rulesync 16.13.0 → 16.15.0

package/dist/{import-ChnrtxiJ.cjs → import-nfDFI5X1.cjs}

@@ -134,27 +134,27 @@ const isFeatureValueEnabled = (value) => {
 };
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$289 } = node_path.posix;
+const { join: join$290 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$289(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "checks");
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$289(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "rules");
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$290(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "commands");
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "subagents");
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "checks");
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$290(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$289(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$289(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$290(RULESYNC_RELATIVE_DIR_PATH, "skills");
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$290(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -444,7 +444,8 @@ const permissionsProcessorToolTargetTuple = [
 	"takt",
 	"vibe",
 	"warp",
-	"zed"
+	"zed",
+	"zoocode"
 ];
 const checksProcessorToolTargetTuple = [
 	"amp",
@@ -4421,11 +4422,26 @@ const KiloPermissionsOverrideSchema = zod_mini.z.looseObject({
 * rather than which commands are permitted — so it is a loose passthrough on
 * the same terms, merged into the top level of `.claude/settings.json`.
 *
+* Any other key is a plain top-level `settings.json` key (`editorMode`, `env`,
+* `model`, ...), deep-merged into the generated file verbatim so settings
+* Claude Code adds faster than an allowlist can track stay authorable.
+* The exceptions are the keys another feature owns (`hooks`) and `$schema`.
+* Keys the target file cannot honor — `Managed`-only and `~/.claude.json`-only
+* keys in either scope, plus user-scope keys at project scope — are dropped
+* with a warning rather than written where they would never apply. So are the
+* keys whose value is a command Claude Code executes (`apiKeyHelper`,
+* `statusLine`, ...): this file is shareable via `rulesync fetch`, and a file
+* named for restricting things is not where a command belongs — author those
+* in `.rulesync/hooks.jsonc` instead.
+*
 * @example
 * { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
 * @example
 * { "sandbox": { "network": { "allowedDomains": ["example.com"], "strictAllowlist": true } } }
+* @example
+* { "editorMode": "vim", "env": { "MY_VAR": "1" } }
 * @see https://code.claude.com/docs/en/sandboxing
+* @see https://code.claude.com/docs/en/settings-reference
 */
 const ClaudecodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -5100,6 +5116,15 @@ const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	sandbox_workspace_write: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	apps: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	approvals_reviewer: zod_mini.z.optional(zod_mini.z.union([CodexApprovalsReviewerSchema, zod_mini.z.looseObject({})])),
+	/**
+	* The `[tui]` table of `config.toml` (e.g. `vim_mode_default`, `keymap.*`).
+	* Not a permission surface, but like `apps` it is a top-level table with no
+	* canonical category, and Codex adds keys to it faster than an explicit model
+	* could track — so it is a loose passthrough written verbatim.
+	*
+	* @see https://developers.openai.com/codex/config-reference
+	*/
+	tui: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	git_write_rules: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
@@ -5370,6 +5395,7 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 		systemPrompt: zod_mini.z.optional(zod_mini.z.enum(["append"])),
 		contextFile: zod_mini.z.optional(zod_mini.z.enum(["override"]))
 	})),
+	roo: zod_mini.z.optional(zod_mini.z.looseObject({ mode: zod_mini.z.optional(zod_mini.z.string()) })),
 	takt: zod_mini.z.optional(zod_mini.z.looseObject({
 		name: zod_mini.z.optional(zod_mini.z.string()),
 		extends: zod_mini.z.optional(zod_mini.z.string()),
@@ -7486,7 +7512,8 @@ const CODEXCLI_OVERRIDE_KEYS = [
 	"sandbox_mode",
 	"sandbox_workspace_write",
 	"apps",
-	"approvals_reviewer"
+	"approvals_reviewer",
+	"tui"
 ];
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
@@ -7811,7 +7838,9 @@ const SHARED_CONFIG_OWNERSHIP = {
 			ownedKeys: [
 				"chat.tools.terminal.autoApprove",
 				"chat.tools.edits.autoApprove",
-				"chat.tools.urls.autoApprove"
+				"chat.tools.urls.autoApprove",
+				"zoo-code.allowedCommands",
+				"zoo-code.deniedCommands"
 			]
 		} }
 	},
@@ -12775,6 +12804,21 @@ const ROO_DIR = ".roo";
 const ROO_COMMANDS_DIR_PATH = (0, node_path.join)(ROO_DIR, "commands");
 const ROO_SKILLS_DIR_PATH = (0, node_path.join)(ROO_DIR, "skills");
 const ROO_MCP_FILE_NAME = "mcp.json";
+/**
+* Mode slugs Roo/Zoo Code themselves accept for a `rules-{mode}` directory:
+* the loader builds the directory name by interpolating the active mode slug,
+* and custom-mode slugs are restricted to this alphabet. Validating against it
+* also keeps an authored value from escaping `.roo/` through path separators or
+* `..` segments.
+*/
+const ROO_MODE_SLUG_PATTERN = /^[a-zA-Z0-9-]+$/;
+/**
+* `.roo/rules-{mode}/` — the mode-specific rule directory Roo/Zoo Code load
+* INSTEAD of `.roo/rules/` while that mode is active. The relative path is the
+* same in global scope, where it resolves under `~/.roo/`.
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/core/prompts/sections/custom-instructions.ts
+*/
+const rooModeRulesDirName = (mode) => `rules-${mode}`;
 const ROO_IGNORE_FILE_NAME = ".rooignore";
 /**
 * Roo Code reads project-level custom modes from a single aggregated
@@ -27800,6 +27844,27 @@ const defaultGetFactory$3 = (target) => {
 	if (!factory) throw new Error(`Unsupported tool target: ${target}`);
 	return factory;
 };
+/**
+* Warn about per-server tool filters the target tool cannot express.
+*
+* `enabledTools`/`disabledTools` are canonical fields, so a single
+* `.rulesync/.mcp.json` can carry a filter that only some targets read. The
+* unsupported ones are stripped before generation (writing them would produce a
+* key the tool discards on load), which used to happen silently — the filter
+* simply did not apply and nothing said so. Warning names the servers whose
+* filter is being dropped for this target so the gap is visible at generate
+* time rather than in the tool's behavior.
+*
+* Only fields actually present are reported, so a config that never authored
+* the filter stays quiet.
+*/
+function warnStrippedMcpServerFields({ mcpServers, fields, toolTarget, logger }) {
+	for (const field of fields) {
+		const serverNames = Object.entries(mcpServers ?? {}).filter(([, serverConfig]) => serverConfig[field] !== void 0).map(([serverName]) => serverName);
+		if (serverNames.length === 0) continue;
+		logger.warn(`${toolTarget} does not read the per-server \`${field}\` MCP tool filter; dropping it from ${serverNames.join(", ")}.`);
+	}
+}
 var McpProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
@@ -27879,6 +27944,12 @@ var McpProcessor = class extends FeatureProcessor {
 			const fieldsToStrip = [];
 			if (!factory.meta.supportsEnabledTools) fieldsToStrip.push("enabledTools");
 			if (!factory.meta.supportsDisabledTools) fieldsToStrip.push("disabledTools");
+			warnStrippedMcpServerFields({
+				mcpServers: targetedRulesyncMcp.getJson().mcpServers,
+				fields: fieldsToStrip,
+				toolTarget: this.toolTarget,
+				logger: this.logger
+			});
 			const filteredRulesyncMcp = targetedRulesyncMcp.stripMcpServerFields(fieldsToStrip);
 			return await factory.class.fromRulesyncMcp({
 				outputRoot: this.outputRoot,
@@ -29359,6 +29430,27 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	return { permission };
 }
 //#endregion
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
+* line and paragraph separators, and the plain LRM/RLM marks. A name or value
+* copied out of an untrusted config file, a fetched repository, or a tool's own
+* settings file must never reach the terminal with these intact: they let the
+* text forge log lines, reorder what is printed around them, or inject escape
+* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
+* neutral characters beside them, so they go too — a diagnostic line is not the
+* place to preserve the typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+//#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Claude Code tool names (PascalCase).
@@ -29443,8 +29535,9 @@ function deepMergeRecords(base, patch) {
 * emits them only under `--global`.
 *
 * Deliberately NOT listed:
-* - `bwrapPath` / `socatPath`: v2.1.232 added them to the managed-settings
-*   approval dialog, which is a consent prompt, not a project-scope rejection.
+* - `ripgrep` / `bwrapPath` / `socatPath`: each names an executable, so
+*   `stripCommandExecutingSandboxPaths` refuses them in both scopes rather than
+*   emitting them under `--global`.
 * - `credentials.envVars` / `credentials.files`: the ignored-at-project-scope
 *   unit is the individual entry's mode, not the settings key, and the same
 *   lists carry `deny` entries that project settings *do* honor — dropping a
@@ -29452,7 +29545,6 @@ function deepMergeRecords(base, patch) {
 *   filters those lists per entry instead.
 *
 * @see https://code.claude.com/docs/en/sandboxing
-* @see https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md — v2.1.232 scoped `sandbox.ripgrep`
 */
 const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["filesystem", "disabled"],
@@ -29461,10 +29553,228 @@ const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["credentials", "allowPlaintextInject"],
 	["credentials", "awsPairs"],
 	["credentials", "sigv4"],
-	["allowAppleEvents"],
-	["ripgrep"]
+	["allowAppleEvents"]
+];
+/**
+* Walks `segments` from `root`, returning the record they name or `undefined` if
+* any step is missing or not a record. Shared by everything below that addresses
+* a `sandbox` path, so a nested path added to one of the tables is actually
+* traversed rather than silently skipped.
+*/
+function resolveSandboxParent({ root, segments }) {
+	let parent = root;
+	for (const segment of segments) {
+		const next = parent[segment];
+		if (!isPlainRecord(next)) return void 0;
+		parent = next;
+	}
+	return parent;
+}
+/**
+* Deletes `path` from `target` in place and reports whether anything was there,
+* dropping a container the removal emptied so no `"network": {}` noise is left
+* behind.
+*/
+function deleteSandboxPath({ target, path }) {
+	const leaf = path.at(-1);
+	if (leaf === void 0) return false;
+	const parentPath = path.slice(0, -1);
+	const parent = resolveSandboxParent({
+		root: target,
+		segments: parentPath
+	});
+	if (parent === void 0 || parent[leaf] === void 0) return false;
+	delete parent[leaf];
+	for (let depth = parentPath.length; depth > 0; depth--) {
+		const container = resolveSandboxParent({
+			root: target,
+			segments: parentPath.slice(0, depth)
+		});
+		if (container === void 0 || Object.keys(container).length > 0) break;
+		const holder = resolveSandboxParent({
+			root: target,
+			segments: parentPath.slice(0, depth - 1)
+		});
+		const name = parentPath[depth - 1];
+		if (holder === void 0 || name === void 0) break;
+		delete holder[name];
+	}
+	return true;
+}
+/**
+* The `permissions.defaultMode` values that start a session with fewer prompts
+* than the default. `plan` and `default` are absent because they do not widen
+* anything.
+*/
+const CLAUDECODE_WIDENING_DEFAULT_MODES = {
+	acceptEdits: "every file edit is then applied without a prompt",
+	auto: "shell commands are then auto-approved by a classifier rather than by you",
+	bypassPermissions: "every session then starts with no permission prompts at all"
+};
+/**
+* The `permissions` fields that widen rather than restrict: a `defaultMode` that
+* removes prompts, and `additionalDirectories`, which moves the
+* working-directory boundary. Warned for the same reason `disableAllHooks` is: a
+* shareable permissions file should not loosen the permission system quietly.
+*/
+function warnOnWideningPermissionFields({ fields, relativeFilePath, logger }) {
+	const defaultMode = fields.defaultMode;
+	if (typeof defaultMode === "string" && Object.hasOwn(CLAUDECODE_WIDENING_DEFAULT_MODES, defaultMode)) logger?.warn(`Claude Code permissions: writing 'permissions.defaultMode: "${defaultMode}"' to ${relativeFilePath}; ${CLAUDECODE_WIDENING_DEFAULT_MODES[defaultMode]}. Review it as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+	const additionalDirectories = fields.additionalDirectories;
+	if (additionalDirectories !== void 0 && !(Array.isArray(additionalDirectories) && additionalDirectories.length === 0)) logger?.warn(`Claude Code permissions: writing 'permissions.additionalDirectories' to ${relativeFilePath}; it moves the boundary of what Claude Code may read and edit outside the project. Review the paths, especially if this permissions file came from 'rulesync fetch'.`);
+}
+/**
+* `sandbox` paths whose value names a binary Claude Code runs. `sandbox` has its
+* own merge branch, so the top-level refusal in `stripUnhonoredTopLevelKeys`
+* never sees them — they are refused here on the same grounds, in both scopes:
+* a fetched `.rulesync/permissions.jsonc` must not be able to point Claude Code
+* at an executable of its choosing.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+*/
+const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
+	["ripgrep"],
+	["bwrapPath"],
+	["socatPath"]
+];
+/**
+* `sandbox` paths that loosen the sandbox rather than naming something to run:
+* they let commands out of it, weaken the isolation it provides, or redirect
+* where its traffic goes. They are written like `env` is — the ordinary uses are
+* too common to refuse — but never silently, because a fetched override should
+* not be able to open the sandbox without saying so. `widens` keeps the warning
+* to the value that actually loosens the policy, so authoring the restrictive
+* value (`allowUnsandboxedCommands: false`, an empty `excludedCommands`) stays
+* quiet. The `allow*` lists are here for a structural reason: Claude Code merges
+* a list across every settings scope rather than replacing it, so a project file
+* can only ever add to them. Their counterparts — `denyRead`, `denyWrite`,
+* `deniedDomains` — merge the same way, but adding to a deny list only ever
+* narrows the policy, so they are absent.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+*/
+const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["allowAppleEvents"],
+		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
+		widens: (value) => value === true
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "controls whether Claude may retry a blocked command outside the sandbox",
+		widens: (value) => value !== false
+	},
+	{
+		path: ["autoAllowBashIfSandboxed"],
+		reason: "controls whether every Bash command the sandbox accepts runs without a prompt",
+		widens: (value) => value !== false
+	},
+	{
+		path: ["enableWeakerNestedSandbox"],
+		reason: "runs the Linux sandbox inside an unprivileged container, which weakens it",
+		widens: (value) => value === true
+	},
+	{
+		path: ["enableWeakerNetworkIsolation"],
+		reason: "weakens the sandbox's network isolation on macOS",
+		widens: (value) => value === true
+	},
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox on, and sandboxed Bash commands then run without a permission prompt unless `autoAllowBashIfSandboxed` is false",
+		widens: (value) => value === true
+	},
+	{
+		path: ["excludedCommands"],
+		reason: "names commands that always run outside the sandbox, with no sandbox policy applied",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["filesystem", "allowRead"],
+		reason: "re-opens reading inside a region the sandbox's `denyRead` blocks",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["filesystem", "allowWrite"],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["ignoreViolations"],
+		reason: "hides the sandbox violations it names, so a blocked access stops being reported",
+		widens: (value) => isPlainRecord(value) ? Object.keys(value).length > 0 : value !== false
+	},
+	{
+		path: ["network", "allowAllUnixSockets"],
+		reason: "lets sandboxed commands connect to every Unix socket",
+		widens: (value) => value === true
+	},
+	{
+		path: ["network", "allowedDomains"],
+		reason: "pre-allows domains sandboxed commands may reach without a prompt",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["network", "allowLocalBinding"],
+		reason: "lets sandboxed commands bind local ports",
+		widens: (value) => value === true
+	},
+	{
+		path: ["network", "allowMachLookup"],
+		reason: "names the macOS services sandboxed commands may reach, and `*` means every service",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["network", "allowUnixSockets"],
+		reason: "names Unix sockets sandboxed commands may reach, and one such as `/var/run/docker.sock` is host access",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["network", "httpProxyPort"],
+		reason: "routes the sandbox's HTTP traffic through the port it names",
+		widens: () => true
+	},
+	{
+		path: ["network", "socksProxyPort"],
+		reason: "routes the sandbox's SOCKS traffic through the port it names",
+		widens: () => true
+	}
 ];
 /**
+* Warns once per authored `sandbox` path that loosens the sandbox. Nothing is
+* removed — the value is written, just not silently. Called on the filtered
+* `sandbox` so it never claims to be writing a path the scope filters dropped.
+*/
+function warnOnTrustAffectingSandboxPaths({ sandbox, relativeFilePath, logger }) {
+	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
+		const leaf = path.at(-1);
+		if (leaf === void 0) continue;
+		const parent = resolveSandboxParent({
+			root: sandbox,
+			segments: path.slice(0, -1)
+		});
+		if (parent === void 0) continue;
+		const value = parent[leaf];
+		if (value === void 0 || !widens(value)) continue;
+		logger?.warn(`Claude Code permissions: writing 'sandbox.${path.join(".")}' to ${relativeFilePath}; it ${reason}. Review the value as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+	}
+}
+/**
+* Copy of the authored `sandbox` override with the paths that name an
+* executable removed, warning once per dropped path.
+*/
+function stripCommandExecutingSandboxPaths({ sandbox, relativeFilePath, logger }) {
+	const filtered = structuredClone(sandbox);
+	for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) {
+		if (!deleteSandboxPath({
+			target: filtered,
+			path
+		})) continue;
+		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' names an executable Claude Code runs, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; set this path in ${relativeFilePath} by hand.`);
+	}
+	return filtered;
+}
+/**
 * Copy of the authored `sandbox` override with the user/managed-only paths
 * removed, warning once per dropped path. Only the override copy is filtered —
 * a value already hand-written in the target file is left untouched, matching
@@ -29473,24 +29783,10 @@ const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 function stripGlobalOnlySandboxPaths({ sandbox, relativeFilePath, logger }) {
 	const filtered = structuredClone(sandbox);
 	for (const path of CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS) {
-		const leaf = path.at(-1);
-		if (leaf === void 0) continue;
-		const parentPath = path.slice(0, -1);
-		let parent = filtered;
-		for (const segment of parentPath) {
-			const next = parent[segment];
-			if (!isPlainRecord(next)) {
-				parent = {};
-				break;
-			}
-			parent = next;
-		}
-		if (parent[leaf] === void 0) continue;
-		delete parent[leaf];
-		const [container] = parentPath;
-		if (container !== void 0 && isPlainRecord(filtered[container])) {
-			if (Object.keys(filtered[container]).length === 0) delete filtered[container];
-		}
+		if (!deleteSandboxPath({
+			target: filtered,
+			path
+		})) continue;
 		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
 	}
 	return filtered;
@@ -29546,6 +29842,215 @@ function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
 	else filtered.credentials = filteredCredentials;
 	return filtered;
 }
+/**
+* Top-level `.claude/settings.json` keys another feature owns, derived from
+* {@link SHARED_CONFIG_OWNERSHIP} rather than restated here so a feature that
+* starts owning a new key is excluded from the passthrough automatically
+* (today: `hooks`, from the hooks feature). Only `replace-owned-keys` entries
+* name keys; the `custom` policies on this file (`ignore`, `permissions`) own
+* entries *inside* `permissions`, which the passthrough excludes wholesale.
+*/
+const CLAUDECODE_FEATURE_OWNED_SETTINGS_KEYS = Object.entries(SHARED_CONFIG_OWNERSHIP[".claude/settings.json"]?.features ?? {}).flatMap(([feature, policy]) => feature !== "permissions" && policy.kind === "replace-owned-keys" ? policy.ownedKeys : []);
+/**
+* Top-level `.claude/settings.json` keys the generic `claudecode` override
+* passthrough must not carry. `permissions` and `sandbox` have their own merge
+* branches (the managed `allow`/`ask`/`deny` arrays and the scope filtering
+* respectively), `permission` is rulesync's own canonical tool-scoped block
+* rather than a settings key, `$schema` is an editor pointer rather than a
+* Claude Code setting, and the rest belong to the other features writing this
+* shared file.
+*/
+const CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS = /* @__PURE__ */ new Set([
+	"permission",
+	"permissions",
+	"sandbox",
+	"$schema",
+	...CLAUDECODE_FEATURE_OWNED_SETTINGS_KEYS
+]);
+/**
+* Top-level settings keys Claude Code reads only from user settings, managed
+* settings and the `--settings` CLI flag — the same restriction
+* `CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS` records for the `sandbox` subtree, and
+* the reason the passthrough drops them at project scope instead of committing
+* a setting that never applies. `rulesync generate --global` writes the user
+* settings file, so they are emitted there.
+*
+* Derived from the per-key **Scope** column of the settings reference: every
+* top-level key documented as `User or managed` or `User, local, or managed`.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_USER_SCOPE_ONLY_KEYS = /* @__PURE__ */ new Set([
+	"askUserQuestionTimeout",
+	"autoMode",
+	"dialogExpiry",
+	"enableArtifact",
+	"footerLinksRegexes",
+	"pluginConfigs",
+	"skipAutoPermissionPrompt",
+	"skipDangerousModePermissionPrompt",
+	"spellcheck",
+	"sshConfigs",
+	"syncClaudeAiSkills",
+	"useAutoModeDuringPlan",
+	"vimInsertModeRemaps"
+]);
+/**
+* Top-level settings keys neither file rulesync writes can honor, with the file
+* that does. `Managed` keys are read only from the settings file an organization
+* deploys, and `Global config` keys only from `~/.claude.json` — rulesync writes
+* `.claude/settings.json` and `~/.claude/settings.json`, so authoring either
+* kind through the override would produce a policy that silently never applies.
+*
+* Derived from the per-key **Scope** column of the settings reference.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_UNHONORED_KEY_SOURCES = {
+	allowAllClaudeAiMcps: "managed settings",
+	allowedChannelPlugins: "managed settings",
+	allowManagedHooksOnly: "managed settings",
+	allowManagedMcpServersOnly: "managed settings",
+	allowManagedPermissionRulesOnly: "managed settings",
+	autoConnectIde: "~/.claude.json",
+	autoInstallIdeExtension: "~/.claude.json",
+	blockedMarketplaces: "managed settings",
+	browserExternalPageTools: "managed settings",
+	channelsEnabled: "managed settings",
+	claudeMd: "managed settings",
+	diffTool: "~/.claude.json",
+	disableBrowserExternalNavigation: "managed settings",
+	disableCommandPluginSources: "managed settings",
+	disableMobileSimulatorTools: "managed settings",
+	disableSideloadFlags: "managed settings",
+	externalEditorContext: "~/.claude.json",
+	forceLoginGatewayUrl: "managed settings",
+	forceRemoteSettingsRefresh: "managed settings",
+	parentSettingsBehavior: "managed settings",
+	permissionExplainerEnabled: "~/.claude.json",
+	pluginSuggestionMarketplaces: "managed settings",
+	pluginTrustMessage: "managed settings",
+	requiredMaximumVersion: "managed settings",
+	requiredMinimumVersion: "managed settings",
+	sshHostAllowlist: "managed settings",
+	strictKnownMarketplaces: "managed settings",
+	strictPluginOnlyCustomization: "managed settings",
+	teammateDefaultModel: "~/.claude.json",
+	wslInheritsWindowsSettings: "managed settings"
+};
+/**
+* Top-level settings keys whose value Claude Code **executes**. The generic
+* passthrough refuses them outright rather than warning: `.rulesync/*` files
+* are shareable — `rulesync fetch` copies a third party's `permissions.jsonc`
+* straight into a project — and a file named for *restricting* what an agent
+* may do is not somewhere a reviewer looks for a command to run. Commands
+* belong in `.rulesync/hooks.jsonc` and `.rulesync/.mcp.json`, which are read
+* as executable by anyone reviewing them. Set these by hand in the settings
+* file if you need them.
+*
+* The value is the reason, spliced into the warning.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_COMMAND_EXECUTING_KEYS = {
+	apiKeyHelper: "runs the script it names to mint an API key",
+	awsAuthRefresh: "runs the command it names to refresh AWS credentials",
+	awsCredentialExport: "runs the command it names to export AWS credentials",
+	fileSuggestion: "runs its `command` on every `@` file completion",
+	gcpAuthRefresh: "runs the command it names to refresh Google Cloud credentials",
+	otelHeadersHelper: "runs the script it names to build OpenTelemetry headers",
+	policyHelper: "runs the executable it names to compute the managed settings",
+	processWrapper: "wraps every process Claude Code spawns",
+	statusLine: "runs its `command` on every status-line render",
+	subagentStatusLine: "runs its `command` on every subagent status row"
+};
+/**
+* Top-level settings keys the passthrough does write, but never silently: each
+* one widens what Claude Code trusts or where it sends data, so a value that
+* arrived with a fetched `.rulesync/permissions.jsonc` should be looked at
+* deliberately. Warning on write follows the precedent set for Warp's
+* `command_denylist`, which also replaces a protection when rulesync writes it.
+*
+* The value is the reason, spliced into the warning.
+*/
+const CLAUDECODE_TRUST_AFFECTING_KEYS = {
+	agent: "starts every session as the named subagent, with that subagent's prompt, tools and model",
+	allowedHttpHookUrls: "limits which URLs an HTTP hook may target, and an empty list means every URL",
+	allowedMcpServers: "allowlists the MCP servers that may be used, and entries from every settings file merge into one list, so an entry here widens an allowlist deployed elsewhere",
+	autoMode: "auto-approves shell commands with a classifier rather than with a prompt",
+	disableAllHooks: "controls whether hooks run at all",
+	disableSkillShellExecution: "re-opens the inline shell commands in a skill or custom command that a user setting had turned off",
+	enableAllProjectMcpServers: "auto-approves every server in the project `.mcp.json`",
+	enabledMcpjsonServers: "auto-approves the named servers in the project `.mcp.json`",
+	enabledPlugins: "enables plugins, which can ship their own hooks",
+	env: "sets environment variables for every process Claude Code spawns, so a value such as `NODE_OPTIONS` or `PATH` runs code and `ANTHROPIC_BASE_URL` redirects every prompt",
+	extraKnownMarketplaces: "registers plugin marketplace sources",
+	httpHookAllowedEnvVars: "controls which environment variables an HTTP hook may put in a request header, credentials included",
+	outputStyle: "replaces the system prompt every session runs with",
+	skipAutoPermissionPrompt: "removes the confirmation shown before auto-approval mode starts",
+	skipDangerousModePermissionPrompt: "removes the confirmation shown before the mode that skips every permission check starts"
+};
+/**
+* The keys from the table above that only widen at one particular value.
+* `disableSkillShellExecution: true` turns inline shell execution off, which
+* restricts; the `false` that turns it back on is what a fetched override could
+* use to undo a user setting, so only that value is warned about.
+*/
+const CLAUDECODE_TRUST_KEY_WIDENING_VALUES = { disableSkillShellExecution: (value) => value === false };
+/**
+* A key name is authored data that ends up in a log line, so strip the control
+* characters that would let it forge a line or hide the warnings beside it, and
+* cap the length.
+*/
+function displayKey(key) {
+	const stripped = stripControlCharacters(key);
+	return stripped.length > 80 ? `${stripped.slice(0, 80)}…` : stripped;
+}
+/**
+* Alternate spellings Claude Code accepts for a top-level settings key, mapped
+* to the canonical key whose **Scope** the alias inherits: "In any settings
+* file that accepts the canonical key, Claude Code reads the alias exactly as
+* it reads the canonical key." Resolving through this map before the scope
+* check keeps an alias from slipping past a restriction its canonical spelling
+* is caught by — `allowedMarketplaces` is `Managed`, like
+* `strictKnownMarketplaces`. Both aliases require Claude Code v2.1.232+.
+*
+* @see https://code.claude.com/docs/en/settings-reference#marketplace-key-aliases
+*/
+const CLAUDECODE_SETTINGS_KEY_ALIASES = {
+	additionalMarketplaces: "extraKnownMarketplaces",
+	allowedMarketplaces: "strictKnownMarketplaces"
+};
+/**
+* Copy of the authored top-level passthrough with the keys the target file
+* cannot honor removed, warning once per dropped key. Like
+* `stripGlobalOnlySandboxPaths`, only the override copy is filtered — a value
+* already hand-written in the target file is left untouched, which is why the
+* warning points at it.
+*/
+function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logger }) {
+	const filtered = {};
+	for (const [key, value] of Object.entries(overrides)) {
+		const shown = displayKey(key);
+		const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
+		if (Object.hasOwn(CLAUDECODE_COMMAND_EXECUTING_KEYS, canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' ${CLAUDECODE_COMMAND_EXECUTING_KEYS[canonicalKey]}, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; author commands in .rulesync/hooks.jsonc, or set this key in ${relativeFilePath} by hand.`);
+			continue;
+		}
+		if (Object.hasOwn(CLAUDECODE_UNHONORED_KEY_SOURCES, canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' is only honored in ${CLAUDECODE_UNHONORED_KEY_SOURCES[canonicalKey]}, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in that file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		if (!global && CLAUDECODE_USER_SCOPE_ONLY_KEYS.has(canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — Claude Code reads it from user, local or managed settings. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		const widensAtValue = CLAUDECODE_TRUST_KEY_WIDENING_VALUES[canonicalKey];
+		if (Object.hasOwn(CLAUDECODE_TRUST_AFFECTING_KEYS, canonicalKey) && (widensAtValue === void 0 || widensAtValue(value))) logger?.warn(`Claude Code permissions: writing '${shown}' to ${relativeFilePath}; it ${CLAUDECODE_TRUST_AFFECTING_KEYS[canonicalKey]}. Review the value as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+		filtered[key] = value;
+	}
+	return filtered;
+}
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -29616,7 +30121,13 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		});
 		const overridePermissions = config.claudecode?.permissions;
 		if (overridePermissions && typeof overridePermissions === "object") {
-			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			const { allow: _a, ask: _k, deny: _d, ...rest } = overridePermissions;
+			const nonListFields = Object.fromEntries(Object.entries(rest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
+			warnOnWideningPermissionFields({
+				fields: nonListFields,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
 			settings.permissions = {
 				...settings.permissions,
 				...nonListFields
@@ -29624,17 +30135,41 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
 		if (isPlainRecord(overrideSandbox)) {
-			const scopedSandbox = global ? overrideSandbox : stripProjectIgnoredMaskEntries({
+			const executableFreeSandbox = stripCommandExecutingSandboxPaths({
+				sandbox: overrideSandbox,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
+			const scopedSandbox = global ? executableFreeSandbox : stripProjectIgnoredMaskEntries({
 				sandbox: stripGlobalOnlySandboxPaths({
-					sandbox: overrideSandbox,
+					sandbox: executableFreeSandbox,
 					relativeFilePath: paths.relativeFilePath,
 					logger
 				}),
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
+			warnOnTrustAffectingSandboxPaths({
+				sandbox: scopedSandbox,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
 			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
+		const overrideTopLevel = {};
+		for (const [key, value] of Object.entries(config.claudecode ?? {})) {
+			if (CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS.has(key)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (value === void 0) continue;
+			overrideTopLevel[key] = value;
+		}
+		const scopedTopLevel = stripUnhonoredTopLevelKeys({
+			overrides: overrideTopLevel,
+			global,
+			relativeFilePath: paths.relativeFilePath,
+			logger
+		});
+		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
 		const managedToolNames = managedClaudeToolNames(config);
 		const merged = applyPermissions({
 			settings,
@@ -29667,12 +30202,33 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		const { allow: _a, ask: _k, deny: _d, ...permissionsRest } = permissions;
+		const nonListFields = Object.fromEntries(Object.entries(permissionsRest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
 		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		const { sandbox } = settings;
-		if (isPlainRecord(sandbox) && Object.keys(sandbox).length > 0) config.claudecode = {
+		if (isPlainRecord(sandbox)) {
+			const importedSandbox = structuredClone(sandbox);
+			for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) deleteSandboxPath({
+				target: importedSandbox,
+				path
+			});
+			if (Object.keys(importedSandbox).length > 0) config.claudecode = {
+				...config.claudecode,
+				sandbox: importedSandbox
+			};
+		}
+		const topLevelPassthrough = {};
+		for (const [key, value] of Object.entries(settings)) {
+			if (CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS.has(key)) continue;
+			const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
+			if (Object.hasOwn(CLAUDECODE_COMMAND_EXECUTING_KEYS, canonicalKey)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (value === void 0) continue;
+			topLevelPassthrough[key] = value;
+		}
+		if (Object.keys(topLevelPassthrough).length > 0) config.claudecode = {
 			...config.claudecode,
-			sandbox
+			...topLevelPassthrough
 		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
@@ -33532,7 +34088,7 @@ function extractKiroOverride(toolsSettings) {
 	if (Object.keys(overrideToolsSettings).length === 0) return void 0;
 	return { toolsSettings: overrideToolsSettings };
 }
-function asStringArray(value) {
+function asStringArray$1(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 /**
@@ -33542,8 +34098,8 @@ function asStringArray(value) {
 */
 function rulesFromArrays(settings, allowKey, denyKey) {
 	const rules = {};
-	for (const pattern of asStringArray(settings[allowKey])) rules[pattern] = "allow";
-	for (const pattern of asStringArray(settings[denyKey])) rules[pattern] = "deny";
+	for (const pattern of asStringArray$1(settings[allowKey])) rules[pattern] = "allow";
+	for (const pattern of asStringArray$1(settings[denyKey])) rules[pattern] = "deny";
 	return rules;
 }
 //#endregion
@@ -36455,6 +37011,181 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 	}
 };
 //#endregion
+//#region src/constants/zoocode-paths.ts
+/**
+* Zoo Code is a VS Code extension, so its committable command allow/deny lists
+* are workspace settings rather than files in the `.roo/` agent-asset tree that
+* the other Zoo Code features write.
+*
+* `zoo-code.allowedCommands` / `zoo-code.deniedCommands` are contributed with no
+* `scope`, which in VS Code means `window` scope — settable in a workspace's
+* `.vscode/settings.json` — and `ClineProvider.mergeCommandLists()` unions the
+* workspace values into the effective auto-approval lists.
+*
+* The `zoo-code.*` namespace is Zoo-era (the v3.74.0 rebrand); the archived Roo
+* Code lineage spelled the same settings `roo-cline.*`, so this surface is
+* deliberately not shared with the `roo` target.
+*
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/package.json
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/core/webview/ClineProvider.ts
+*/
+const ZOOCODE_VSCODE_SETTINGS_DIR = ".vscode";
+const ZOOCODE_VSCODE_SETTINGS_FILE_NAME = "settings.json";
+const ZOOCODE_ALLOWED_COMMANDS_KEY = "zoo-code.allowedCommands";
+const ZOOCODE_DENIED_COMMANDS_KEY = "zoo-code.deniedCommands";
+//#endregion
+//#region src/features/permissions/zoocode-permissions.ts
+/**
+* The canonical category Zoo Code's command lists correspond to. Zoo Code gates
+* terminal command execution and nothing else through these settings, so only
+* `bash` maps; `read`/`write`/`edit`/`webfetch` have no workspace-settable
+* counterpart in the extension's contributions.
+*/
+const COMMAND_CATEGORY = "bash";
+function asStringArray(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((entry) => typeof entry === "string");
+}
+/**
+* Split one canonical category's rules into Zoo Code's two command lists.
+*
+* Zoo Code matches these entries as command **prefixes**: a command runs
+* without a confirmation prompt when it starts with an `allowedCommands` entry,
+* and is refused outright when it starts with a `deniedCommands` entry (deny
+* wins). `ask` is represented by listing the pattern in neither list, which
+* leaves Zoo Code's default approval prompt in charge.
+*
+* Each list is `undefined` when it would be empty, so the key is retracted from
+* the settings file rather than written as an empty array — an empty
+* `allowedCommands` and an absent one mean the same thing to Zoo Code, and the
+* absent form leaves no rulesync residue behind.
+*/
+function buildCommandLists(rules) {
+	const allowed = [];
+	const denied = [];
+	for (const [pattern, action] of Object.entries(rules)) if (action === "allow") allowed.push(pattern);
+	else if (action === "deny") denied.push(pattern);
+	return {
+		allowed: allowed.length > 0 ? allowed : void 0,
+		denied: denied.length > 0 ? denied : void 0
+	};
+}
+/**
+* Permissions generator for Zoo Code.
+*
+* Zoo Code has no policy file in its `.roo/` tree: the committable command
+* allow/deny lists are VS Code workspace settings
+* (`zoo-code.allowedCommands` / `zoo-code.deniedCommands` in
+* `.vscode/settings.json`), which `ClineProvider.mergeCommandLists()` unions
+* into the lists the auto-approval decision reads. That file is a
+* general-purpose workspace settings file with many unrelated keys, so reads
+* and writes merge into the existing JSONC (touching only the two managed keys)
+* and the file is never deleted.
+*
+* Only project scope is modeled: VS Code's user-scope `settings.json` lives at
+* a platform-dependent path outside rulesync's home-relative global model.
+*
+* The `roo` target deliberately does not get this adapter. The settings
+* namespace is Zoo-era (`roo-cline.*` before the v3.74.0 rebrand), and Roo Code
+* is EOL with its repository archived, so emitting `zoo-code.*` keys for a
+* `--targets roo` generate would write settings that Roo itself never reads.
+*
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/package.json
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/core/auto-approval/commands.ts
+*/
+var ZoocodePermissions = class ZoocodePermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	/**
+	* `.vscode/settings.json` is a user-managed workspace file with unrelated
+	* settings, so it must not be deleted.
+	*/
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: ZOOCODE_VSCODE_SETTINGS_DIR,
+			relativeFilePath: ZOOCODE_VSCODE_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+		const paths = ZoocodePermissions.getSettablePaths();
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new ZoocodePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions }) {
+		const paths = ZoocodePermissions.getSettablePaths();
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const rules = rulesyncPermissions.getJson().permission[COMMAND_CATEGORY];
+		const patch = {};
+		if (rules !== void 0) {
+			const { allowed, denied } = buildCommandLists(rules);
+			patch[ZOOCODE_ALLOWED_COMMANDS_KEY] = allowed;
+			patch[ZOOCODE_DENIED_COMMANDS_KEY] = denied;
+		}
+		return new ZoocodePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
+			validate: true
+		});
+	}
+	toRulesyncPermissions() {
+		let settings;
+		try {
+			settings = parseSharedConfig({
+				format: "jsonc",
+				fileContent: this.getFileContent() || "{}",
+				filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath()),
+				invalidRootPolicy: "error",
+				jsoncParseErrors: "error"
+			});
+		} catch (error) {
+			throw new Error(`Failed to parse Zoo Code VS Code settings in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+		}
+		const rules = {};
+		for (const pattern of asStringArray(settings[ZOOCODE_ALLOWED_COMMANDS_KEY])) rules[pattern] = "allow";
+		for (const pattern of asStringArray(settings[ZOOCODE_DENIED_COMMANDS_KEY])) rules[pattern] = "deny";
+		const permission = {};
+		if (Object.keys(rules).length > 0) permission[COMMAND_CATEGORY] = rules;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new ZoocodePermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/permissions/permissions-processor.ts
 const PermissionsProcessorToolTargetSchema = zod_mini.z.enum(permissionsProcessorToolTargetTuple);
 const toolPermissionsFactories = /* @__PURE__ */ new Map([
@@ -36697,6 +37428,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true,
 			supportsImport: true
 		}
+	}],
+	["zoocode", {
+		class: ZoocodePermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: false,
+			supportsImport: true
+		}
 	}]
 ]);
 var PermissionsProcessor = class extends FeatureProcessor {
@@ -52076,11 +52815,12 @@ var RooRule = class RooRule extends ToolRule {
 	static getSettablePaths(_options = {}) {
 		return { nonRoot: { relativeDirPath: buildToolPath(ROO_DIR, "rules", _options.excludeToolDir) } };
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
-		const fileContent = await readFileContent((0, node_path.join)(outputRoot, this.getSettablePaths().nonRoot.relativeDirPath, relativeFilePath));
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, relativeDirPath: overrideDirPath, validate = true }) {
+		const relativeDirPath = overrideDirPath !== void 0 && RooRule.extractModeFromDirPath(overrideDirPath) !== void 0 ? overrideDirPath : this.getSettablePaths().nonRoot.relativeDirPath;
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath));
 		return new RooRule({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().nonRoot.relativeDirPath,
+			relativeDirPath,
 			relativeFilePath,
 			fileContent,
 			validate,
@@ -52088,12 +52828,16 @@ var RooRule = class RooRule extends ToolRule {
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
-		return new RooRule(this.buildToolRuleParamsDefault({
+		const params = this.buildToolRuleParamsDefault({
 			outputRoot,
 			rulesyncRule,
 			validate,
 			nonRootPath: this.getSettablePaths().nonRoot
-		}));
+		});
+		const mode = rulesyncRule.getFrontmatter().roo?.mode;
+		if (!params.root && mode !== void 0 && mode !== "") if (!ROO_MODE_SLUG_PATTERN.test(mode)) warnWithFallback(void 0, `Ignoring roo.mode "${mode}" on ${rulesyncRule.getRelativeFilePath()}: a mode slug may contain only letters, digits and hyphens. Writing the rule to ${params.relativeDirPath} instead.`);
+		else params.relativeDirPath = (0, node_path.join)((0, node_path.dirname)(params.relativeDirPath), rooModeRulesDirName(mode));
+		return new RooRule(params);
 	}
 	/**
 	* Extract mode slug from file path for mode-specific rules
@@ -52105,8 +52849,51 @@ var RooRule = class RooRule extends ToolRule {
 		const singleFileMatch = filePath.match(/\.(roo|cline)rules-([a-zA-Z0-9-]+)$/);
 		if (singleFileMatch) return singleFileMatch[2];
 	}
+	/**
+	* The mode slug of a `.roo/rules-{mode}/` directory, or `undefined` for the
+	* generic `.roo/rules/` directory and anything else. Path-shaped input is
+	* rejected by the slug pattern, so a crafted directory name cannot be lifted
+	* back into frontmatter.
+	*/
+	static extractModeFromDirPath(relativeDirPath) {
+		for (const segment of toPosixPath(relativeDirPath).split("/")) {
+			if (!segment.startsWith("rules-")) continue;
+			const mode = segment.slice(6);
+			if (ROO_MODE_SLUG_PATTERN.test(mode)) return mode;
+		}
+	}
 	toRulesyncRule() {
-		return this.toRulesyncRuleDefault();
+		const mode = RooRule.extractModeFromDirPath(this.getRelativeDirPath());
+		if (mode === void 0) return this.toRulesyncRuleDefault();
+		const baseName = this.getRelativeFilePath().replace(/\.md$/, "");
+		const suffix = `-${mode}`;
+		const importedName = baseName.endsWith(suffix) ? baseName : `${baseName}${suffix}`;
+		return new RulesyncRule({
+			outputRoot: this.getOutputRoot(),
+			relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
+			relativeFilePath: `${importedName}.md`,
+			frontmatter: {
+				root: false,
+				targets: [this.constructor.getToolTargetName()],
+				description: this.description,
+				globs: this.globs ?? [],
+				roo: { mode }
+			},
+			body: this.getFileContent(),
+			validate: true
+		});
+	}
+	/**
+	* Mode-specific rule directories (`.roo/rules-{mode}/`), which Roo/Zoo Code
+	* load instead of `.roo/rules/` while that mode is active. Import-only: the
+	* generic directory is the only one the deletion sweep enumerates, because a
+	* `rules-*` glob would also match mode rules a user wrote by hand.
+	*/
+	static getNestedFilePatterns({ outputRoot }) {
+		return {
+			include: [`${toPosixPath(outputRoot)}/${toPosixPath(ROO_DIR)}/rules-*/**/*.md`],
+			ignore: []
+		};
 	}
 	validate() {
 		return {
@@ -52127,10 +52914,18 @@ var RooRule = class RooRule extends ToolRule {
 	static isTargetedByRulesyncRule(rulesyncRule) {
 		return this.isTargetedByRulesyncRuleDefault({
 			rulesyncRule,
-			toolTarget: "roo"
+			toolTarget: this.getToolTargetName()
 		});
 	}
 	/**
+	* The tool target this class imports as. `ZoocodeRule` narrows the same
+	* `.roo/` adapters to the `zoocode` target, so the name has to come from the
+	* class rather than a literal.
+	*/
+	static getToolTargetName() {
+		return "roo";
+	}
+	/**
 	* Glob for the `separate-local-file` deletion; Roo reads `AGENTS.local.md`
 	* at the project root, not under `.roo/` (mirrors rovodev).
 	*/
@@ -52663,11 +53458,8 @@ var ZedRule = class ZedRule extends ToolRule {
 * @see https://docs.zoocode.dev
 */
 var ZoocodeRule = class extends RooRule {
-	static isTargetedByRulesyncRule(rulesyncRule) {
-		return this.isTargetedByRulesyncRuleDefault({
-			rulesyncRule,
-			toolTarget: "zoocode"
-		});
+	static getToolTargetName() {
+		return "zoocode";
 	}
 };
 //#endregion
@@ -56324,6 +57116,12 @@ Object.defineProperty(exports, "stringifyFrontmatter", {
 		return stringifyFrontmatter;
 	}
 });
+Object.defineProperty(exports, "stripControlCharacters", {
+	enumerable: true,
+	get: function() {
+		return stripControlCharacters;
+	}
+});
 Object.defineProperty(exports, "toPosixPath", {
 	enumerable: true,
 	get: function() {