: { relativeDirPath: buildToolPath(DEVIN_DIR, "rules", excludeToolDir) }
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
-		if (global) {
-			const rootPath = DevinRule.getGlobalRootPath();
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
+		const nonRootDirPath = buildToolPath(DEVIN_DIR, "rules");
+		if (relativeDirPath !== void 0 ? relativeDirPath !== nonRootDirPath : relativeFilePath === DevinRule.getRootPath(global).relativeFilePath) {
+			const rootPath = DevinRule.getRootPath(global);
 			const fileContent = await readFileContent((0, node_path.join)(outputRoot, rootPath.relativeDirPath, rootPath.relativeFilePath));
 			return new DevinRule({
 				outputRoot,
@@ -49683,19 +50286,6 @@ var DevinRule = class DevinRule extends ToolRule {
 				root: true
 			});
 		}
-		if (relativeFilePath === "AGENTS.md") {
-			const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativeFilePath));
-			return new DevinRule({
-				outputRoot,
-				relativeDirPath: ".",
-				relativeFilePath: "AGENTS.md",
-				frontmatter: {},
-				body: fileContent,
-				validate,
-				root: true
-			});
-		}
-		const nonRootDirPath = buildToolPath(DEVIN_DIR, "rules");
 		const filePath = (0, node_path.join)(outputRoot, nonRootDirPath, relativeFilePath);
 		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
 		let parsedFrontmatter;
@@ -49715,8 +50305,9 @@ var DevinRule = class DevinRule extends ToolRule {
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
-		if (global) {
-			const rootPath = DevinRule.getGlobalRootPath();
+		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
+		if (rulesyncFrontmatter.root) {
+			const rootPath = DevinRule.getRootPath(global);
 			return new DevinRule({
 				outputRoot,
 				relativeDirPath: rootPath.relativeDirPath,
@@ -49727,16 +50318,6 @@ var DevinRule = class DevinRule extends ToolRule {
 				root: true
 			});
 		}
-		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
-		if (rulesyncFrontmatter.root) return new DevinRule({
-			outputRoot,
-			relativeDirPath: ".",
-			relativeFilePath: "AGENTS.md",
-			frontmatter: {},
-			body: rulesyncRule.getBody(),
-			validate,
-			root: true
-		});
 		const storedDevin = rulesyncFrontmatter.devin;
 		const normalized = normalizeStoredDevin(storedDevin);
 		const storedTrigger = storedDevin?.trigger;
@@ -49796,7 +50377,7 @@ var DevinRule = class DevinRule extends ToolRule {
 			error: null
 		};
 	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
 		return new DevinRule({
 			outputRoot,
 			relativeDirPath,
@@ -49804,7 +50385,7 @@ var DevinRule = class DevinRule extends ToolRule {
 			frontmatter: {},
 			body: "",
 			validate: false,
-			root: global
+			root: relativeDirPath !== buildToolPath(DEVIN_DIR, "rules")
 		});
 	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
@@ -50437,6 +51018,11 @@ var KimiCodeRule = class KimiCodeRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/kiro-rule.ts
+/**
+* Kiro loads `AGENTS.md` as steering context from any directory in the
+* workspace tree (CLI 2.18.0 / IDE 1.0.309), not just the workspace root.
+*/
+const KIRO_NESTED_STEERING_FILE_NAME = "AGENTS.md";
 const WILDCARD_GLOBS = /* @__PURE__ */ new Set([
 	"**/*",
 	"**",
@@ -50510,8 +51096,17 @@ var KiroRule = class KiroRule extends ToolRule {
 		};
 		return { nonRoot: { relativeDirPath: steeringDirPath } };
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
+		const steeringDirPath = paths.nonRoot?.relativeDirPath ?? buildToolPath(".kiro", "steering");
+		if (overrideDirPath !== void 0 && overrideDirPath !== steeringDirPath && overrideDirPath !== "." && relativeFilePath === KIRO_NESTED_STEERING_FILE_NAME) return new KiroRule({
+			outputRoot,
+			relativeDirPath: overrideDirPath,
+			relativeFilePath,
+			fileContent: await readFileContent((0, node_path.join)(outputRoot, overrideDirPath, relativeFilePath)),
+			validate,
+			root: false
+		});
 		const isRoot = "root" in paths && relativeFilePath === paths.root.relativeFilePath;
 		const relativeDirPath = paths.nonRoot?.relativeDirPath ?? buildToolPath(".kiro", "steering");
 		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath));
@@ -50535,6 +51130,12 @@ var KiroRule = class KiroRule extends ToolRule {
 		});
 		if (params.root) return new KiroRule(params);
 		const frontmatter = rulesyncRule.getFrontmatter();
+		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
+		if (!global && subprojectPath) return new KiroRule({
+			...params,
+			relativeDirPath: (0, node_path.join)(subprojectPath),
+			relativeFilePath: KIRO_NESTED_STEERING_FILE_NAME
+		});
 		const inclusion = deriveKiroInclusion({
 			kiro: frontmatter.kiro,
 			globs: frontmatter.globs
@@ -50545,7 +51146,34 @@ var KiroRule = class KiroRule extends ToolRule {
 			fileContent: stringifyFrontmatter(rulesyncRule.getBody(), inclusion)
 		});
 	}
+	/**
+	* The subproject directory a nested `AGENTS.md` scopes, or `undefined` for the
+	* root rule and for the `.kiro/steering/` files.
+	*/
+	getSubprojectPath() {
+		if (this.isRoot() || this.getRelativeFilePath() !== KIRO_NESTED_STEERING_FILE_NAME) return;
+		const relativeDirPath = toPosixPath(this.getRelativeDirPath());
+		if (relativeDirPath === "." || relativeDirPath === "" || relativeDirPath.startsWith(".")) return;
+		return relativeDirPath;
+	}
 	toRulesyncRule() {
+		const subprojectPath = this.getSubprojectPath();
+		if (subprojectPath !== void 0) {
+			const slug = subprojectPath.replaceAll("/", "-");
+			return new RulesyncRule({
+				outputRoot: this.getOutputRoot(),
+				relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
+				relativeFilePath: `${slug}-kiro.md`,
+				frontmatter: {
+					targets: ["kiro"],
+					root: false,
+					globs: [`${subprojectPath}/**/*`],
+					agentsmd: { subprojectPath }
+				},
+				body: this.getFileContent(),
+				validate: true
+			});
+		}
 		const { frontmatter, body } = parseFrontmatter(this.getFileContent(), this.getRelativeFilePath());
 		const inclusion = typeof frontmatter.inclusion === "string" ? frontmatter.inclusion : void 0;
 		if (!inclusion) return this.toRulesyncRuleDefault();
@@ -50578,6 +51206,26 @@ var KiroRule = class KiroRule extends ToolRule {
 			error: null
 		};
 	}
+	/**
+	* Nested `AGENTS.md` files anywhere in the workspace tree, which Kiro loads as
+	* steering context alongside `.kiro/steering/`. Import-only, like every other
+	* nested scan: these are hand-authored files outside a rulesync-owned
+	* directory, so enumerating them for `--delete` would sweep away work rulesync
+	* never wrote.
+	* @see https://kiro.dev/docs/steering/
+	*/
+	static getNestedFilePatterns({ outputRoot }) {
+		const root = toPosixPath(outputRoot);
+		return {
+			include: [`${root}/**/${KIRO_NESTED_STEERING_FILE_NAME}`],
+			ignore: [
+				`${root}/${KIRO_NESTED_STEERING_FILE_NAME}`,
+				`${root}/**/.*/**`,
+				...NESTED_SCAN_EXCLUDED_DIRS_ANY_DEPTH.map((dir) => `${root}/**/${dir}/**`),
+				...NESTED_SCAN_EXCLUDED_ROOT_DIRS.map((dir) => `${root}/${dir}/**`)
+			]
+		};
+	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
 		return new KiroRule({
 			outputRoot,
@@ -52046,6 +52694,18 @@ const resolveIncludeLocalRoot = (options) => {
 	return parsed.data.includeLocalRoot ?? true;
 };
 /**
+* Whether `candidate` is `base` itself or a class that extends it.
+*
+* Class-identity dispatch (`factory.class === Base`) is subclass-blind: a target
+* whose adapter merely narrows another one — `ZoocodeRule extends RooRule` — fails
+* a strict `===` and silently falls through. That is how `zoocode` ended up
+* declaring `localRootMode: "separate-local-file"` while never emitting
+* `AGENTS.local.md`, in both directions and without a warning.
+*/
+function isClassOrSubclassOf({ candidate, base }) {
+	return candidate === base || Object.prototype.isPrototypeOf.call(base, candidate);
+}
+/**
 * Factory Map mapping tool targets to their rule factories.
 * Using Map to preserve insertion order for consistent iteration.
 */
@@ -52399,7 +53059,9 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 		meta: {
 			extension: "md",
 			supportsGlobal: true,
-			ruleDiscoveryMode: "auto"
+			ruleDiscoveryMode: "auto",
+			localRootMode: "separate-local-file",
+			localRootFileName: "AGENTS.local.md"
 		}
 	}],
 	["zed", {
@@ -52686,7 +53348,10 @@ var RulesProcessor = class extends FeatureProcessor {
 		if (rootRule) rootRule.setFileContent(rootRule.getFileContent() + "\n\n" + localRootBody);
 	}
 	buildLocalRootFile({ factory, fileName, body, relativeDirPath, localRoot = false }) {
-		if (factory.class === ClaudecodeRule) {
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: ClaudecodeRule
+		})) {
 			const paths = ClaudecodeRule.getSettablePaths({ global: this.global });
 			return new ClaudecodeRule({
 				outputRoot: this.outputRoot,
@@ -52699,7 +53364,10 @@ var RulesProcessor = class extends FeatureProcessor {
 				localRoot
 			});
 		}
-		if (factory.class === ClaudecodeLegacyRule) {
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: ClaudecodeLegacyRule
+		})) {
 			const paths = ClaudecodeLegacyRule.getSettablePaths({ global: this.global });
 			return new ClaudecodeLegacyRule({
 				outputRoot: this.outputRoot,
@@ -52711,7 +53379,10 @@ var RulesProcessor = class extends FeatureProcessor {
 				localRoot
 			});
 		}
-		if (factory.class === RovodevRule) return new RovodevRule({
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: RovodevRule
+		})) return new RovodevRule({
 			outputRoot: this.outputRoot,
 			relativeDirPath: relativeDirPath ?? ".",
 			relativeFilePath: fileName,
@@ -52720,7 +53391,10 @@ var RulesProcessor = class extends FeatureProcessor {
 			root: true,
 			localRoot
 		});
-		if (factory.class === RooRule) return new RooRule({
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: RooRule
+		})) return new RooRule({
 			outputRoot: this.outputRoot,
 			relativeDirPath: relativeDirPath ?? ".",
 			relativeFilePath: fileName,
@@ -52729,7 +53403,23 @@ var RulesProcessor = class extends FeatureProcessor {
 			root: true,
 			localRoot
 		});
-		if (factory.class === QwencodeRule) return new QwencodeRule({
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: DevinRule
+		})) return new DevinRule({
+			outputRoot: this.outputRoot,
+			relativeDirPath: relativeDirPath ?? ".",
+			relativeFilePath: fileName,
+			frontmatter: {},
+			body,
+			validate: true,
+			root: true,
+			localRoot
+		});
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: QwencodeRule
+		})) return new QwencodeRule({
 			outputRoot: this.outputRoot,
 			relativeDirPath: relativeDirPath ?? ".qwen",
 			relativeFilePath: fileName,