rulesync 16.14.0 → 16.16.0

package/dist/{import-Ds0QeVp6.js → import-DimKwtQ6.js}

@@ -113,11 +113,18 @@ const { join: join$1 } = posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$1(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "checks");
+const RULES_FEATURE_SUBDIR = "rules";
+const CURATED_RULES_FEATURE_SUBDIR = join$1(RULES_FEATURE_SUBDIR, ".curated");
+const COMMANDS_FEATURE_SUBDIR = "commands";
+const SUBAGENTS_FEATURE_SUBDIR = "subagents";
+const CHECKS_FEATURE_SUBDIR = "checks";
+const SKILLS_FEATURE_SUBDIR = "skills";
+const CURATED_SKILLS_FEATURE_SUBDIR = join$1(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
 const RULESYNC_MCP_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
 const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
 const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
@@ -128,8 +135,8 @@ const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
 const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$1(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$1(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -1117,6 +1124,7 @@ const ConfigParamsSchema = z.object({
 	dryRun: optional(z.boolean()),
 	check: optional(z.boolean()),
 	inputRoot: optional(z.string()),
+	inputRoots: optional(z.array(z.string()).check(minLength(1, "inputRoots must be non-empty"))),
 	sources: optional(z.array(SourceEntrySchema))
 });
 z.partial(ConfigParamsSchema);
@@ -1129,14 +1137,39 @@ z.required(ConfigParamsSchema);
 * Normalizes the configuration file location to an absolute path.
 *
 * `ConfigResolver` always supplies the path it actually loaded; the fallback
-* only covers direct programmatic construction, where the conventional
-* location next to the input root is the best guess.
+* only covers direct programmatic construction. `anchorDir` is the directory
+* the config file lives next to — for the default `.rulesync/` layout this
+* is the parent of the primary source tree.
 */
-function normalizeConfigFilePath({ configFilePath, inputRoot }) {
-	if (configFilePath === void 0) return join(inputRoot, RULESYNC_CONFIG_RELATIVE_FILE_PATH);
+function normalizeConfigFilePath({ configFilePath, anchorDir }) {
+	if (configFilePath === void 0) return join(anchorDir, RULESYNC_CONFIG_RELATIVE_FILE_PATH);
 	return isAbsolute(configFilePath) ? configFilePath : resolve(configFilePath);
 }
 /**
+* Resolves any accepted input-root shape (`inputRoot`, `inputRoots`, or
+* neither) to the canonical non-empty tuple of absolute paths that
+* `Config` stores. Relative entries are resolved against the current
+* working directory at call time.
+*
+* Semantics (post-refactor):
+* - Each entry in `inputRoots` is a rulesync **source tree** (the directory
+*   that directly holds `rules/`, `skills/`, `mcp.jsonc`, etc.). No implicit
+*   `.rulesync/` join is applied.
+* - The legacy singular `inputRoot` is a shorthand for "parent of the
+*   default `.rulesync/` source tree", and is expanded to
+*   `[join(inputRoot, ".rulesync")]` before hitting any consumer. This is
+*   the ONLY place `.rulesync` is appended by convention.
+* - The "nothing configured" default expands to `[join(cwd, ".rulesync")]`
+*   so existing projects with a single `.rulesync/` tree keep working
+*   unchanged.
+*
+* Callers must have already run `assertInputRootFieldsExclusive`.
+*/
+function normalizeInputRoots({ inputRoot, inputRoots }) {
+	const resolved = (inputRoots !== void 0 && inputRoots.length > 0 ? inputRoots : inputRoot !== void 0 ? [join(inputRoot, RULESYNC_RELATIVE_DIR_PATH)] : [join(process.cwd(), RULESYNC_RELATIVE_DIR_PATH)]).map((entry) => isAbsolute(entry) ? entry : resolve(entry));
+	return [resolved[0], ...resolved.slice(1)];
+}
+/**
 * Conflicting target pairs that cannot be used together.
 * Exported so `rulesync doctor` can report the same conflicts as diagnostics
 * without duplicating the list.
@@ -1173,6 +1206,28 @@ const assertTargetsFeaturesExclusive = ({ targets, features }) => {
 	if (targets !== void 0 && !Array.isArray(targets) && features !== void 0) throw new Error("Invalid config: when 'targets' is in object form, 'features' must be omitted. Declare per-target features inside the 'targets' object instead.");
 };
 /**
+* Rejects a single user-authored config file (or a single programmatic
+* construction) that defines both `inputRoot` and `inputRoots` — the two
+* fields express the same setting at singular vs. list level and cannot
+* be combined within one file without ambiguity.
+*
+* The check is intentionally per-file: base and local config files can each
+* be valid in isolation and merge into a state where both survive, and the
+* resolver picks `inputRoots` in that case (see `resolveEffectiveInputRoots`).
+* Only a single file declaring both is a genuine authoring error.
+*/
+const assertInputRootFieldsExclusive = ({ inputRoot, inputRoots }) => {
+	if (inputRoot !== void 0 && inputRoots !== void 0) throw new Error("Invalid config: 'inputRoot' and 'inputRoots' cannot be combined. Remove 'inputRoot' and keep 'inputRoots', or reduce 'inputRoots' to a single-element 'inputRoot' string.");
+};
+/**
+* Rejects an explicitly supplied empty `inputRoots` list. Omitting the field
+* selects the conventional default, while an empty list has no meaningful
+* source-tree semantics and must not be treated as an absent override.
+*/
+const assertInputRootsNonEmpty = ({ inputRoots }) => {
+	if (inputRoots !== void 0 && inputRoots.length === 0) throw new Error("Invalid config: 'inputRoots' must be non-empty.");
+};
+/**
 * Normalizes a post-resolution `ConfigParams` input by rejecting the case
 * where both `targets` and `features` are undefined — a degenerate state
 * that would silently produce a no-op config (no targets, no features).
@@ -1208,14 +1263,35 @@ var Config = class Config {
 	gitignoreDestination;
 	dryRun;
 	check;
-	inputRoot;
+	/**
+	* Ordered, absolute-path list of rulesync source trees. Each entry is a
+	* source tree itself — the directory that directly contains `rules/`,
+	* `skills/`, `mcp.jsonc`, etc. No implicit `.rulesync/` join is applied.
+	*
+	* Always non-empty by construction — the constructor either normalizes
+	* an `inputRoot`/`inputRoots` input or falls back to a single-element
+	* list containing `join(<cwd>, ".rulesync")`.
+	*
+	* `inputRoot` (singular) is a deprecated backward-compatibility alias
+	* that expands to `[join(inputRoot, ".rulesync")]`.
+	*
+	* Typed as a non-empty tuple so the one internal caller that legitimately
+	* needs "the primary root" (`normalizeConfigFilePath` fallback) can index
+	* `[0]` without a runtime null-check.
+	*/
+	inputRoots;
 	configFilePath;
 	sources;
-	constructor({ outputRoots, targets, features, verbose, delete: isDelete, global, silent, simulateCommands, simulateSubagents, simulateSkills, flattenedCommandNaming, gitignoreTargetsOnly, gitignoreDestination, dryRun, check, inputRoot, configFilePath, sources, configFileTargets }) {
+	constructor({ outputRoots, targets, features, verbose, delete: isDelete, global, silent, simulateCommands, simulateSubagents, simulateSkills, flattenedCommandNaming, gitignoreTargetsOnly, gitignoreDestination, dryRun, check, inputRoot, inputRoots, configFilePath, sources, configFileTargets }) {
 		assertTargetsFeaturesExclusive({
 			targets,
 			features
 		});
+		assertInputRootFieldsExclusive({
+			inputRoot,
+			inputRoots
+		});
+		assertInputRootsNonEmpty({ inputRoots });
 		assertTargetsOrFeaturesProvided({
 			targets,
 			features
@@ -1243,10 +1319,13 @@ var Config = class Config {
 		this.gitignoreDestination = gitignoreDestination ?? "gitignore";
 		this.dryRun = dryRun ?? false;
 		this.check = check ?? false;
-		this.inputRoot = inputRoot === void 0 ? process.cwd() : isAbsolute(inputRoot) ? inputRoot : resolve(inputRoot);
+		this.inputRoots = normalizeInputRoots({
+			inputRoot,
+			inputRoots
+		});
 		this.configFilePath = normalizeConfigFilePath({
 			configFilePath,
-			inputRoot: this.inputRoot
+			anchorDir: dirname(this.inputRoots[0])
 		});
 		this.sources = sources ?? [];
 	}
@@ -1430,16 +1509,22 @@ var Config = class Config {
 		return this.check;
 	}
 	/**
-	* Returns the directory containing the `.rulesync/` source files. The value
-	* is always an absolute path captured at config-construction time, so this
-	* accessor is pure and never depends on a live `process.cwd()` read.
+	* Returns the ordered list of rulesync source trees. Each entry is the
+	* source tree itself — the directory that directly contains `rules/`,
+	* `skills/`, `mcp.jsonc`, etc. Values are absolute paths captured at
+	* config-construction time, so this accessor is pure and never depends on
+	* a live `process.cwd()` read.
 	*
-	* When no `inputRoot` was supplied to the constructor, `process.cwd()` is
-	* snapshotted once during construction. When a relative `inputRoot` is
-	* supplied, it is resolved to absolute against the construction-time cwd.
+	* The returned tuple is always non-empty: when no `inputRoot`/`inputRoots`
+	* was supplied, `[join(process.cwd(), ".rulesync")]` is snapshotted once
+	* during construction. The first entry is the required base source tree.
+	* Later entries are optional overlays and may be absent; when present, they
+	* take precedence when the same relative source path exists in more than
+	* one root (see per-feature merge policies in the processor
+	* `loadRulesync*` methods).
 	*/
-	getInputRoot() {
-		return this.inputRoot;
+	getInputRoots() {
+		return this.inputRoots;
 	}
 	/**
 	* Returns the absolute path of the configuration file this config was
@@ -1480,6 +1565,7 @@ const getDefaults = () => ({
 	dryRun: false,
 	check: false,
 	inputRoot: void 0,
+	inputRoots: void 0,
 	sources: []
 });
 const loadConfigFromFile = async (filePath) => {
@@ -1491,8 +1577,23 @@ const loadConfigFromFile = async (filePath) => {
 		targets: configParams.targets,
 		features: configParams.features
 	});
+	try {
+		assertInputRootFieldsExclusive({
+			inputRoot: configParams.inputRoot,
+			inputRoots: configParams.inputRoots
+		});
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(`${detail} (in ${JSON.stringify(filePath)})`, { cause: error });
+	}
 	return configParams;
 };
+function mergeInputRootConfigs({ baseConfig, localConfig }) {
+	return {
+		inputRoot: localConfig.inputRoot ?? baseConfig.inputRoot,
+		inputRoots: localConfig.inputRoots ?? baseConfig.inputRoots
+	};
+}
 const mergeConfigs = (baseConfig, localConfig) => {
 	return {
 		targets: localConfig.targets ?? baseConfig.targets,
@@ -1510,7 +1611,10 @@ const mergeConfigs = (baseConfig, localConfig) => {
 		gitignoreDestination: localConfig.gitignoreDestination ?? baseConfig.gitignoreDestination,
 		dryRun: localConfig.dryRun ?? baseConfig.dryRun,
 		check: localConfig.check ?? baseConfig.check,
-		inputRoot: localConfig.inputRoot ?? baseConfig.inputRoot,
+		...mergeInputRootConfigs({
+			baseConfig,
+			localConfig
+		}),
 		sources: localConfig.sources ?? baseConfig.sources
 	};
 };
@@ -1539,13 +1643,14 @@ function assertMergedTargetsFeaturesExclusive({ configByFile, validatedConfigPat
 	}
 }
 /**
-* Resolve the effective `global` flag. When an `inputRoot` is in play the user
-* is decoupling source from output, so a config-file `global: true` is dropped
-* (unless the caller also explicitly passes `global`); a warning is emitted in
+* Resolve the effective `global` flag. When an input root (singular
+* `inputRoot` or plural `inputRoots`) is in play the user is decoupling
+* source from output, so a config-file `global: true` is dropped (unless
+* the caller also explicitly passes `global`); a warning is emitted in
 * that case. Returns the resolved boolean `global`.
 */
 function resolveGlobal({ logger, resolvedInputRoot, global, configByFile, validatedConfigPath }) {
-	if (resolvedInputRoot !== void 0 && global === void 0 && configByFile.global === true) warnWithFallback(logger, `Ignoring "global: true" from ${JSON.stringify(validatedConfigPath)} because an inputRoot was configured; pass global=true (CLI: --global) to keep user-scope output. Output will be project-scope (global=false).`);
+	if (resolvedInputRoot !== void 0 && global === void 0 && configByFile.global === true) warnWithFallback(logger, `Ignoring "global: true" from ${JSON.stringify(validatedConfigPath)} because an input root was configured; pass global=true (CLI: --global) to keep user-scope output. Output will be project-scope (global=false).`);
 	return pick({
 		cli: global,
 		file: resolvedInputRoot !== void 0 ? false : configByFile.global,
@@ -1569,17 +1674,81 @@ function resolveFeaturesAndTargets({ features, targets, configByFile }) {
 		resolvedTargets: userProvidedTargets ?? getDefaults().targets
 	};
 }
+/**
+* Resolve the effective, non-empty, absolute-path list of source-tree roots
+* by applying CLI > file > default precedence and preferring `inputRoots`
+* over `inputRoot` when both survive the base+local merge. Duplicates (after
+* normalization to absolute paths) are removed silently so overlapping
+* base/local declarations do not double-count the same tree.
+*
+* Semantics (post-refactor):
+* - `inputRoots` entries are the source trees themselves (each holds
+*   `rules/`, `skills/`, `mcp.jsonc`, etc.); they are passed through
+*   unchanged.
+* - `inputRoot` (legacy singular) is a shorthand for "parent of the
+*   `.rulesync/` source tree" and is expanded to `join(inputRoot,
+*   ".rulesync")` before it hits any consumer.
+* - The "nothing configured" default expands to `[join(cwd, ".rulesync")]`
+*   so existing projects keep working unchanged.
+*
+* When both the merged file config has `inputRoots` and the CLI supplied
+* `inputRoot` (or vice versa), CLI wins outright — matching how every
+* other field is resolved. When only the file config supplies both, the
+* plural wins over the singular and the drop is logged at debug level.
+*/
+function resolveEffectiveInputRoots({ cliInputRoot, cliInputRoots, configByFile, cwd, logger }) {
+	let source;
+	let field;
+	if (cliInputRoots !== void 0 && cliInputRoots.length > 0) {
+		source = cliInputRoots;
+		field = "inputRoots";
+	} else if (cliInputRoot !== void 0) {
+		source = [join(cliInputRoot, RULESYNC_RELATIVE_DIR_PATH)];
+		field = "inputRoot";
+	} else if (configByFile.inputRoots !== void 0 && configByFile.inputRoots.length > 0) {
+		source = configByFile.inputRoots;
+		field = "inputRoots";
+		if (configByFile.inputRoot !== void 0) logger?.debug(`Both 'inputRoot' and 'inputRoots' were set after merging base and local configs; 'inputRoots' wins and 'inputRoot' was dropped.`);
+	} else if (configByFile.inputRoot !== void 0) {
+		source = [join(configByFile.inputRoot, RULESYNC_RELATIVE_DIR_PATH)];
+		field = "inputRoot";
+	} else source = [join(cwd, RULESYNC_RELATIVE_DIR_PATH)];
+	const candidates = source.map((entry) => resolve(cwd, entry));
+	const seen = /* @__PURE__ */ new Set();
+	const resolved = [];
+	for (const absolute of candidates) {
+		if (seen.has(absolute)) continue;
+		seen.add(absolute);
+		resolved.push(absolute);
+	}
+	return {
+		inputRoots: [resolved[0], ...resolved.slice(1)],
+		candidates,
+		field
+	};
+}
 var ConfigResolver = class {
-	static async resolve({ targets, features, verbose, delete: isDelete, outputRoots, configPath = getDefaults().configPath, global, silent, simulateCommands, simulateSubagents, simulateSkills, gitignoreTargetsOnly, dryRun, check, gitignoreDestination, inputRoot }, { logger } = {}) {
+	static async resolve({ targets, features, verbose, delete: isDelete, outputRoots, configPath = getDefaults().configPath, global, silent, simulateCommands, simulateSubagents, simulateSkills, gitignoreTargetsOnly, dryRun, check, gitignoreDestination, inputRoot, inputRoots }, { logger } = {}) {
 		const cwd = resolve(process.cwd());
+		assertInputRootFieldsExclusive({
+			inputRoot,
+			inputRoots
+		});
+		assertInputRootsNonEmpty({ inputRoots });
 		if (inputRoot !== void 0) validateOutputRoot(inputRoot);
-		const validatedConfigPath = resolvePath(configPath, resolve(inputRoot ?? cwd));
+		if (inputRoots !== void 0) for (const entry of inputRoots) validateOutputRoot(entry);
+		const cliConfigAnchor = inputRoot;
+		const hasCliInputRootOverride = inputRoot !== void 0 || inputRoots !== void 0;
+		const validatedConfigPath = resolvePath(configPath, resolve(cliConfigAnchor ?? cwd));
 		const baseConfig = await loadConfigFromFile(validatedConfigPath);
 		const configDir = dirname(validatedConfigPath);
 		const localConfigPath = join(configDir, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH);
 		const localConfig = await loadConfigFromFile(localConfigPath);
 		const configByFile = mergeConfigs(baseConfig, localConfig);
-		if (inputRoot === void 0 && configByFile.inputRoot !== void 0) validateOutputRoot(configByFile.inputRoot);
+		if (!hasCliInputRootOverride) {
+			if (configByFile.inputRoot !== void 0) validateOutputRoot(configByFile.inputRoot);
+			if (configByFile.inputRoots !== void 0) for (const entry of configByFile.inputRoots) validateOutputRoot(entry);
+		}
 		assertMergedTargetsFeaturesExclusive({
 			configByFile,
 			validatedConfigPath,
@@ -1605,10 +1774,16 @@ var ConfigResolver = class {
 				silent: resolvedSilent
 			});
 		}
-		const resolvedInputRoot = inputRoot ?? configByFile.inputRoot;
+		const resolvedInputRoots = resolveEffectiveInputRoots({
+			cliInputRoot: inputRoot,
+			cliInputRoots: inputRoots,
+			configByFile,
+			cwd,
+			logger
+		}).inputRoots;
 		const resolvedGlobal = resolveGlobal({
 			logger,
-			resolvedInputRoot,
+			resolvedInputRoot: inputRoot !== void 0 || inputRoots !== void 0 || configByFile.inputRoot !== void 0 || configByFile.inputRoots !== void 0 ? resolvedInputRoots[0] : void 0,
 			global,
 			configByFile,
 			validatedConfigPath
@@ -1672,7 +1847,7 @@ var ConfigResolver = class {
 				file: configByFile.check,
 				fallback: getDefaults().check
 			}),
-			inputRoot: resolvedInputRoot !== void 0 ? resolve(resolvedInputRoot) : cwd,
+			inputRoots: resolvedInputRoots,
 			configFilePath: validatedConfigPath,
 			sources: configByFile.sources ?? getDefaults().sources,
 			flattenedCommandNaming: configByFile.flattenedCommandNaming ?? getDefaults().flattenedCommandNaming,
@@ -2072,8 +2247,9 @@ var RulesyncCheck = class RulesyncCheck extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath }) {
-		const filePath = join(outputRoot, RULESYNC_CHECKS_RELATIVE_DIR_PATH, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths().relativeDirPath;
+		const filePath = join(outputRoot, dirPath, relativeFilePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncCheckFrontmatterSchema.safeParse(frontmatter);
@@ -2081,7 +2257,7 @@ var RulesyncCheck = class RulesyncCheck extends RulesyncFile {
 		const filename = basename(relativeFilePath);
 		return new RulesyncCheck({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath: filename,
 			frontmatter: result.data,
 			body: content.trim()
@@ -2152,8 +2328,9 @@ var RulesyncCommand = class RulesyncCommand extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath }) {
-		const filePath = join(outputRoot, RulesyncCommand.getSettablePaths().relativeDirPath, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const dirPath = relativeDirPath ?? RulesyncCommand.getSettablePaths().relativeDirPath;
+		const filePath = join(outputRoot, dirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(fileContent, filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
@@ -2161,7 +2338,7 @@ var RulesyncCommand = class RulesyncCommand extends RulesyncFile {
 		if (!result.success) throw new Error(`Invalid frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
 		return new RulesyncCommand({
 			outputRoot,
-			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath,
 			frontmatter: result.data,
 			body: content.trim(),
@@ -3550,8 +3727,19 @@ const CANONICAL_TO_VIBE_EVENT_NAMES = {
 };
 /**
 * Map Mistral Vibe snake_case event names to canonical camelCase.
+*
+* The pre-2.21.0 spellings are accepted alongside the current ones. Vibe's
+* strict `HookType` enum rejects a file that still uses them, so such a file is
+* already dead on disk; reading it here and emitting the renamed spelling is
+* what repairs it, whereas leaving the old name unmapped would route the hook
+* into a tool override block and lose the event.
 */
-const VIBE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_VIBE_EVENT_NAMES).map(([k, v]) => [v, k]));
+const VIBE_TO_CANONICAL_EVENT_NAMES = {
+	...Object.fromEntries(Object.entries(CANONICAL_TO_VIBE_EVENT_NAMES).map(([k, v]) => [v, k])),
+	before_tool: "preToolUse",
+	after_tool: "postToolUse",
+	post_agent_turn: "stop"
+};
 /**
 * Map canonical camelCase event names to Qwen Code PascalCase.
 *
@@ -3772,15 +3960,17 @@ var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 			error: null
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, validate = true }) {
 		const paths = RulesyncHooks.getSettablePaths();
+		const overrideDirPath = relativeDirPath;
 		for (const candidate of getRulesyncSourceCandidates({ paths })) {
-			const filePath = join(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+			const filePath = join(outputRoot, candidateDirPath, candidate.relativeFilePath);
 			if (!await fileExists(filePath)) continue;
 			const fileContent = await readFileContent(filePath);
 			return new RulesyncHooks({
 				outputRoot,
-				relativeDirPath: candidate.relativeDirPath,
+				relativeDirPath: candidateDirPath,
 				relativeFilePath: candidate.relativeFilePath,
 				fileContent,
 				validate
@@ -3807,21 +3997,23 @@ var RulesyncIgnore = class RulesyncIgnore extends RulesyncFile {
 				relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
 				relativeFilePath: RULESYNC_AIIGNORE_FILE_NAME
 			},
-			legacy: {
+			legacy: [{
 				relativeDirPath: ".",
 				relativeFilePath: RULESYNC_IGNORE_RELATIVE_FILE_PATH
-			}
+			}]
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd() } = {}) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath } = {}) {
 		const paths = this.getSettablePaths();
-		const recommendedPath = join(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
-		const legacyPath = join(outputRoot, paths.legacy.relativeDirPath, paths.legacy.relativeFilePath);
+		const recommendedDirPath = relativeDirPath ?? paths.recommended.relativeDirPath;
+		const recommendedPath = join(outputRoot, recommendedDirPath, paths.recommended.relativeFilePath);
+		const [legacy] = paths.legacy;
+		const legacyPath = join(outputRoot, legacy.relativeDirPath, legacy.relativeFilePath);
 		if (await fileExists(recommendedPath)) {
 			const fileContent = await readFileContent(recommendedPath);
 			return new RulesyncIgnore({
 				outputRoot,
-				relativeDirPath: paths.recommended.relativeDirPath,
+				relativeDirPath: recommendedDirPath,
 				relativeFilePath: paths.recommended.relativeFilePath,
 				fileContent
 			});
@@ -3830,15 +4022,15 @@ var RulesyncIgnore = class RulesyncIgnore extends RulesyncFile {
 			const fileContent = await readFileContent(legacyPath);
 			return new RulesyncIgnore({
 				outputRoot,
-				relativeDirPath: paths.legacy.relativeDirPath,
-				relativeFilePath: paths.legacy.relativeFilePath,
+				relativeDirPath: legacy.relativeDirPath,
+				relativeFilePath: legacy.relativeFilePath,
 				fileContent
 			});
 		}
 		const fileContent = await readFileContent(recommendedPath);
 		return new RulesyncIgnore({
 			outputRoot,
-			relativeDirPath: paths.recommended.relativeDirPath,
+			relativeDirPath: recommendedDirPath,
 			relativeFilePath: paths.recommended.relativeFilePath,
 			fileContent
 		});
@@ -3994,6 +4186,118 @@ const RulesyncMcpFileSchema = z.looseObject({
 	warp: z.optional(toolScopedMcpSchema),
 	zed: z.optional(toolScopedMcpSchema)
 });
+/**
+* The tool-scoped block keys that carry a `{toolname}.mcpServers` sub-map.
+* Derived from `RulesyncMcpFileSchema`'s own shape so this set can never drift
+* from the schema — every tool-scoped block declared above is treated as a
+* "merge servers by name" site by `mergeMcpJsonOverlays`, and everything else
+* (including `$schema` and top-level Kimi Code timeout fields) is replaced
+* atomically.
+*/
+const TOOL_SCOPED_MCP_KEYS = new Set(Object.keys(RulesyncMcpFileSchema.def.shape).filter((key) => key !== "$schema" && key !== "mcpServers"));
+/**
+* Return the first candidate path (recommended, then legacy variants) that
+* exists under `outputRoot`, or `undefined` when none is present. Shared
+* between `fromFile` (single-root) and `fromRoots` (multi-root) so both
+* paths honour the same intra-root resolution order.
+*
+* When `overrideDirPath` is provided it replaces the candidates'
+* class-level `relativeDirPath` (which defaults to `.rulesync/`) so the
+* caller can point at a non-default source tree (e.g. `.rulesync.local/`).
+* Also returned is the effective `relativeDirPath` for the winning
+* candidate so the caller can reconstruct a `RulesyncMcp` with matching
+* anchor fields.
+*/
+async function findFirstExistingCandidate({ paths, outputRoot, overrideDirPath }) {
+	for (const candidate of getRulesyncSourceCandidates({ paths })) {
+		const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+		const filePath = join(outputRoot, candidateDirPath, candidate.relativeFilePath);
+		if (await fileExists(filePath)) return {
+			filePath,
+			candidate: {
+				relativeDirPath: candidateDirPath,
+				relativeFilePath: candidate.relativeFilePath
+			}
+		};
+	}
+}
+/**
+* Merge two parsed MCP JSON objects with the one-level policy from the
+* inputRoots plan: the top-level `mcpServers` map and each
+* `<toolname>.mcpServers` sub-map are merged by server name (later wins per
+* key). Every other value — individual server configs, other top-level keys
+* — is replaced atomically. This keeps the merge predictable: an overlay can
+* add or replace whole shared servers, but a partial patch of one server's
+* `args`/`env` is deliberately not supported.
+*/
+function getRecordField({ value, path }) {
+	if (value === void 0) return {};
+	if (!isRecord$1(value)) throw new Error(`Invalid MCP overlay: '${path}' must be an object.`);
+	return value;
+}
+/**
+* Overlay one record onto another, dropping any overlay key that could reach
+* `Object.prototype`. Every overlay merge goes through this so a `__proto__`
+* entry cannot enter the merged config from any depth — top-level
+* `mcpServers`, a tool-scoped block, or that block's own `mcpServers`.
+*/
+function mergeRecordsSkippingPollutionKeys({ base, overlay }) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(overlay)) {
+		if (isPrototypePollutionKey(key)) continue;
+		merged[key] = value;
+	}
+	return merged;
+}
+function mergeMcpJsonOverlays({ base, overlay }) {
+	const merged = { ...base };
+	for (const [key, overlayValue] of Object.entries(overlay)) {
+		if (isPrototypePollutionKey(key)) continue;
+		if (key === "mcpServers") {
+			merged.mcpServers = mergeRecordsSkippingPollutionKeys({
+				base: getRecordField({
+					value: base.mcpServers,
+					path: "mcpServers"
+				}),
+				overlay: getRecordField({
+					value: overlayValue,
+					path: "mcpServers"
+				})
+			});
+			continue;
+		}
+		if (TOOL_SCOPED_MCP_KEYS.has(key)) {
+			const baseBlock = getRecordField({
+				value: base[key],
+				path: key
+			});
+			const overlayBlock = getRecordField({
+				value: overlayValue,
+				path: key
+			});
+			const mergedBlock = mergeRecordsSkippingPollutionKeys({
+				base: baseBlock,
+				overlay: overlayBlock
+			});
+			const baseServers = getRecordField({
+				value: baseBlock.mcpServers,
+				path: `${key}.mcpServers`
+			});
+			const overlayServers = getRecordField({
+				value: overlayBlock.mcpServers,
+				path: `${key}.mcpServers`
+			});
+			if (Object.keys(baseServers).length > 0 || Object.keys(overlayServers).length > 0) mergedBlock.mcpServers = mergeRecordsSkippingPollutionKeys({
+				base: baseServers,
+				overlay: overlayServers
+			});
+			merged[key] = mergedBlock;
+			continue;
+		}
+		merged[key] = overlayValue;
+	}
+	return merged;
+}
 var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	json;
 	constructor(params) {
@@ -4030,28 +4334,136 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 			error: null
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, logger }) {
+	/**
+	* Load and merge MCP source files across the configured input roots.
+	*
+	* `inputRoots` entries are the source trees themselves (e.g.
+	* `/repo/.rulesync`, `/repo/.rulesync.local`). Per-root behavior mirrors
+	* `fromFile`: each root's own candidate paths (recommended `mcp.jsonc`,
+	* legacy `mcp.json`, deprecated `.mcp.json`) are checked INSIDE that
+	* source tree and the first hit is loaded. Roots that have no candidate
+	* contribute nothing.
+	*
+	* Cross-root behavior: the parsed JSON objects are folded left-to-right
+	* with `mergeMcpJsonOverlays`, so later roots overlay earlier ones by
+	* server name (one level deep) and replace every other value atomically.
+	* With one root, this delegates to `fromFile` so JSONC formatting and the
+	* actual candidate path are preserved. With multiple roots, each source is
+	* parsed and schema-validated before merging so failures name the originating
+	* file. The merged object is necessarily synthetic, serialized JSON anchored
+	* to the first root's recommended path.
+	*
+	* A multi-root configuration where only one root actually supplies a file is
+	* treated as the single-root case: nothing is merged, so the original file
+	* content is kept verbatim (preserving JSONC comments) and the instance is
+	* anchored at the root that supplied it rather than at the primary root's
+	* recommended path.
+	*
+	* When no root supplies any candidate, this falls back to reading the
+	* primary root's recommended path so the underlying file-not-found error
+	* matches the single-root behavior of `fromFile`.
+	*/
+	static async fromRoots({ inputRoots, validate = true, logger }) {
+		if (inputRoots.length === 1) {
+			const [primary] = inputRoots;
+			return this.fromFile({
+				outputRoot: dirname(primary),
+				relativeDirPath: basename(primary),
+				validate,
+				logger
+			});
+		}
 		const paths = this.getSettablePaths();
+		const rootSources = [];
+		for (const root of inputRoots) {
+			const parent = dirname(root);
+			const treeName = basename(root);
+			const found = await findFirstExistingCandidate({
+				paths,
+				outputRoot: parent,
+				overrideDirPath: treeName
+			});
+			if (found === void 0) continue;
+			const { filePath, candidate } = found;
+			if (filePath.endsWith(".mcp.json")) {
+				const recommendedPath = join(parent, treeName, paths.recommended.relativeFilePath);
+				logger?.warn(`⚠️  Using deprecated path "${filePath}". Please migrate to "${recommendedPath}"`);
+			}
+			const fileContent = await readFileContent(filePath);
+			let parsed;
+			try {
+				parsed = parseJsonc(fileContent);
+				if (!isRecord$1(parsed)) throw new Error("Expected a JSON object.");
+				if (validate) {
+					const result = RulesyncMcpFileSchema.safeParse(parsed);
+					if (!result.success) throw result.error;
+				}
+			} catch (error) {
+				throw new Error(`Invalid MCP source file '${filePath}': ${formatError(error)}`, { cause: error });
+			}
+			rootSources.push({
+				record: parsed,
+				outputRoot: parent,
+				relativeDirPath: candidate.relativeDirPath,
+				relativeFilePath: candidate.relativeFilePath,
+				fileContent
+			});
+		}
+		if (rootSources.length === 0) {
+			const primary = inputRoots[0];
+			return this.fromFile({
+				outputRoot: dirname(primary),
+				relativeDirPath: basename(primary),
+				validate,
+				logger
+			});
+		}
+		const onlySource = rootSources.length === 1 ? rootSources[0] : void 0;
+		if (onlySource !== void 0) return new RulesyncMcp({
+			outputRoot: onlySource.outputRoot,
+			relativeDirPath: onlySource.relativeDirPath,
+			relativeFilePath: onlySource.relativeFilePath,
+			fileContent: onlySource.fileContent,
+			validate
+		});
+		const merged = rootSources.reduce((acc, next) => mergeMcpJsonOverlays({
+			base: acc,
+			overlay: next.record
+		}), {});
+		const primary = inputRoots[0];
+		return new RulesyncMcp({
+			outputRoot: dirname(primary),
+			relativeDirPath: basename(primary),
+			relativeFilePath: paths.recommended.relativeFilePath,
+			fileContent: JSON.stringify(merged, null, 2),
+			validate
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, validate = true, logger }) {
+		const paths = this.getSettablePaths();
+		const overrideDirPath = relativeDirPath;
 		for (const candidate of getRulesyncSourceCandidates({ paths })) {
-			const filePath = join(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+			const filePath = join(outputRoot, candidateDirPath, candidate.relativeFilePath);
 			if (!await fileExists(filePath)) continue;
 			if (candidate.relativeFilePath === ".mcp.json") {
-				const recommendedPath = join(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath);
+				const recommendedPath = join(outputRoot, candidateDirPath, paths.recommended.relativeFilePath);
 				logger?.warn(`⚠️  Using deprecated path "${filePath}". Please migrate to "${recommendedPath}"`);
 			}
 			const fileContent = await readFileContent(filePath);
 			return new RulesyncMcp({
 				outputRoot,
-				relativeDirPath: candidate.relativeDirPath,
+				relativeDirPath: candidateDirPath,
 				relativeFilePath: candidate.relativeFilePath,
 				fileContent,
 				validate
 			});
 		}
-		const fileContent = await readFileContent(join(outputRoot, paths.recommended.relativeDirPath, paths.recommended.relativeFilePath));
+		const fallbackDirPath = overrideDirPath ?? paths.recommended.relativeDirPath;
+		const fileContent = await readFileContent(join(outputRoot, fallbackDirPath, paths.recommended.relativeFilePath));
 		return new RulesyncMcp({
 			outputRoot,
-			relativeDirPath: paths.recommended.relativeDirPath,
+			relativeDirPath: fallbackDirPath,
 			relativeFilePath: paths.recommended.relativeFilePath,
 			fileContent,
 			validate
@@ -4397,11 +4809,26 @@ const KiloPermissionsOverrideSchema = z.looseObject({
 * rather than which commands are permitted — so it is a loose passthrough on
 * the same terms, merged into the top level of `.claude/settings.json`.
 *
+* Any other key is a plain top-level `settings.json` key (`editorMode`, `env`,
+* `model`, ...), deep-merged into the generated file verbatim so settings
+* Claude Code adds faster than an allowlist can track stay authorable.
+* The exceptions are the keys another feature owns (`hooks`) and `$schema`.
+* Keys the target file cannot honor — `Managed`-only and `~/.claude.json`-only
+* keys in either scope, plus user-scope keys at project scope — are dropped
+* with a warning rather than written where they would never apply. So are the
+* keys whose value is a command Claude Code executes (`apiKeyHelper`,
+* `statusLine`, ...): this file is shareable via `rulesync fetch`, and a file
+* named for restricting things is not where a command belongs — author those
+* in `.rulesync/hooks.jsonc` instead.
+*
 * @example
 * { "permissions": { "defaultMode": "acceptEdits", "additionalDirectories": ["../shared"] } }
 * @example
 * { "sandbox": { "network": { "allowedDomains": ["example.com"], "strictAllowlist": true } } }
+* @example
+* { "editorMode": "vim", "env": { "MY_VAR": "1" } }
 * @see https://code.claude.com/docs/en/sandboxing
+* @see https://code.claude.com/docs/en/settings-reference
 */
 const ClaudecodePermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
@@ -5076,6 +5503,15 @@ const CodexcliPermissionsOverrideSchema = z.looseObject({
 	sandbox_workspace_write: z.optional(z.looseObject({})),
 	apps: z.optional(z.looseObject({})),
 	approvals_reviewer: z.optional(z.union([CodexApprovalsReviewerSchema, z.looseObject({})])),
+	/**
+	* The `[tui]` table of `config.toml` (e.g. `vim_mode_default`, `keymap.*`).
+	* Not a permission surface, but like `apps` it is a top-level table with no
+	* canonical category, and Codex adds keys to it faster than an explicit model
+	* could track — so it is a loose passthrough written verbatim.
+	*
+	* @see https://developers.openai.com/codex/config-reference
+	*/
+	tui: z.optional(z.looseObject({})),
 	git_write_rules: z.optional(z.boolean())
 });
 /**
@@ -5222,15 +5658,17 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 			error: null
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, validate = true }) {
 		const paths = RulesyncPermissions.getSettablePaths();
+		const overrideDirPath = relativeDirPath;
 		for (const candidate of getRulesyncSourceCandidates({ paths })) {
-			const filePath = join(outputRoot, candidate.relativeDirPath, candidate.relativeFilePath);
+			const candidateDirPath = overrideDirPath ?? candidate.relativeDirPath;
+			const filePath = join(outputRoot, candidateDirPath, candidate.relativeFilePath);
 			if (!await fileExists(filePath)) continue;
 			const fileContent = await readFileContent(filePath);
 			return new RulesyncPermissions({
 				outputRoot,
-				relativeDirPath: candidate.relativeDirPath,
+				relativeDirPath: candidateDirPath,
 				relativeFilePath: candidate.relativeFilePath,
 				fileContent,
 				validate
@@ -5394,8 +5832,9 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
-		const filePath = join(outputRoot, this.getSettablePaths().recommended.relativeDirPath, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths().recommended.relativeDirPath;
+		const filePath = join(outputRoot, dirPath, relativeFilePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncRuleFrontmatterSchema.safeParse(frontmatter);
@@ -5408,7 +5847,7 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 		};
 		return new RulesyncRule({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().recommended.relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath,
 			frontmatter: validatedFrontmatter,
 			body: content.trim(),
@@ -5656,7 +6095,11 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
 		"user-invocable": z.optional(z.boolean()),
 		enabled: z.optional(z.boolean()),
-		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
+		license: z.optional(z.unknown()),
+		compatibility: z.optional(z.unknown()),
+		metadata: z.optional(z.unknown()),
+		version: z.optional(z.unknown())
 	})),
 	grokcli: z.optional(z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
@@ -5832,8 +6275,9 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath }) {
-		const filePath = join(outputRoot, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH, relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths().relativeDirPath;
+		const filePath = join(outputRoot, dirPath, relativeFilePath);
 		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(await readFileContent(filePath), filePath);
 		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}. Rulesync files must begin with a YAML frontmatter block delimited by '---'.`);
 		const result = RulesyncSubagentFrontmatterSchema.safeParse(frontmatter);
@@ -5841,7 +6285,7 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 		const filename = basename(relativeFilePath);
 		return new RulesyncSubagent({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeDirPath: dirPath,
 			relativeFilePath: filename,
 			frontmatter: result.data,
 			body: content.trim()
@@ -5851,16 +6295,18 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 //#endregion
 //#region src/features/skills/skills-utils.ts
 /**
-* Returns the set of local skill directory names (excluding `.curated`).
+* Returns the set of local skill directory names (excluding `.curated`)
+* from a rulesync source tree (e.g. `/repo/.rulesync` or
+* `/repo/.rulesync.local`).
 */
-async function getLocalSkillDirNames(outputRoot) {
-	const skillsDir = join(outputRoot, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
+async function getLocalSkillDirNames(sourceTree) {
+	const skillsDir = join(sourceTree, SKILLS_FEATURE_SUBDIR);
 	const names = /* @__PURE__ */ new Set();
 	if (!await directoryExists(skillsDir)) return names;
 	const dirPaths = await findFilesByGlobs(join(skillsDir, "*"), { type: "dir" });
 	for (const dirPath of dirPaths) {
 		const name = basename(dirPath);
-		if (name === basename(RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH)) continue;
+		if (name === basename(CURATED_SKILLS_FEATURE_SUBDIR)) continue;
 		names.add(name);
 	}
 	return names;
@@ -6173,15 +6619,49 @@ function companionFileContentsEquivalent({ filePath, expected, existing, compose
 	return tryFileContentsEquivalent(filePath, expectedText, existingText) ?? false;
 }
 //#endregion
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
+* line and paragraph separators, and the plain LRM/RLM marks. A name or value
+* copied out of an untrusted config file, a fetched repository, or a tool's own
+* settings file must never reach the terminal with these intact: they let the
+* text forge log lines, reorder what is printed around them, or inject escape
+* sequences. LRM/RLM open no bidi scope of their own, but they still reorder the
+* neutral characters beside them, so they go too — a diagnostic line is not the
+* place to preserve the typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+//#endregion
 //#region src/types/feature-processor.ts
 var FeatureProcessor = class {
 	outputRoot;
-	inputRoot;
+	/**
+	* Ordered, non-empty list of rulesync source-tree directories. Each entry
+	* is a source tree itself — the directory that directly contains feature
+	* subdirectories (`rules/`, `commands/`, …) and single-file features
+	* (`mcp.jsonc`, `hooks.jsonc`, …). Later entries take precedence in
+	* per-feature merges. Defaults to `[join(process.cwd(), ".rulesync")]`.
+	*
+	* The singular user-facing alias (`inputRoot` in `rulesync.jsonc` / the
+	* `--input-root` CLI flag / `GenerateOptions.inputRoot`) is deprecated
+	* and collapsed into `[join(inputRoot, ".rulesync")]` before it ever
+	* reaches a processor — every internal consumer only ever sees the
+	* plural form, with the source tree already resolved.
+	*/
+	inputRoots;
 	dryRun;
 	logger;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, dryRun = false, logger }) {
 		this.outputRoot = outputRoot;
-		this.inputRoot = inputRoot;
+		this.inputRoots = inputRoots !== void 0 && inputRoots.length > 0 ? [inputRoots[0], ...inputRoots.slice(1)] : [join(process.cwd(), RULESYNC_RELATIVE_DIR_PATH)];
 		this.dryRun = dryRun;
 		this.logger = logger;
 	}
@@ -6248,6 +6728,198 @@ var FeatureProcessor = class {
 		return orphanFiles.length;
 	}
 };
+/**
+* Messages already reported for a given logger.
+*
+* One `generate` run constructs a single-file processor per tool target and
+* per output root — more than twenty times for `--targets "*"` — and each one
+* re-resolves the same roots. Keying on the logger — created once per run, and
+* once per test — keeps the shadowing warning to a single line instead of
+* repeating it for every target. `--watch` reuses one logger across runs, so
+* {@link resetRootShadowingWarnings} clears the set at the start of each one.
+*/
+const warnedRootShadowingByLogger = /* @__PURE__ */ new WeakMap();
+/**
+* Forget which shadowing warnings have already been reported.
+*
+* `generate` calls this once per run. Without it, `--watch` reuses one logger
+* for the whole session, so the warning would be printed on the first
+* generation and never again — the opposite of why it is a warning, since
+* `--watch` is exactly when an overlay is most likely to be added or edited.
+*/
+function resetRootShadowingWarnings({ logger }) {
+	warnedRootShadowingByLogger.delete(logger);
+}
+/**
+* Return the last input root that contains any of the given `relativePaths`,
+* or `undefined` when none of the roots has any of them. Used by single-file
+* features (hooks, permissions, ignore) to implement the "later root wins
+* the whole file" merge policy without materializing the file contents.
+*
+* `relativePaths` accepts a small list so features that historically read
+* either a recommended path or a legacy alias (e.g. `.rulesync/mcp.jsonc`
+* plus `.rulesync/mcp.json`) can preserve that resolution order per root.
+* A root counts as "having" the file as long as at least one candidate path
+* is present.
+*/
+async function pickLastRootWithFile({ inputRoots, relativePaths, logger, artifactName }) {
+	let winner;
+	const rootsWithFile = [];
+	for (const root of inputRoots) for (const relativePath of relativePaths) if (await fileExists(join(root, relativePath))) {
+		winner = root;
+		rootsWithFile.push(root);
+		break;
+	}
+	if (rootsWithFile.length > 1 && winner !== void 0) {
+		const shadowed = rootsWithFile.slice(0, -1);
+		const message = `${artifactName} is provided by more than one input root; '${stripControlCharacters(winner)}' replaces the whole file from ${shadowed.map((root) => `'${stripControlCharacters(root)}'`).join(", ")}.`;
+		let warnedMessages = warnedRootShadowingByLogger.get(logger);
+		if (warnedMessages === void 0) {
+			warnedMessages = /* @__PURE__ */ new Set();
+			warnedRootShadowingByLogger.set(logger, warnedMessages);
+		}
+		if (!warnedMessages.has(message)) {
+			warnedMessages.add(message);
+			logger.warn(message);
+		}
+	}
+	return winner;
+}
+/**
+* Merge per-root result lists into a single ordered list, keeping the
+* later root's entry when two roots produced an item with the same
+* identity. Identity is intentionally provided by the caller so
+* per-feature nuances (case-insensitive filesystems, directory names for
+* skills, server names for MCP) live next to the feature that owns them.
+*
+* The returned list preserves the FIRST appearance order of each identity —
+* items in the earliest root keep their position, but their content is
+* replaced by the last root that provided the same identity. This matches
+* the "overlay" mental model: an overlay changes content, not order.
+*/
+function mergeByIdentity({ perRoot, identity }) {
+	const order = [];
+	const winnerByKey = /* @__PURE__ */ new Map();
+	for (const rootItems of perRoot) for (const item of rootItems) {
+		const key = identity(item);
+		if (!winnerByKey.has(key)) order.push(key);
+		winnerByKey.set(key, item);
+	}
+	return order.map((key) => winnerByKey.get(key));
+}
+/**
+* The key two spellings share when a case-insensitive filesystem would give
+* them one file. `toLowerCase()` is locale-independent (unlike
+* `toLocaleLowerCase`, it does not turn `I` into the Turkish `ı` under a Turkish
+* locale), and the NFC pass folds the composed and decomposed spellings of an
+* accented name — which macOS also resolves to a single directory —
+* onto each other.
+*
+* This is simple lowercasing rather than full Unicode case folding, so it is
+* deliberately narrower than what a filesystem considers one file: a Greek
+* final sigma, a Turkish `ı` under NTFS's upcasing, and a Win32 name whose
+* trailing dot is stripped all still produce distinct keys. Those pairs keep
+* the pre-existing behavior (both are imported, and the later one wins on the
+* filesystem); folding them here would instead drop names that a
+* case-sensitive filesystem keeps genuinely apart.
+*/
+function caseFoldIdentity(identity) {
+	return identity.normalize("NFC").toLowerCase();
+}
+/**
+* Group spellings by their case-folded identity, keeping every original
+* spelling. On a case-sensitive filesystem one identity can cover several
+* spellings at once, and the caller needs them all to describe a collision
+* accurately.
+*/
+function groupSpellingsByCaseFoldedIdentity(spellings) {
+	const grouped = /* @__PURE__ */ new Map();
+	for (const spelling of spellings) {
+		const identity = caseFoldIdentity(spelling);
+		const existing = grouped.get(identity);
+		if (existing === void 0) grouped.set(identity, [spelling]);
+		else existing.push(spelling);
+	}
+	return grouped;
+}
+/**
+* Build the warning emitted when a `.curated/` entry and a local entry in the
+* same tree differ only in case.
+*
+* `.curated/` is expanded from a declarative source (an external Git repository
+* or npm package), so its names are untrusted input; both sides are stripped of
+* control characters before they reach the terminal.
+*
+* The winning local spelling is the LAST one, matching the precedence
+* {@link mergeByCaseInsensitiveIdentity} applies afterwards; any other spelling
+* that folds onto the same identity is listed too, so the message never names a
+* spelling that loses.
+*/
+function formatCuratedCaseCollisionWarning({ artifactKind, entryNoun, treeDirPath, curatedSpelling, localSpellings }) {
+	const winner = localSpellings[localSpellings.length - 1] ?? "";
+	const shadowed = localSpellings.slice(0, -1);
+	const shadowedSuffix = shadowed.length === 0 ? "" : ` Other local spellings that fold onto the same identity: ${shadowed.map((spelling) => `'${stripControlCharacters(spelling)}'`).join(", ")}.`;
+	return `Case-insensitive ${artifactKind} collision under ${stripControlCharacters(treeDirPath)}: curated '${stripControlCharacters(curatedSpelling)}' and local '${stripControlCharacters(winner)}' resolve to the same identity. The local ${entryNoun} wins and the curated ${entryNoun} is skipped.` + shadowedSuffix;
+}
+/**
+* Merge artifacts whose filenames are case-insensitive identities, warning
+* when distinct spellings collapse to the same key. Exact-name overlays are
+* intentional and remain quiet; only case-only ambiguity is diagnosed.
+*
+* Precedence here is the opposite of {@link ClaimedIdentities}: this merges
+* overlay roots, where the LAST entry wins, while the tool-side loaders keep
+* the FIRST root to claim a name.
+*/
+function mergeByCaseInsensitiveIdentity({ perRoot, identity, artifactName, logger }) {
+	const spellingByKey = /* @__PURE__ */ new Map();
+	const warnedKeys = /* @__PURE__ */ new Set();
+	return mergeByIdentity({
+		perRoot,
+		identity: (item) => {
+			const spelling = identity(item);
+			const key = caseFoldIdentity(spelling);
+			const previousSpelling = spellingByKey.get(key);
+			if (previousSpelling !== void 0 && previousSpelling !== spelling && !warnedKeys.has(key)) {
+				logger.warn(`Case-insensitive ${artifactName} collision: '${stripControlCharacters(previousSpelling)}' and '${stripControlCharacters(spelling)}' resolve to the same identity. The later entry wins.`);
+				warnedKeys.add(key);
+			}
+			if (previousSpelling === void 0) spellingByKey.set(key, spelling);
+			return key;
+		}
+	});
+}
+/**
+* Tracks the import identities already claimed while scanning, folding case
+* through {@link caseFoldIdentity}.
+*
+* The tool-side loaders scan several roots in precedence order and keep the
+* first spelling of each identity. Comparing those identities exactly lets
+* `.junie/skills/dup-skill` and `.agents/skills/Dup-Skill` both through, and
+* since macOS and Windows resolve the two written-back directories to a
+* single one, the shared Agent Skills copy lands last and overwrites the
+* tool-specific one — inverting the precedence the roots were ordered by.
+*
+* The FIRST claimer wins, which is the opposite of the overlay precedence in
+* {@link mergeByCaseInsensitiveIdentity}: roots are passed in precedence
+* order, so the earliest one to name a skill is the one that should keep it.
+*/
+var ClaimedIdentities = class {
+	claimByKey = /* @__PURE__ */ new Map();
+	/**
+	* Claim `identity` on behalf of `source`. Returns `null` when nothing held
+	* it yet, or the standing claim when something did.
+	*/
+	claim({ identity, source }) {
+		const key = caseFoldIdentity(identity);
+		const claimed = this.claimByKey.get(key);
+		if (claimed !== void 0) return claimed;
+		this.claimByKey.set(key, {
+			spelling: identity,
+			source
+		});
+		return null;
+	}
+};
 //#endregion
 //#region src/constants/amp-paths.ts
 const AMP_DIR = ".amp";
@@ -7463,7 +8135,8 @@ const CODEXCLI_OVERRIDE_KEYS = [
 	"sandbox_mode",
 	"sandbox_workspace_write",
 	"apps",
-	"approvals_reviewer"
+	"approvals_reviewer",
+	"tui"
 ];
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
@@ -8569,10 +9242,10 @@ var ChecksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$6, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$6, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -8609,11 +9282,15 @@ var ChecksProcessor = class extends FeatureProcessor {
 		return toolFiles.filter((file) => file instanceof ToolCheck).flatMap((toolCheck) => toolCheck.toRulesyncChecks());
 	}
 	/**
-	* Implementation of abstract method from Processor
-	* Load and parse rulesync check files from .rulesync/checks/ directory
+	* Load check files from a single source-tree's `checks/` subtree.
+	* `sourceTree` is the source tree itself (e.g. `/repo/.rulesync` or
+	* `/repo/.rulesync.local`).
 	*/
-	async loadRulesyncFiles() {
-		const checksDir = join(this.inputRoot, RulesyncCheck.getSettablePaths().relativeDirPath);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = dirname(sourceTree);
+		const treeName = basename(sourceTree);
+		const treeChecksDirPath = join(treeName, CHECKS_FEATURE_SUBDIR);
+		const checksDir = join(sourceTree, CHECKS_FEATURE_SUBDIR);
 		if (!await directoryExists(checksDir)) {
 			this.logger.debug(`Rulesync checks directory not found: ${checksDir}`);
 			return [];
@@ -8629,7 +9306,8 @@ var ChecksProcessor = class extends FeatureProcessor {
 			const filepath = join(checksDir, mdFile);
 			try {
 				const rulesyncCheck = await RulesyncCheck.fromFile({
-					outputRoot: this.inputRoot,
+					outputRoot: treeParent,
+					relativeDirPath: treeChecksDirPath,
 					relativeFilePath: mdFile,
 					validate: true
 				});
@@ -8640,6 +9318,21 @@ var ChecksProcessor = class extends FeatureProcessor {
 				continue;
 			}
 		}
+		return rulesyncChecks;
+	}
+	/**
+	* Implementation of abstract method from Processor
+	* Load and parse rulesync check files from every configured input root's
+	* `.rulesync/checks/` directory, merging by relative file path so a check
+	* from a later root replaces the earlier root's copy.
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncChecks = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (check) => check.getRelativeFilePath(),
+			artifactName: "check",
+			logger: this.logger
+		});
 		this.logger.debug(`Successfully loaded ${rulesyncChecks.length} rulesync checks`);
 		return rulesyncChecks;
 	}
@@ -10118,18 +10811,23 @@ function commandSlug(relativeFilePath) {
 	return basename(relativeFilePath, ".md").replace(/[^a-zA-Z0-9_-]/g, "-");
 }
 /**
-* Whether a rulesync command exists whose slug matches `dirName`.
+* Whether a rulesync command exists whose slug matches `dirName` in any of
+* the configured input roots.
+*
+* `inputRoots[i]` is a source tree itself (e.g. `/repo/.rulesync` or
+* `/repo/.rulesync.local`), so commands live directly under
+* `<sourceTree>/commands/`.
 *
 * Used by the skills-surface `isDirOwned` hooks of tools whose commands are
 * emitted as `<slug>/SKILL.md` into the skills tree: a directory matching a
 * current command slug is owned by the commands feature, so the skills
 * feature must neither import it as a skill nor delete it as an orphan
-* skill. Once the command is removed from `.rulesync/commands/`, the
-* directory stops matching and the skills feature cleans it up as a regular
-* orphan.
+* skill. Once the command is removed from every source tree's `commands/`
+* directory, the directory stops matching and the skills feature cleans
+* it up as a regular orphan.
 */
-async function rulesyncCommandSlugExists({ inputRoot, dirName }) {
-	return (await findFilesByGlobs(join(inputRoot, RULESYNC_COMMANDS_RELATIVE_DIR_PATH, "**", "*.md"))).some((filePath) => commandSlug(basename(filePath)) === dirName);
+async function rulesyncCommandSlugExists({ inputRoots, dirName }) {
+	return (await Promise.all(inputRoots.map((root) => findFilesByGlobs(join(root, COMMANDS_FEATURE_SUBDIR, "**", "*.md"))))).flat().some((filePath) => commandSlug(basename(filePath)) === dirName);
 }
 //#endregion
 //#region src/features/commands/devin-command.ts
@@ -10819,11 +11517,10 @@ var GrokcliCommand = class GrokcliCommand extends ToolCommand {
 	* output is lost — so this warns rather than failing the run the way the
 	* Hermes check does, where the two surfaces really do write the same path.
 	*/
-	static async validateRulesyncCommands({ inputRoot, rulesyncCommands, logger }) {
+	static async validateRulesyncCommands({ inputRoots, rulesyncCommands, logger }) {
 		const commandNames = new Set(rulesyncCommands.filter((command) => this.isTargetedByRulesyncCommand(command)).map((command) => basename(command.getRelativeFilePath(), ".md")));
 		if (commandNames.size === 0) return;
-		const skillsRoot = join(inputRoot, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
-		const shadowed = (await findFilesByGlobs(join(skillsRoot, "**", "SKILL.md"))).map((filePath) => basename(dirname(filePath))).filter((skillName) => commandNames.has(skillName));
+		const shadowed = (await Promise.all(inputRoots.map((root) => findFilesByGlobs(join(root, SKILLS_FEATURE_SUBDIR, "**", "SKILL.md"))))).flat().map((filePath) => basename(dirname(filePath))).filter((skillName) => commandNames.has(skillName));
 		if (shadowed.length > 0) logger.warn(`Grok CLI resolves skills before commands, so these skills shadow the same-named commands, which will never be reachable: ${[...new Set(shadowed)].toSorted().join(", ")}. Rename either side to make both invocable.`);
 	}
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
@@ -11595,7 +12292,7 @@ var HermesagentCommand = class HermesagentCommand extends ToolCommand {
 	static getExtraSharedWritePaths() {
 		return getHermesagentSharedConfigWritePaths();
 	}
-	static async validateRulesyncCommands({ inputRoot, rulesyncCommands }) {
+	static async validateRulesyncCommands({ inputRoots, rulesyncCommands }) {
 		const commandSlugs = /* @__PURE__ */ new Set();
 		const commandOrigins = /* @__PURE__ */ new Map();
 		for (const command of rulesyncCommands.filter((candidate) => this.isTargetedByRulesyncCommand(candidate))) {
@@ -11607,13 +12304,25 @@ var HermesagentCommand = class HermesagentCommand extends ToolCommand {
 			commandOrigins.set(slug, origin);
 			commandSlugs.add(slug);
 		}
-		const skillsRoot = join(inputRoot, RULESYNC_SKILLS_RELATIVE_DIR_PATH);
-		const skillFiles = await findFilesByGlobs(join(skillsRoot, "**", "SKILL.md"));
-		const collisions = (await Promise.all(skillFiles.map((path) => RulesyncSkill.fromDir({
-			outputRoot: inputRoot,
-			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
-			dirName: toPosixPath(relative(skillsRoot, dirname(path)))
-		})))).filter((skill) => HermesagentSkill.isTargetedByRulesyncSkill(skill)).map((skill) => hermesSlashName(skill.getFrontmatter().name)).filter((slug) => commandSlugs.has(slug));
+		const skillsByName = /* @__PURE__ */ new Map();
+		for (const rootPath of inputRoots) {
+			const skillsRoot = join(rootPath, SKILLS_FEATURE_SUBDIR);
+			const skillFiles = await findFilesByGlobs(join(skillsRoot, "**", "SKILL.md"));
+			const loaded = await Promise.all(skillFiles.map(async (filePath) => {
+				const dirName = toPosixPath(relative(skillsRoot, dirname(filePath)));
+				return {
+					rulesyncSkill: await RulesyncSkill.fromDir({
+						outputRoot: rootPath,
+						relativeDirPath: SKILLS_FEATURE_SUBDIR,
+						dirName
+					}),
+					dirName,
+					rootPath
+				};
+			}));
+			for (const entry of loaded) skillsByName.set(caseFoldIdentity(entry.dirName), entry);
+		}
+		const collisions = [...skillsByName.values()].map(({ rulesyncSkill }) => rulesyncSkill).filter((skill) => HermesagentSkill.isTargetedByRulesyncSkill(skill)).map((skill) => hermesSlashName(skill.getFrontmatter().name)).filter((slug) => commandSlugs.has(slug));
 		if (collisions.length > 0) throw new Error(`Hermes command and skill slash-name collision: ${[...new Set(collisions)].toSorted().join(", ")}`);
 	}
 	static async getAuxiliaryFiles({ toolCommands, outputRoot, global = false, forDeletion = false }) {
@@ -11746,6 +12455,8 @@ const JUNIE_PERMISSIONS_FILE_NAME = "allowlist.json";
 const JUNIE_IGNORE_FILE_NAME = ".aiignore";
 const JUNIE_RULE_FILE_NAME = "AGENTS.md";
 const JUNIE_LEGACY_RULE_FILE_NAME = "guidelines.md";
+const JUNIE_RULES_DIR_NAME = "rules";
+const JUNIE_PLAYBOOK_FILE_NAME = "playbook.md";
 //#endregion
 //#region src/features/commands/junie-command.ts
 const JunieCommandFrontmatterSchema = z.looseObject({ description: z.optional(z.string()) });
@@ -13706,10 +14417,10 @@ var CommandsProcessor = class extends FeatureProcessor {
 	global;
 	getFactory;
 	flattenedCommandNaming;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$5, dryRun = false, flattenedCommandNaming = "basename", logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$5, dryRun = false, flattenedCommandNaming = "basename", logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -13724,7 +14435,7 @@ var CommandsProcessor = class extends FeatureProcessor {
 		const rulesyncCommands = rulesyncFiles.filter((file) => file instanceof RulesyncCommand);
 		const factory = this.getFactory(this.toolTarget);
 		await factory.class.validateRulesyncCommands?.({
-			inputRoot: this.inputRoot,
+			inputRoots: this.inputRoots,
 			rulesyncCommands,
 			logger: this.logger
 		});
@@ -13776,16 +14487,36 @@ var CommandsProcessor = class extends FeatureProcessor {
 		return rel;
 	}
 	/**
-	* Implementation of abstract method from FeatureProcessor
-	* Load and parse rulesync command files from .rulesync/commands/ directory
+	* Load rulesync command files from a single source-tree's `commands/`
+	* subtree. `sourceTree` is the source tree itself (e.g.
+	* `/repo/.rulesync` or `/repo/.rulesync.local`).
 	*/
-	async loadRulesyncFiles() {
-		const basePath = join(this.inputRoot, RulesyncCommand.getSettablePaths().relativeDirPath);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = dirname(sourceTree);
+		const treeName = basename(sourceTree);
+		const treeCommandsDirPath = join(treeName, COMMANDS_FEATURE_SUBDIR);
+		const basePath = join(sourceTree, COMMANDS_FEATURE_SUBDIR);
 		const rulesyncCommandPaths = await findFilesByGlobs(join(basePath, "**", "*.md"));
-		const rulesyncCommands = await Promise.all(rulesyncCommandPaths.map((path) => RulesyncCommand.fromFile({
-			outputRoot: this.inputRoot,
+		return await Promise.all(rulesyncCommandPaths.map((path) => RulesyncCommand.fromFile({
+			outputRoot: treeParent,
+			relativeDirPath: treeCommandsDirPath,
 			relativeFilePath: this.safeRelativePath(basePath, path)
 		})));
+	}
+	/**
+	* Implementation of abstract method from FeatureProcessor
+	* Load and parse rulesync command files from every configured input root's
+	* `.rulesync/commands/` directory, merging by relative path so a command
+	* with the same target path from a later root replaces the earlier root's
+	* copy.
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncCommands = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (command) => command.getRelativeFilePath(),
+			artifactName: "command",
+			logger: this.logger
+		});
 		this.logger.debug(`Successfully loaded ${rulesyncCommands.length} rulesync commands`);
 		return rulesyncCommands;
 	}
@@ -19425,6 +20156,7 @@ function vibeEntryToCanonicalDef(raw) {
 	const entry = raw;
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
+	if (isPrototypePollutionKey(vibeEvent)) return null;
 	const canonicalEvent = VIBE_TO_CANONICAL_EVENT_NAMES[vibeEvent] ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
@@ -19973,10 +20705,10 @@ const hooksProcessorToolTargetsGlobalImportable = [...toolHooksFactories.entries
 var HooksProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -19986,9 +20718,17 @@ var HooksProcessor = class extends FeatureProcessor {
 		this.global = global;
 	}
 	async loadRulesyncFiles() {
+		const relativePaths = getRulesyncSourceCandidates({ paths: RulesyncHooks.getSettablePaths() }).map((candidate) => candidate.relativeFilePath);
+		const sourceTree = await pickLastRootWithFile({
+			inputRoots: this.inputRoots,
+			relativePaths,
+			logger: this.logger,
+			artifactName: "The hooks file"
+		}) ?? this.inputRoots[0];
 		try {
 			return [await RulesyncHooks.fromFile({
-				outputRoot: this.inputRoot,
+				outputRoot: dirname(sourceTree),
+				relativeDirPath: basename(sourceTree),
 				validate: true
 			})];
 		} catch (error) {
@@ -21530,10 +22270,10 @@ var IgnoreProcessor = class extends FeatureProcessor {
 	getFactory;
 	featureOptions;
 	global;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, getFactory = defaultGetFactory$4, global = false, dryRun = false, logger, featureOptions }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, getFactory = defaultGetFactory$4, global = false, dryRun = false, logger, featureOptions }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -21550,11 +22290,35 @@ var IgnoreProcessor = class extends FeatureProcessor {
 	}
 	/**
 	* Implementation of abstract method from FeatureProcessor
-	* Load and parse rulesync ignore files from .rulesync/ignore/ directory
+	*
+	* Load and parse the rulesync ignore file. `inputRoots[i]` is a source
+	* tree itself (e.g. `/repo/.rulesync.local`); the recommended `.aiignore`
+	* lives directly inside it. The legacy `.rulesyncignore` is shared at the
+	* project root, so it is intentionally not considered when choosing which
+	* source tree wins; `RulesyncIgnore.fromFile` still uses it as a fallback
+	* for the chosen tree.
+	*
+	* When multiple input roots are configured, the last root that provides
+	* an ignore file wins entirely (whole-file replacement — no line-level
+	* merge in this slice; see the "Deliberately out of scope" section of
+	* the inputRoots plan for context). If no root has the file, fall back
+	* to the primary root's path so the underlying `RulesyncIgnore.fromFile`
+	* surfaces the same missing-file error it would in the single-root case.
 	*/
 	async loadRulesyncFiles() {
+		const paths = RulesyncIgnore.getSettablePaths();
+		const relativePaths = getRulesyncSourceCandidates({ paths }).filter((candidate) => candidate.relativeDirPath === paths.recommended.relativeDirPath).map((candidate) => candidate.relativeFilePath);
+		const sourceTree = await pickLastRootWithFile({
+			inputRoots: this.inputRoots,
+			relativePaths,
+			logger: this.logger,
+			artifactName: "The ignore file (.aiignore)"
+		}) ?? this.inputRoots[0];
 		try {
-			return [await RulesyncIgnore.fromFile({ outputRoot: this.inputRoot })];
+			return [await RulesyncIgnore.fromFile({
+				outputRoot: dirname(sourceTree),
+				relativeDirPath: basename(sourceTree)
+			})];
 		} catch (error) {
 			this.logger.error(`Failed to load rulesync ignore file (${RULESYNC_AIIGNORE_RELATIVE_FILE_PATH}): ${formatError(error)}`);
 			return [];
@@ -26589,11 +27353,86 @@ function disabledNamesOf(config) {
 	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
+* The value `mcp.mcpConfigPath` needs so Rovo Dev reads the project-scope
+* `.rovodev/mcp.json`. A config-file value, not a filesystem path, so it is
+* always POSIX-separated.
+*/
+const ROVODEV_PROJECT_MCP_CONFIG_POINTER = posix.join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME);
+/**
+* The keys that make an entry in `mcp.json` something Rovo Dev can start:
+* a local process, or a remote endpoint under either spelling the canonical
+* config accepts.
+*/
+const MCP_SERVER_ENDPOINT_KEYS = [
+	"command",
+	"url",
+	"httpUrl"
+];
+function normalizeMcpConfigPathValue(value) {
+	return toPosixPath(value).replace(/^\.\//, "");
+}
+/**
+* Point `mcp.mcpConfigPath` at the project-scope `mcp.json` rulesync writes,
+* and report whether the block gained a value it did not already carry.
+*
+* Rovo Dev's `mcpConfigPath` defaults to a file under the user's home
+* directory, so a repo-committed `.rovodev/mcp.json` is inert until the active
+* config points at it — the Bitbucket Agentic Pipelines guide documents
+* registering the server and setting the pointer as two required steps. Global
+* scope is left alone: there the default already resolves to the file rulesync
+* writes.
+*
+* The pointer names one config rather than merging with the default, so it is
+* written only when this project actually has a Rovo Dev server to run — a
+* server that targets `rovodev` and is not disabled. Otherwise `mcp.json` is
+* generated empty, and pointing at it would take away the user's global
+* servers for this repository in exchange for nothing.
+*
+* That condition can also stop holding after the fact, once the last server is
+* removed from the canonical config or switched off. Rulesync does not take
+* the pointer back out — it cannot tell its own past value from a user who
+* typed the same string — but it says so, since the file is now a live setting
+* that resolves to nothing.
+*
+* A pointer the user aimed somewhere else is theirs, not ours: overwriting it
+* would silently redirect Rovo Dev away from a file they chose. It is named in
+* a warning instead, because the generated `mcp.json` is unread while it
+* stands.
+*
+* Whatever the outcome, it is logged: writing the pointer turns servers that
+* were generated-but-never-read into servers Rovo Dev actually spawns, and
+* points it away from the global MCP config, so it is not something to do
+* quietly.
+*
+* @see https://support.atlassian.com/bitbucket-cloud/docs/rovo-dev-advanced-agentic-configuration/
+* @see https://support.atlassian.com/rovo/docs/manage-rovo-dev-cli-settings/
+*/
+function applyProjectMcpConfigPointer({ existingMcp, global, hasLiveServers, logger }) {
+	if (global) return false;
+	const existing = existingMcp.mcpConfigPath;
+	const pointsAtGeneratedFile = typeof existing === "string" && normalizeMcpConfigPathValue(existing) === ROVODEV_PROJECT_MCP_CONFIG_POINTER;
+	if (!hasLiveServers) {
+		if (pointsAtGeneratedFile) logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${join(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)} points at ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)}, which now has no enabled server. Rovo Dev reads that file instead of the global MCP config, so this project has no MCP servers at all until one targeting rovodev is added back — remove the mcp.mcpConfigPath line to fall back to the global config.`);
+		return false;
+	}
+	if (existing === void 0) {
+		existingMcp.mcpConfigPath = ROVODEV_PROJECT_MCP_CONFIG_POINTER;
+		logger?.info(`Rovo Dev MCP: setting mcp.mcpConfigPath to "${ROVODEV_PROJECT_MCP_CONFIG_POINTER}" in ${join(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)}. Rovo Dev will now launch the servers in ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} for this project instead of the ones in the default global MCP config.`);
+		return true;
+	}
+	if (pointsAtGeneratedFile) return false;
+	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${JSON.stringify(existing)} in ${join(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)}. Rovo Dev reads MCP servers from that path, so the generated ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} is unused until it is set to "${ROVODEV_PROJECT_MCP_CONFIG_POINTER}".`);
+	return false;
+}
+/**
 * Auxiliary writer for the `mcp:` block of `.rovodev/config.yml` (project) /
 * `~/.rovodev/config.yml` (global). Carries `disabledMcpServers` — the key
-* Rovo Dev actually consults to switch a server off — recomputed from the
-* existing block so user keys (`mcpConfigPath`, `allowedMcpServers`, ...) and
-* disabled names for servers rulesync does not manage survive.
+* Rovo Dev actually consults to switch a server off — plus `mcpConfigPath`,
+* which rulesync authors in project scope when the key is absent and this
+* project has a server to run (see `applyProjectMcpConfigPointer`). The block
+* is recomputed from the existing one, so user keys (`allowedMcpServers`,
+* ...), a `mcpConfigPath` the user aimed elsewhere, and disabled names for
+* servers rulesync does not manage all survive.
 */
 var RovodevMcpConfigYaml = class extends ToolFile {
 	isDeletable() {
@@ -26726,7 +27565,17 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 		const mergedDisabled = [...existingDisabled.filter((name) => !managedNameSet.has(name)), ...disabledNames].toSorted();
 		if (mergedDisabled.length > 0) existingMcp.disabledMcpServers = mergedDisabled;
 		else delete existingMcp.disabledMcpServers;
-		if (mergedDisabled.length === 0 && existingContent.trim() === "") return [];
+		const wrotePointer = applyProjectMcpConfigPointer({
+			existingMcp,
+			global,
+			hasLiveServers: managedNames.filter((name) => {
+				if (disabledNames.includes(name)) return false;
+				const server = servers[name];
+				return isRecord$1(server) && MCP_SERVER_ENDPOINT_KEYS.some((endpointKey) => server[endpointKey] !== void 0);
+			}).length > 0,
+			logger
+		});
+		if (mergedDisabled.length === 0 && !wrotePointer && existingContent.trim() === "") return [];
 		const fileContent = applySharedConfigPatch({
 			fileKey: ROVODEV_CONFIG_SHARED_FILE_KEY,
 			feature: "mcp",
@@ -27819,10 +28668,10 @@ var McpProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$3, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$3, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -27838,7 +28687,10 @@ var McpProcessor = class extends FeatureProcessor {
 	*/
 	async loadRulesyncFiles() {
 		try {
-			return [await RulesyncMcp.fromFile({ outputRoot: this.inputRoot })];
+			return [await RulesyncMcp.fromRoots({
+				inputRoots: this.inputRoots,
+				logger: this.logger
+			})];
 		} catch (error) {
 			this.logger.error(`Failed to load a Rulesync MCP file (${RULESYNC_MCP_RELATIVE_FILE_PATH}): ${formatError(error)}`);
 			return [];
@@ -29464,8 +30316,9 @@ function deepMergeRecords(base, patch) {
 * emits them only under `--global`.
 *
 * Deliberately NOT listed:
-* - `bwrapPath` / `socatPath`: v2.1.232 added them to the managed-settings
-*   approval dialog, which is a consent prompt, not a project-scope rejection.
+* - `ripgrep` / `bwrapPath` / `socatPath`: each names an executable, so
+*   `CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL` refuses them in both scopes
+*   rather than emitting them under `--global`.
 * - `credentials.envVars` / `credentials.files`: the ignored-at-project-scope
 *   unit is the individual entry's mode, not the settings key, and the same
 *   lists carry `deny` entries that project settings *do* honor — dropping a
@@ -29473,7 +30326,6 @@ function deepMergeRecords(base, patch) {
 *   filters those lists per entry instead.
 *
 * @see https://code.claude.com/docs/en/sandboxing
-* @see https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md — v2.1.232 scoped `sandbox.ripgrep`
 */
 const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["filesystem", "disabled"],
@@ -29482,37 +30334,309 @@ const CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS = [
 	["credentials", "allowPlaintextInject"],
 	["credentials", "awsPairs"],
 	["credentials", "sigv4"],
-	["allowAppleEvents"],
-	["ripgrep"]
+	["allowAppleEvents"]
 ];
 /**
-* Copy of the authored `sandbox` override with the user/managed-only paths
-* removed, warning once per dropped path. Only the override copy is filtered —
-* a value already hand-written in the target file is left untouched, matching
-* the `qwencode` `security.allowPrivateNetworkHooks` precedent.
+* `sandbox.*` paths documented with a `Managed` scope: Claude Code reads them
+* only from the settings file an organization deploys. Neither file rulesync
+* writes is that file, so they are dropped in **both** scopes — the `sandbox`
+* counterpart of {@link CLAUDECODE_UNHONORED_KEY_SOURCES}, which does the same
+* for top-level `Managed` keys.
+*
+* Both only ever *narrow* the policy — they stop a lower-scoped file from
+* re-opening what managed settings blocked — so neither is trust-widening. They
+* are dropped rather than written for the opposite reason: written into a
+* project or user file they do nothing at all, and a `sandbox` block that reads
+* as though it locked the policy to managed values while Claude Code ignores it
+* is the more dangerous of the two failure modes.
+*
+* Import keeps them, unlike the command-executing paths: the value in an
+* existing `settings.json` was hand-written to be honored somewhere, and
+* round-tripping it preserves the author's intent for the day it moves into a
+* managed file. The cost is a warning on every generate until it is removed,
+* which the refusal message points at.
+*
+* @see https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-allowmanagedreadpathsonly
+*   — "Scope: `Managed`"; the `network` entry says the same.
+*/
+const CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS = [["filesystem", "allowManagedReadPathsOnly"], ["network", "allowManagedDomainsOnly"]];
+/**
+* Walks `segments` from `root`, returning the record they name or `undefined` if
+* any step is missing or not a record. Shared by everything below that addresses
+* a `sandbox` path, so a nested path added to one of the tables is actually
+* traversed rather than silently skipped.
+*/
+function resolveSandboxParent({ root, segments }) {
+	let parent = root;
+	for (const segment of segments) {
+		const next = parent[segment];
+		if (!isPlainRecord(next)) return void 0;
+		parent = next;
+	}
+	return parent;
+}
+/**
+* Deletes `path` from `target` in place and reports whether anything was there,
+* dropping a container the removal emptied so no `"network": {}` noise is left
+* behind.
+*/
+function deleteSandboxPath({ target, path }) {
+	const leaf = path.at(-1);
+	if (leaf === void 0) return false;
+	const parentPath = path.slice(0, -1);
+	const parent = resolveSandboxParent({
+		root: target,
+		segments: parentPath
+	});
+	if (parent === void 0 || parent[leaf] === void 0) return false;
+	delete parent[leaf];
+	for (let depth = parentPath.length; depth > 0; depth--) {
+		const container = resolveSandboxParent({
+			root: target,
+			segments: parentPath.slice(0, depth)
+		});
+		if (container === void 0 || Object.keys(container).length > 0) break;
+		const holder = resolveSandboxParent({
+			root: target,
+			segments: parentPath.slice(0, depth - 1)
+		});
+		const name = parentPath[depth - 1];
+		if (holder === void 0 || name === void 0) break;
+		delete holder[name];
+	}
+	return true;
+}
+/**
+* The one warning that names every trust-affecting setting this generate wrote
+* to `relativeFilePath`. Emitted once per file: the individual reasons are what
+* matter, but the "review this as you would a hook" framing only needs saying
+* once, and repeating it per key buries the reasons in boilerplate.
 */
-function stripGlobalOnlySandboxPaths({ sandbox, relativeFilePath, logger }) {
-	const filtered = structuredClone(sandbox);
-	for (const path of CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS) {
+function warnOnTrustAffectingEntries({ entries, relativeFilePath, logger }) {
+	if (entries.length === 0) return;
+	const one = entries.length === 1;
+	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
+	logger?.warn(`Claude Code permissions: writing ${entries.length} trust-affecting ${one ? "setting" : "settings"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
+}
+/**
+* The `permissions.defaultMode` values that start a session with fewer prompts
+* than the default. `plan` and `default` are absent because they do not widen
+* anything.
+*/
+const CLAUDECODE_WIDENING_DEFAULT_MODES = {
+	acceptEdits: "every file edit is then applied without a prompt",
+	auto: "shell commands are then auto-approved by a classifier rather than by you",
+	bypassPermissions: "every session then starts with no permission prompts at all"
+};
+/**
+* The `permissions` fields that widen rather than restrict: a `defaultMode` that
+* removes prompts, and `additionalDirectories`, which moves the
+* working-directory boundary. Reported for the same reason `disableAllHooks` is:
+* a shareable permissions file should not loosen the permission system quietly.
+*/
+function collectWideningPermissionFields({ fields }) {
+	const entries = [];
+	const defaultMode = fields.defaultMode;
+	if (typeof defaultMode === "string" && Object.hasOwn(CLAUDECODE_WIDENING_DEFAULT_MODES, defaultMode)) entries.push({
+		label: `permissions.defaultMode: "${defaultMode}"`,
+		reason: CLAUDECODE_WIDENING_DEFAULT_MODES[defaultMode]
+	});
+	const additionalDirectories = fields.additionalDirectories;
+	if (additionalDirectories !== void 0 && !(Array.isArray(additionalDirectories) && additionalDirectories.length === 0)) entries.push({
+		label: "permissions.additionalDirectories",
+		reason: "moves the boundary of what Claude Code may read and edit outside the project"
+	});
+	return entries;
+}
+/**
+* `sandbox` paths whose value names a binary Claude Code runs. `sandbox` has its
+* own merge branch, so the top-level refusal in `stripUnhonoredTopLevelKeys`
+* never sees them — they are refused here on the same grounds, in both scopes:
+* a fetched `.rulesync/permissions.jsonc` must not be able to point Claude Code
+* at an executable of its choosing.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+*/
+const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
+	["ripgrep"],
+	["bwrapPath"],
+	["socatPath"]
+];
+/**
+* The predicates the "which value actually widens?" tables are built from.
+* Each names the value that does *not* widen and reports everything else, never
+* the reverse: the override is authored JSONC, so a key can carry any value at
+* all, and one Claude Code coerces is still honored. Reporting an off-type value
+* keeps the warning fail-safe — silence has to mean "this cannot loosen
+* anything", not "this is not the type the table expected".
+*/
+const isNotFalse = (value) => value !== false;
+const isNotTrue = (value) => value !== true;
+const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
+const isNonEmptyMap = (value) => !isPlainRecord(value) || Object.keys(value).length > 0;
+/**
+* `sandbox` paths that loosen the sandbox rather than naming something to run:
+* they let commands out of it, weaken the isolation it provides, or redirect
+* where its traffic goes. They are written like `env` is — the ordinary uses are
+* too common to refuse — but never silently, because a fetched override should
+* not be able to open the sandbox without saying so. `widens` keeps the warning
+* to the value that actually loosens the policy, so authoring the restrictive
+* value (`allowUnsandboxedCommands: false`, an empty `excludedCommands`) stays
+* quiet. The `allow*` lists are here for a structural reason: Claude Code merges
+* a list across every settings scope rather than replacing it, so a project file
+* can only ever add to them. Their counterparts — `denyRead`, `denyWrite`,
+* `deniedDomains` — merge the same way, but adding to a deny list only ever
+* narrows the policy, so they are absent.
+*
+* @see https://code.claude.com/docs/en/sandboxing
+*/
+const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["allowAppleEvents"],
+		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
+		widens: isNotFalse
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "controls whether Claude may retry a blocked command outside the sandbox",
+		widens: isNotFalse
+	},
+	{
+		path: ["autoAllowBashIfSandboxed"],
+		reason: "controls whether every Bash command the sandbox accepts runs without a prompt",
+		widens: isNotFalse
+	},
+	{
+		path: ["enableWeakerNestedSandbox"],
+		reason: "runs the Linux sandbox inside an unprivileged container, which weakens it",
+		widens: isNotFalse
+	},
+	{
+		path: ["enableWeakerNetworkIsolation"],
+		reason: "weakens the sandbox's network isolation on macOS",
+		widens: isNotFalse
+	},
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox on, and sandboxed Bash commands then run without a permission prompt unless `autoAllowBashIfSandboxed` is false",
+		widens: isNotFalse
+	},
+	{
+		path: ["excludedCommands"],
+		reason: "names commands that always run outside the sandbox, with no sandbox policy applied",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["filesystem", "allowRead"],
+		reason: "re-opens reading inside a region the sandbox's `denyRead` blocks",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["filesystem", "allowWrite"],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["ignoreViolations"],
+		reason: "hides the sandbox violations it names, so a blocked access stops being reported",
+		widens: (value) => isNonEmptyMap(value) && isNotFalse(value)
+	},
+	{
+		path: ["network", "allowAllUnixSockets"],
+		reason: "lets sandboxed commands connect to every Unix socket",
+		widens: isNotFalse
+	},
+	{
+		path: ["network", "allowedDomains"],
+		reason: "pre-allows domains sandboxed commands may reach without a prompt",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["network", "allowLocalBinding"],
+		reason: "lets sandboxed commands bind local ports",
+		widens: isNotFalse
+	},
+	{
+		path: ["network", "allowMachLookup"],
+		reason: "names the macOS services sandboxed commands may reach, and `*` means every service",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["network", "allowUnixSockets"],
+		reason: "names Unix sockets sandboxed commands may reach, and one such as `/var/run/docker.sock` is host access",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["network", "httpProxyPort"],
+		reason: "routes the sandbox's HTTP traffic through the port it names",
+		widens: () => true
+	},
+	{
+		path: ["network", "socksProxyPort"],
+		reason: "routes the sandbox's SOCKS traffic through the port it names",
+		widens: () => true
+	}
+];
+/**
+* Every authored `sandbox` path that loosens the sandbox. Nothing is removed —
+* the values are written, just not silently. Called on the filtered `sandbox`
+* so it never claims to be writing a path the scope filters dropped.
+*/
+function collectTrustAffectingSandboxPaths({ sandbox }) {
+	const entries = [];
+	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
 		const leaf = path.at(-1);
 		if (leaf === void 0) continue;
-		const parentPath = path.slice(0, -1);
-		let parent = filtered;
-		for (const segment of parentPath) {
-			const next = parent[segment];
-			if (!isPlainRecord(next)) {
-				parent = {};
-				break;
-			}
-			parent = next;
-		}
-		if (parent[leaf] === void 0) continue;
-		delete parent[leaf];
-		const [container] = parentPath;
-		if (container !== void 0 && isPlainRecord(filtered[container])) {
-			if (Object.keys(filtered[container]).length === 0) delete filtered[container];
-		}
-		logger?.warn(`Claude Code permissions: 'sandbox.${path.join(".")}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+		const parent = resolveSandboxParent({
+			root: sandbox,
+			segments: path.slice(0, -1)
+		});
+		if (parent === void 0) continue;
+		const value = parent[leaf];
+		if (value === void 0 || !widens(value)) continue;
+		entries.push({
+			label: `sandbox.${path.join(".")}`,
+			reason
+		});
+	}
+	return entries;
+}
+/** Paths that name an executable Claude Code runs. Refused in both scopes. */
+const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL = {
+	paths: CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS,
+	warn: ({ label, relativeFilePath }) => `Claude Code permissions: '${label}' names an executable Claude Code runs, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; set this path in ${relativeFilePath} by hand.`
+};
+/**
+* Paths Claude Code honors only from managed settings. Refused in both scopes,
+* like the command-executing paths, because managed settings are not a file
+* rulesync writes in either of them.
+*/
+const CLAUDECODE_MANAGED_ONLY_SANDBOX_REFUSAL = {
+	paths: CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS,
+	warn: ({ label, relativeFilePath }) => `Claude Code permissions: '${label}' is only honored in managed settings, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in the managed settings file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`
+};
+/** Paths Claude Code honors only above project scope. Refused at project scope. */
+const CLAUDECODE_GLOBAL_ONLY_SANDBOX_REFUSAL = {
+	paths: CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS,
+	warn: ({ label, relativeFilePath }) => `Claude Code permissions: '${label}' is only honored in user/managed/--settings settings, so it is not written to the project-scoped ${relativeFilePath}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`
+};
+/**
+* Copy of the authored `sandbox` override with every path of every passed
+* refusal removed, warning once per dropped path. Only the override copy is
+* filtered — a value already hand-written in the target file is left untouched,
+* matching the `qwencode` `security.allowPrivateNetworkHooks` precedent.
+*/
+function stripSandboxPaths({ sandbox, refusals, relativeFilePath, logger }) {
+	const filtered = structuredClone(sandbox);
+	for (const { paths, warn } of refusals) for (const path of paths) {
+		if (!deleteSandboxPath({
+			target: filtered,
+			path
+		})) continue;
+		logger?.warn(warn({
+			label: `sandbox.${path.join(".")}`,
+			relativeFilePath
+		}));
 	}
 	return filtered;
 }
@@ -29536,7 +30660,7 @@ const CLAUDECODE_MASKABLE_CREDENTIAL_LISTS = ["envVars", "files"];
 * such entries to `deny`), so the "reads as masked but isn't" state this guards
 * against cannot slip through a differently-spelled value.
 *
-* Like `stripGlobalOnlySandboxPaths`, only the override copy is filtered — a
+* Like `stripSandboxPaths`, only the override copy is filtered — a
 * value already in the target file is left untouched, which is why the warning
 * points at it.
 *
@@ -29567,6 +30691,271 @@ function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
 	else filtered.credentials = filteredCredentials;
 	return filtered;
 }
+/**
+* Top-level `.claude/settings.json` keys another feature owns, derived from
+* {@link SHARED_CONFIG_OWNERSHIP} rather than restated here so a feature that
+* starts owning a new key is excluded from the passthrough automatically
+* (today: `hooks`, from the hooks feature). Only `replace-owned-keys` entries
+* name keys; the `custom` policies on this file (`ignore`, `permissions`) own
+* entries *inside* `permissions`, which the passthrough excludes wholesale.
+*/
+const CLAUDECODE_FEATURE_OWNED_SETTINGS_KEYS = Object.entries(SHARED_CONFIG_OWNERSHIP[".claude/settings.json"]?.features ?? {}).flatMap(([feature, policy]) => feature !== "permissions" && policy.kind === "replace-owned-keys" ? policy.ownedKeys : []);
+/**
+* Top-level `.claude/settings.json` keys the generic `claudecode` override
+* passthrough must not carry. `permissions` and `sandbox` have their own merge
+* branches (the managed `allow`/`ask`/`deny` arrays and the scope filtering
+* respectively), `permission` is rulesync's own canonical tool-scoped block
+* rather than a settings key, `$schema` is an editor pointer rather than a
+* Claude Code setting, and the rest belong to the other features writing this
+* shared file.
+*/
+const CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS = /* @__PURE__ */ new Set([
+	"permission",
+	"permissions",
+	"sandbox",
+	"$schema",
+	...CLAUDECODE_FEATURE_OWNED_SETTINGS_KEYS
+]);
+/**
+* Top-level settings keys Claude Code reads only from user settings, managed
+* settings and the `--settings` CLI flag — the same restriction
+* `CLAUDECODE_GLOBAL_ONLY_SANDBOX_PATHS` records for the `sandbox` subtree, and
+* the reason the passthrough drops them at project scope instead of committing
+* a setting that never applies. `rulesync generate --global` writes the user
+* settings file, so they are emitted there.
+*
+* Derived from the per-key **Scope** column of the settings reference: every
+* top-level key documented as `User or managed` or `User, local, or managed`.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_USER_SCOPE_ONLY_KEYS = /* @__PURE__ */ new Set([
+	"askUserQuestionTimeout",
+	"autoMode",
+	"dialogExpiry",
+	"enableArtifact",
+	"footerLinksRegexes",
+	"pluginConfigs",
+	"skipAutoPermissionPrompt",
+	"skipDangerousModePermissionPrompt",
+	"spellcheck",
+	"sshConfigs",
+	"syncClaudeAiSkills",
+	"useAutoModeDuringPlan",
+	"vimInsertModeRemaps"
+]);
+/**
+* Top-level settings keys neither file rulesync writes can honor, with the file
+* that does. `Managed` keys are read only from the settings file an organization
+* deploys, and `Global config` keys only from `~/.claude.json` — rulesync writes
+* `.claude/settings.json` and `~/.claude/settings.json`, so authoring either
+* kind through the override would produce a policy that silently never applies.
+*
+* Derived from the per-key **Scope** column of the settings reference.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_UNHONORED_KEY_SOURCES = {
+	allowAllClaudeAiMcps: "managed settings",
+	allowedChannelPlugins: "managed settings",
+	allowManagedHooksOnly: "managed settings",
+	allowManagedMcpServersOnly: "managed settings",
+	allowManagedPermissionRulesOnly: "managed settings",
+	autoConnectIde: "~/.claude.json",
+	autoInstallIdeExtension: "~/.claude.json",
+	blockedMarketplaces: "managed settings",
+	browserExternalPageTools: "managed settings",
+	channelsEnabled: "managed settings",
+	claudeMd: "managed settings",
+	diffTool: "~/.claude.json",
+	disableBrowserExternalNavigation: "managed settings",
+	disableCommandPluginSources: "managed settings",
+	disableMobileSimulatorTools: "managed settings",
+	disableSideloadFlags: "managed settings",
+	externalEditorContext: "~/.claude.json",
+	forceLoginGatewayUrl: "managed settings",
+	forceRemoteSettingsRefresh: "managed settings",
+	parentSettingsBehavior: "managed settings",
+	permissionExplainerEnabled: "~/.claude.json",
+	pluginSuggestionMarketplaces: "managed settings",
+	pluginTrustMessage: "managed settings",
+	requiredMaximumVersion: "managed settings",
+	requiredMinimumVersion: "managed settings",
+	sshHostAllowlist: "managed settings",
+	strictKnownMarketplaces: "managed settings",
+	strictPluginOnlyCustomization: "managed settings",
+	teammateDefaultModel: "~/.claude.json",
+	wslInheritsWindowsSettings: "managed settings"
+};
+/**
+* Top-level settings keys whose value Claude Code **executes**. The generic
+* passthrough refuses them outright rather than warning: `.rulesync/*` files
+* are shareable — `rulesync fetch` copies a third party's `permissions.jsonc`
+* straight into a project — and a file named for *restricting* what an agent
+* may do is not somewhere a reviewer looks for a command to run. Commands
+* belong in `.rulesync/hooks.jsonc` and `.rulesync/.mcp.json`, which are read
+* as executable by anyone reviewing them. Set these by hand in the settings
+* file if you need them.
+*
+* The value is the reason, spliced into the warning.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_COMMAND_EXECUTING_KEYS = {
+	apiKeyHelper: "runs the script it names to mint an API key",
+	awsAuthRefresh: "runs the command it names to refresh AWS credentials",
+	awsCredentialExport: "runs the command it names to export AWS credentials",
+	fileSuggestion: "runs its `command` on every `@` file completion",
+	gcpAuthRefresh: "runs the command it names to refresh Google Cloud credentials",
+	otelHeadersHelper: "runs the script it names to build OpenTelemetry headers",
+	policyHelper: "runs the executable it names to compute the managed settings",
+	processWrapper: "wraps every process Claude Code spawns",
+	statusLine: "runs its `command` on every status-line render",
+	subagentStatusLine: "runs its `command` on every subagent status row"
+};
+/**
+* Top-level settings keys the passthrough does write, but never silently: each
+* one widens what Claude Code trusts or where it sends data, so a value that
+* arrived with a fetched `.rulesync/permissions.jsonc` should be looked at
+* deliberately. Warning on write follows the precedent set for Warp's
+* `command_denylist`, which also replaces a protection when rulesync writes it.
+*
+* The value is the reason, spliced into the warning.
+*/
+const CLAUDECODE_TRUST_AFFECTING_KEYS = {
+	agent: "starts every session as the named subagent, with that subagent's prompt, tools and model",
+	allowedHttpHookUrls: "limits which URLs an HTTP hook may target, and an empty list means every URL",
+	allowedMcpServers: "allowlists the MCP servers that may be used, and entries from every settings file merge into one list, so an entry here widens an allowlist deployed elsewhere",
+	autoMode: "auto-approves shell commands with a classifier rather than with a prompt",
+	claudeMdExcludes: "skips the CLAUDE.md files its patterns match, so the instructions a repository relies on can be dropped from every session",
+	companyAnnouncements: "prints the strings it names at startup as your organization's announcement, so a fetched value speaks to the reader with your organization's voice",
+	crossSessionInbound: "decides what a session does with messages arriving from your other Claude Code sessions, and `accept` delivers them straight to Claude",
+	disableAllHooks: "controls whether hooks run at all",
+	disableSkillShellExecution: "re-opens the inline shell commands in a skill or custom command that a user setting had turned off",
+	enableAllProjectMcpServers: "auto-approves every server in the project `.mcp.json`",
+	enabledMcpjsonServers: "auto-approves the named servers in the project `.mcp.json`",
+	enabledPlugins: "enables plugins, which can ship their own hooks",
+	env: "sets environment variables for every process Claude Code spawns, so a value such as `NODE_OPTIONS` or `PATH` runs code and `ANTHROPIC_BASE_URL` redirects every prompt",
+	extraKnownMarketplaces: "registers plugin marketplace sources",
+	httpHookAllowedEnvVars: "controls which environment variables an HTTP hook may put in a request header, credentials included",
+	modelOverrides: "maps the model IDs it names to provider-specific model IDs, so an entry decides which inference profile or deployment every call for that model is routed to",
+	outputStyle: "replaces the system prompt every session runs with",
+	prUrlTemplate: "rewrites the pull-request links Claude Code renders, so they can point at a host of the template's choosing rather than at the reviewed PR",
+	remoteControlAtStartup: "connects Remote Control automatically at session start, and the transcript of a connected session is stored on Anthropic servers to sync it across devices",
+	skipAutoPermissionPrompt: "removes the confirmation shown before auto-approval mode starts",
+	skipDangerousModePermissionPrompt: "removes the confirmation shown before the mode that skips every permission check starts",
+	skipWebFetchPreflight: "turns off the WebFetch domain safety check, so WebFetch retrieves any URL without consulting Anthropic's blocklist"
+};
+/**
+* The keys from the table above that only widen at one particular value.
+* `disableSkillShellExecution: true` turns inline shell execution off, which
+* restricts; anything else re-opens it, and that is what a fetched override
+* could use to undo a user setting. The rest default to off, so only a value
+* other than the one that leaves them off is worth a line — and for the
+* list-valued and map-valued keys, only a non-empty one, since an empty list or
+* map excludes, announces and overrides nothing.
+*/
+const CLAUDECODE_TRUST_KEY_WIDENING_VALUES = {
+	claudeMdExcludes: isNonEmptyList,
+	companyAnnouncements: isNonEmptyList,
+	crossSessionInbound: (value) => value !== "hold" && value !== "refuse",
+	disableSkillShellExecution: isNotTrue,
+	modelOverrides: isNonEmptyMap,
+	remoteControlAtStartup: isNotFalse,
+	skipWebFetchPreflight: isNotFalse
+};
+/**
+* Top-level keys a project-scoped `.claude/settings.json` honors at one value
+* but ignores at another — the value-level counterpart of
+* {@link CLAUDECODE_USER_SCOPE_ONLY_KEYS}, which is scoped per key. The ignored
+* value is dropped at project scope for the same reason a wholly unhonored key
+* is: committing it would read as a policy that never applies.
+*
+* `remoteControlAtStartup` is the only entry whose honored value can be decided
+* from the value alone. Claude Code honors a `false` from project or local
+* settings — a repository may turn auto-connect off for its own checkout — but
+* ignores a `true`, so that a checked-in file cannot turn Remote Control on for
+* everyone who opens the repository.
+*
+* `crossSessionInbound` is on the same documented list but deliberately absent
+* here: it is a ladder (`accept` < `hold` < `refuse`) whose project value is
+* honored only when it is stricter than the one above it, which no per-value
+* predicate can decide without reading the user's own settings. It is warned
+* about through {@link CLAUDECODE_TRUST_AFFECTING_KEYS} instead, since under
+* `--global` its loosening value is honored outright.
+*
+* @see https://code.claude.com/docs/en/settings#security-keys-where-the-stricter-value-applies
+*/
+const CLAUDECODE_PROJECT_SCOPE_IGNORED_VALUES = { remoteControlAtStartup: {
+	ignored: isNotFalse,
+	note: "Claude Code honors only a `false` there, so that a checked-in file cannot turn Remote Control on for everyone who opens the repository"
+} };
+/**
+* A key name is authored data that ends up in a log line, so strip the control
+* characters that would let it forge a line or hide the warnings beside it, and
+* cap the length.
+*/
+function displayKey(key) {
+	const stripped = stripControlCharacters(key);
+	return stripped.length > 80 ? `${stripped.slice(0, 80)}…` : stripped;
+}
+/**
+* Alternate spellings Claude Code accepts for a top-level settings key, mapped
+* to the canonical key whose **Scope** the alias inherits: "In any settings
+* file that accepts the canonical key, Claude Code reads the alias exactly as
+* it reads the canonical key." Resolving through this map before the scope
+* check keeps an alias from slipping past a restriction its canonical spelling
+* is caught by — `allowedMarketplaces` is `Managed`, like
+* `strictKnownMarketplaces`. Both aliases require Claude Code v2.1.232+.
+*
+* @see https://code.claude.com/docs/en/settings-reference#marketplace-key-aliases
+*/
+const CLAUDECODE_SETTINGS_KEY_ALIASES = {
+	additionalMarketplaces: "extraKnownMarketplaces",
+	allowedMarketplaces: "strictKnownMarketplaces"
+};
+/**
+* Copy of the authored top-level passthrough with the keys the target file
+* cannot honor removed, warning once per dropped key. Like
+* `stripSandboxPaths`, only the override copy is filtered — a value
+* already hand-written in the target file is left untouched, which is why the
+* warning points at it.
+*/
+function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logger }) {
+	const filtered = {};
+	const trustAffecting = [];
+	for (const [key, value] of Object.entries(overrides)) {
+		const shown = displayKey(key);
+		const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
+		if (Object.hasOwn(CLAUDECODE_COMMAND_EXECUTING_KEYS, canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' ${CLAUDECODE_COMMAND_EXECUTING_KEYS[canonicalKey]}, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; author commands in .rulesync/hooks.jsonc, or set this key in ${relativeFilePath} by hand.`);
+			continue;
+		}
+		if (Object.hasOwn(CLAUDECODE_UNHONORED_KEY_SOURCES, canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' is only honored in ${CLAUDECODE_UNHONORED_KEY_SOURCES[canonicalKey]}, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in that file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		if (!global && CLAUDECODE_USER_SCOPE_ONLY_KEYS.has(canonicalKey)) {
+			logger?.warn(`Claude Code permissions: '${shown}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — Claude Code reads it from user, local or managed settings. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		const projectIgnored = Object.hasOwn(CLAUDECODE_PROJECT_SCOPE_IGNORED_VALUES, canonicalKey) ? CLAUDECODE_PROJECT_SCOPE_IGNORED_VALUES[canonicalKey] : void 0;
+		if (!global && projectIgnored !== void 0 && projectIgnored.ignored(value)) {
+			logger?.warn(`Claude Code permissions: this value of '${shown}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — ${projectIgnored.note}. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+			continue;
+		}
+		const widensAtValue = Object.hasOwn(CLAUDECODE_TRUST_KEY_WIDENING_VALUES, canonicalKey) ? CLAUDECODE_TRUST_KEY_WIDENING_VALUES[canonicalKey] : void 0;
+		if (Object.hasOwn(CLAUDECODE_TRUST_AFFECTING_KEYS, canonicalKey) && (widensAtValue === void 0 || widensAtValue(value))) trustAffecting.push({
+			label: shown,
+			reason: CLAUDECODE_TRUST_AFFECTING_KEYS[canonicalKey]
+		});
+		filtered[key] = value;
+	}
+	return {
+		filtered,
+		trustAffecting
+	};
+}
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -29635,9 +31024,12 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			config,
 			logger
 		});
+		const trustAffecting = [];
 		const overridePermissions = config.claudecode?.permissions;
 		if (overridePermissions && typeof overridePermissions === "object") {
-			const { allow: _a, ask: _k, deny: _d, ...nonListFields } = overridePermissions;
+			const { allow: _a, ask: _k, deny: _d, ...rest } = overridePermissions;
+			const nonListFields = Object.fromEntries(Object.entries(rest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
+			trustAffecting.push(...collectWideningPermissionFields({ fields: nonListFields }));
 			settings.permissions = {
 				...settings.permissions,
 				...nonListFields
@@ -29645,17 +31037,44 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
 		if (isPlainRecord(overrideSandbox)) {
-			const scopedSandbox = global ? overrideSandbox : stripProjectIgnoredMaskEntries({
-				sandbox: stripGlobalOnlySandboxPaths({
-					sandbox: overrideSandbox,
-					relativeFilePath: paths.relativeFilePath,
-					logger
-				}),
+			const honorableSandbox = stripSandboxPaths({
+				sandbox: overrideSandbox,
+				refusals: [
+					CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL,
+					CLAUDECODE_MANAGED_ONLY_SANDBOX_REFUSAL,
+					...global ? [] : [CLAUDECODE_GLOBAL_ONLY_SANDBOX_REFUSAL]
+				],
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
+			const scopedSandbox = global ? honorableSandbox : stripProjectIgnoredMaskEntries({
+				sandbox: honorableSandbox,
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
+			trustAffecting.push(...collectTrustAffectingSandboxPaths({ sandbox: scopedSandbox }));
 			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
+		const overrideTopLevel = {};
+		for (const [key, value] of Object.entries(config.claudecode ?? {})) {
+			if (CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS.has(key)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (value === void 0) continue;
+			overrideTopLevel[key] = value;
+		}
+		const { filtered: scopedTopLevel, trustAffecting: trustAffectingTopLevel } = stripUnhonoredTopLevelKeys({
+			overrides: overrideTopLevel,
+			global,
+			relativeFilePath: paths.relativeFilePath,
+			logger
+		});
+		trustAffecting.push(...trustAffectingTopLevel);
+		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
+		warnOnTrustAffectingEntries({
+			entries: trustAffecting,
+			relativeFilePath: paths.relativeFilePath,
+			logger
+		});
 		const managedToolNames = managedClaudeToolNames(config);
 		const merged = applyPermissions({
 			settings,
@@ -29688,12 +31107,33 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		const { allow: _a, ask: _k, deny: _d, ...nonListFields } = permissions;
+		const { allow: _a, ask: _k, deny: _d, ...permissionsRest } = permissions;
+		const nonListFields = Object.fromEntries(Object.entries(permissionsRest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
 		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		const { sandbox } = settings;
-		if (isPlainRecord(sandbox) && Object.keys(sandbox).length > 0) config.claudecode = {
+		if (isPlainRecord(sandbox)) {
+			const importedSandbox = structuredClone(sandbox);
+			for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) deleteSandboxPath({
+				target: importedSandbox,
+				path
+			});
+			if (Object.keys(importedSandbox).length > 0) config.claudecode = {
+				...config.claudecode,
+				sandbox: importedSandbox
+			};
+		}
+		const topLevelPassthrough = {};
+		for (const [key, value] of Object.entries(settings)) {
+			if (CLAUDECODE_NON_PASSTHROUGH_OVERRIDE_KEYS.has(key)) continue;
+			const canonicalKey = Object.hasOwn(CLAUDECODE_SETTINGS_KEY_ALIASES, key) ? CLAUDECODE_SETTINGS_KEY_ALIASES[key] : key;
+			if (Object.hasOwn(CLAUDECODE_COMMAND_EXECUTING_KEYS, canonicalKey)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (value === void 0) continue;
+			topLevelPassthrough[key] = value;
+		}
+		if (Object.keys(topLevelPassthrough).length > 0) config.claudecode = {
 			...config.claudecode,
-			sandbox
+			...topLevelPassthrough
 		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
@@ -34612,11 +36052,8 @@ const TOOL_KEY_TO_CATEGORY = {
 	updateConfluencePage: "edit"
 };
 const MANAGED_TOOL_KEYS = [.../* @__PURE__ */ new Set([...Object.values(CATEGORY_TO_TOOL_KEYS).flat(), ...Object.keys(TOOL_KEY_TO_CATEGORY)])];
-const OWNED_TOOL_PERMISSION_KEYS = [
-	"bash",
-	"allowedExternalPaths",
-	"default"
-];
+const OWNED_TOOL_PERMISSION_KEYS = ["allowedExternalPaths", "default"];
+const MANAGED_BASH_KEYS = ["default", "commands"];
 /**
 * Permissions adapter for Rovo Dev CLI.
 *
@@ -34752,6 +36189,22 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 	}
 };
 /**
+* Report a `toolPermissions.bash.runInSandbox: false` that this generate is
+* about to carry through.
+*
+* The unmanaged `bash` siblings survive untouched, which for this one means a
+* generate is not the reset a user might read it as: every command the agent
+* runs stays outside the sandbox. Rulesync never authors the key and will not
+* start owning it, but a setting that persists on a committed file and loosens
+* containment should not do so without saying anything — least of all on the
+* path where the user just tightened `.rulesync/permissions.*`.
+*/
+function warnAboutPreservedSandboxOptOut({ existingToolPermissions, filePath, logger }) {
+	const existingBash = existingToolPermissions.bash;
+	if (!isRecord$1(existingBash) || existingBash.runInSandbox !== false) return;
+	logger?.warn(`${filePath}: keeping toolPermissions.bash.runInSandbox: false — rulesync does not manage that key, so regenerating does not restore Rovo Dev's sandbox for bash commands.`);
+}
+/**
 * Resolve the `toolPermissions` block to write, merging the generated levels
 * over the existing file. Every other top-level key of `config.yml` is the
 * caller's to preserve; inside this block, keys rulesync manages are owned and
@@ -34759,6 +36212,11 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 */
 function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, filePath, logger }) {
 	const existingToolPermissions = isRecord$1(existing) ? { ...existing } : {};
+	warnAboutPreservedSandboxOptOut({
+		existingToolPermissions,
+		filePath,
+		logger
+	});
 	if (Object.keys(generated).length === 0 && sourceStatesRules) {
 		if (!isRecord$1(existing)) return;
 		const strippedKeys = stripPermissiveOwnedValues(existingToolPermissions);
@@ -34767,9 +36225,12 @@ function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, f
 	}
 	const hasExistingToolsRecord = isRecord$1(existingToolPermissions.tools);
 	const existingTools = hasExistingToolsRecord ? { ...existingToolPermissions.tools } : {};
+	const hasExistingBashRecord = isRecord$1(existingToolPermissions.bash);
+	const existingBash = hasExistingBashRecord ? { ...existingToolPermissions.bash } : {};
 	warnAboutDroppedOwnedKeys({
 		existingToolPermissions,
 		existingTools,
+		existingBash,
 		generated,
 		filePath,
 		logger
@@ -34779,15 +36240,22 @@ function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, f
 		delete existingToolPermissions[toolKey];
 		delete existingTools[toolKey];
 	}
+	for (const bashKey of MANAGED_BASH_KEYS) delete existingBash[bashKey];
 	const tools = {
 		...existingTools,
 		...generated.tools
 	};
+	const bash = {
+		...existingBash,
+		...generated.bash
+	};
 	if (hasExistingToolsRecord) delete existingToolPermissions.tools;
+	if (hasExistingBashRecord) delete existingToolPermissions.bash;
 	return {
 		...existingToolPermissions,
 		...generated,
-		...Object.keys(tools).length > 0 ? { tools } : {}
+		...Object.keys(tools).length > 0 ? { tools } : {},
+		...Object.keys(bash).length > 0 ? { bash } : {}
 	};
 }
 /**
@@ -34796,9 +36264,14 @@ function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, f
 * `/directories` and by an "always allow" answer to a prompt — so their removal
 * must not be silent.
 */
-function warnAboutDroppedOwnedKeys({ existingToolPermissions, existingTools, generated, filePath, logger }) {
+function warnAboutDroppedOwnedKeys({ existingToolPermissions, existingTools, existingBash, generated, filePath, logger }) {
 	const newTools = generated.tools ?? {};
-	const droppedKeys = [...OWNED_TOOL_PERMISSION_KEYS.filter((ownedKey) => existingToolPermissions[ownedKey] !== void 0 && generated[ownedKey] === void 0), ...MANAGED_TOOL_KEYS.filter((toolKey) => existingTools[toolKey] !== void 0 && newTools[toolKey] === void 0).map((toolKey) => `tools.${toolKey}`)];
+	const newBash = generated.bash ?? {};
+	const droppedKeys = [
+		...OWNED_TOOL_PERMISSION_KEYS.filter((ownedKey) => existingToolPermissions[ownedKey] !== void 0 && generated[ownedKey] === void 0),
+		...MANAGED_TOOL_KEYS.filter((toolKey) => existingTools[toolKey] !== void 0 && newTools[toolKey] === void 0).map((toolKey) => `tools.${toolKey}`),
+		...MANAGED_BASH_KEYS.filter((bashKey) => existingBash[bashKey] !== void 0 && newBash[bashKey] === void 0).map((bashKey) => `bash.${bashKey}`)
+	];
 	if (droppedKeys.length > 0) logger?.warn(`Rovo Dev permissions: removing ${droppedKeys.map((key) => `"${key}"`).join(", ")} from ${filePath} because the rulesync source no longer produces them.`);
 }
 /**
@@ -36906,10 +38379,10 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 var PermissionsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -36919,9 +38392,17 @@ var PermissionsProcessor = class extends FeatureProcessor {
 		this.global = global;
 	}
 	async loadRulesyncFiles() {
+		const relativePaths = getRulesyncSourceCandidates({ paths: RulesyncPermissions.getSettablePaths() }).map((candidate) => candidate.relativeFilePath);
+		const sourceTree = await pickLastRootWithFile({
+			inputRoots: this.inputRoots,
+			relativePaths,
+			logger: this.logger,
+			artifactName: "The permissions file"
+		}) ?? this.inputRoots[0];
 		try {
 			return [await RulesyncPermissions.fromFile({
-				outputRoot: this.inputRoot,
+				outputRoot: dirname(sourceTree),
+				relativeDirPath: basename(sourceTree),
 				validate: true
 			})];
 		} catch (error) {
@@ -37345,13 +38826,26 @@ var RovodevSkill = class RovodevSkill extends ToolSkill {
 //#region src/types/dir-feature-processor.ts
 var DirFeatureProcessor = class {
 	outputRoot;
-	inputRoot;
+	/**
+	* Ordered, non-empty list of rulesync source-tree directories. Each entry
+	* is a source tree itself — the directory that directly contains
+	* feature subdirectories (`rules/`, `skills/`, …) and single-file
+	* features (`mcp.jsonc`, `hooks.jsonc`, …). Later entries take precedence
+	* when two trees supply the same relative path. Defaults to
+	* `[join(process.cwd(), ".rulesync")]`.
+	*
+	* The singular user-facing alias (`inputRoot` in `rulesync.jsonc` / the
+	* `--input-root` CLI flag / `GenerateOptions.inputRoot`) is deprecated
+	* and collapsed into `[join(inputRoot, ".rulesync")]` before it ever
+	* reaches a processor.
+	*/
+	inputRoots;
 	dryRun;
 	avoidBlockScalars;
 	logger;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), dryRun = false, avoidBlockScalars = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, dryRun = false, avoidBlockScalars = false, logger }) {
 		this.outputRoot = outputRoot;
-		this.inputRoot = inputRoot;
+		this.inputRoots = inputRoots !== void 0 && inputRoots.length > 0 ? [inputRoots[0], ...inputRoots.slice(1)] : [join(process.cwd(), RULESYNC_RELATIVE_DIR_PATH)];
 		this.dryRun = dryRun;
 		this.avoidBlockScalars = avoidBlockScalars;
 		this.logger = logger;
@@ -39610,9 +41104,9 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 	* slug is owned by the commands feature: it must not be imported as a
 	* skill nor deleted as an orphan skill.
 	*/
-	static async isDirOwned({ dirName, inputRoot }) {
+	static async isDirOwned({ dirName, inputRoots }) {
 		return !await rulesyncCommandSlugExists({
-			inputRoot,
+			inputRoots,
 			dirName
 		});
 	}
@@ -39662,7 +41156,11 @@ const FactorydroidSkillFrontmatterSchema = z.looseObject({
 	"user-invocable": z.optional(z.boolean()),
 	"disable-model-invocation": z.optional(z.boolean()),
 	enabled: z.optional(z.boolean()),
-	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
+	license: z.optional(z.unknown()),
+	compatibility: z.optional(z.unknown()),
+	metadata: z.optional(z.unknown()),
+	version: z.optional(z.unknown())
 });
 /**
 * Represents a Factory Droid skill directory.
@@ -39715,16 +41213,10 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 		};
 	}
 	toRulesyncSkill() {
-		const frontmatter = this.getFrontmatter();
-		const factorydroidBlock = {
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
-			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter.enabled !== void 0 && { enabled: frontmatter.enabled },
-			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] }
-		};
+		const { name, description, ...factorydroidBlock } = this.getFrontmatter();
 		const rulesyncFrontmatter = {
-			name: frontmatter.name,
-			description: frontmatter.description,
+			name,
+			description,
 			targets: ["*"],
 			...Object.keys(factorydroidBlock).length > 0 && { factorydroid: factorydroidBlock }
 		};
@@ -39751,13 +41243,13 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 			rootFrontmatter: rulesyncFrontmatter,
 			section: factorydroidSection
 		});
+		const { name: _sectionName, description: _sectionDescription, ...section } = factorydroidSection ?? {};
 		const factorydroidFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
+			...section,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
-			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
-			...factorydroidSection?.enabled !== void 0 && { enabled: factorydroidSection.enabled },
-			...factorydroidSection?.["allowed-tools"] !== void 0 && { "allowed-tools": factorydroidSection["allowed-tools"] }
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable }
 		};
 		return new FactorydroidSkill({
 			outputRoot,
@@ -40169,7 +41661,10 @@ var JunieSkill = class JunieSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths(_options) {
-		return { relativeDirPath: JUNIE_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: JUNIE_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return JunieSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -42331,9 +43826,9 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 	* slug is owned by the commands feature: it must not be imported as a
 	* skill nor deleted as an orphan skill.
 	*/
-	static async isDirOwned({ dirName, inputRoot }) {
+	static async isDirOwned({ dirName, inputRoots }) {
 		return !await rulesyncCommandSlugExists({
-			inputRoot,
+			inputRoots,
 			dirName
 		});
 	}
@@ -42891,10 +44386,10 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$2, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$2, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			avoidBlockScalars: toolTarget === "cursor",
 			logger
@@ -42932,39 +44427,67 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		return rulesyncSkills;
 	}
 	/**
-	* Implementation of abstract method from DirFeatureProcessor
-	* Load and parse rulesync skill directories from .rulesync/skills/ directory
-	* and also from .rulesync/skills/.curated/ for remote skills.
-	* Local skills take precedence over curated skills with the same name.
+	* Load rulesync skill directories from a single source-tree's `skills/`
+	* (and `skills/.curated/`) subtree. `sourceTree` is the source tree
+	* itself (e.g. `/repo/.rulesync` or `/repo/.rulesync.local`). Intra-tree:
+	* local skills take precedence over curated skills with the same name.
 	*/
-	async loadRulesyncDirs() {
-		const localDirNames = [...await getLocalSkillDirNames(this.inputRoot)];
+	async loadRulesyncDirsForRoot(sourceTree) {
+		const treeParent = dirname(sourceTree);
+		const treeName = basename(sourceTree);
+		const treeSkillsDirPath = join(treeName, SKILLS_FEATURE_SUBDIR);
+		const treeCuratedSkillsDirPath = join(treeName, CURATED_SKILLS_FEATURE_SUBDIR);
+		const localDirNames = [...await getLocalSkillDirNames(sourceTree)];
 		const localSkills = await Promise.all(localDirNames.map((dirName) => RulesyncSkill.fromDir({
-			outputRoot: this.inputRoot,
+			outputRoot: treeParent,
+			relativeDirPath: treeSkillsDirPath,
 			dirName,
 			global: this.global
 		})));
-		const localSkillNames = new Set(localDirNames);
-		const curatedDirPath = join(this.inputRoot, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH);
+		const localSkillNamesByIdentity = groupSpellingsByCaseFoldedIdentity(localDirNames);
+		const curatedDirPath = join(sourceTree, CURATED_SKILLS_FEATURE_SUBDIR);
 		let curatedSkills = [];
 		if (await directoryExists(curatedDirPath)) {
 			const nonConflicting = (await findFilesByGlobs(join(curatedDirPath, "*"), { type: "dir" })).map((path) => basename(path)).filter((name) => {
-				if (localSkillNames.has(name)) {
-					this.logger.debug(`Skipping curated skill "${name}": local skill takes precedence.`);
-					return false;
-				}
-				return true;
+				const spellings = localSkillNamesByIdentity.get(caseFoldIdentity(name));
+				if (spellings === void 0) return true;
+				if (spellings.includes(name)) this.logger.debug(`Skipping curated skill "${name}": local skill takes precedence.`);
+				else this.logger.warn(formatCuratedCaseCollisionWarning({
+					artifactKind: "skill",
+					entryNoun: "skill",
+					treeDirPath: treeSkillsDirPath,
+					curatedSpelling: name,
+					localSpellings: spellings
+				}));
+				return false;
 			});
-			const curatedRelativeDirPath = RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH;
 			curatedSkills = await Promise.all(nonConflicting.map((dirName) => RulesyncSkill.fromDir({
-				outputRoot: this.inputRoot,
-				relativeDirPath: curatedRelativeDirPath,
+				outputRoot: treeParent,
+				relativeDirPath: treeCuratedSkillsDirPath,
 				dirName,
 				global: this.global
 			})));
 		}
-		const allSkills = [...localSkills, ...curatedSkills];
-		this.logger.debug(`Successfully loaded ${allSkills.length} rulesync skills (${localSkills.length} local, ${curatedSkills.length} curated)`);
+		return [...localSkills, ...curatedSkills];
+	}
+	/**
+	* Implementation of abstract method from DirFeatureProcessor.
+	*
+	* Load and parse rulesync skill directories from every configured input
+	* root's `.rulesync/skills/` tree (each root also honours its own
+	* `.curated/` subdirectory). When two roots supply a skill with the same
+	* directory name, the later root's skill replaces the earlier root's copy
+	* atomically (companion files included) — an overlay always ships a whole
+	* skill directory, never a partial patch.
+	*/
+	async loadRulesyncDirs() {
+		const allSkills = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncDirsForRoot(root))),
+			identity: (skill) => skill.getDirName(),
+			artifactName: "skill",
+			logger: this.logger
+		});
+		this.logger.debug(`Successfully loaded ${allSkills.length} rulesync skills`);
 		return allSkills;
 	}
 	/**
@@ -42980,7 +44503,17 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		}) : [];
 		const configuredRootPaths = new Set(configuredRoots.map((root) => root.relativeDirPath));
 		const roots = [...toolSkillImportRoots(paths), ...configuredRoots];
-		const seenSkillNames = /* @__PURE__ */ new Set();
+		const claimedSkillNames = new ClaimedIdentities();
+		const claimSkillName = ({ skill, relativeDirPath, sourcePath }) => {
+			const skillName = skill.getImportIdentity();
+			const claimed = claimedSkillNames.claim({
+				identity: skillName,
+				source: relativeDirPath
+			});
+			if (claimed === null) return true;
+			if (claimed.spelling !== skillName) this.logger.warn(`Case-insensitive ${this.toolTarget} skill collision: "${claimed.spelling}" and "${skillName}" resolve to the same skill directory. Keeping "${claimed.spelling}" from ${claimed.source === relativeDirPath ? "earlier in the same root" : `the higher-precedence ${claimed.source}`} and ignoring ${sourcePath}, which is not imported.`);
+			return false;
+		};
 		const toolSkills = [];
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
@@ -42996,54 +44529,60 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 					outputRoot: rootOutputRoot,
 					relativeDirPath,
 					dirName,
-					inputRoot: this.inputRoot
+					inputRoots: this.inputRoots
 				})) continue;
 				ownedDirNames.push(dirName);
 			}
 			const directorySkills = (await Promise.all(ownedDirNames.map(async (dirName) => {
+				const sourcePath = join(relativeDirPath, dirName);
 				try {
-					return await factory.class.fromDir({
-						outputRoot: rootOutputRoot,
-						relativeDirPath,
-						dirName,
-						global: this.global
-					});
+					return {
+						skill: await factory.class.fromDir({
+							outputRoot: rootOutputRoot,
+							relativeDirPath,
+							dirName,
+							global: this.global
+						}),
+						sourcePath
+					};
 				} catch (error) {
 					if (!isLenientRoot) throw error;
-					this.logger.warn(`Skipping ${join(relativeDirPath, dirName)}: ${formatError(error)}`);
+					this.logger.warn(`Skipping ${sourcePath}: ${formatError(error)}`);
 					return null;
 				}
-			}))).filter((skill) => skill !== null);
-			for (const skill of directorySkills) {
-				const skillName = skill.getImportIdentity();
-				if (seenSkillNames.has(skillName)) continue;
-				seenSkillNames.add(skillName);
-				toolSkills.push(skill);
-			}
+			}))).filter((loaded) => loaded !== null);
+			for (const { skill, sourcePath } of directorySkills) if (claimSkillName({
+				skill,
+				relativeDirPath,
+				sourcePath
+			})) toolSkills.push(skill);
 			if (!factory.class.fromFlatFile) continue;
 			const fromFlatFile = factory.class.fromFlatFile;
 			const directoryStems = new Set(ownedDirNames);
 			const flatFilePaths = (await findFilesByGlobs(join(skillsDirPath, "*.md"), { type: "file" })).filter((filePath) => !directoryStems.has(basename(filePath, ".md")));
 			const flatSkills = (await Promise.all(flatFilePaths.map(async (filePath) => {
+				const sourcePath = join(relativeDirPath, basename(filePath));
 				try {
-					return await fromFlatFile({
-						outputRoot: rootOutputRoot,
-						relativeDirPath,
-						relativeFilePath: basename(filePath),
-						global: this.global
-					});
+					return {
+						skill: await fromFlatFile({
+							outputRoot: rootOutputRoot,
+							relativeDirPath,
+							relativeFilePath: basename(filePath),
+							global: this.global
+						}),
+						sourcePath
+					};
 				} catch (error) {
 					if (!isLenientRoot) throw error;
-					this.logger.warn(`Skipping ${join(relativeDirPath, basename(filePath))}: ${formatError(error)}`);
+					this.logger.warn(`Skipping ${sourcePath}: ${formatError(error)}`);
 					return null;
 				}
-			}))).filter((skill) => skill !== null);
-			for (const skill of flatSkills) {
-				const skillName = skill.getImportIdentity();
-				if (seenSkillNames.has(skillName)) continue;
-				seenSkillNames.add(skillName);
-				toolSkills.push(skill);
-			}
+			}))).filter((loaded) => loaded !== null);
+			for (const { skill, sourcePath } of flatSkills) if (claimSkillName({
+				skill,
+				relativeDirPath,
+				sourcePath
+			})) toolSkills.push(skill);
 		}
 		this.logger.debug(`Successfully loaded ${toolSkills.length} skills from ${roots.length} root(s)`);
 		return toolSkills;
@@ -43073,7 +44612,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 					outputRoot: this.outputRoot,
 					relativeDirPath: root,
 					dirName,
-					inputRoot: this.inputRoot
+					inputRoots: this.inputRoots
 				})) continue;
 				const toolSkill = factory.class.forDeletion({
 					outputRoot: this.outputRoot,
@@ -45831,6 +47370,7 @@ const JunieSubagentFrontmatterSchema = z.looseObject({
 	disallowedTools: z.optional(z.union([z.string(), z.array(z.string())])),
 	mcpServers: z.optional(z.union([z.string(), z.array(z.string())])),
 	model: z.optional(z.string()),
+	permissionMode: z.optional(z.string()),
 	reasoningLevel: z.optional(z.string()),
 	maxTurns: z.optional(z.number()),
 	skills: z.optional(z.union([z.string(), z.array(z.string())])),
@@ -47811,14 +49351,25 @@ const subagentsProcessorToolTargetsSimulated = allToolTargetKeys$1.filter((targe
 const subagentsProcessorToolTargetsGlobal = allToolTargetKeys$1.filter((target) => {
 	return toolSubagentFactories.get(target)?.meta.supportsGlobal ?? false;
 });
+/**
+* Stands in for a discovery root when a subagent came from a tool's own config
+* file rather than a directory (see `loadAdditionalImportFiles`). The angle
+* brackets keep it from ever matching a real relative directory path.
+*/
+const INLINE_SOURCE = "<inline>";
+/**
+* The single "root" of the post-conversion output guard, which de-duplicates
+* `.rulesync/subagents/` paths rather than discovery roots.
+*/
+const OUTPUT_SOURCE = "<output>";
 var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -47864,24 +49415,31 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			rulesyncSubagents.push(toolSubagent.toRulesyncSubagent());
 		}
 		const uniqueRulesyncSubagents = [];
-		const seenOutputPaths = /* @__PURE__ */ new Set();
+		const claimedOutputPaths = new ClaimedIdentities();
 		for (const rulesyncSubagent of rulesyncSubagents) {
 			const outputPath = join(rulesyncSubagent.getRelativeDirPath(), rulesyncSubagent.getRelativeFilePath());
-			if (seenOutputPaths.has(outputPath)) {
-				this.logger.warn(`Multiple ${this.toolTarget} subagents resolve to "${outputPath}"; keeping the first and ignoring this copy.`);
+			const claimed = claimedOutputPaths.claim({
+				identity: outputPath,
+				source: OUTPUT_SOURCE
+			});
+			if (claimed !== null) {
+				this.logger.warn(claimed.spelling === outputPath ? `Multiple ${this.toolTarget} subagents resolve to "${outputPath}"; keeping the first and ignoring this copy.` : `${this.toolTarget} subagent "${outputPath}" differs only in case from "${claimed.spelling}", which is the same file on a case-insensitive filesystem; keeping the first and ignoring this copy.`);
 				continue;
 			}
-			seenOutputPaths.add(outputPath);
 			uniqueRulesyncSubagents.push(rulesyncSubagent);
 		}
 		return uniqueRulesyncSubagents;
 	}
 	/**
-	* Implementation of abstract method from Processor
-	* Load and parse rulesync subagent files from .rulesync/subagents/ directory
+	* Load subagent files from a single source-tree's `subagents/` subtree.
+	* `sourceTree` is the source tree itself (e.g. `/repo/.rulesync` or
+	* `/repo/.rulesync.local`).
 	*/
-	async loadRulesyncFiles() {
-		const subagentsDir = join(this.inputRoot, RulesyncSubagent.getSettablePaths().relativeDirPath);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = dirname(sourceTree);
+		const treeName = basename(sourceTree);
+		const treeSubagentsDirPath = join(treeName, SUBAGENTS_FEATURE_SUBDIR);
+		const subagentsDir = join(sourceTree, SUBAGENTS_FEATURE_SUBDIR);
 		if (!await directoryExists(subagentsDir)) {
 			this.logger.debug(`Rulesync subagents directory not found: ${subagentsDir}`);
 			return [];
@@ -47897,7 +49455,8 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			const filepath = join(subagentsDir, mdFile);
 			try {
 				const rulesyncSubagent = await RulesyncSubagent.fromFile({
-					outputRoot: this.inputRoot,
+					outputRoot: treeParent,
+					relativeDirPath: treeSubagentsDirPath,
 					relativeFilePath: mdFile,
 					validate: true
 				});
@@ -47908,8 +49467,24 @@ var SubagentsProcessor = class extends FeatureProcessor {
 				continue;
 			}
 		}
+		return rulesyncSubagents;
+	}
+	/**
+	* Implementation of abstract method from Processor
+	* Load and parse rulesync subagent files from every configured input root's
+	* `.rulesync/subagents/` directory, merging by relative file path so a
+	* subagent with the same target path from a later root replaces the
+	* earlier root's copy.
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncSubagents = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (subagent) => subagent.getRelativeFilePath(),
+			artifactName: "subagent",
+			logger: this.logger
+		});
 		if (rulesyncSubagents.length === 0) {
-			this.logger.debug(`No valid subagents found in ${subagentsDir}`);
+			this.logger.debug(`No valid subagents found`);
 			return [];
 		}
 		this.logger.debug(`Successfully loaded ${rulesyncSubagents.length} rulesync subagents`);
@@ -47924,7 +49499,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		const paths = factory.class.getSettablePaths({ global: this.global });
 		const roots = forDeletion ? [paths.relativeDirPath] : [paths.relativeDirPath, ...paths.importDirPaths ?? []];
 		const toolSubagents = [];
-		const seenRelativeFilePaths = /* @__PURE__ */ new Set();
+		const claimedRelativeFilePaths = new ClaimedIdentities();
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
 			const dirPath = typeof root === "string" ? root : root.relativeDirPath;
@@ -47963,37 +49538,77 @@ var SubagentsProcessor = class extends FeatureProcessor {
 				relativeFilePath: toRelativeFilePath(path),
 				global: this.global
 			})));
-			const deduped = [];
-			for (const subagent of loaded) {
-				const key = subagent.getImportIdentity();
-				if (seenRelativeFilePaths.has(key)) {
-					this.logger.warn(`Duplicate ${this.toolTarget} subagent "${key}" found in ${dirPath}; keeping the one from a higher-precedence directory and ignoring this copy.`);
-					continue;
-				}
-				seenRelativeFilePaths.add(key);
-				deduped.push(subagent);
-			}
-			toolSubagents.push(...deduped);
+			toolSubagents.push(...this.claimStandaloneSubagents({
+				loaded,
+				dirPath,
+				claimedRelativeFilePaths
+			}));
 		}
 		if (!forDeletion && factory.class.loadAdditionalImportFiles) {
 			const additionalSubagents = await factory.class.loadAdditionalImportFiles({
 				outputRoot: this.outputRoot,
 				global: this.global
 			});
-			for (const subagent of additionalSubagents) {
-				const key = subagent.getImportIdentity();
-				if (seenRelativeFilePaths.has(key)) {
-					this.logger.warn(`Duplicate ${this.toolTarget} subagent "${key}" defined inline; keeping the standalone file and ignoring the inline copy.`);
-					continue;
-				}
-				seenRelativeFilePaths.add(key);
-				toolSubagents.push(subagent);
-			}
+			toolSubagents.push(...this.claimInlineSubagents({
+				additionalSubagents,
+				claimedRelativeFilePaths
+			}));
 		}
 		this.logger.debug(`Successfully loaded ${toolSubagents.length} ${this.toolTarget} subagents from ${roots.length} root(s)`);
 		return toolSubagents;
 	}
 	/**
+	* Keeps the subagents from one discovery root whose import identity is still
+	* unclaimed, warning about each copy that loses. Split out of
+	* `loadToolFiles` so the two de-duplication passes stay readable side by
+	* side (and so that method stays within the linter's complexity budget).
+	*
+	* When more than one discovery root is scanned (e.g. Junie's `.junie/agents/`
+	* plus `.agents/`), two roots can hold a subagent with the same relative
+	* path. Downstream conversion keys by that path, so a later one would
+	* silently overwrite an earlier one. Warn instead of failing, keeping the
+	* earlier (higher-precedence) root's file.
+	*/
+	claimStandaloneSubagents({ loaded, dirPath, claimedRelativeFilePaths }) {
+		const deduped = [];
+		for (const subagent of loaded) {
+			const key = subagent.getImportIdentity();
+			const claimed = claimedRelativeFilePaths.claim({
+				identity: key,
+				source: dirPath
+			});
+			if (claimed === null) {
+				deduped.push(subagent);
+				continue;
+			}
+			const keptFrom = claimed.source === dirPath ? `the earlier one in ${dirPath}` : `the one from the higher-precedence ${claimed.source}`;
+			this.logger.warn(claimed.spelling === key ? `Duplicate ${this.toolTarget} subagent "${key}" found in ${dirPath}; keeping ${keptFrom} and ignoring this copy.` : `Duplicate ${this.toolTarget} subagent "${key}" found in ${dirPath} differs only in case from "${claimed.spelling}"; keeping ${keptFrom} and ignoring this copy.`);
+		}
+		return deduped;
+	}
+	/**
+	* The same claim-or-warn pass for subagents defined inline in a tool's own
+	* config file (see `loadAdditionalImportFiles`), which are scanned after
+	* every standalone file so a Markdown file of the same name wins.
+	*/
+	claimInlineSubagents({ additionalSubagents, claimedRelativeFilePaths }) {
+		const deduped = [];
+		for (const subagent of additionalSubagents) {
+			const key = subagent.getImportIdentity();
+			const claimed = claimedRelativeFilePaths.claim({
+				identity: key,
+				source: INLINE_SOURCE
+			});
+			if (claimed === null) {
+				deduped.push(subagent);
+				continue;
+			}
+			const kept = claimed.source === INLINE_SOURCE ? "the earlier inline definition" : `the standalone file in ${claimed.source}`;
+			this.logger.warn(claimed.spelling === key ? `Duplicate ${this.toolTarget} subagent "${key}" defined inline; keeping ${kept} and ignoring the inline copy.` : `Inline ${this.toolTarget} subagent "${key}" differs only in case from "${claimed.spelling}"; keeping ${kept} and ignoring the inline copy.`);
+		}
+		return deduped;
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Return the tool targets that this processor supports
 	*/
@@ -50923,17 +52538,32 @@ var HermesagentRule = class HermesagentRule extends ToolRule {
 * Rule generator for JetBrains Junie AI coding agent
 *
 * Generates `.junie/AGENTS.md` files based on rulesync rule content. Junie CLI
-* resolves project guidelines **first-match-wins**: `.junie/AGENTS.md` → root
-* `AGENTS.md` → legacy `.junie/guidelines.md` / `.junie/guidelines/`. Only the
-* first match is loaded, it documents no `@`-reference or file-inclusion
-* mechanism, and no `.junie/memories/` read path exists — so non-root rules
-* are folded into the single root `.junie/AGENTS.md` by the RulesProcessor
-* (`nonRoot` is `undefined`, mirroring the warp / deepagents
-* targets; decision recorded in issue #2211). The legacy
+* resolves project guidelines in this order: `.junie/AGENTS.md` → root
+* `AGENTS.md` **combined with `.junie/playbook.md` and every
+* `.junie/rules/*.md`** → legacy `.junie/guidelines.md` / `.junie/guidelines/`.
+* The multi-file branch exists, but it is unreachable while `.junie/AGENTS.md`
+* is present: that file "is used exclusively and no other guidelines files are
+* combined with it". So emitting `.junie/rules/*.md` next to the root file
+* rulesync writes would produce files Junie never reads, and moving the root
+* output to project-root `AGENTS.md` would both change every existing output
+* path and collide with the `agentsmd` target. Non-root rules therefore stay
+* folded into the single root `.junie/AGENTS.md` by the RulesProcessor
+* (`nonRoot` is `undefined`, mirroring the warp / deepagents targets) — the
+* fold is lossless, since Junie loads that one file in full. The original
+* rationale for this shape was recorded in issue #2211 and re-confirmed
+* against the 2026-08-21 docs revision in issue #2728. The legacy
 * `.junie/guidelines.md` is still accepted as an import fallback, but
 * generation always targets `.junie/AGENTS.md`. Junie uses plain markdown
 * without frontmatter requirements.
 *
+* The multi-file branch is still read on **import**, though: a repo that
+* authors `.junie/rules/*.md` or `.junie/playbook.md` by hand — the live
+* layout whenever `.junie/AGENTS.md` is absent, which is exactly the state a
+* first `rulesync import` finds — declares those paths as `importOnlyRoots`
+* and imports them as non-root rules. They are never written back there:
+* generating `.junie/AGENTS.md` moves Junie onto the first branch, where the
+* folded root file carries the same content.
+*
 * Global (user) scope writes a single `~/.junie/AGENTS.md` file. Junie merges
 * these user-scope guidelines with the project guidelines (both are included
 * and marked clearly).
@@ -50955,6 +52585,14 @@ var JunieRule = class JunieRule extends ToolRule {
 			alternativeRoots: [{
 				relativeDirPath: buildToolPath(JUNIE_DIR, ".", excludeToolDir),
 				relativeFilePath: JUNIE_LEGACY_RULE_FILE_NAME
+			}],
+			importOnlyRoots: [{
+				relativeDirPath: buildToolPath(JUNIE_DIR, JUNIE_RULES_DIR_NAME, excludeToolDir),
+				onlyWhenRootAbsent: true
+			}, {
+				relativeDirPath: buildToolPath(JUNIE_DIR, ".", excludeToolDir),
+				relativeFilePath: JUNIE_PLAYBOOK_FILE_NAME,
+				onlyWhenRootAbsent: true
 			}]
 		};
 	}
@@ -50965,7 +52603,7 @@ var JunieRule = class JunieRule extends ToolRule {
 	static isRootRelativeFilePath(relativeFilePath) {
 		return relativeFilePath === "AGENTS.md" || relativeFilePath === "guidelines.md";
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath: relativeDirPathParam, relativeFilePath, validate = true, global = false }) {
 		if (global) {
 			const paths = this.getSettablePaths({ global: true });
 			if (!("root" in paths) || !paths.root) throw new Error("JunieRule global settable paths must include a root path");
@@ -50979,7 +52617,8 @@ var JunieRule = class JunieRule extends ToolRule {
 				root: true
 			});
 		}
-		const relativeDirPath = this.getSettablePaths().root.relativeDirPath;
+		const settablePaths = this.getSettablePaths();
+		const relativeDirPath = relativeDirPathParam ?? settablePaths.root.relativeDirPath;
 		const relativePath = join(relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(join(outputRoot, relativePath));
 		return new JunieRule({
@@ -50988,7 +52627,7 @@ var JunieRule = class JunieRule extends ToolRule {
 			relativeFilePath,
 			fileContent,
 			validate,
-			root: JunieRule.isRootRelativeFilePath(relativeFilePath)
+			root: relativeDirPath === settablePaths.root.relativeDirPath && JunieRule.isRootRelativeFilePath(relativeFilePath)
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
@@ -53340,10 +54979,23 @@ const defaultGetFactory = (target) => {
 	if (!factory) throw new Error(`Unsupported tool target: ${target}`);
 	return factory;
 };
-const findFilesWithFallback = async (primaryGlob, alternativeRoots, buildAltGlob) => {
-	const primaryFilePaths = await findFilesByGlobs(primaryGlob);
+/**
+* How many skipped import-only paths a single warning names before it
+* summarizes the rest. Keeps one line readable when a rules directory holds
+* dozens of files.
+*/
+const MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS = 10;
+/**
+* Fall back to a tool's legacy roots when its primary root file is absent.
+*
+* The primary hits are passed in rather than globbed here, so that callers
+* which need "the root file Rulesync generates" — rather than "whatever root
+* the tool will read" — can keep the two apart. A legacy root is a file
+* Rulesync reads but never writes, and the difference matters to them.
+*/
+const findFilesWithFallback = async (primaryFilePaths, alternativeRoots, buildAltGlob) => {
 	if (primaryFilePaths.length > 0) return primaryFilePaths;
-	if (alternativeRoots) return findFilesByGlobs(alternativeRoots.map(buildAltGlob));
+	if (alternativeRoots) return await findFilesByGlobs(alternativeRoots.map(buildAltGlob));
 	return [];
 };
 var RulesProcessor = class extends FeatureProcessor {
@@ -53355,10 +55007,10 @@ var RulesProcessor = class extends FeatureProcessor {
 	getFactory;
 	skills;
 	featureOptions;
-	constructor({ outputRoot = process.cwd(), inputRoot = process.cwd(), toolTarget, simulateCommands = false, simulateSubagents = false, simulateSkills = false, global = false, getFactory = defaultGetFactory, skills, featureOptions, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, simulateCommands = false, simulateSubagents = false, simulateSkills = false, global = false, getFactory = defaultGetFactory, skills, featureOptions, dryRun = false, logger }) {
 		super({
 			outputRoot,
-			inputRoot,
+			inputRoots,
 			dryRun,
 			logger
 		});
@@ -53733,25 +55385,45 @@ As this project's AI coding tool, you must follow the additional conventions bel
 				claimedBy.set(target.toLowerCase(), source);
 				continue;
 			}
-			this.logger.warn(`Both ${previous} and ${source} import to ${join(RULESYNC_RULES_RELATIVE_DIR_PATH, target)} (compared case-insensitively, as on macOS and Windows); the last one wins wherever they collide.`);
+			this.logger.warn(`Both ${stripControlCharacters(previous)} and ${stripControlCharacters(source)} import to ${stripControlCharacters(join(RULESYNC_RULES_RELATIVE_DIR_PATH, target))} (compared case-insensitively, as on macOS and Windows); the last one wins wherever they collide.`);
 		}
 		return rulesyncRules;
 	}
 	/**
-	* Implementation of abstract method from FeatureProcessor
-	* Load and parse rulesync rule files from .rulesync/rules/ directory
+	* Load rulesync rule files from a single source-tree's `rules/` (and
+	* `rules/.curated/`) subtree. `sourceTree` is the source tree itself
+	* (e.g. `/repo/.rulesync` or `/repo/.rulesync.local`), NOT its parent.
+	*
+	* Intra-tree behavior — the local-wins-over-curated rule and the
+	* case-insensitive collision handling — is preserved from the previous
+	* single-root implementation. See `loadRulesyncFiles` for how the
+	* per-root results are combined into the effective set.
 	*/
-	async loadRulesyncFiles() {
-		const rulesyncOutputRoot = join(this.inputRoot, RULESYNC_RULES_RELATIVE_DIR_PATH);
-		const curatedOutputRoot = join(this.inputRoot, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH);
+	async loadRulesyncFilesForRoot(sourceTree) {
+		const treeParent = dirname(sourceTree);
+		const treeName = basename(sourceTree);
+		const treeRulesDirPath = join(treeName, RULES_FEATURE_SUBDIR);
+		const rulesyncOutputRoot = join(sourceTree, RULES_FEATURE_SUBDIR);
+		const curatedOutputRoot = join(sourceTree, CURATED_RULES_FEATURE_SUBDIR);
 		const [discoveredFiles, discoveredCuratedFiles] = await Promise.all([findFilesByGlobs(join(rulesyncOutputRoot, "**", "*.md")), findFilesByGlobs(join(curatedOutputRoot, "**", "*.md"))]);
 		const files = [.../* @__PURE__ */ new Set([...discoveredFiles, ...discoveredCuratedFiles])];
 		const localFiles = files.filter((file) => !relative(rulesyncOutputRoot, file).startsWith(`.curated${sep}`));
-		const localRelativePaths = new Set(localFiles.map((file) => relative(rulesyncOutputRoot, file)));
+		const localRelativePathsByIdentity = groupSpellingsByCaseFoldedIdentity(localFiles.map((file) => relative(rulesyncOutputRoot, file)));
 		const curatedFiles = files.filter((file) => relative(rulesyncOutputRoot, file).startsWith(`.curated${sep}`)).map((file) => ({
 			file,
 			relativeFilePath: relative(curatedOutputRoot, file)
-		})).filter(({ relativeFilePath }) => !localRelativePaths.has(relativeFilePath));
+		})).filter(({ relativeFilePath }) => {
+			const spellings = localRelativePathsByIdentity.get(caseFoldIdentity(relativeFilePath));
+			if (spellings === void 0) return true;
+			if (!spellings.includes(relativeFilePath)) this.logger.warn(formatCuratedCaseCollisionWarning({
+				artifactKind: "rule",
+				entryNoun: "file",
+				treeDirPath: treeRulesDirPath,
+				curatedSpelling: join(".curated", relativeFilePath),
+				localSpellings: spellings
+			}));
+			return false;
+		});
 		const selectedFiles = [...localFiles.map((file) => ({
 			file,
 			sourceRelativeFilePath: relative(rulesyncOutputRoot, file),
@@ -53761,25 +55433,41 @@ As this project's AI coding tool, you must follow the additional conventions bel
 			sourceRelativeFilePath: join(".curated", relativeFilePath),
 			relativeFilePath
 		}))];
-		this.logger.debug(`Found ${selectedFiles.length} rulesync files`);
-		const rulesyncRules = await Promise.all(selectedFiles.map(async ({ sourceRelativeFilePath, relativeFilePath }) => {
+		this.logger.debug(`Found ${selectedFiles.length} rulesync files under ${rulesyncOutputRoot}`);
+		return await Promise.all(selectedFiles.map(async ({ sourceRelativeFilePath, relativeFilePath }) => {
 			checkPathTraversal({
 				relativePath: sourceRelativeFilePath,
 				intendedRootDir: rulesyncOutputRoot
 			});
 			const rule = await RulesyncRule.fromFile({
-				outputRoot: this.inputRoot,
+				outputRoot: treeParent,
+				relativeDirPath: treeRulesDirPath,
 				relativeFilePath: sourceRelativeFilePath
 			});
 			if (sourceRelativeFilePath === relativeFilePath) return rule;
 			return new RulesyncRule({
-				outputRoot: this.inputRoot,
-				relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+				outputRoot: treeParent,
+				relativeDirPath: treeRulesDirPath,
 				relativeFilePath,
 				frontmatter: rule.getFrontmatter(),
 				body: rule.getBody()
 			});
 		}));
+	}
+	/**
+	* Implementation of abstract method from FeatureProcessor
+	* Load and parse rulesync rule files from every configured input root's
+	* `.rulesync/rules/` directory, merging by relative path so that a rule
+	* with the same target path from a later root replaces the earlier root's
+	* copy (case-insensitive, matching the intra-root collision handling).
+	*/
+	async loadRulesyncFiles() {
+		const rulesyncRules = mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (rule) => rule.getRelativeFilePath(),
+			artifactName: "rule",
+			logger: this.logger
+		});
 		const factory = this.getFactory(this.toolTarget);
 		const targetedRootRules = rulesyncRules.filter((rule) => rule.getFrontmatter().root).filter((rule) => factory.class.isTargetedByRulesyncRule(rule));
 		if (targetedRootRules.length === 0 && rulesyncRules.length > 0) this.logger.warn(`No root rulesync rule file found for target '${this.toolTarget}'. Consider adding 'root: true' to one of your rule files in ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
@@ -53873,23 +55561,42 @@ As this project's AI coding tool, you must follow the additional conventions bel
 					});
 				}).filter((rule) => rule.isDeletable());
 			};
+			/**
+			* Import counterpart of {@link buildDeletionRulesFromPaths} for the
+			* root-shaped scans (root, legacy roots, and read-only roots), whose
+			* paths all sit at a directory Rulesync resolves from the file itself.
+			*/
+			const buildImportRulesFromPaths = (filePaths) => Promise.all(filePaths.map((filePath) => {
+				const relativeDirPath = resolveRelativeDirPath(filePath);
+				checkPathTraversal({
+					relativePath: relativeDirPath,
+					intendedRootDir: this.outputRoot
+				});
+				return factory.class.fromFile({
+					outputRoot: this.outputRoot,
+					relativeDirPath,
+					relativeFilePath: basename(filePath),
+					global: this.global
+				});
+			}));
+			/**
+			* The tool's own root file, as opposed to whichever root
+			* `rootToolRules` ends up resolving. A legacy root reached through
+			* `alternativeRoots` is deliberately not counted here: it is a
+			* hand-authored file Rulesync never writes, so it has folded nothing in,
+			* and in Junie's resolution order it ranks *below* the multi-file layout
+			* that `importOnlyRoots` describes. Gating those roots on it would drop
+			* exactly the files the tool is really reading.
+			*
+			* Resolved once, up front, so the two blocks that need it do not depend
+			* on each other's evaluation order.
+			*/
+			const primaryRootFilePaths = settablePaths.root ? await findFilesByGlobs(join(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", settablePaths.root.relativeFilePath)) : [];
 			const rootToolRules = await (async () => {
 				if (!settablePaths.root) return [];
-				const uniqueRootFilePaths = await findFilesWithFallback(join(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", settablePaths.root.relativeFilePath), settablePaths.alternativeRoots, (alt) => join(this.outputRoot, alt.relativeDirPath, alt.relativeFilePath));
+				const uniqueRootFilePaths = await findFilesWithFallback(primaryRootFilePaths, settablePaths.alternativeRoots, (alt) => join(this.outputRoot, alt.relativeDirPath, alt.relativeFilePath));
 				if (forDeletion) return buildDeletionRulesFromPaths(uniqueRootFilePaths);
-				return await Promise.all(uniqueRootFilePaths.map((filePath) => {
-					const relativeDirPath = resolveRelativeDirPath(filePath);
-					checkPathTraversal({
-						relativePath: relativeDirPath,
-						intendedRootDir: this.outputRoot
-					});
-					return factory.class.fromFile({
-						outputRoot: this.outputRoot,
-						relativeFilePath: basename(filePath),
-						relativeDirPath,
-						global: this.global
-					});
-				}));
+				return await buildImportRulesFromPaths(uniqueRootFilePaths);
 			})();
 			this.logger.debug(`Found ${rootToolRules.length} root tool rule files`);
 			const localRootToolRules = await (async () => {
@@ -53901,7 +55608,7 @@ As this project's AI coding tool, you must follow the additional conventions bel
 						fileName
 					}));
 					if (!settablePaths.root) return [];
-					return await findFilesWithFallback(join(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", fileName), settablePaths.alternativeRoots, (alt) => join(this.outputRoot, alt.relativeDirPath, fileName));
+					return await findFilesWithFallback(await findFilesByGlobs(join(this.outputRoot, settablePaths.root.relativeDirPath ?? ".", fileName)), settablePaths.alternativeRoots, (alt) => join(this.outputRoot, alt.relativeDirPath, fileName));
 				})();
 				if (forDeletion) return buildDeletionRulesFromPaths(filePaths);
 				return (await Promise.all(filePaths.map(async (filePath) => {
@@ -53977,6 +55684,29 @@ As this project's AI coding tool, you must follow the additional conventions bel
 				}));
 			})();
 			this.logger.debug(`Found ${nestedToolRules.length} nested tool rule files`);
+			const importOnlyToolRules = await (async () => {
+				const importOnlyRoots = "importOnlyRoots" in settablePaths ? settablePaths.importOnlyRoots : void 0;
+				if (forDeletion || !importOnlyRoots || importOnlyRoots.length === 0) return [];
+				const rootFilePath = primaryRootFilePaths[0];
+				const scannedPaths = [];
+				const skippedPaths = [];
+				for (const importOnlyRoot of importOnlyRoots) {
+					const matchedPaths = await findFilesByGlobs(join(this.outputRoot, importOnlyRoot.relativeDirPath, importOnlyRoot.relativeFilePath ?? `*.${factory.meta.extension}`), { type: "file" });
+					if (importOnlyRoot.onlyWhenRootAbsent === true && rootFilePath !== void 0) {
+						skippedPaths.push(...matchedPaths);
+						continue;
+					}
+					scannedPaths.push(...matchedPaths);
+				}
+				if (skippedPaths.length > 0 && rootFilePath !== void 0) {
+					const skippedNames = skippedPaths.map((filePath) => stripControlCharacters(relative(this.outputRoot, filePath)));
+					const listedNames = skippedNames.slice(0, MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS);
+					const remainingCount = skippedNames.length - listedNames.length;
+					this.logger.warn(`Not importing ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} for ${this.toolTarget}: ${stripControlCharacters(relative(this.outputRoot, rootFilePath))} exists, and the tool reads that file exclusively. Delete them once you have checked that content is in the root file, or move it into ${RULESYNC_RULES_RELATIVE_DIR_PATH} if it is not.`);
+				}
+				return await buildImportRulesFromPaths(scannedPaths);
+			})();
+			this.logger.debug(`Found ${importOnlyToolRules.length} import-only tool rule files`);
 			const nonRootToolRules = await (async () => {
 				if (!settablePaths.nonRoot) return [];
 				const nonRootOutputRoot = join(this.outputRoot, settablePaths.nonRoot.relativeDirPath);
@@ -54009,6 +55739,7 @@ As this project's AI coding tool, you must follow the additional conventions bel
 			})();
 			this.logger.debug(`Found ${nonRootToolRules.length} non-root tool rule files`);
 			return [
+				...importOnlyToolRules,
 				...rootToolRules,
 				...localRootToolRules,
 				...rootMirrorDeletionRules,
@@ -54816,14 +56547,53 @@ function warnUnsupportedTargets(params) {
 	}
 }
 /**
-* Check if .rulesync directory exists.
-*
-* The `.rulesync/` directory lives under the *input* root (where source rules
-* are read from), not under any individual output root, so callers always pass
-* `config.getInputRoot()` here.
+* Inspect every configured input-root path. The first entry is the required
+* base source tree; later entries are optional overlays and may be absent.
+* Each existing entry is a rulesync source tree itself (the directory that
+* directly holds `rules/`, `skills/`, `mcp.jsonc`, etc.). Existing empty
+* directories are valid because delete and check workflows still need to
+* inspect generated outputs.
 */
-async function checkRulesyncDirExists(params) {
-	return fileExists(join(params.inputRoot, RULESYNC_RELATIVE_DIR_PATH));
+async function inspectInputRoots(inputRoots) {
+	const existing = [];
+	const missing = [];
+	const invalidOverlays = [];
+	const nonDirectories = /* @__PURE__ */ new Set();
+	for (const [index, root] of inputRoots.entries()) if (await directoryExists(root)) existing.push(root);
+	else {
+		missing.push(root);
+		if (await fileExists(root)) {
+			nonDirectories.add(root);
+			if (index > 0) invalidOverlays.push(root);
+		}
+	}
+	const primaryRoot = inputRoots[0];
+	const displayPrimaryRoot = stripControlCharacters(primaryRoot ?? "");
+	if (primaryRoot === void 0 || existing.includes(primaryRoot)) {
+		const invalidOverlay = invalidOverlays[0];
+		return {
+			existing,
+			missing,
+			message: invalidOverlay === void 0 ? void 0 : `Configured optional input root '${stripControlCharacters(invalidOverlay)}' exists but is not a directory.`
+		};
+	}
+	const defaultRoot = join(process.cwd(), RULESYNC_RELATIVE_DIR_PATH);
+	if (primaryRoot === defaultRoot && !nonDirectories.has(primaryRoot)) return {
+		existing,
+		missing,
+		message: `Rulesync source directory '${defaultRoot}' does not exist. Run 'rulesync init' first.`
+	};
+	const settingHint = `your input root setting ('inputRoots', or the deprecated 'inputRoot')`;
+	if (nonDirectories.has(primaryRoot)) return {
+		existing,
+		missing,
+		message: `Configured primary input root '${displayPrimaryRoot}' exists but is not a directory. Point ${settingHint} at a directory.`
+	};
+	return {
+		existing,
+		missing,
+		message: `Configured primary input root '${displayPrimaryRoot}' does not exist. Create the directory or update ${settingHint}.`
+	};
 }
 function dependsOnReachable(byId, from, target) {
 	const seen = /* @__PURE__ */ new Set();
@@ -54954,7 +56724,7 @@ async function warnSkillSubagentNameCollisions(params) {
 		const subagentsDirPath = subagentFactory.class.getSettablePaths({ global }).relativeDirPath;
 		if (subagentsDirPath !== skillFactory.class.getSettablePaths({ global }).relativeDirPath) continue;
 		const subagentsProcessor = new SubagentsProcessor({
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global,
 			logger
@@ -54962,7 +56732,7 @@ async function warnSkillSubagentNameCollisions(params) {
 		const subagentNames = new Set((await subagentsProcessor.loadRulesyncFiles()).filter((file) => file instanceof RulesyncSubagent).filter((file) => subagentFactory.class.isTargetedByRulesyncSubagent(file)).map((file) => basename(file.getRelativeFilePath(), extname(file.getRelativeFilePath()))));
 		if (subagentNames.size === 0) continue;
 		const skillNames = (await new SkillsProcessor({
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global,
 			logger
@@ -55011,6 +56781,7 @@ async function collectHermesProjectPluginNames({ config, resultsById }) {
 */
 async function generate(params) {
 	const { config, logger } = params;
+	resetRootShadowingWarnings({ logger });
 	for (const toolTarget of config.getTargets()) for (const outputRoot of config.getOutputRoots(toolTarget)) await assertPluginRootSafe({
 		toolTarget,
 		outputRoot
@@ -55149,7 +56920,7 @@ async function generateRulesCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			simulateCommands: config.getSimulateCommands(),
@@ -55199,7 +56970,7 @@ async function generateIgnoreCore(params) {
 		for (const outputRoot of config.getOutputRoots(toolTarget)) try {
 			const processor = new IgnoreProcessor({
 				outputRoot,
-				inputRoot: config.getInputRoot(),
+				inputRoots: config.getInputRoots(),
 				toolTarget,
 				global,
 				dryRun: config.isPreviewMode(),
@@ -55246,7 +57017,7 @@ async function generateMcpCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55292,7 +57063,7 @@ async function generateCommandsCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55339,7 +57110,7 @@ async function generateSubagentsCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55386,7 +57157,7 @@ async function generateSkillsCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55431,7 +57202,7 @@ async function generateHooksCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55473,7 +57244,7 @@ async function generatePermissionsCore(params) {
 					toolTarget,
 					global: config.getGlobal()
 				}),
-				inputRoot: config.getInputRoot(),
+				inputRoots: config.getInputRoots(),
 				toolTarget,
 				global: config.getGlobal(),
 				dryRun: config.isPreviewMode(),
@@ -55519,7 +57290,7 @@ async function generateChecksCore(params) {
 				toolTarget,
 				global: config.getGlobal()
 			}),
-			inputRoot: config.getInputRoot(),
+			inputRoots: config.getInputRoots(),
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
@@ -55891,6 +57662,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { JsonLogger as $, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as $t, RulesyncRuleFrontmatterSchema as A, ALL_TOOL_TARGETS_WITH_WILDCARD as At, RulesyncCheck as B, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Bt, CODEXCLI_DIR as C, removeTempDirectory as Ct, RulesyncSkill as D, writeFileBuffer as Dt, RulesyncSubagentFrontmatterSchema as E, toPosixPath as Et, getRulesyncSourceCandidates as F, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Ft, SKILL_FILE_NAME as G, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Gt, stringifyFrontmatter as H, RULESYNC_HOOKS_FILE_NAME as Ht, resolveRulesyncSourceWritePath as I, RULESYNC_CHECKS_RELATIVE_DIR_PATH as It, ConfigFileSchema as J, RULESYNC_MCP_LEGACY_FILE_NAME as Jt, ConfigResolver as K, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Kt, parseJsonc as L, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Lt, RulesyncMcp as M, ToolTargetSchema as Mt, RulesyncIgnore as N, MAX_FILE_SIZE as Nt, RulesyncSkillFrontmatterSchema as O, writeFileContent as Ot, RulesyncHooks as P, RULESYNC_AIIGNORE_FILE_NAME as Pt, ConsoleLogger as Q, RULESYNC_PERMISSIONS_FILE_NAME as Qt, RulesyncCommand as R, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Rt, CODEXCLI_BASH_RULES_FILE_NAME as S, removeFileStrict as St, RulesyncSubagent as T, runWithDirectoryRollback as Tt, loadYaml as U, RULESYNC_HOOKS_LEGACY_FILE_NAME as Ut, RulesyncCheckFrontmatterSchema as V, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Vt, SHARED_USER_MANAGED_CONFIG_PATHS as W, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Wt, SourceEntrySchema as X, RULESYNC_MCP_SCHEMA_URL as Xt, GITIGNORE_DESTINATION_KEY as Y, RULESYNC_MCP_RELATIVE_FILE_PATH as Yt, findControlCharacter as Z, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Zt, CLAUDECODE_LOCAL_RULE_FILE_NAME as _, readFileContent as _t, convertFromTool as a, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as an, assertTreeContainsNoSymlinks as at, CLAUDECODE_SKILLS_DIR_PATH as b, removeDirectoryStrict as bt, SubagentsProcessor as c, ALL_FEATURES_WITH_WILDCARD as cn, createTempDirectory as ct, IgnoreProcessor as d, fileExists as dt, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as en, fallbackLogger as et, HooksProcessor as f, findFilesByGlobs as ft, CLAUDECODE_DIR as g, listDirectoryFiles as gt, QWENCODE_LOCAL_RULE_FILE_NAME as h, isSymlink as ht, getProcessorRegistryEntry as i, RULESYNC_SKILLS_RELATIVE_DIR_PATH as in, assertDirectoryIfExists as it, RulesyncPermissions as j, PACKAGING_TOOL_TARGETS as jt, RulesyncRule as k, ALL_TOOL_TARGETS as kt, SkillsProcessor as l, DEPRECATED_FEATURE_REPLACEMENTS as ln, directoryExists as lt, QWENCODE_DIR as m, getHomeDirectory as mt, checkRulesyncDirExists as n, RULESYNC_RELATIVE_DIR_PATH as nn, CLIError as nt, isPackagingToolTarget as o, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as on, assertWritablePathInsideRoot as ot, CommandsProcessor as p, getFileSize as pt, CONFLICTING_TARGET_PAIRS as q, RULESYNC_MCP_FILE_NAME as qt, generate as r, RULESYNC_RULES_RELATIVE_DIR_PATH as rn, ErrorCodes as rt, RulesProcessor as s, ALL_FEATURES as sn, checkPathTraversal as st, importFromTool as t, RULESYNC_PERMISSIONS_SCHEMA_URL as tn, warnOnConflictingFlags as tt, McpProcessor as u, formatError as un, ensureDir as ut, CLAUDECODE_MEMORIES_DIR_NAME as v, readFileContentOrNull as vt, getLocalSkillDirNames as w, resolvePath as wt, ChecksProcessor as x, removeFile as xt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as y, removeDirectory as yt, RulesyncCommandFrontmatterSchema as z, RULESYNC_CONFIG_SCHEMA_URL as zt };
+export { SourceEntrySchema as $, RULESYNC_MCP_SCHEMA_URL as $t, RulesyncRule as A, writeFileBuffer as At, RulesyncCommandFrontmatterSchema as B, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Bt, CODEXCLI_DIR as C, removeDirectoryStrict as Ct, RulesyncSubagentFrontmatterSchema as D, resolvePath as Dt, RulesyncSubagent as E, removeTempDirectory as Et, RulesyncHooks as F, ToolTargetSchema as Ft, SHARED_USER_MANAGED_CONFIG_PATHS as G, RULESYNC_HOOKS_FILE_NAME as Gt, RulesyncCheckFrontmatterSchema as H, RULESYNC_CONFIG_SCHEMA_URL as Ht, getRulesyncSourceCandidates as I, MAX_FILE_SIZE as It, mergeInputRootConfigs as J, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Jt, SKILL_FILE_NAME as K, RULESYNC_HOOKS_LEGACY_FILE_NAME as Kt, resolveRulesyncSourceWritePath as L, RULESYNC_AIIGNORE_FILE_NAME as Lt, RulesyncPermissions as M, ALL_TOOL_TARGETS as Mt, RulesyncMcp as N, ALL_TOOL_TARGETS_WITH_WILDCARD as Nt, RulesyncSkill as O, runWithDirectoryRollback as Ot, RulesyncIgnore as P, PACKAGING_TOOL_TARGETS as Pt, GITIGNORE_DESTINATION_KEY as Q, RULESYNC_MCP_RELATIVE_FILE_PATH as Qt, parseJsonc as R, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Rt, CODEXCLI_BASH_RULES_FILE_NAME as S, removeDirectory as St, getLocalSkillDirNames as T, removeFileStrict as Tt, stringifyFrontmatter as U, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Ut, RulesyncCheck as V, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Vt, loadYaml as W, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Wt, CONFLICTING_TARGET_PAIRS as X, RULESYNC_MCP_FILE_NAME as Xt, resolveEffectiveInputRoots as Y, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Yt, ConfigFileSchema as Z, RULESYNC_MCP_LEGACY_FILE_NAME as Zt, CLAUDECODE_LOCAL_RULE_FILE_NAME as _, getHomeDirectory as _t, convertFromTool as a, RULESYNC_RELATIVE_DIR_PATH as an, CLIError as at, CLAUDECODE_SKILLS_DIR_PATH as b, readFileContent as bt, SubagentsProcessor as c, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as cn, assertTreeContainsNoSymlinks as ct, IgnoreProcessor as d, ALL_FEATURES_WITH_WILDCARD as dn, createTempDirectory as dt, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as en, findControlCharacter as et, HooksProcessor as f, DEPRECATED_FEATURE_REPLACEMENTS as fn, directoryExists as ft, CLAUDECODE_DIR as g, getFileSize as gt, QWENCODE_LOCAL_RULE_FILE_NAME as h, findFilesByGlobs as ht, getProcessorRegistryEntry as i, RULESYNC_PERMISSIONS_SCHEMA_URL as in, warnOnConflictingFlags as it, RulesyncRuleFrontmatterSchema as j, writeFileContent as jt, RulesyncSkillFrontmatterSchema as k, toPosixPath as kt, SkillsProcessor as l, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as ln, assertWritablePathInsideRoot as lt, QWENCODE_DIR as m, fileExists as mt, generate as n, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as nn, JsonLogger as nt, isPackagingToolTarget as o, RULESYNC_RULES_RELATIVE_DIR_PATH as on, ErrorCodes as ot, CommandsProcessor as p, formatError as pn, ensureDir as pt, ConfigResolver as q, RULESYNC_HOOKS_RELATIVE_FILE_PATH as qt, inspectInputRoots as r, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as rn, fallbackLogger as rt, RulesProcessor as s, RULESYNC_SKILLS_RELATIVE_DIR_PATH as sn, assertDirectoryIfExists as st, importFromTool as t, RULESYNC_PERMISSIONS_FILE_NAME as tn, ConsoleLogger as tt, McpProcessor as u, ALL_FEATURES as un, checkPathTraversal as ut, CLAUDECODE_MEMORIES_DIR_NAME as v, isSymlink as vt, stripControlCharacters as w, removeFile as wt, ChecksProcessor as x, readFileContentOrNull as xt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as y, listDirectoryFiles as yt, RulesyncCommand as z, RULESYNC_CHECKS_RELATIVE_DIR_PATH as zt };
 
-//# sourceMappingURL=import-Ds0QeVp6.js.map
+//# sourceMappingURL=import-DimKwtQ6.js.map