rulesync 16.14.0 → 16.15.0

package/dist/{import-DsiSzsJH.cjs → import-nfDFI5X1.cjs}

@@ -4422,11 +4422,26 @@ const KiloPermissionsOverrideSchema = zod_mini.z.looseObject({
 * rather than which commands are permitted — so it is a loose passthrough on
 * the same terms, merged into the top level of `.claude/settings.json`.
 *
+* Any other key is a plain top-level `settings.json` key (`editorMode`, `env`,
+* `model`, ...), deep-merged into the generated file verbatim so settings
+* Claude Code adds faster than an allowlist can track stay authorable.
+* The exceptions are the keys another feature owns (`hooks`) and `$schema`.
+* Keys the target file cannot honor — `Managed`-only and `~/.claude.json`-only
+* keys in either scope, plus user-scope keys at project scope — are dropped
+* with a warning rather than written where they would never apply. So are the
+* keys whose value is a command Claude Code executes (`apiKeyHelper`,
+* `statusLine`, ...): this file is shareable via `rulesync fetch`, and a file
+* named for restricting things is not where a command belongs — author those
+* in `.rulesync/hooks.jsonc` instead.
+*
 * @example
 * { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
 * @example
 * { "sandbox": { "network": { "allowedDomains": ["example.com"], "strictAllowlist": true } } }
+* @example
+* { "editorMode": "vim", "env": { "MY_VAR": "1" } }
 * @see https://code.claude.com/docs/en/sandboxing
+* @see https://code.claude.com/docs/en/settings-reference
 */
 const ClaudecodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -5101,6 +5116,15 @@ const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	sandbox_workspace_write: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	apps: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	approvals_reviewer: zod_mini.z.optional(zod_mini.z.union([CodexApprovalsReviewerSchema, zod_mini.z.looseObject({})])),
+	/**
+	* The `[tui]` table of `config.toml` (e.g. `vim_mode_default`, `keymap.*`).
+	* Not a permission surface, but like `apps` it is a top-level table with no
+	* canonical category, and Codex adds keys to it faster than an explicit model
+	* could track — so it is a loose passthrough written verbatim.
+	*
+	* @see https://developers.openai.com/codex/config-reference
+	*/
+	tui: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	git_write_rules: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
@@ -7488,7 +7512,8 @@ const CODEXCLI_OVERRIDE_KEYS = [
 	"sandbox_mode",
 	"sandbox_workspace_write",
 	"apps",
-	"approvals_reviewer"
+	"approvals_reviewer",
+	"tui"
 ];
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
@@ -29405,6 +29430,27 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	return { permission };
 }
 //#endregion
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
+* line and paragraph separators, and the plain LRM/RLM marks. A name or value
+* copied out of an untrusted config file, a fetched repository, or a tool's own
+* settings file must never reach the terminal with these intact: they let the
+* text forge log lines, reorder what is printed around them, or inject escape
+* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
+* neutral characters beside them, so they go too — a diagnostic line is not the
+* place to preserve the typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+//#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Claude Code tool names (PascalCase).
@@ -29489,8 +29535,9 @@ function deepMergeRecords(base, patch) {
 * emits them only under `--global`.
 *
 * Deliberately NOT listed:
-* - `bwrapPath` / `socatPath`: v2.1.232 added them to the managed-settings
-*   approval dialog, which is a consent prompt, not a project-scope rejection.
+* - `ripgrep` / `bwrapPath` / `socatPath`: each names an executable, so
+*   `stripCommandExecutingSandboxPaths` refuses them in both scopes rather than
+*   emitting them under `--global`.
 * - `credentials.envVars` / `credentials.files`: the ignored-at-project-scope
 *   unit is the individual entry's mode, not the settings key, and the same
 *   lists carry `deny` entries that project settings *do* honor — dropping a
@@ -29498,7 +29545,6 @@ function deepMergeRecords(base, patch) {
 *   filters those lists per entry instead.
 *
 * @see https://code.claude.com/docs/en/sandboxing
-* @see https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md — v2.1.232 scoped `sandbox.ripgrep`
 */
 const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["filesystem", "disabled"],
@@ -29507,10 +29553,228 @@ const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["credentials", "allowPlaintextInject"],
 	["credentials", "awsPairs"],
 	["credentials", "sigv4"],
-	["allowAppleEvents"],
-	["ripgrep"]
+	["allowAppleEvents"]
+];
+/**
+* Walks `segments` from `root`, returning the record they name or `undefined` if
+* any step is missing or not a record. Shared by everything below that addresses
+* a `sandbox` path, so a nested path added to one of the tables is actually
+* traversed rather than silently skipped.
+*/
+function resolveSandboxParent({ root, segments }) {
+	let parent = root;
+	for (const segment of segments) {
+		const next = parent[segment];
+		if (!isPlainRecord(next)) return void 0;
+		parent = next;
+	}
+	return parent;
+}
+/**
+* Deletes `path` from `target` in place and reports whether anything was there,
+* dropping a container the removal emptied so no `"network": {}` noise is left
+* behind.
+*/
+function deleteSandboxPath({ target, path }) {
+	const leaf = path.at(-1);
+	if (leaf === void 0) return false;
+	const parentPath = path.slice(0, -1);
+	const parent = resolveSandboxParent({
+		root: target,
+		segments: parentPath
+	});
+	if (parent === void 0 || parent[leaf] === void 0) return false;
+	delete parent[leaf];
+	for (let depth = parentPath.length; depth > 0; depth--) {
+		const container = resolveSandboxParent({
+			root: target,
+			segments: parentPath.slice(0, depth)
+		});
+		if (container === void 0 || Object.keys(container).length > 0) break;
+		const holder = resolveSandboxParent({
+			root: target,
+			segments: parentPath.slice(0, depth - 1)
+		});
+		const name = parentPath[depth - 1];
+		if (holder === void 0 || name === void 0) break;
+		delete holder[name];
+	}
+	return true;
+}
+/**
+* The `permissions.defaultMode` values that start a session with fewer prompts
+* than the default. `plan` and `default` are absent because they do not widen
+* anything.
+*/
+const CLAUDECODE_WIDENING_DEFAULT_MODES = {
+	acceptEdits: "every file edit is then applied without a prompt",
+	auto: "shell commands are then auto-approved by a classifier rather than by you",
+	bypassPermissions: "every session then starts with no permission prompts at all"
+};
+/**
+* The `permissions` fields that widen rather than restrict: a `defaultMode` that
+* removes prompts, and `additionalDirectories`, which moves the
+* working-directory boundary. Warned for the same reason `disableAllHooks` is: a
+* shareable permissions file should not loosen the permission system quietly.
+*/
+function warnOnWideningPermissionFields({ fields, relativeFilePath, logger }) {
+	const defaultMode = fields.defaultMode;
+	if (typeof defaultMode === "string" && Object.hasOwn(CLAUDECODE_WIDENING_DEFAULT_MODES, defaultMode)) logger?.warn(`Claude Code permissions: writing 'permissions.defaultMode: "${defaultMode}"' to ${relativeFilePath}; ${CLAUDECODE_WIDENING_DEFAULT_MODES[defaultMode]}. Review it as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+	const additionalDirectories = fields.additionalDirectories;
+	if (additionalDirectories !== void 0 && !(Array.isArray(additionalDirectories) && additionalDirectories.length === 0)) logger?.warn(`Claude Code permissions: writing 'permissions.additionalDirectories' to ${relativeFilePath}; it moves the boundary of what Claude Code may read and edit outside the project. Review the paths, especially if this permissions file came from 'rulesync fetch'.`);
+}
+/**
+* `sandbox` paths whose value names a binary Claude Code runs. `sandbox` has its
+* own merge branch, so the top-level refusal in `stripUnhonoredTopLevelKeys`
+* never sees them — they are refused here on the same grounds, in both scopes:
+* a fetched `.rulesync/permissions.jsonc` must not be able to point Claude Code
+* at an executable of its choosing.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+*/
+const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
+	["ripgrep"],
+	["bwrapPath"],
+	["socatPath"]
+];
+/**
+* `sandbox` paths that loosen the sandbox rather than naming something to run:
+* they let commands out of it, weaken the isolation it provides, or redirect
+* where its traffic goes. They are written like `env` is — the ordinary uses are
+* too common to refuse — but never silently, because a fetched override should
+* not be able to open the sandbox without saying so. `widens` keeps the warning
+* to the value that actually loosens the policy, so authoring the restrictive
+* value (`allowUnsandboxedCommands: false`, an empty `excludedCommands`) stays
+* quiet. The `allow*` lists are here for a structural reason: Claude Code merges
+* a list across every settings scope rather than replacing it, so a project file
+* can only ever add to them. Their counterparts — `denyRead`, `denyWrite`,
+* `deniedDomains` — merge the same way, but adding to a deny list only ever
+* narrows the policy, so they are absent.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+*/
+const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["allowAppleEvents"],
+		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
+		widens: (value) => value === true
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "controls whether Claude may retry a blocked command outside the sandbox",
+		widens: (value) => value !== false
+	},
+	{
+		path: ["autoAllowBashIfSandboxed"],
+		reason: "controls whether every Bash command the sandbox accepts runs without a prompt",
+		widens: (value) => value !== false
+	},
+	{
+		path: ["enableWeakerNestedSandbox"],
+		reason: "runs the Linux sandbox inside an unprivileged container, which weakens it",
+		widens: (value) => value === true
+	},
+	{
+		path: ["enableWeakerNetworkIsolation"],
+		reason: "weakens the sandbox's network isolation on macOS",
+		widens: (value) => value === true
+	},
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox on, and sandboxed Bash commands then run without a permission prompt unless `autoAllowBashIfSandboxed` is false",
+		widens: (value) => value === true
+	},
+	{
+		path: ["excludedCommands"],
+		reason: "names commands that always run outside the sandbox, with no sandbox policy applied",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["filesystem", "allowRead"],
+		reason: "re-opens reading inside a region the sandbox's `denyRead` blocks",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["filesystem", "allowWrite"],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["ignoreViolations"],
+		reason: "hides the sandbox violations it names, so a blocked access stops being reported",
+		widens: (value) => isPlainRecord(value) ? Object.keys(value).length > 0 : value !== false
+	},
+	{
+		path: ["network", "allowAllUnixSockets"],
+		reason: "lets sandboxed commands connect to every Unix socket",
+		widens: (value) => value === true
+	},
+	{
+		path: ["network", "allowedDomains"],
+		reason: "pre-allows domains sandboxed commands may reach without a prompt",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["network", "allowLocalBinding"],
+		reason: "lets sandboxed commands bind local ports",
+		widens: (value) => value === true
+	},
+	{
+		path: ["network", "allowMachLookup"],
+		reason: "names the macOS services sandboxed commands may reach, and `*` means every service",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["network", "allowUnixSockets"],
+		reason: "names Unix sockets sandboxed commands may reach, and one such as `/var/run/docker.sock` is host access",
+		widens: (value) => !Array.isArray(value) || value.length > 0
+	},
+	{
+		path: ["network", "httpProxyPort"],
+		reason: "routes the sandbox's HTTP traffic through the port it names",
+		widens: () => true
+	},
+	{
+		path: ["network", "socksProxyPort"],
+		reason: "routes the sandbox's SOCKS traffic through the port it names",
+		widens: () => true
+	}
 ];
 /**
+* Warns once per authored `sandbox` path that loosens the sandbox. Nothing is
+* removed — the value is written, just not silently. Called on the filtered
+* `sandbox` so it never claims to be writing a path the scope filters dropped.
+*/
+function warnOnTrustAffectingSandboxPaths({ sandbox, relativeFilePath, logger }) {
+	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
+		const leaf = path.at(-1);
+		if (leaf === void 0) continue;
+		const parent = resolveSandboxParent({
+			root: sandbox,
+			segments: path.slice(0, -1)
+		});
+		if (parent === void 0) continue;
+		const value = parent[leaf];
+		if (value === void 0 || !widens(value)) continue;
+		logger?.warn(`Claude Code permissions: writing 'sandbox.${path.join(".")}' to ${relativeFilePath}; it ${reason}. Review the value as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+	}
+}
+/**
+* Copy of the authored `sandbox` override with the paths that name an
+* executable removed, warning once per dropped path.
+*/
+function stripCommandExecutingSandboxPaths({ sandbox, relativeFilePath, logger }) {
+	const filtered = structuredClone(sandbox);
+	for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) {
+		if (!deleteSandboxPath({
+			target: filtered,
+			path
+		})) continue;
+		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' names an executable Claude Code runs, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; set this path in ${relativeFilePath} by hand.`);
+	}
+	return filtered;
+}
+/**
 * Copy of the authored `sandbox` override with the user/managed-only paths
 * removed, warning once per dropped path. Only the override copy is filtered —
 * a value already hand-written in the target file is left untouched, matching
@@ -29519,24 +29783,10 @@ const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 function stripGlobalOnlySandboxPaths({ sandbox, relativeFilePath, logger }) {
 	const filtered = structuredClone(sandbox);
 	for (const path of CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS) {
-		const leaf = path.at(-1);
-		if (leaf === void 0) continue;
-		const parentPath = path.slice(0, -1);
-		let parent = filtered;
-		for (const segment of parentPath) {
-			const next = parent[segment];
-			if (!isPlainRecord(next)) {
-				parent = {};
-				break;
-			}
-			parent = next;
-		}
-		if (parent[leaf] === void 0) continue;
-		delete parent[leaf];
-		const [container] = parentPath;
-		if (container !== void 0 && isPlainRecord(filtered[container])) {
-			if (Object.keys(filtered[container]).length === 0) delete filtered[container];
-		}
+		if (!deleteSandboxPath({
+			target: filtered,
+			path
+		})) continue;
 		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
 	}
 	return filtered;
@@ -29592,6 +29842,215 @@ function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
 	else filtered.credentials = filteredCredentials;
 	return filtered;
 }
+/**
+* Top-level `.claude/settings.json` keys another feature owns, derived from
+* {@link SHARED_CONFIG_OWNERSHIP} rather than restated here so a feature that
+* starts owning a new key is excluded from the passthrough automatically
+* (today: `hooks`, from the hooks feature). Only `replace-owned-keys` entries
+* name keys; the `custom` policies on this file (`ignore`, `permissions`) own
+* entries *inside* `permissions`, which the passthrough excludes wholesale.
+*/
+const CLAUDECODE_FEATURE_OWNED_SETTINGS_KEYS = Object.entries(SHARED_CONFIG_OWNERSHIP[".claude/settings.json"]?.features ?? {}).flatMap(([feature, policy]) => feature !== "permissions" && policy.kind === "replace-owned-keys" ? policy.ownedKeys : []);
+/**
+* Top-level `.claude/settings.json` keys the generic `claudecode` override
+* passthrough must not carry. `permissions` and `sandbox` have their own merge
+* branches (the managed `allow`/`ask`/`deny` arrays and the scope filtering
+* respectively), `permission` is rulesync's own canonical tool-scoped block
+* rather than a settings key, `$schema` is an editor pointer rather than a
+* Claude Code setting, and the rest belong to the other features writing this
+* shared file.
+*/
+const CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS = /* @__PURE__ */ new Set([
+	"permission",
+	"permissions",
+	"sandbox",
+	"$schema",
+	...CLAUDECODE_FEATURE_OWNED_SETTINGS_KEYS
+]);
+/**
+* Top-level settings keys Claude Code reads only from user settings, managed
+* settings and the `--settings` CLI flag — the same restriction
+* `CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS` records for the `sandbox` subtree, and
+* the reason the passthrough drops them at project scope instead of committing
+* a setting that never applies. `rulesync generate --global` writes the user
+* settings file, so they are emitted there.
+*
+* Derived from the per-key **Scope** column of the settings reference: every
+* top-level key documented as `User or managed` or `User, local, or managed`.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_USER_SCOPE_ONLY_KEYS = /* @__PURE__ */ new Set([
+	"askUserQuestionTimeout",
+	"autoMode",
+	"dialogExpiry",
+	"enableArtifact",
+	"footerLinksRegexes",
+	"pluginConfigs",
+	"skipAutoPermissionPrompt",
+	"skipDangerousModePermissionPrompt",
+	"spellcheck",
+	"sshConfigs",
+	"syncClaudeAiSkills",
+	"useAutoModeDuringPlan",
+	"vimInsertModeRemaps"
+]);
+/**
+* Top-level settings keys neither file rulesync writes can honor, with the file
+* that does. `Managed` keys are read only from the settings file an organization
+* deploys, and `Global config` keys only from `~/.claude.json` — rulesync writes
+* `.claude/settings.json` and `~/.claude/settings.json`, so authoring either
+* kind through the override would produce a policy that silently never applies.
+*
+* Derived from the per-key **Scope** column of the settings reference.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_UNHONORED_KEY_SOURCES = {
+	allowAllClaudeAiMcps: "managed settings",
+	allowedChannelPlugins: "managed settings",
+	allowManagedHooksOnly: "managed settings",
+	allowManagedMcpServersOnly: "managed settings",
+	allowManagedPermissionRulesOnly: "managed settings",
+	autoConnectIde: "~/.claude.json",
+	autoInstallIdeExtension: "~/.claude.json",
+	blockedMarketplaces: "managed settings",
+	browserExternalPageTools: "managed settings",
+	channelsEnabled: "managed settings",
+	claudeMd: "managed settings",
+	diffTool: "~/.claude.json",
+	disableBrowserExternalNavigation: "managed settings",
+	disableCommandPluginSources: "managed settings",
+	disableMobileSimulatorTools: "managed settings",
+	disableSideloadFlags: "managed settings",
+	externalEditorContext: "~/.claude.json",
+	forceLoginGatewayUrl: "managed settings",
+	forceRemoteSettingsRefresh: "managed settings",
+	parentSettingsBehavior: "managed settings",
+	permissionExplainerEnabled: "~/.claude.json",
+	pluginSuggestionMarketplaces: "managed settings",
+	pluginTrustMessage: "managed settings",
+	requiredMaximumVersion: "managed settings",
+	requiredMinimumVersion: "managed settings",
+	sshHostAllowlist: "managed settings",
+	strictKnownMarketplaces: "managed settings",
+	strictPluginOnlyCustomization: "managed settings",
+	teammateDefaultModel: "~/.claude.json",
+	wslInheritsWindowsSettings: "managed settings"
+};
+/**
+* Top-level settings keys whose value Claude Code **executes**. The generic
+* passthrough refuses them outright rather than warning: `.rulesync/*` files
+* are shareable — `rulesync fetch` copies a third party's `permissions.jsonc`
+* straight into a project — and a file named for *restricting* what an agent
+* may do is not somewhere a reviewer looks for a command to run. Commands
+* belong in `.rulesync/hooks.jsonc` and `.rulesync/.mcp.json`, which are read
+* as executable by anyone reviewing them. Set these by hand in the settings
+* file if you need them.
+*
+* The value is the reason, spliced into the warning.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_COMMAND_EXECUTING_KEYS = {
+	apiKeyHelper: "runs the script it names to mint an API key",
+	awsAuthRefresh: "runs the command it names to refresh AWS credentials",
+	awsCredentialExport: "runs the command it names to export AWS credentials",
+	fileSuggestion: "runs its `command` on every `@` file completion",
+	gcpAuthRefresh: "runs the command it names to refresh Google Cloud credentials",
+	otelHeadersHelper: "runs the script it names to build OpenTelemetry headers",
+	policyHelper: "runs the executable it names to compute the managed settings",
+	processWrapper: "wraps every process Claude Code spawns",
+	statusLine: "runs its `command` on every status-line render",
+	subagentStatusLine: "runs its `command` on every subagent status row"
+};
+/**
+* Top-level settings keys the passthrough does write, but never silently: each
+* one widens what Claude Code trusts or where it sends data, so a value that
+* arrived with a fetched `.rulesync/permissions.jsonc` should be looked at
+* deliberately. Warning on write follows the precedent set for Warp's
+* `command_denylist`, which also replaces a protection when rulesync writes it.
+*
+* The value is the reason, spliced into the warning.
+*/
+const CLAUDECODE_TRUST_AFFECTING_KEYS = {
+	agent: "starts every session as the named subagent, with that subagent's prompt, tools and model",
+	allowedHttpHookUrls: "limits which URLs an HTTP hook may target, and an empty list means every URL",
+	allowedMcpServers: "allowlists the MCP servers that may be used, and entries from every settings file merge into one list, so an entry here widens an allowlist deployed elsewhere",
+	autoMode: "auto-approves shell commands with a classifier rather than with a prompt",
+	disableAllHooks: "controls whether hooks run at all",
+	disableSkillShellExecution: "re-opens the inline shell commands in a skill or custom command that a user setting had turned off",
+	enableAllProjectMcpServers: "auto-approves every server in the project `.mcp.json`",
+	enabledMcpjsonServers: "auto-approves the named servers in the project `.mcp.json`",
+	enabledPlugins: "enables plugins, which can ship their own hooks",
+	env: "sets environment variables for every process Claude Code spawns, so a value such as `NODE_OPTIONS` or `PATH` runs code and `ANTHROPIC_BASE_URL` redirects every prompt",
+	extraKnownMarketplaces: "registers plugin marketplace sources",
+	httpHookAllowedEnvVars: "controls which environment variables an HTTP hook may put in a request header, credentials included",
+	outputStyle: "replaces the system prompt every session runs with",
+	skipAutoPermissionPrompt: "removes the confirmation shown before auto-approval mode starts",
+	skipDangerousModePermissionPrompt: "removes the confirmation shown before the mode that skips every permission check starts"
+};
+/**
+* The keys from the table above that only widen at one particular value.
+* `disableSkillShellExecution: true` turns inline shell execution off, which
+* restricts; the `false` that turns it back on is what a fetched override could
+* use to undo a user setting, so only that value is warned about.
+*/
+const CLAUDECODE_TRUST_KEY_WIDENING_VALUES = { disableSkillShellExecution: (value) => value === false };
+/**
+* A key name is authored data that ends up in a log line, so strip the control
+* characters that would let it forge a line or hide the warnings beside it, and
+* cap the length.
+*/
+function displayKey(key) {
+	const stripped = stripControlCharacters(key);
+	return stripped.length > 80 ? `${stripped.slice(0, 80)}…` : stripped;
+}
+/**
+* Alternate spellings Claude Code accepts for a top-level settings key, mapped
+* to the canonical key whose **Scope** the alias inherits: "In any settings
+* file that accepts the canonical key, Claude Code reads the alias exactly as
+* it reads the canonical key." Resolving through this map before the scope
+* check keeps an alias from slipping past a restriction its canonical spelling
+* is caught by — `allowedMarketplaces` is `Managed`, like
+* `strictKnownMarketplaces`. Both aliases require Claude Code v2.1.232+.
+*
+* @see https://code.claude.com/docs/en/settings-reference#marketplace-key-aliases
+*/
+const CLAUDECODE_SETTINGS_KEY_ALIASES = {
+	additionalMarketplaces: "extraKnownMarketplaces",
+	allowedMarketplaces: "strictKnownMarketplaces"
+};
+/**
+* Copy of the authored top-level passthrough with the keys the target file
+* cannot honor removed, warning once per dropped key. Like
+* `stripGlobalOnlySandboxPaths`, only the override copy is filtered — a value
+* already hand-written in the target file is left untouched, which is why the
+* warning points at it.
+*/
+function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logger }) {
+	const filtered = {};
+	for (const [key, value] of Object.entries(overrides)) {
+		const shown = displayKey(key);
+		const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
+		if (Object.hasOwn(CLAUDECODE_COMMAND_EXECUTING_KEYS, canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' ${CLAUDECODE_COMMAND_EXECUTING_KEYS[canonicalKey]}, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; author commands in .rulesync/hooks.jsonc, or set this key in ${relativeFilePath} by hand.`);
+			continue;
+		}
+		if (Object.hasOwn(CLAUDECODE_UNHONORED_KEY_SOURCES, canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' is only honored in ${CLAUDECODE_UNHONORED_KEY_SOURCES[canonicalKey]}, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in that file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		if (!global && CLAUDECODE_USER_SCOPE_ONLY_KEYS.has(canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — Claude Code reads it from user, local or managed settings. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		const widensAtValue = CLAUDECODE_TRUST_KEY_WIDENING_VALUES[canonicalKey];
+		if (Object.hasOwn(CLAUDECODE_TRUST_AFFECTING_KEYS, canonicalKey) && (widensAtValue === void 0 || widensAtValue(value))) logger?.warn(`Claude Code permissions: writing '${shown}' to ${relativeFilePath}; it ${CLAUDECODE_TRUST_AFFECTING_KEYS[canonicalKey]}. Review the value as you would a hook, especially if this permissions file came from 'rulesync fetch'.`);
+		filtered[key] = value;
+	}
+	return filtered;
+}
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -29662,7 +30121,13 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		});
 		const overridePermissions = config.claudecode?.permissions;
 		if (overridePermissions && typeof overridePermissions === "object") {
-			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			const { allow: _a, ask: _k, deny: _d, ...rest } = overridePermissions;
+			const nonListFields = Object.fromEntries(Object.entries(rest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
+			warnOnWideningPermissionFields({
+				fields: nonListFields,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
 			settings.permissions = {
 				...settings.permissions,
 				...nonListFields
@@ -29670,17 +30135,41 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
 		if (isPlainRecord(overrideSandbox)) {
-			const scopedSandbox = global ? overrideSandbox : stripProjectIgnoredMaskEntries({
+			const executableFreeSandbox = stripCommandExecutingSandboxPaths({
+				sandbox: overrideSandbox,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
+			const scopedSandbox = global ? executableFreeSandbox : stripProjectIgnoredMaskEntries({
 				sandbox: stripGlobalOnlySandboxPaths({
-					sandbox: overrideSandbox,
+					sandbox: executableFreeSandbox,
 					relativeFilePath: paths.relativeFilePath,
 					logger
 				}),
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
+			warnOnTrustAffectingSandboxPaths({
+				sandbox: scopedSandbox,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
 			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
+		const overrideTopLevel = {};
+		for (const [key, value] of Object.entries(config.claudecode ?? {})) {
+			if (CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS.has(key)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (value === void 0) continue;
+			overrideTopLevel[key] = value;
+		}
+		const scopedTopLevel = stripUnhonoredTopLevelKeys({
+			overrides: overrideTopLevel,
+			global,
+			relativeFilePath: paths.relativeFilePath,
+			logger
+		});
+		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
 		const managedToolNames = managedClaudeToolNames(config);
 		const merged = applyPermissions({
 			settings,
@@ -29713,12 +30202,33 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		const { allow: _a, ask: _k, deny: _d, ...permissionsRest } = permissions;
+		const nonListFields = Object.fromEntries(Object.entries(permissionsRest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
 		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		const { sandbox } = settings;
-		if (isPlainRecord(sandbox) && Object.keys(sandbox).length > 0) config.claudecode = {
+		if (isPlainRecord(sandbox)) {
+			const importedSandbox = structuredClone(sandbox);
+			for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) deleteSandboxPath({
+				target: importedSandbox,
+				path
+			});
+			if (Object.keys(importedSandbox).length > 0) config.claudecode = {
+				...config.claudecode,
+				sandbox: importedSandbox
+			};
+		}
+		const topLevelPassthrough = {};
+		for (const [key, value] of Object.entries(settings)) {
+			if (CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS.has(key)) continue;
+			const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
+			if (Object.hasOwn(CLAUDECODE_COMMAND_EXECUTING_KEYS, canonicalKey)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (value === void 0) continue;
+			topLevelPassthrough[key] = value;
+		}
+		if (Object.keys(topLevelPassthrough).length > 0) config.claudecode = {
 			...config.claudecode,
-			sandbox
+			...topLevelPassthrough
 		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
@@ -56606,6 +57116,12 @@ Object.defineProperty(exports, "stringifyFrontmatter", {
 		return stringifyFrontmatter;
 	}
 });
+Object.defineProperty(exports, "stripControlCharacters", {
+	enumerable: true,
+	get: function() {
+		return stripControlCharacters;
+	}
+});
 Object.defineProperty(exports, "toPosixPath", {
 	enumerable: true,
 	get: function() {