rulesync 16.18.0 → 16.19.0

package/dist/{import-BQpUs1JO.cjs → import-q1SKbuFR.cjs}

@@ -30,16 +30,222 @@ let node_os = require("node:os");
 node_os = __toESM(node_os, 1);
 let es_toolkit = require("es-toolkit");
 let globby = require("globby");
+let node_async_hooks = require("node:async_hooks");
+let node_util = require("node:util");
 let gray_matter = require("gray-matter");
 gray_matter = __toESM(gray_matter, 1);
 let js_yaml = require("js-yaml");
 let es_toolkit_object = require("es-toolkit/object");
 let node_fs = require("node:fs");
 let node_crypto = require("node:crypto");
-let node_util = require("node:util");
 let smol_toml = require("smol-toml");
 smol_toml = __toESM(smol_toml, 1);
 let _toon_format_toon = require("@toon-format/toon");
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, the Unicode
+* line and paragraph separators, and the plain LRM/RLM/ALM marks. A name or
+* value copied out of an untrusted config file, a fetched repository, or a
+* tool's own settings file must never reach the terminal with these intact:
+* they let the text forge log lines, reorder what is printed around them, or
+* inject escape sequences. LRM, RLM and the Arabic letter mark open no bidi
+* scope of their own, but they still reorder the neutral characters beside
+* them, so they go too — a diagnostic line is not the place to preserve the
+* typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+/**
+* Removes every control character from `text` except the line feed, so a
+* message written to be read over several lines still is.
+*
+* `stripControlCharacters` takes newlines out because a diagnostic is one line
+* and a name that carries one can forge a second. An error message is not: a
+* lock file names the process holding it over several lines, and the MCP
+* `generate` failure lists one unreadable source per line. The carriage return
+* still goes, since on its own it paints over the line already written — which
+* is why this splits on the line feed and strips each line rather than carrying
+* a second character class that has to be kept in step with the first.
+*/
+function stripControlCharactersKeepingLineFeeds(text) {
+	return text.split("\n").map(stripControlCharacters).join("\n");
+}
+/**
+* Matches the characters that take no width of their own.
+*
+* `Default_Ignorable_Code_Point` is the Unicode property for exactly this — the
+* zero-width joiners, the soft hyphen, the variation selectors, the Hangul
+* fillers, the tag characters — and the format category `Cf` covers the few
+* that sit outside it, such as the interlinear annotation marks. Both are used
+* rather than a list of ranges because a list has to be revisited every time
+* Unicode adds one, and the one that is missed is the one an attacker reaches
+* for: U+3164 HANGUL FILLER, the classic of the homograph domain names, is a
+* letter of the Hangul script and would pass every check aimed at Latin.
+*
+* The braille blank is named on its own. It carries no dots, so it draws as
+* nothing while belonging to neither set.
+*
+* None of these is a control character, so none is caught by
+* `stripControlCharacters` — and none of them shows. A name that differs from
+* another only by one of these is drawn exactly like it, which is why a name
+* that carries one is not a name a user can be asked to judge.
+*/
+const INVISIBLE_CHARACTERS_PATTERN = /[\p{Default_Ignorable_Code_Point}\p{Cf}\u2800]/gu;
+/**
+* Removes every zero-width and otherwise invisible character from `text`.
+*
+* Kept apart from `stripControlCharacters` because the two answer different
+* questions. That one asks what is safe to print; this one asks whether a name
+* shows everything it contains, which is what a prompt needs before it offers
+* the name as something to pick.
+*/
+function stripInvisibleCharacters(text) {
+	return text.replace(INVISIBLE_CHARACTERS_PATTERN, "");
+}
+/**
+* Removes every character that does not show: the control characters and the
+* invisible ones alike.
+*
+* This is the form a name has to survive unchanged before it can be offered as
+* something to choose. Callers that need the whole answer should reach for this
+* rather than composing the two strippers themselves, so that the order — and
+* the definition of "hidden" — lives in one place.
+*/
+function stripHiddenCharacters(text) {
+	return stripInvisibleCharacters(stripControlCharacters(text));
+}
+/**
+* The invisible characters that do a job in some scripts rather than only
+* hiding: the two zero-width joiners and the variation selectors.
+*
+* A Persian or Indic name spells a word with ZWNJ (U+200C) in it, and an emoji
+* name is a chain of ZWJ (U+200D) and variation selectors. Refusing those
+* outright would refuse names that are written the only way their script writes
+* them, so they are judged by where they sit rather than by what they are.
+*/
+const ZERO_WIDTH_JOINER_PATTERN = /\u200c|\u200d/u;
+const VARIATION_SELECTOR_PATTERN = /[\u{fe00}-\u{fe0f}]|[\u{e0100}-\u{e01ef}]/u;
+/** The twelve characters a keycap can be built on, per ED-14 of UTS #51. */
+const KEYCAP_BASE_PATTERN = /[0-9#*]/u;
+/** The selector that asks for the emoji form of the character before it. */
+const EMOJI_PRESENTATION_SELECTOR$1 = "️";
+/** U+20E3, which draws the box the base and the selector go inside. */
+const COMBINING_ENCLOSING_KEYCAP = "⃣";
+/**
+* Whether the three characters are an emoji keycap, spelled as UTS #51 spells
+* it: `Emoji_Keycap_Sequence := [0-9#*] FE0F 20E3`.
+*
+* The twelve bases are the only ASCII characters Unicode gives the `Emoji`
+* property to, and not one of them is a pictograph — `1` is a digit and `#` is
+* punctuation — so the joining list below cannot see the sequence, and a
+* directory named `1\u{fe0f}\u{20e3}` would be turned away as a digit padded
+* with a variation selector. It is not padding: the selector is what asks for
+* the emoji form of the digit, and the enclosing keycap behind it is what draws
+* the box around it. Both neighbors are required, which is what keeps the
+* exception to the sequence rather than handing it to every digit in every
+* name: `pdf1` with a variation selector and no keycap after it is padding
+* still, and is refused still.
+*
+* @see https://www.unicode.org/reports/tr51/#def_emoji_keycap_sequence
+*/
+function isKeycapSequence(params) {
+	const { base, selector, following } = params;
+	return base !== void 0 && KEYCAP_BASE_PATTERN.test(base) && selector === EMOJI_PRESENTATION_SELECTOR$1 && following === COMBINING_ENCLOSING_KEYCAP;
+}
+/**
+* The characters a joiner has work to do beside: the scripts whose words are
+* written with one, and the pictographs an emoji sequence is built from.
+*
+* A list of what may join rather than of what may not, because the two are not
+* the same size. `pdf` with a ZWNJ between the d and the f is `pdf` on screen
+* and a different directory underneath, and the same is true of `設定` with a
+* ZWJ after the first character: neither Latin nor Han joins anything that way,
+* and nor does Cyrillic, Greek, Hangul or kana. Naming the scripts that do —
+* the Arabic family, the Indic ones, Mongolian, and the pictographs — is what
+* keeps the exception to the names that need it, instead of handing it to every
+* writing system that is merely not Latin.
+*/
+const JOINING_CONTEXT_PATTERN = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}\p{Script=Nko}\p{Script=Mongolian}\p{Script=Devanagari}\p{Script=Bengali}\p{Script=Gurmukhi}\p{Script=Gujarati}\p{Script=Oriya}\p{Script=Tamil}\p{Script=Telugu}\p{Script=Kannada}\p{Script=Malayalam}\p{Script=Sinhala}\p{Script=Myanmar}\p{Script=Khmer}\p{Script=Tibetan}\p{Script=Adlam}\p{Extended_Pictographic}]/u;
+/** Non-global copies, because `test` on a global regex carries state between calls. */
+const CONTROL_CHARACTER_PATTERN = new RegExp(CONTROL_CHARACTERS_PATTERN.source, "u");
+const INVISIBLE_CHARACTER_PATTERN = new RegExp(INVISIBLE_CHARACTERS_PATTERN.source, "u");
+/**
+* Whether `text` carries a hidden character that is there to hide something.
+*
+* This is the question a name has to answer before it can be offered as
+* something to pick, and it is a narrower one than `stripHiddenCharacters`
+* answers. Every control character counts, and so does every invisible
+* character — except a joiner or variation selector standing where its own
+* script would put one, which is to say beside a character from a script that
+* is written with joiners, or beside a pictograph.
+*
+* A joiner is held to both of its neighbors, since it exists to bind two
+* characters and a name that ends in one is binding nothing: `設定` with a ZWJ
+* after it is `設定` on screen and a second directory underneath. A variation
+* selector is held only to the character before it, which is the one it selects
+* a form for, and which is why an emoji name may end in one.
+*
+* The keycap sequence is the one emoji the joining list cannot recognize on its
+* own, since what it is built on is a digit or an ASCII sign rather than a
+* pictograph, so it is matched whole instead.
+*
+* Han is not on the joining list, so an ideographic variation sequence — a Han
+* character followed by one of U+E0100 onward — is refused along with the rest.
+* That is the intended trade: no skill directory here is named with one, and
+* the pair is drawn as the bare character on every terminal that has no font
+* for the variant, which is the shape the check exists to refuse.
+*
+* The test is a heuristic in place of the CONTEXTJ joining rules of IDNA,
+* which decide the same question by the joining type of the characters around
+* the joiner. It errs toward accepting a name written in a script that needs
+* these characters, and toward rejecting one that mixes them into Latin, where
+* they can only be padding.
+*/
+function hasDeceptiveHiddenCharacters(text) {
+	const characters = [...text];
+	const joinsCharacter = (neighbor) => neighbor !== void 0 && JOINING_CONTEXT_PATTERN.test(neighbor);
+	return characters.some((character, index) => {
+		if (CONTROL_CHARACTER_PATTERN.test(character)) return true;
+		if (!INVISIBLE_CHARACTER_PATTERN.test(character)) return false;
+		if (VARIATION_SELECTOR_PATTERN.test(character)) {
+			if (isKeycapSequence({
+				base: characters[index - 1],
+				selector: character,
+				following: characters[index + 1]
+			})) return false;
+			return !joinsCharacter(characters[index - 1]);
+		}
+		if (!ZERO_WIDTH_JOINER_PATTERN.test(character)) return true;
+		return !joinsCharacter(characters[index - 1]) || !joinsCharacter(characters[index + 1]);
+	});
+}
+//#endregion
+//#region src/utils/truncate.ts
+/**
+* Cut `text` to `maxLength` without splitting a character in half.
+*
+* `String.prototype.slice` counts UTF-16 units, so cutting inside a surrogate
+* pair leaves a lone surrogate that the next encoder turns into a replacement
+* character, and cutting inside a `\uXXXX` escape that `JSON.stringify` wrote
+* leaves a dangling backslash. Diagnostics quote files rulesync did not write,
+* so both are reachable from a repository's own content rather than only from
+* a hand-crafted string.
+*/
+function truncateText({ text, maxLength, suffix }) {
+	if (text.length <= maxLength) return text;
+	const characters = Array.from(text.slice(0, maxLength * 2 + 2));
+	if (characters.length <= maxLength) return text;
+	const cut = characters.slice(0, maxLength).join("");
+	return `${(/\\*$/.exec(cut)?.[0].length ?? 0) % 2 === 0 ? cut : cut.slice(0, -1)}${suffix}`;
+}
+//#endregion
 //#region src/utils/error.ts
 /**
 * Convert various error types to a readable error message
@@ -64,10 +270,52 @@ let _toon_format_toon = require("@toon-format/toon");
 function isZodErrorLike(error) {
 	return error !== null && typeof error === "object" && "issues" in error && Array.isArray(error.issues) && error.issues.every((issue) => issue !== null && typeof issue === "object" && "path" in issue && Array.isArray(issue.path) && "message" in issue && typeof issue.message === "string");
 }
+/**
+* How much of a Zod error the formatted message spells out.
+*
+* One `safeParse` of a large invalid document produces an issue per offending
+* node, each carrying the path and message, so the raw expansion is bounded by
+* the size of the input rather than by anything rulesync decides — and the
+* formatted message no longer stops at a terminal: it becomes the `message` of
+* a `--json` failure document and of an MCP result. The first few issues are
+* what tells the reader which file to open; the rest is the same information
+* again, at whatever length the input chose.
+*/
+const MAX_ZOD_ISSUES_LENGTH = 2e3;
+/**
+* How much of any other error the formatted message spells out.
+*
+* Larger than the Zod bound because the text is the error's own sentence rather
+* than a re-listing of one issue per offending node, and because the MCP
+* `generate` failure hands this one a line per unreadable source. Bounded all
+* the same: a parser quotes the offending line verbatim, and a minified file is
+* one line the length of the file.
+*/
+const MAX_ERROR_MESSAGE_LENGTH = 8e3;
+/**
+* Strip and bound an error message that is about to be read by something other
+* than a terminal — a `--json` failure document, an MCP result.
+*
+* The line feed stays: several messages are deliberately written over more than
+* one line, and running them together would cost more than the newline can do
+* here. Everything that reorders the text around it, or that an escape sequence
+* is written with, goes.
+*/
+function boundErrorMessage(text) {
+	return truncateText({
+		text: stripControlCharactersKeepingLineFeeds(text),
+		maxLength: MAX_ERROR_MESSAGE_LENGTH,
+		suffix: "…(truncated)"
+	});
+}
 function formatError(error) {
-	if (error instanceof zod.ZodError || isZodErrorLike(error)) return `Zod raw error: ${JSON.stringify(error.issues)}`;
-	if (error instanceof Error) return `${error.name}: ${error.message}`;
-	return String(error);
+	if (error instanceof zod.ZodError || isZodErrorLike(error)) return `Zod raw error: ${truncateText({
+		text: stripControlCharacters(JSON.stringify(error.issues)),
+		maxLength: MAX_ZOD_ISSUES_LENGTH,
+		suffix: "…(truncated)"
+	})}`;
+	if (error instanceof Error) return boundErrorMessage(`${error.name}: ${error.message}`);
+	return boundErrorMessage(String(error));
 }
 //#endregion
 //#region src/types/features.ts
@@ -147,34 +395,34 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$299 } = node_path.posix;
+const { join: join$298 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$299(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$298(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$299(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$299(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$298(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$298(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$298(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -361,7 +609,8 @@ const subagentsProcessorToolTargetTuple = [
 	"zoocode",
 	"rovodev",
 	"takt",
-	"vibe"
+	"vibe",
+	"zcode"
 ];
 const skillsProcessorToolTargetTuple = [
 	"agentsmd",
@@ -541,138 +790,6 @@ async function mapWithConcurrency({ items, limit, mapper }) {
 	return results;
 }
 //#endregion
-//#region src/utils/control-characters.ts
-/**
-* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
-* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
-* line and paragraph separators, and the plain LRM/RLM/ALM marks. A name or value
-* copied out of an untrusted config file, a fetched repository, or a tool's own
-* settings file must never reach the terminal with these intact: they let the
-* text forge log lines, reorder what is printed around them, or inject escape
-* sequences. LRM, RLM and the Arabic letter mark open no bidi scope of their
-* own, but they still reorder the neutral characters beside them, so they go too — a diagnostic line is not the
-* place to preserve the typography of a right-to-left name.
-*/
-const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
-/**
-* Removes every control character from `text` so it is safe to splice into a
-* log line or other terminal output.
-*/
-function stripControlCharacters(text) {
-	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
-}
-/**
-* Matches the characters that take no width of their own.
-*
-* `Default_Ignorable_Code_Point` is the Unicode property for exactly this — the
-* zero-width joiners, the soft hyphen, the variation selectors, the Hangul
-* fillers, the tag characters — and the format category `Cf` covers the few
-* that sit outside it, such as the interlinear annotation marks. Both are used
-* rather than a list of ranges because a list has to be revisited every time
-* Unicode adds one, and the one that is missed is the one an attacker reaches
-* for: U+3164 HANGUL FILLER, the classic of the homograph domain names, is a
-* letter of the Hangul script and would pass every check aimed at Latin.
-*
-* The braille blank is named on its own. It carries no dots, so it draws as
-* nothing while belonging to neither set.
-*
-* None of these is a control character, so none is caught by
-* `stripControlCharacters` — and none of them shows. A name that differs from
-* another only by one of these is drawn exactly like it, which is why a name
-* that carries one is not a name a user can be asked to judge.
-*/
-const INVISIBLE_CHARACTERS_PATTERN = /[\p{Default_Ignorable_Code_Point}\p{Cf}\u2800]/gu;
-/**
-* Removes every zero-width and otherwise invisible character from `text`.
-*
-* Kept apart from `stripControlCharacters` because the two answer different
-* questions. That one asks what is safe to print; this one asks whether a name
-* shows everything it contains, which is what a prompt needs before it offers
-* the name as something to pick.
-*/
-function stripInvisibleCharacters(text) {
-	return text.replace(INVISIBLE_CHARACTERS_PATTERN, "");
-}
-/**
-* Removes every character that does not show: the control characters and the
-* invisible ones alike.
-*
-* This is the form a name has to survive unchanged before it can be offered as
-* something to choose. Callers that need the whole answer should reach for this
-* rather than composing the two strippers themselves, so that the order — and
-* the definition of "hidden" — lives in one place.
-*/
-function stripHiddenCharacters(text) {
-	return stripInvisibleCharacters(stripControlCharacters(text));
-}
-/**
-* The invisible characters that do a job in some scripts rather than only
-* hiding: the two zero-width joiners and the variation selectors.
-*
-* A Persian or Indic name spells a word with ZWNJ (U+200C) in it, and an emoji
-* name is a chain of ZWJ (U+200D) and variation selectors. Refusing those
-* outright would refuse names that are written the only way their script writes
-* them, so they are judged by where they sit rather than by what they are.
-*/
-const ZERO_WIDTH_JOINER_PATTERN = /\u200c|\u200d/u;
-const VARIATION_SELECTOR_PATTERN = /[\u{fe00}-\u{fe0f}]|[\u{e0100}-\u{e01ef}]/u;
-/**
-* The characters a joiner has work to do beside: the scripts whose words are
-* written with one, and the pictographs an emoji sequence is built from.
-*
-* A list of what may join rather than of what may not, because the two are not
-* the same size. `pdf` with a ZWNJ between the d and the f is `pdf` on screen
-* and a different directory underneath, and the same is true of `設定` with a
-* ZWJ after the first character: neither Latin nor Han joins anything that way,
-* and nor does Cyrillic, Greek, Hangul or kana. Naming the scripts that do —
-* the Arabic family, the Indic ones, Mongolian, and the pictographs — is what
-* keeps the exception to the names that need it, instead of handing it to every
-* writing system that is merely not Latin.
-*/
-const JOINING_CONTEXT_PATTERN = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}\p{Script=Nko}\p{Script=Mongolian}\p{Script=Devanagari}\p{Script=Bengali}\p{Script=Gurmukhi}\p{Script=Gujarati}\p{Script=Oriya}\p{Script=Tamil}\p{Script=Telugu}\p{Script=Kannada}\p{Script=Malayalam}\p{Script=Sinhala}\p{Script=Myanmar}\p{Script=Khmer}\p{Script=Tibetan}\p{Script=Adlam}\p{Extended_Pictographic}]/u;
-/** Non-global copies, because `test` on a global regex carries state between calls. */
-const CONTROL_CHARACTER_PATTERN = new RegExp(CONTROL_CHARACTERS_PATTERN.source, "u");
-const INVISIBLE_CHARACTER_PATTERN = new RegExp(INVISIBLE_CHARACTERS_PATTERN.source, "u");
-/**
-* Whether `text` carries a hidden character that is there to hide something.
-*
-* This is the question a name has to answer before it can be offered as
-* something to pick, and it is a narrower one than `stripHiddenCharacters`
-* answers. Every control character counts, and so does every invisible
-* character — except a joiner or variation selector standing where its own
-* script would put one, which is to say beside a character from a script that
-* is written with joiners, or beside a pictograph.
-*
-* A joiner is held to both of its neighbors, since it exists to bind two
-* characters and a name that ends in one is binding nothing: `設定` with a ZWJ
-* after it is `設定` on screen and a second directory underneath. A variation
-* selector is held only to the character before it, which is the one it selects
-* a form for, and which is why an emoji name may end in one.
-*
-* Han is not on the joining list, so an ideographic variation sequence — a Han
-* character followed by one of U+E0100 onward — is refused along with the rest.
-* That is the intended trade: no skill directory here is named with one, and
-* the pair is drawn as the bare character on every terminal that has no font
-* for the variant, which is the shape the check exists to refuse.
-*
-* The test is a heuristic in place of the CONTEXTJ joining rules of IDNA,
-* which decide the same question by the joining type of the characters around
-* the joiner. It errs toward accepting a name written in a script that needs
-* these characters, and toward rejecting one that mixes them into Latin, where
-* they can only be padding.
-*/
-function hasDeceptiveHiddenCharacters(text) {
-	const characters = [...text];
-	const joinsCharacter = (neighbor) => neighbor !== void 0 && JOINING_CONTEXT_PATTERN.test(neighbor);
-	return characters.some((character, index) => {
-		if (CONTROL_CHARACTER_PATTERN.test(character)) return true;
-		if (!INVISIBLE_CHARACTER_PATTERN.test(character)) return false;
-		if (VARIATION_SELECTOR_PATTERN.test(character)) return !joinsCharacter(characters[index - 1]);
-		if (!ZERO_WIDTH_JOINER_PATTERN.test(character)) return true;
-		return !joinsCharacter(characters[index - 1]) || !joinsCharacter(characters[index + 1]);
-	});
-}
-//#endregion
 //#region src/utils/vitest.ts
 function isEnvTest() {
 	return process.env.NODE_ENV === "test";
@@ -1029,7 +1146,16 @@ async function isSymlink(filepath) {
 		return false;
 	}
 }
-async function listDirectoryFiles(dir) {
+/**
+* Every entry name directly under `dir`, of whatever kind, in the order the
+* filesystem reports them.
+*
+* Named for what it returns, because {@link listFileNames} sits beside it and
+* answers a narrower question: this one reports directories and links as well
+* as files, and reads an unreadable directory as an empty one instead of
+* failing. Picking this where the other was meant brings both of those back.
+*/
+async function listDirectoryEntryNames(dir) {
 	try {
 		return await (0, node_fs_promises.readdir)(dir);
 	} catch {
@@ -1041,6 +1167,20 @@ function countHiddenSegments(filePath) {
 	return splitPathSegments(filePath).filter(isHiddenPathSegment).length;
 }
 /**
+* A path the running platform produced, written posix-separated.
+*
+* Not {@link toPosixPath}, which rewrites every backslash whatever it means. That
+* is right for a path a caller spelled, which may be spelled either way; it is
+* wrong for one the platform handed back. On a posix platform a backslash is an
+* ordinary character in a name, so rewriting it folds `a\b` onto `a/b` -- two
+* different directories, and wherever the result is used as a file's identity the
+* second one to be seen is taken for a repeat of the first and dropped. On
+* Windows no name can hold a backslash, so the rewrite there is lossless.
+*/
+function nativePathToPosix(filePath) {
+	return node_path.sep === "\\" ? filePath.replaceAll("\\", "/") : filePath;
+}
+/**
 * The real file a path denotes, posix-separated so it compares against the globby results
 * that produce it. Two paths share an identity when they resolve to the very same file --
 * a link beside its target, a link into a shared tree, or a cycle that walks back into an
@@ -1048,19 +1188,61 @@ function countHiddenSegments(filePath) {
 */
 async function realFileIdentity(filePath) {
 	try {
-		return toPosixPath(await (0, node_fs_promises.realpath)(filePath));
+		return nativePathToPosix(await (0, node_fs_promises.realpath)(filePath));
 	} catch {
-		return toPosixPath(filePath);
+		return nativePathToPosix(filePath);
 	}
 }
 /**
+* Where the file `targetPath` really denotes sits relative to the one `rootPath`
+* does, with every link on both sides resolved. Posix-separated, because the
+* resolved paths it is built from are; a caller that splits it must split on `/`
+* alone, which is also the only separator a real name can never contain.
+*
+* Both sides fall back to their literal path when they cannot be resolved, so an
+* unresolvable path reads as an escape rather than as a contained one.
+*/
+async function resolvedRelativePath({ rootPath, targetPath }) {
+	const [realRootPath, realTargetPath] = await Promise.all([realFileIdentity(rootPath), realFileIdentity(targetPath)]);
+	return node_path.posix.relative(realRootPath, realTargetPath);
+}
+/**
+* Whether a posix relative path -- one {@link resolvedRelativePath} returned, or any
+* built the same way -- leads out of the root it was taken against.
+*
+* Exported so a caller that already holds the relative path can ask this of the very
+* path it goes on to read, instead of resolving both sides a second time and judging
+* a result it then has to trust is the same one.
+*/
+function posixRelativePathEscapesRoot(relativePath) {
+	return relativePath === ".." || relativePath.startsWith("../") || node_path.posix.isAbsolute(relativePath);
+}
+/**
+* How many trailing segments `filePath` and `identity` have in common.
+*
+* A path that walked through no link at all shares all of its own segments with
+* the file's identity; one that walked through a link named differently from
+* its target parts from the identity at that segment and shares only what
+* follows it. Counting from the end rather than testing the two for equality is
+* what lets the comparison hold for a path that is not itself resolved: a glob
+* rooted at a directory that is a link of its own gives every candidate the
+* same unresolved prefix, and only the segments below it decide.
+*/
+function sharedTrailingSegments(filePath, identity) {
+	const left = splitPathSegments(nativePathToPosix(filePath));
+	const right = splitPathSegments(identity);
+	let shared = 0;
+	while (shared < left.length && shared < right.length && left[left.length - 1 - shared] === right[right.length - 1 - shared]) shared++;
+	return shared;
+}
+/**
 * Pick the one path that represents a file among the paths that resolve to it.
 *
-* The path that walked through no link at all wins outright: it is already the real one,
-* so it equals the file's identity. That keeps the real location of a file as the path
-* callers see, rather than an alias that happens to sort first -- a directory link named
-* `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a cycle must not replace
-* `sub/note.md` with the same file reached back through the cycle.
+* The path that walked through no link at all wins outright: it shares every one of its
+* segments with the file's identity, which no alias does. That keeps the real location of
+* a file as the path callers see, rather than an alias that happens to sort first -- a
+* directory link named `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a
+* cycle must not replace `sub/note.md` with the same file reached back through the cycle.
 * Failing that, the fewest dot-prefixed segments wins: when only links are on offer, the
 * named one represents the entry rather than a hidden alias that a hidden-entry rule may
 * then drop, taking the named path's content with it. `candidates` arrives in sorted
@@ -1068,8 +1250,9 @@ async function realFileIdentity(filePath) {
 */
 function chooseRepresentative(candidates, identity) {
 	return candidates.reduce((best, candidate) => {
-		if (toPosixPath(best) === identity) return best;
-		if (toPosixPath(candidate) === identity) return candidate;
+		const bestShared = sharedTrailingSegments(best, identity);
+		const candidateShared = sharedTrailingSegments(candidate, identity);
+		if (candidateShared !== bestShared) return candidateShared > bestShared ? candidate : best;
 		return countHiddenSegments(candidate) < countHiddenSegments(best) ? candidate : best;
 	});
 }
@@ -1167,7 +1350,7 @@ async function dedupeNamesByFileIdentity(params) {
 	});
 	const entriesByIdentity = /* @__PURE__ */ new Map();
 	for (const [index, entry] of entries.entries()) {
-		const identity = identities[index] ?? toPosixPath((0, node_path.join)(dirPath, entry.name));
+		const identity = identities[index] ?? nativePathToPosix((0, node_path.join)(dirPath, entry.name));
 		const group = entriesByIdentity.get(identity);
 		if (group === void 0) entriesByIdentity.set(identity, [entry]);
 		else group.push(entry);
@@ -1219,6 +1402,94 @@ async function listFileNames(dirPath, options = {}) {
 		nameFilter: options.nameFilter
 	});
 }
+/**
+* The paths of every file below `dirPath`, relative to it, walked rather than
+* globbed.
+*
+* The recursive counterpart of {@link listFileNames}, and there for the same
+* reason: globby reads a backslash as a path separator and rewrites it in the
+* paths it returns, so a file named `back\\slash.md` comes back as
+* `back/slash.md` — a path that belongs to no file, under a name that belongs
+* to no file either.
+*
+* A root that is not there is an empty root. A root that is there but cannot be
+* read is reported, so it is never mistaken for an empty one — as is a
+* directory below it, since a subtree silently missing from the result is the
+* same mistake one level down.
+*
+* A directory link is followed like any other directory, but each real
+* directory is walked only once, so neither a cycle nor a mesh of links can
+* make the walk repeat itself -- taking every distinct route through a graph of
+* aliases would cost one traversal per route, which a handful of links is
+* enough to make hopeless. The name a twice-reachable directory is reported
+* under is therefore whichever the walk reaches first, and the walk goes level
+* by level with each level sorted, so that is the shortest path to it and the
+* first in sorted order among equals. Note the difference from
+* {@link findFilesByGlobs}, which resolves each of its results and keeps the
+* real one: here a link nearer the root than the directory it points at stands
+* in for it. `nameFilter` narrows the files, not the directories the walk
+* descends into.
+*
+* The cost is one round of `readdir` per directory, taken in sequence, and the
+* whole of a level is held at once, so residency follows the widest level
+* rather than the deepest path.
+*/
+async function listFilePathsRecursively(dirPath, options = {}) {
+	const { followSymbolicLinks = true, includeHidden = false, nameFilter, deduplicateByFileIdentity = false } = options;
+	if (!await directoryExists(dirPath)) return [];
+	const filePaths = [];
+	const walkedIdentities = /* @__PURE__ */ new Set();
+	let level = [{
+		currentPath: dirPath,
+		prefix: ""
+	}];
+	while (level.length > 0) {
+		const nextLevel = [];
+		for (const { currentPath, prefix } of level.toSorted((a, b) => a.prefix < b.prefix ? -1 : a.prefix > b.prefix ? 1 : 0)) {
+			const identity = await realFileIdentity(currentPath);
+			if (walkedIdentities.has(identity)) continue;
+			walkedIdentities.add(identity);
+			const [fileNames, dirNames] = await Promise.all([listFileNames(currentPath, {
+				followSymbolicLinks,
+				includeHidden,
+				nameFilter
+			}), listSubdirectoryNames(currentPath, {
+				followSymbolicLinks,
+				includeHidden
+			})]);
+			for (const fileName of fileNames) filePaths.push(prefix === "" ? fileName : (0, node_path.join)(prefix, fileName));
+			for (const dirName of dirNames) nextLevel.push({
+				currentPath: (0, node_path.join)(currentPath, dirName),
+				prefix: prefix === "" ? dirName : (0, node_path.join)(prefix, dirName)
+			});
+		}
+		level = nextLevel;
+	}
+	return deduplicateByFileIdentity ? await deduplicateRelativePathsByFileIdentity({
+		dirPath,
+		relativePaths: filePaths
+	}) : filePaths.toSorted();
+}
+/**
+* One path per real file, chosen the way {@link findFilesByGlobs} chooses it.
+*
+* The walk de-duplicates the directories it descends into, so it cannot loop,
+* but it still reports every name it walks past: a file reached under two names
+* is listed twice. A caller reading the result as a set of files has to fold
+* those aliases together, and has to fold them the same way the glob does, or
+* the two disagree about the name a file has.
+*/
+async function deduplicateRelativePathsByFileIdentity({ dirPath, relativePaths }) {
+	const candidatesByFile = /* @__PURE__ */ new Map();
+	for (const relativePath of relativePaths.toSorted()) {
+		const absolutePath = (0, node_path.join)(dirPath, relativePath);
+		const identity = await realFileIdentity(absolutePath);
+		const candidates = candidatesByFile.get(identity);
+		if (candidates === void 0) candidatesByFile.set(identity, [absolutePath]);
+		else candidates.push(absolutePath);
+	}
+	return [...candidatesByFile.entries()].map(([identity, candidates]) => (0, node_path.relative)(dirPath, chooseRepresentative(candidates, identity))).toSorted();
+}
 async function removeDirectory(dirPath) {
 	if ([
 		".",
@@ -1380,24 +1651,111 @@ var CLIError = class extends Error {
 //#region src/utils/warned-once.ts
 /**
 * The messages a once-per-run warning has already emitted in this process.
-* This lives in its own module, free of imports, so the vitest setup file can
-* clear it between tests without pulling `logger.js` into every test's module
-* graph (which would defeat the module mocks some of those tests install).
+* This lives in its own module, importing nothing of rulesync's, so the vitest
+* setup file can clear it between tests without pulling `logger.js` into every
+* test's module graph (which would defeat the module mocks some of those tests
+* install).
 */
-const warnedOnceMessages = /* @__PURE__ */ new Set();
+const processWideMessages = /* @__PURE__ */ new Set();
+/**
+* The set an operation that opened its own scope uses instead.
+*
+* The MCP server does not serialize requests, so two runs can be in flight at
+* once. Sharing one set between them would let the first run spend the token
+* for a message and leave the second one's result silent about a diagnostic
+* that applies to it just as much. A scope gives each run its own bookkeeping.
+*/
+const scopedMessages = new node_async_hooks.AsyncLocalStorage();
+function currentMessages() {
+	return scopedMessages.getStore() ?? processWideMessages;
+}
 /** Whether `message` has not been emitted yet; records it when it has not. */
 function claimWarnOnce(message) {
-	if (warnedOnceMessages.has(message)) return false;
-	warnedOnceMessages.add(message);
+	const messages = currentMessages();
+	if (messages.has(message)) return false;
+	messages.add(message);
 	return true;
 }
-/** Forget which warnings were already emitted, so each test starts silent. */
+/** Forget which warnings were already emitted, so the next run starts silent. */
 function resetWarnedOnceMessages() {
-	warnedOnceMessages.clear();
+	currentMessages().clear();
+}
+/**
+* Run `operation` with its own once-per-run bookkeeping, so a concurrent run
+* neither spends its tokens nor clears its record.
+*/
+async function withWarnOnceScope(operation) {
+	return await scopedMessages.run(/* @__PURE__ */ new Set(), operation);
 }
 //#endregion
 //#region src/utils/logger.ts
 /**
+* Formats a log line the way `console.warn` would, so a warning that is handed
+* back to a caller reads the same as the one that reaches a terminal.
+*/
+function formatLogLine({ message, args }) {
+	return args.length === 0 ? message : (0, node_util.format)(message, ...args);
+}
+/**
+* How much a collecting logger keeps: at most this many warnings, each at most
+* this long, and no more than this in total.
+*
+* Collected warnings travel to places a console line does not — a `--json`
+* document that another program parses, an MCP result that an agent reads as
+* context — and their text quotes files rulesync did not write. So the amount a
+* repository can push through has to be bounded twice over: a config with
+* thousands of odd keys is a plausible accident, and a report sized in hundreds
+* of kilobytes is a generous budget for text aimed at whoever reads it next.
+* The total is the binding limit; the per-line and per-count limits keep one
+* enormous warning, or one enormous number of them, from being the whole of it.
+*/
+const MAX_COLLECTED_WARNINGS = 100;
+const MAX_COLLECTED_WARNING_LENGTH = 1e3;
+const MAX_COLLECTED_TOTAL_LENGTH = 8e3;
+/**
+* How many distinct warnings the de-duplication remembers.
+*
+* The record has to outlive the reported lines — a line dropped for want of
+* budget must not be counted again the next time the same diagnostic repeats —
+* so it grows with the number of distinct warnings a run raises rather than
+* with the number reported. Bounded for the same reason everything else here
+* is: past this many, later repeats are counted rather than recognized, which
+* inflates the trailing count but cannot grow the record without end.
+*/
+const MAX_DEDUPLICATED_WARNINGS = 1e3;
+/**
+* A bounded list of warning lines.
+*/
+var WarningCollection = class {
+	lines = [];
+	seen = /* @__PURE__ */ new Set();
+	totalLength = 0;
+	omitted = 0;
+	add({ message, args }) {
+		const kept = truncateText({
+			text: stripControlCharacters(formatLogLine({
+				message,
+				args
+			})),
+			maxLength: MAX_COLLECTED_WARNING_LENGTH,
+			suffix: "…(truncated)"
+		});
+		if (this.seen.has(kept)) return;
+		if (this.lines.length >= MAX_COLLECTED_WARNINGS || this.totalLength + kept.length > MAX_COLLECTED_TOTAL_LENGTH) {
+			if (this.seen.size < MAX_DEDUPLICATED_WARNINGS) this.seen.add(kept);
+			this.omitted++;
+			return;
+		}
+		this.seen.add(kept);
+		this.lines.push(kept);
+		this.totalLength += kept.length;
+	}
+	toArray() {
+		if (this.omitted === 0) return [...this.lines];
+		return [...this.lines, `… and ${this.omitted} more warning(s) not reported`];
+	}
+};
+/**
 * Base class for shared verbose/silent state and configuration logic
 */
 var BaseLogger = class {
@@ -1413,6 +1771,9 @@ var BaseLogger = class {
 	get silent() {
 		return this._silent;
 	}
+	get reportsWhileSilent() {
+		return false;
+	}
 	configure({ verbose, silent }) {
 		this._silent = silent;
 		this._verbose = verbose && !silent;
@@ -1458,11 +1819,18 @@ var ConsoleLogger = class extends BaseLogger {
 /**
 * JsonLogger - structured JSON output to stdout/stderr
 *
-* All console output methods (info, success, warn, debug) are no-ops.
+* The console output methods (info, success, debug) are no-ops. `warn` is not:
+* a diagnostic that only reached the console would be invisible to a `--json`
+* consumer, which reads the document and nothing else, so warnings are
+* collected and emitted as the document's top-level `warnings` array instead.
+* Top-level rather than inside `data` so it can never collide with a key a
+* command captured, and so it survives on the failure document too — the case
+* where a diagnostic about the input is most likely to explain the failure.
 */
 var JsonLogger = class extends BaseLogger {
 	_jsonOutputDone = false;
 	_jsonData = {};
+	_warnings = new WarningCollection();
 	_commandName;
 	_version;
 	constructor({ command, version, verbose = false, silent = false }) {
@@ -1491,6 +1859,8 @@ var JsonLogger = class extends BaseLogger {
 			command: this._commandName,
 			version: this._version
 		};
+		const warnings = this._warnings.toArray();
+		if (warnings.length > 0) output.warnings = warnings;
 		if (success) output.data = this._jsonData;
 		else if (error) {
 			output.error = {
@@ -1506,7 +1876,13 @@ var JsonLogger = class extends BaseLogger {
 	}
 	info(_message, ..._args) {}
 	success(_message, ..._args) {}
-	warn(_message, ..._args) {}
+	warn(message, ...args) {
+		if (this._silent) return;
+		this._warnings.add({
+			message,
+			args
+		});
+	}
 	error(message, code, ..._args) {
 		if (isEnvTest()) return;
 		const errorMessage = message instanceof Error ? message.message : message;
@@ -1532,13 +1908,110 @@ function warnOnConflictingFlags({ verbose, silent, jsonMode }) {
 	console.warn("Both --verbose and --silent specified; --silent takes precedence");
 }
 /**
+* Where `fallbackLogger` sends what it is given, scoped to the operation that
+* adopted it.
+*
+* An `AsyncLocalStorage` rather than a plain variable because the target is
+* per-operation, not per-process: a long-lived MCP server can have two requests
+* in flight at once, and a save/restore pair would let the first one to finish
+* hand the still-running request's warnings back to a console nobody reads.
+* Each operation sees only its own store.
+*/
+const fallbackTargetStorage = new node_async_hooks.AsyncLocalStorage();
+/**
+* Where warnings go outside any adopted scope: a plain console logger, which is
+* what a code path with no logger threaded through would otherwise have used.
+*/
+const defaultFallbackTarget = new ConsoleLogger();
+function currentFallbackTarget() {
+	return fallbackTargetStorage.getStore() ?? defaultFallbackTarget;
+}
+/**
+* True while the forwarder is inside a call it is forwarding.
+*
+* The adopted target is supposed to be something other than the forwarder, but
+* a wrapper *around* it — `hooks-processor.ts` returns one that prefixes the
+* tool target onto every warning — passes the identity check in
+* {@link withFallbackLoggerTarget} and would forward straight back here. A
+* plain module-level flag is enough because the forwarding is synchronous: the
+* call returns before anything else can run.
+*/
+let forwarding = false;
+/**
+* Reads from, or writes to, whichever logger the running operation adopted,
+* with the wrapper case above cut off at one hop.
+*
+* Every member of the forwarder goes through here, not just the two that write:
+* `warnOnceWithFallback` reads `silent` and `reportsWhileSilent` before it ever
+* calls `warn`, so a guard on the writing side alone would still be reached
+* through a getter that never returns.
+*/
+function throughFallbackTarget(use) {
+	if (forwarding) return use(defaultFallbackTarget);
+	forwarding = true;
+	try {
+		return use(currentFallbackTarget());
+	} finally {
+		forwarding = false;
+	}
+}
+/**
 * Shared fallback logger for code paths that have no command logger threaded
 * through (module-level translators, `warnWithFallback(undefined, ...)`).
-* `wrapCommand` configures it from CLI flags and `ConfigResolver.resolve`
-* re-configures it from the resolved config, so `silent`/`verbose` settings
-* are honored even on paths where the command logger is not available.
+*
+* It is a thin forwarder rather than a logger of its own so that the operation
+* currently running can adopt it: `wrapCommand` points it at the command
+* logger, which is how a warning raised deep in a translator still reaches a
+* `--json` document or an MCP result instead of being written to a console that
+* nobody in those modes is reading. Modules that captured a reference to
+* `fallbackLogger` at import time follow the redirection too, which a
+* swapped-out binding would not give us.
+*/
+const fallbackLogger = {
+	configure(options) {
+		defaultFallbackTarget.configure(options);
+	},
+	get verbose() {
+		return throughFallbackTarget((target) => target.verbose);
+	},
+	get silent() {
+		return throughFallbackTarget((target) => target.silent);
+	},
+	get reportsWhileSilent() {
+		return throughFallbackTarget((target) => target.reportsWhileSilent);
+	},
+	get jsonMode() {
+		return throughFallbackTarget((target) => target.jsonMode);
+	},
+	captureData(_key, _value) {},
+	getJsonData() {
+		return {};
+	},
+	outputJson(_success, _error) {},
+	info(_message, ..._args) {},
+	success(_message, ..._args) {},
+	warn(message, ...args) {
+		throughFallbackTarget((target) => {
+			target.warn(message, ...args);
+		});
+	},
+	error(message, code, ...args) {
+		defaultFallbackTarget.error(message, code, ...args);
+	},
+	debug(_message, ..._args) {}
+};
+/**
+* Run `operation` with `fallbackLogger` pointed at `logger`, so warnings raised
+* where no logger was threaded through end up in the same place as the rest of
+* that operation's diagnostics.
+*
+* The redirection lasts exactly as long as the operation and is invisible to
+* anything running beside it.
 */
-const fallbackLogger = new ConsoleLogger();
+async function withFallbackLoggerTarget({ logger, operation }) {
+	if (logger === fallbackLogger) return await operation();
+	return await fallbackTargetStorage.run(logger, () => withWarnOnceScope(operation));
+}
 /**
 * Emit a warning through `logger.warn` if a logger is supplied, otherwise
 * fall through to the shared `fallbackLogger`. Centralizes the "logger may
@@ -1556,9 +2029,35 @@ function warnWithFallback(logger, message) {
 * varies with what the user should do next does not.
 */
 function warnOnceWithFallback(logger, message) {
+	const destination = logger ?? fallbackLogger;
+	if (destination.silent && !destination.reportsWhileSilent) return;
 	if (!claimWarnOnce(message)) return;
-	warnWithFallback(logger, message);
+	destination.warn(message);
 }
+/**
+* A `ConsoleLogger` that keeps the warnings it is given.
+*
+* A caller with no console to write to — an MCP tool answering over stdio, where
+* the server's stderr never reaches the agent — can hand this in and put what
+* was reported into its own result, so a diagnostic about the files it just read
+* is something the agent can act on rather than something it never hears.
+*/
+var WarningCollectingLogger = class extends ConsoleLogger {
+	warnings = new WarningCollection();
+	get reportsWhileSilent() {
+		return true;
+	}
+	warn(message, ...args) {
+		this.warnings.add({
+			message,
+			args
+		});
+		super.warn(message, ...args);
+	}
+	getWarnings() {
+		return this.warnings.toArray();
+	}
+};
 //#endregion
 //#region src/utils/validation.ts
 /**
@@ -4565,6 +5064,17 @@ function parseStrict(content) {
 	return result;
 }
 /**
+* The error a source document should fail with when
+* {@link parseJsoncReportingDroppedKeys} reports keys the parser removed.
+*
+* Shared by every source that reports them, so the three files a user can
+* author explain the same removal the same way rather than each inventing its
+* own wording.
+*/
+function droppedPollutionKeysError({ sourcePath, droppedKeys }) {
+	return /* @__PURE__ */ new Error(`${JSON.stringify(sourcePath)} uses ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")} as ${droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`);
+}
+/**
 * The same parse as {@link parseJsonc}, additionally reporting which
 * prototype-pollution keys were removed, as dotted paths
 * (`permission.bash.__proto__`).
@@ -4644,9 +5154,17 @@ async function resolveRulesyncSourceWritePath({ outputRoot, paths }) {
 //#region src/features/hooks/rulesync-hooks.ts
 var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 	json;
+	/**
+	* Prototype-pollution keys the parser removed. They are dropped before the
+	* schema ever sees them, so without this record a hook keyed `constructor`
+	* would produce neither an error nor an entry in any generated file.
+	*/
+	droppedKeys;
 	constructor(params) {
 		super({ ...params });
-		this.json = parseJsonc$8(this.fileContent);
+		const { value, droppedKeys } = parseJsoncReportingDroppedKeys({ content: this.fileContent });
+		this.json = value;
+		this.droppedKeys = droppedKeys;
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -4665,6 +5183,13 @@ var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 		};
 	}
 	validate() {
+		if (this.droppedKeys.length > 0) return {
+			success: false,
+			error: droppedPollutionKeysError({
+				sourcePath: this.getRelativePathFromCwd(),
+				droppedKeys: this.droppedKeys
+			})
+		};
 		const result = HooksConfigSchema.safeParse(this.json);
 		if (!result.success) return {
 			success: false,
@@ -5011,9 +5536,17 @@ function mergeMcpJsonOverlays({ base, overlay }) {
 }
 var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	json;
+	/**
+	* Prototype-pollution keys the parser removed. They are dropped before the
+	* schema ever sees them, so without this record a server named `__proto__`
+	* would produce neither an error nor an entry in any generated file.
+	*/
+	droppedKeys;
 	constructor(params) {
 		super(params);
-		this.json = parseJsonc$8(this.fileContent);
+		const { value, droppedKeys } = parseJsoncReportingDroppedKeys({ content: this.fileContent });
+		this.json = value;
+		this.droppedKeys = droppedKeys;
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -5035,6 +5568,13 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 		};
 	}
 	validate() {
+		if (this.droppedKeys.length > 0) return {
+			success: false,
+			error: droppedPollutionKeysError({
+				sourcePath: this.getRelativePathFromCwd(),
+				droppedKeys: this.droppedKeys
+			})
+		};
 		const result = RulesyncMcpFileSchema.safeParse(this.json);
 		if (!result.success) return {
 			success: false,
@@ -5104,16 +5644,23 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 			}
 			const fileContent = await readFileContent(filePath);
 			let parsed;
+			let droppedKeys;
 			try {
-				parsed = parseJsonc$8(fileContent);
-				if (!isRecord$1(parsed)) throw new Error("Expected a JSON object.");
-				if (validate) {
-					const result = RulesyncMcpFileSchema.safeParse(parsed);
-					if (!result.success) throw result.error;
-				}
+				const result = parseJsoncReportingDroppedKeys({ content: fileContent });
+				if (!isRecord$1(result.value)) throw new Error("Expected a JSON object.");
+				parsed = result.value;
+				droppedKeys = result.droppedKeys;
 			} catch (error) {
 				throw new Error(`Invalid MCP source file '${filePath}': ${formatError(error)}`, { cause: error });
 			}
+			if (validate) {
+				if (droppedKeys.length > 0) throw droppedPollutionKeysError({
+					sourcePath: toPosixPath((0, node_path.relative)(process.cwd(), filePath)),
+					droppedKeys
+				});
+				const result = RulesyncMcpFileSchema.safeParse(parsed);
+				if (!result.success) throw new Error(`Invalid MCP source file '${filePath}': ${formatError(result.error)}`, { cause: result.error });
+			}
 			rootSources.push({
 				record: parsed,
 				outputRoot: parent,
@@ -5359,12 +5906,13 @@ const PermissionActionSchema = zod_mini.z.enum([
 	"deny"
 ]);
 /**
-* Whether a permission pattern is blank — empty, or only whitespace. Shared
-* with the import-side filter so the key the schema rejects and the key that
-* filter removes can never drift apart.
+* Whether a key in a permission block — a category name or a pattern — is
+* blank, that is empty or only whitespace. Shared with the import-side filter
+* so the key the schema rejects and the key that filter removes can never
+* drift apart.
 */
-function isBlankPermissionPattern(pattern) {
-	return pattern.trim().length === 0;
+function isBlankPermissionKey(key) {
+	return key.trim().length === 0;
 }
 /**
 * A single permission pattern key.
@@ -5376,7 +5924,18 @@ function isBlankPermissionPattern(pattern) {
 * silently ignores it. Rather than let each target decide, reject it here so
 * the mistake surfaces once, on the source file.
 */
-const PermissionPatternSchema = zod_mini.z.string().check(zod_mini.z.refine((pattern) => !isBlankPermissionPattern(pattern), { message: "Permission pattern must not be blank" }));
+const PermissionPatternSchema = zod_mini.z.string().check(zod_mini.z.refine((pattern) => !isBlankPermissionKey(pattern), { message: "Permission pattern must not be blank" }));
+/**
+* A permission category key: the name of the tool surface a rules map applies
+* to (`bash`, `edit`, `webfetch`, ...).
+*
+* Blank is rejected for the same reason a blank pattern is, one step up. Every
+* translator reads categories by name, so `{"": {"git *": "allow"}}` reaches no
+* tool at all and the rules under it are silently dead — the mistake is only
+* visible as an entry missing from a generated config. Rejecting it here
+* surfaces it on the source file instead.
+*/
+const PermissionCategorySchema = zod_mini.z.string().check(zod_mini.z.refine((category) => !isBlankPermissionKey(category), { message: "Permission category must not be blank" }));
 /**
 * Permission rules for a single tool category.
 * Keys are glob patterns matching tool input (commands, file paths, etc.).
@@ -5397,7 +5956,7 @@ const PermissionRulesSchema = zod_mini.z.record(PermissionPatternSchema, Permiss
 * @example
 * { "claudecode": { "permission": { "bash": { "git push *": "deny" } } } }
 */
-const ToolScopedPermissionSchema = zod_mini.z.record(zod_mini.z.string(), PermissionRulesSchema);
+const ToolScopedPermissionSchema = zod_mini.z.record(PermissionCategorySchema, PermissionRulesSchema);
 /**
 * Generic tool-scoped override block for tools that have no tool-specific
 * override keys of their own; it carries only the canonical tool-scoped
@@ -5455,7 +6014,7 @@ const OpencodeOverridePermissionValueSchema = zod_mini.z.union([PermissionAction
 * @example
 * { "permission": { "external_directory": "deny", "webfetch": "allow" } }
 */
-const OpencodePermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), OpencodeOverridePermissionValueSchema)) });
+const OpencodePermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(zod_mini.z.record(PermissionCategorySchema, OpencodeOverridePermissionValueSchema)) });
 /**
 * Tool-scoped override block for Hermes Agent. Keys placed here are deep-merged
 * into Hermes's `~/.hermes/config.yaml` and never leak into other tools' configs.
@@ -5515,7 +6074,7 @@ const ClinePermissionsOverrideSchema = zod_mini.z.looseObject({
 * @see https://kilo.ai/docs/getting-started/settings/sandboxing
 */
 const KiloPermissionsOverrideSchema = zod_mini.z.looseObject({
-	permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), OpencodeOverridePermissionValueSchema)),
+	permission: zod_mini.z.optional(zod_mini.z.record(PermissionCategorySchema, OpencodeOverridePermissionValueSchema)),
 	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({}))
 });
 /**
@@ -5586,7 +6145,7 @@ const ClaudecodePermissionsOverrideSchema = zod_mini.z.looseObject({
 * { "enabled_tools": ["bash", "read_file", "grep"] }
 */
 const VibePermissionsOverrideSchema = zod_mini.z.looseObject({
-	permission: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({ sensitive_patterns: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) }))),
+	permission: zod_mini.z.optional(zod_mini.z.record(PermissionCategorySchema, zod_mini.z.looseObject({ sensitive_patterns: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) }))),
 	enabled_tools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 /**
@@ -6320,12 +6879,12 @@ const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
-* The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
-* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie`/`takt`/`amp`/
-* `antigravity-cli`/`augmentcode`/`kiro`/`codexcli`/`zed` keys are tool-scoped
-* overrides consumed only by their respective translator (see the matching
-* `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
-* block and ignores them.
+* The optional tool keys below are tool-scoped overrides consumed only by their
+* respective translator (see the matching `*PermissionsOverrideSchema`); every
+* other tool reads the shared `permission` block and ignores them. The set of
+* keys is exactly `permissionsProcessorToolTargetTuple` mapped through
+* `PERMISSION_OVERRIDE_KEY_ALIASES` — a test asserts that, so this comment does
+* not enumerate them and go stale.
 *
 * Additionally, every permissions-capable tool accepts a canonical tool-scoped
 * `permission` block under its override key (`{toolname}.permission`, same
@@ -6343,7 +6902,7 @@ const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
 * }
 */
 const PermissionsConfigSchema = zod_mini.z.looseObject({
-	permission: zod_mini.z.record(zod_mini.z.string(), PermissionRulesSchema),
+	permission: zod_mini.z.record(PermissionCategorySchema, PermissionRulesSchema),
 	opencode: zod_mini.z.optional(OpencodePermissionsOverrideSchema),
 	hermes: zod_mini.z.optional(HermesPermissionsOverrideSchema),
 	cline: zod_mini.z.optional(ClinePermissionsOverrideSchema),
@@ -6372,7 +6931,9 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
-	rovodev: zod_mini.z.optional(CanonicalPermissionsOverrideSchema)
+	roo: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	rovodev: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	zoocode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema)
 });
 /**
 * Full permissions file schema including optional $schema field.
@@ -6414,10 +6975,40 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 			}]
 		};
 	}
+	/**
+	* The canonical document an importer produces from a tool's own config.
+	*
+	* Every importer has to run the blank-key filter over what it is about to
+	* write: the canonical schema rejects a blank pattern and a blank category
+	* outright, so a source file carrying either would be refused by the very
+	* next `generate` — and that refusal takes the whole file with it, so one
+	* blank key imported from one tool stops every tool's permissions from being
+	* generated. Building the imported document here rather than calling the
+	* filter beside each `new RulesyncPermissions(...)` is what keeps the next
+	* importer from forgetting it.
+	*
+	* `sourcePath` is the tool config being read, used only to name it if
+	* something is dropped.
+	*/
+	static fromImportedFileContent({ outputRoot, fileContent, sourcePath, logger }) {
+		return new RulesyncPermissions({
+			outputRoot,
+			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
+			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
+			fileContent: withoutBlankPermissionKeys({
+				fileContent,
+				sourcePath,
+				logger
+			})
+		});
+	}
 	validate() {
 		if (this.droppedKeys.length > 0) return {
 			success: false,
-			error: /* @__PURE__ */ new Error(`${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)} uses ${this.droppedKeys.join(", ")} as ${this.droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`)
+			error: droppedPollutionKeysError({
+				sourcePath: this.getRelativePathFromCwd(),
+				droppedKeys: this.droppedKeys
+			})
 		};
 		const result = RulesyncPermissionsFileSchema.safeParse(this.json);
 		if (!result.success) return {
@@ -6489,33 +7080,62 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	}
 };
 /**
-* Strip every blank permission pattern from an already-parsed canonical
-* document, reporting how many were dropped from each block.
+* Tool-scoped override keys whose `permission` block maps a category to
+* something other than a pattern map. Vibe alone keeps
+* `{ sensitive_patterns: [...] }` objects there, so the keys one level down are
+* field names and the blank-pattern filter must not walk them. The category
+* names above them are still category names, and are filtered like any other.
+*
+* Typed as `ToolTarget` so a renamed target fails to compile here rather than
+* silently stopping to match, which would let the filter start deleting Vibe's
+* fields and reporting them as removed permission patterns. That only holds for
+* targets whose override key is the target name itself: a target that aliases
+* to another key (see `PERMISSION_OVERRIDE_KEY_ALIASES`) would have to be listed
+* under the alias, which this type would reject. None of them is non-pattern-map
+* today, so add that spelling only when one becomes so.
+*/
+const NON_PATTERN_MAP_PERMISSION_OVERRIDE_KEYS = /* @__PURE__ */ new Set(["vibe"]);
+/**
+* Strip every blank key — category or pattern — from an already-parsed
+* canonical document, reporting how many were dropped from each block.
 *
 * Both the shared `permission` block and every tool-scoped
 * `{toolname}.permission` block are walked, because import produces both:
 * OpenCode and Kilo route their tool-only categories into the tool-scoped block
-* verbatim, so a blank pattern in the user's own config lands there. A category
-* whose value is not a rules map is left exactly as it is, which is what keeps
-* the tool-native shapes intact — OpenCode's and Kilo's bare action strings
-* (`"external_directory": "deny"`) have no pattern key to inspect, Vibe's
-* `sensitive_patterns` objects carry no blank key, and Kilo's `sandbox` is not a
-* `permission` block at all.
-*/
-function stripBlankPermissionPatterns(config) {
-	const removed = /* @__PURE__ */ new Map();
-	const filterBlock = ({ block, blockPath }) => {
+* verbatim, so a blank key in the user's own config lands there. A category
+* whose value is not a rules map keeps its value exactly as it is, which is what
+* keeps the tool-native shapes intact — OpenCode's and Kilo's bare action
+* strings (`"external_directory": "deny"`) have no pattern key to inspect, and
+* Kilo's `sandbox` is not a `permission` block at all.
+*
+* Categories are filtered for the same reason patterns are, one level up: the
+* canonical schema rejects a blank category, so reproducing one would write a
+* source file the very next `generate` refuses — and it would refuse the whole
+* file, taking every tool's permissions generation down with it.
+*
+* The patterns inside {@link NON_PATTERN_MAP_PERMISSION_OVERRIDE_KEYS} blocks
+* are left alone: they are field names rather than patterns there. Their
+* category names are still filtered.
+*/
+function stripBlankPermissionKeys(config) {
+	const patterns = /* @__PURE__ */ new Map();
+	const categories = /* @__PURE__ */ new Map();
+	const filterBlock = ({ block, blockPath, filterPatterns }) => {
 		const filtered = {};
 		for (const [category, rules] of Object.entries(block)) {
-			if (!isRecord$1(rules)) {
+			if (isBlankPermissionKey(category)) {
+				categories.set(blockPath, (categories.get(blockPath) ?? 0) + 1);
+				continue;
+			}
+			if (!filterPatterns || !isRecord$1(rules)) {
 				filtered[category] = rules;
 				continue;
 			}
 			const kept = {};
 			for (const [pattern, action] of Object.entries(rules)) {
-				if (isBlankPermissionPattern(pattern)) {
+				if (isBlankPermissionKey(pattern)) {
 					const path = `${blockPath}.${category}`;
-					removed.set(path, (removed.get(path) ?? 0) + 1);
+					patterns.set(path, (patterns.get(path) ?? 0) + 1);
 					continue;
 				}
 				kept[pattern] = action;
@@ -6528,25 +7148,41 @@ function stripBlankPermissionPatterns(config) {
 	const next = { ...config };
 	if (isRecord$1(config.permission)) next.permission = filterBlock({
 		block: config.permission,
-		blockPath: "permission"
+		blockPath: "permission",
+		filterPatterns: true
 	});
 	for (const [key, value] of Object.entries(config)) {
 		if (key === "permission" || !isRecord$1(value) || !isRecord$1(value.permission)) continue;
-		next[key] = {
-			...value,
-			permission: filterBlock({
-				block: value.permission,
-				blockPath: `${key}.permission`
-			})
-		};
+		const permission = filterBlock({
+			block: value.permission,
+			blockPath: `${key}.permission`,
+			filterPatterns: !NON_PATTERN_MAP_PERMISSION_OVERRIDE_KEYS.has(key)
+		});
+		if (!(Object.keys(permission).length === 0 && Object.keys(value.permission).length > 0)) {
+			next[key] = {
+				...value,
+				permission
+			};
+			continue;
+		}
+		const { permission: _emptied, ...rest } = value;
+		if (Object.keys(rest).length === 0) {
+			delete next[key];
+			continue;
+		}
+		next[key] = rest;
 	}
 	return {
 		config: next,
-		removed
+		removed: {
+			patterns,
+			categories
+		}
 	};
 }
+const summarizeDroppedCounts = (counts) => [...counts.entries()].map(([path, count]) => `${count} in ${JSON.stringify(path)}`).join(", ");
 /**
-* Report the dropped patterns.
+* Report the dropped keys.
 *
 * Dropping an entry silently is the failure mode a permissions source must not
 * have. A blanket blank pattern can read as "deny everything by default";
@@ -6557,27 +7193,36 @@ function stripBlankPermissionPatterns(config) {
 * `logger` is optional because the import direction (`toRulesyncPermissions`)
 * takes no logger parameter; the shared `fallbackLogger` is configured from the
 * CLI flags and the resolved config, so `silent` is still honored.
+*
+* `sourcePath` names the tool config the keys came out of. A single import run
+* reads many tools, and the block paths alone (`permission.bash`) are the same
+* for all of them, so without it the user is told something was dropped but not
+* from where.
 */
-function warnAboutDroppedPatterns({ removed, logger }) {
-	warnWithFallback(logger, `Dropped blank permission patterns while reading a tool's permission configuration (${[...removed.entries()].map(([path, count]) => `${count} in "${path}"`).join(", ")}). An empty or whitespace-only pattern matches everything, and tools disagree on what it means — some apply it to every command, others ignore it entirely — so it is not carried into the rulesync permissions config. If one of them was a blanket deny, the imported configuration now allows more than the file it came from; re-add it with a real pattern.`);
+function warnAboutDroppedKeys({ removed, sourcePath, logger }) {
+	const source = sourcePath === void 0 ? "a tool's permission configuration" : JSON.stringify(sourcePath);
+	if (removed.patterns.size > 0) warnWithFallback(logger, `Dropped blank permission patterns while reading ${source} (${summarizeDroppedCounts(removed.patterns)}). An empty or whitespace-only pattern matches everything, and tools disagree on what it means — some apply it to every command, others ignore it entirely — so it is not carried into the rulesync permissions config. If one of them was a blanket deny, the imported configuration now allows more than the file it came from; re-add it with a real pattern.`);
+	if (removed.categories.size > 0) warnWithFallback(logger, `Dropped blank permission categories while reading ${source} (${summarizeDroppedCounts(removed.categories)}). A category name is how every tool finds the rules underneath it, so an empty or whitespace-only one reaches no tool at all and the rules below it were never going to be generated. Carrying one into the rulesync permissions config would make the next generate refuse the whole file, so it is removed here; re-add those rules under a real category name.`);
 }
 /**
-* Drop blank permission patterns from a canonical document produced by import.
+* Drop blank permission keys from a canonical document produced by import.
 *
-* The canonical schema rejects a blank pattern outright, and every tool that
-* has one in its own config already treats it as something other than a real
-* pattern (Roo Code, for instance, keeps only entries passing
-* `cmd.trim().length > 0`). Reproducing one in `.rulesync/permissions.jsonc`
-* would therefore write a source file that the very next `generate` refuses —
-* so it is removed here instead, and reported.
+* The canonical schema rejects a blank pattern and a blank category outright,
+* and every tool that has a blank pattern in its own config already treats it as
+* something other than a real pattern (Roo Code, for instance, keeps only
+* entries passing `cmd.trim().length > 0`). Reproducing either in
+* `.rulesync/permissions.jsonc` would therefore write a source file that the
+* very next `generate` refuses — the whole file, not just that entry — so they
+* are removed here instead, and reported.
 */
-function withoutBlankPermissionPatterns({ fileContent, logger }) {
+function withoutBlankPermissionKeys({ fileContent, sourcePath, logger }) {
 	const parsed = parseJsonc$8(fileContent);
 	if (!isRecord$1(parsed)) return fileContent;
-	const { config, removed } = stripBlankPermissionPatterns(parsed);
-	if (removed.size === 0) return fileContent;
-	warnAboutDroppedPatterns({
+	const { config, removed } = stripBlankPermissionKeys(parsed);
+	if (removed.patterns.size === 0 && removed.categories.size === 0) return fileContent;
+	warnAboutDroppedKeys({
 		removed,
+		sourcePath,
 		logger
 	});
 	return JSON.stringify(config, null, 2);
@@ -6586,14 +7231,15 @@ function withoutBlankPermissionPatterns({ fileContent, logger }) {
 * The same filter over an already-parsed document, for callers that validate a
 * canonical block before it is ever serialized. Hermes Agent stores its
 * rulesync provenance inside its own config and parses it back on import; left
-* unfiltered, one blank pattern would fail `safeParse` and discard the entire
-* provenance block without a word.
+* unfiltered, one blank pattern or category would fail `safeParse` and discard
+* the entire provenance block without a word.
 */
-function withoutBlankPermissionPatternsIn({ config, logger }) {
-	const { config: filtered, removed } = stripBlankPermissionPatterns(config);
-	if (removed.size === 0) return config;
-	warnAboutDroppedPatterns({
+function withoutBlankPermissionKeysIn({ config, sourcePath, logger }) {
+	const { config: filtered, removed } = stripBlankPermissionKeys(config);
+	if (removed.patterns.size === 0 && removed.categories.size === 0) return config;
+	warnAboutDroppedKeys({
 		removed,
+		sourcePath,
 		logger
 	});
 	return filtered;
@@ -6742,6 +7388,24 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 //#endregion
 //#region src/types/ai-dir.ts
 /**
+* Whether `name` is a path rather than a single name.
+*
+* Both separators are rejected on every platform, which is why neither
+* `path.sep` nor the platform is consulted: a backslash is a legal character in
+* a POSIX name, but a name carrying one is a path the moment it reaches
+* Windows, and `AiDir` names travel between the two — most tools take one
+* straight from a skill's frontmatter.
+*
+* Exported because the checks that run *before* a name reaches `AiDir` — so
+* that an unusable name is reported and skipped rather than thrown over — have
+* to reject exactly the set this guard does. Two spellings of one rule drift
+* apart the moment either is tightened, and the pre-filter drifting narrower
+* turns a reported name back into a failed run.
+*/
+function containsPathSeparator(name) {
+	return name.includes("/") || name.includes("\\");
+}
+/**
 * Directories that hold credentials. Excluding these protects something, so
 * their exclusion is reported rather than silent.
 */
@@ -7201,7 +7865,7 @@ var AiDir = class AiDir {
 	*/
 	global;
 	constructor({ outputRoot = process.cwd(), relativeDirPath, dirName, mainFile, otherFiles = [], global = false }) {
-		if (dirName.includes(node_path.default.sep) || dirName.includes("/") || dirName.includes("\\")) throw new Error(`Directory name cannot contain path separators: dirName="${dirName}"`);
+		if (containsPathSeparator(dirName)) throw new Error(`Directory name cannot contain path separators: dirName="${dirName}"`);
 		if (dirName === "" || dirName === "." || dirName === "..") throw new Error(`Directory name cannot be empty, ".", or "..": dirName="${dirName}"`);
 		this.outputRoot = outputRoot;
 		this.relativeDirPath = relativeDirPath;
@@ -7262,7 +7926,7 @@ var AiDir = class AiDir {
 		const mainFile = this.getMainFile();
 		if (mainFile === void 0) return;
 		const name = mainFile.name;
-		if (name === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\")) return;
+		if (name === "" || name === "." || name === ".." || containsPathSeparator(name)) return;
 		return node_path.default.join(this.getDirPath(), name);
 	}
 	getDirPath() {
@@ -7593,7 +8257,7 @@ var AiDir = class AiDir {
 * differ from the path the run claims, which turns it into an orphan.
 */
 function isUnsafeSkillDirName(name) {
-	return name === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.endsWith(".") || name.endsWith(" ");
+	return name === "" || name === "." || name === ".." || containsPathSeparator(name) || name.endsWith(".") || name.endsWith(" ");
 }
 const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string().check(zod_mini.z.refine((name) => !isUnsafeSkillDirName(name), { message: "name is used as a directory name: it may not be empty, \".\" or \"..\", contain a path separator, or end with a dot or a space" })),
@@ -7853,6 +8517,16 @@ const RulesyncSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	zoocode: zod_mini.z.optional(zod_mini.z.looseObject({ 
 	/** Per-mode MCP server allowlist (Zoo Code v3.60.0+); omitted = all. */
 allowedMcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })),
+	zcode: zod_mini.z.optional(zod_mini.z.looseObject({
+		model: zod_mini.z.optional(zod_mini.z.string()),
+		thoughtLevel: zod_mini.z.optional(zod_mini.z.string()),
+		color: zod_mini.z.optional(zod_mini.z.string()),
+		tools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		disallowedTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		maxTurns: zod_mini.z.optional(zod_mini.z.number().check(zod_mini.z.int(), zod_mini.z.positive())),
+		injectAgentsMd: zod_mini.z.optional(zod_mini.z.boolean()),
+		mcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	})),
 	vibe: zod_mini.z.optional(zod_mini.z.looseObject({
 		agent_type: zod_mini.z.optional(zod_mini.z.enum(["agent", "subagent"])),
 		display_name: zod_mini.z.optional(zod_mini.z.string()),
@@ -7940,10 +8614,12 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 * lets a directory be *created* with a backslash in its name, so such a
 * directory can sit in a skills root that nothing here can name — it is
 * reported rather than passed on, since the alternative is a candidate built
-* from a name that belongs to no directory at all.
+* from a name that belongs to no directory at all. The test is `AiDir`'s own,
+* so this pre-filter cannot come to accept a name the guard behind it throws
+* over.
 */
 function isAddressableSkillName(name) {
-	return !name.includes("/") && !name.includes("\\");
+	return !containsPathSeparator(name);
 }
 /**
 * The names of the skill directories directly under `skillsRoot`.
@@ -9334,18 +10010,168 @@ function splitCheckFile({ fileContent, fallbackName }) {
 	});
 }
 //#endregion
+//#region src/features/checks/aggregated-tool-check.ts
+/**
+* Shared skeleton for the checks adapters whose output is a single aggregated
+* instruction file — one file whose sections are the marked blocks
+* `aggregated-check-file.ts` renders and splits, rather than a directory with a
+* file per check.
+*
+* That module already held the rendering and the splitting; what is here is the
+* adapter around it, which was near-verbatim in Cursor Bugbot, Rovo Dev and
+* Factory Droid. A subclass supplies {@link ToolCheck.getSettablePaths} and
+* {@link getAggregatedCheckConfig}, and inherits the rest — so a fix to how
+* these files are read or written lands once instead of three times.
+*
+* `fromRulesyncCheck` is refused here rather than implemented: sections share
+* one file, so an output cannot be produced from one check in isolation and the
+* processor calls {@link fromRulesyncChecks} instead.
+*
+* Not declared `abstract`, even though nothing instantiates it directly: the
+* statics below build the subclass with `new this(...)`, which an abstract
+* constructor type forbids. What a subclass owes is enforced the way the rest
+* of this codebase enforces it on a static — {@link getAggregatedCheckConfig}
+* throws until it is overridden.
+*/
+var AggregatedToolCheck = class extends ToolCheck {
+	/**
+	* The per-tool values the shared skeleton reads. Thrown rather than abstract
+	* because TypeScript has no abstract statics; a subclass that forgets it
+	* fails on its first use rather than silently taking a default.
+	*/
+	static getAggregatedCheckConfig() {
+		throw new Error("Please implement this method in the subclass.");
+	}
+	/**
+	* The settable paths with the file name required. An aggregated adapter names
+	* the one file it writes — that is what keeps consumers which would otherwise
+	* claim the whole tool directory, the gitignore derivation among them,
+	* narrowed to it — so a missing name is a mistake in the subclass rather than
+	* a case to fall back for.
+	*/
+	static getAggregatedPaths({ global = false } = {}) {
+		const paths = this.getSettablePaths({ global });
+		if (!paths.relativeFilePath) throw new Error(`${this.name} writes one aggregated file, so getSettablePaths must name it.`);
+		return {
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath
+		};
+	}
+	static getAggregatedFilePath({ outputRoot, global = false }) {
+		const paths = this.getAggregatedPaths({ global });
+		return {
+			...paths,
+			filePath: (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)
+		};
+	}
+	static isTargetedByRulesyncCheck(rulesyncCheck) {
+		return this.isTargetedByRulesyncCheckDefault({
+			rulesyncCheck,
+			toolTarget: this.getAggregatedCheckConfig().toolTarget
+		});
+	}
+	/**
+	* Ownership guard the processor consults before it deletes anything for this
+	* tool. Every one of these paths is one a user may well have written by hand,
+	* whether because the tool documents it as the place to write review
+	* instructions or because it is shared with something else the tool loads, so
+	* anything in it that rulesync did not write is not rulesync's to remove — dropping the last check targeting the tool must not
+	* take somebody's review instructions with it. Deletion is therefore allowed
+	* only for a file that is nothing but generated sections: one that carries no
+	* marker at all, or that carries hand-written text ahead of the first marker,
+	* stays.
+	*/
+	static async canDeleteAuxiliaryFiles({ outputRoot }) {
+		const { filePath } = this.getAggregatedFilePath({ outputRoot });
+		const fileContent = await readFileContentOrNull(filePath);
+		if (fileContent === null) return true;
+		return isOnlyGeneratedSections(fileContent);
+	}
+	static fromRulesyncCheck(_params) {
+		const { displayName } = this.getAggregatedCheckConfig();
+		throw new Error(`${displayName} checks are built from all checks at once; use fromRulesyncChecks.`);
+	}
+	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
+		if (rulesyncChecks.length === 0) return [];
+		const config = this.getAggregatedCheckConfig();
+		const { relativeDirPath, relativeFilePath, filePath } = this.getAggregatedFilePath({
+			outputRoot,
+			global
+		});
+		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) {
+			if (config.handWrittenPreamble === "skip") {
+				logger?.warn(config.handWrittenWarning({
+					filePath,
+					displayName: config.displayName,
+					toolTarget: config.toolTarget
+				}));
+				return [];
+			}
+			logger?.warn(`${config.displayName} checks: ${filePath} holds instructions rulesync did not write, and generating replaces the whole file. Run \`rulesync import --targets ${config.toolTarget} --features checks\` first to keep them.`);
+		}
+		return [new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: renderCheckFile(rulesyncChecks),
+			global
+		})];
+	}
+	static async fromFile({ outputRoot = process.cwd(), global = false }) {
+		const { relativeDirPath, relativeFilePath, filePath } = this.getAggregatedFilePath({
+			outputRoot,
+			global
+		});
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: await readFileContentOrNull(filePath) ?? "",
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncCheck() {
+		const first = this.toRulesyncChecks()[0];
+		if (!first) throw new Error(`No check instructions found in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
+		return first;
+	}
+	toRulesyncChecks() {
+		const config = this.constructor.getAggregatedCheckConfig();
+		const fileContent = this.getFileContent();
+		return splitCheckFile({
+			fileContent: config.transformImportedContent?.(fileContent) ?? fileContent,
+			fallbackName: config.fallbackCheckName
+		});
+	}
+};
+//#endregion
 //#region src/features/checks/cursor-check.ts
-const FALLBACK_CHECK_NAME$2 = "bugbot";
 /**
 * Checks adapter for Cursor Bugbot (`.cursor/BUGBOT.md`).
 *
 * Bugbot takes one aggregated instruction file per directory rather than a file
 * per check, so every `.rulesync/checks/*.md` targeting Cursor collapses into
-* the repository-root `.cursor/BUGBOT.md` — hence {@link fromRulesyncChecks}
-* rather than the usual per-check conversion. Each check becomes one section:
-* an HTML-comment marker carrying the check name, an `## <name>` heading, and
-* the check body as the instruction text (the `description` is used when the
-* body is empty).
+* the repository-root `.cursor/BUGBOT.md` — hence `fromRulesyncChecks` rather
+* than the usual per-check conversion, which {@link AggregatedToolCheck}
+* provides. Each check becomes one section: an HTML-comment marker carrying the
+* check name, an `## <name>` heading, and the check body as the instruction
+* text (the `description` is used when the body is empty).
 *
 * Bugbot reads the file as free prose, so a check's `severity` and `tools` have
 * no equivalent there: they are not written and do not come back on import. So
@@ -9361,97 +10187,26 @@ const FALLBACK_CHECK_NAME$2 = "bugbot";
 * before the first marker — and a hand-written file with no markers at all —
 * becomes a single `bugbot` check, so nothing in the file is dropped. A file
 * holding anything rulesync did not write is never deleted either (see
-* {@link canDeleteAuxiliaryFiles}), though generating checks for Cursor does
-* replace it — import first to keep what is there, which is warned about.
+* `canDeleteAuxiliaryFiles` on the base), though generating checks for Cursor
+* does replace it — import first to keep what is there, which is warned about.
 *
 * @see https://cursor.com/docs/bugbot
 */
-var CursorCheck = class CursorCheck extends ToolCheck {
+var CursorCheck = class extends AggregatedToolCheck {
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: CURSOR_DIR,
 			relativeFilePath: CURSOR_BUGBOT_FILE_NAME
 		};
 	}
-	static isTargetedByRulesyncCheck(rulesyncCheck) {
-		return this.isTargetedByRulesyncCheckDefault({
-			rulesyncCheck,
-			toolTarget: "cursor"
-		});
-	}
-	/**
-	* Ownership guard the processor consults before it deletes anything for this
-	* tool. `.cursor/BUGBOT.md` is a file Cursor's own documentation tells users
-	* to hand-write, so anything in it that rulesync did not write is not
-	* rulesync's to remove — dropping the last check targeting Cursor must not
-	* take somebody's hand-written review instructions with it. Deletion is
-	* therefore allowed only for a file that is nothing but generated sections:
-	* one that carries no marker at all, or that carries hand-written text ahead
-	* of the first marker, stays.
-	*/
-	static async canDeleteAuxiliaryFiles({ outputRoot }) {
-		const paths = CursorCheck.getSettablePaths();
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? "BUGBOT.md"));
-		if (fileContent === null) return true;
-		return isOnlyGeneratedSections(fileContent);
-	}
-	static fromRulesyncCheck(_params) {
-		throw new Error("Cursor checks are built from all checks at once; use fromRulesyncChecks.");
-	}
-	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
-		if (rulesyncChecks.length === 0) return [];
-		const paths = CursorCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "BUGBOT.md";
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) logger?.warn(`Cursor checks: ${filePath} holds instructions rulesync did not write, and generating replaces the whole file. Run \`rulesync import --targets cursor --features checks\` first to keep them.`);
-		const fileContent = renderCheckFile(rulesyncChecks);
-		return [new CursorCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent,
-			global
-		})];
-	}
-	static async fromFile({ outputRoot = process.cwd(), global = false }) {
-		const paths = CursorCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "BUGBOT.md";
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		return new CursorCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: await readFileContentOrNull(filePath) ?? "",
-			global
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new CursorCheck({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			global
-		});
-	}
-	validate() {
+	static getAggregatedCheckConfig() {
 		return {
-			success: true,
-			error: null
+			displayName: "Cursor",
+			toolTarget: "cursor",
+			fallbackCheckName: "bugbot",
+			handWrittenPreamble: "replace"
 		};
 	}
-	toRulesyncCheck() {
-		const first = this.toRulesyncChecks()[0];
-		if (!first) throw new Error(`No check instructions found in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
-		return first;
-	}
-	toRulesyncChecks() {
-		return splitCheckFile({
-			fileContent: this.getFileContent(),
-			fallbackName: FALLBACK_CHECK_NAME$2
-		});
-	}
 };
 //#endregion
 //#region src/constants/factorydroid-paths.ts
@@ -9488,7 +10243,6 @@ const FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME = "review-guidelines";
 const FACTORYDROID_REVIEW_GUIDELINES_DIR_PATH = (0, node_path.join)(FACTORYDROID_SKILLS_DIR_PATH, FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME);
 //#endregion
 //#region src/features/checks/factorydroid-check.ts
-const FALLBACK_CHECK_NAME$1 = FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME;
 /**
 * Drop the YAML frontmatter of a hand-authored `review-guidelines` skill before
 * the file is split into checks.
@@ -9523,6 +10277,9 @@ function stripSkillFrontmatter(fileContent) {
 		content = rest.slice(closing.index + closing[0].length).replace(LEADING_BLANK_LINE_PATTERN, "");
 	}
 }
+function handWrittenWarning({ filePath, displayName, toolTarget }) {
+	return `${displayName} checks: ${filePath} holds instructions rulesync did not write, so it is left as it is and no checks were generated for ${displayName}. Run \`rulesync import --targets ${toolTarget} --features checks\` to bring them into \`.rulesync/checks/\` and then delete the file, so the next generate writes it back from there; delete it outright if you no longer want it, or rename the directory if it is an ordinary skill rather than review guidelines. Importing alone leaves this file as it is, so it keeps blocking generation until it is gone. A rulesync skill named \`${FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME}\` is no longer generated here — Factory's reviewer reads this path, so the checks feature owns it — but a directory an older rulesync wrote can still be sitting there.`;
+}
 /**
 * Checks adapter for Factory Droid's code-review guidelines
 * (`.factory/skills/review-guidelines/SKILL.md`).
@@ -9531,9 +10288,10 @@ function stripSkillFrontmatter(fileContent) {
 * "repository-specific review guidelines" from a skill named
 * `review-guidelines` and injects them into every review run. That makes the
 * output a single aggregated file like Cursor Bugbot's and Rovo Dev's, so every
-* `.rulesync/checks/*.md` targeting Factory Droid collapses into it via
-* {@link fromRulesyncChecks}, each check written as a marked section (see
-* `aggregated-check-file.ts` for the marker convention the adapters share).
+* `.rulesync/checks/*.md` targeting Factory Droid collapses into it via the
+* `fromRulesyncChecks` on {@link AggregatedToolCheck}, each check written as a
+* marked section (see `aggregated-check-file.ts` for the marker convention the
+* three aggregated adapters share).
 *
 * The file is plain Markdown with no frontmatter, matching Factory's documented
 * example. Frontmatter would also be self-defeating here: `renderCheckFile`
@@ -9551,8 +10309,9 @@ function stripSkillFrontmatter(fileContent) {
 * The output lives inside the same `.factory/skills/` tree the `skills` feature
 * writes, so a user-authored `review-guidelines` skill collides with it. The
 * path has one owner rather than a merge rule, and the owner is this feature:
-* {@link fromRulesyncChecks} leaves a file holding anything rulesync did not
-* write untouched, and {@link canDeleteAuxiliaryFiles} refuses to remove one.
+* generating leaves a file holding anything rulesync did not write untouched —
+* the `skip` policy below — and the base's `canDeleteAuxiliaryFiles` refuses to
+* remove one.
 * Their content is somebody's own writing and rulesync cannot reconstruct it,
 * so neither direction guesses. That is stricter than Cursor Bugbot's
 * replace-and-warn, and deliberately: `.cursor/BUGBOT.md` is a path only the
@@ -9562,92 +10321,23 @@ function stripSkillFrontmatter(fileContent) {
 *
 * @see https://docs.factory.ai/software-factory/code-review-ci
 */
-var FactorydroidCheck = class FactorydroidCheck extends ToolCheck {
+var FactorydroidCheck = class extends AggregatedToolCheck {
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: FACTORYDROID_REVIEW_GUIDELINES_DIR_PATH,
 			relativeFilePath: SKILL_FILE_NAME
 		};
 	}
-	static isTargetedByRulesyncCheck(rulesyncCheck) {
-		return this.isTargetedByRulesyncCheckDefault({
-			rulesyncCheck,
-			toolTarget: "factorydroid"
-		});
-	}
-	/**
-	* Ownership guard the processor consults before it deletes anything for this
-	* tool. `review-guidelines` is an ordinary skill directory a user may have
-	* authored by hand, so dropping the last check targeting Factory Droid must
-	* not take their review instructions with it. Deletion is allowed only for a
-	* file that is nothing but generated sections.
-	*/
-	static async canDeleteAuxiliaryFiles({ outputRoot }) {
-		const paths = FactorydroidCheck.getSettablePaths();
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? "SKILL.md"));
-		if (fileContent === null) return true;
-		return isOnlyGeneratedSections(fileContent);
-	}
-	static fromRulesyncCheck(_params) {
-		throw new Error("Factory Droid checks are built from all checks at once; use fromRulesyncChecks.");
-	}
-	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
-		if (rulesyncChecks.length === 0) return [];
-		const paths = FactorydroidCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "SKILL.md";
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) {
-			logger?.warn(`Factory Droid checks: ${filePath} holds instructions rulesync did not write, so it is left as it is and no checks were generated for Factory Droid. Run \`rulesync import --targets factorydroid --features checks\` to bring them into \`.rulesync/checks/\` and then delete the file, so the next generate writes it back from there; delete it outright if you no longer want it, or rename the directory if it is an ordinary skill rather than review guidelines. Importing alone leaves this file as it is, so it keeps blocking generation until it is gone. A rulesync skill named \`${FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME}\` is no longer generated here — Factory's reviewer reads this path, so the checks feature owns it — but a directory an older rulesync wrote can still be sitting there.`);
-			return [];
-		}
-		const fileContent = renderCheckFile(rulesyncChecks);
-		return [new FactorydroidCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent,
-			global
-		})];
-	}
-	static async fromFile({ outputRoot = process.cwd(), global = false }) {
-		const paths = FactorydroidCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "SKILL.md";
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		return new FactorydroidCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: await readFileContentOrNull(filePath) ?? "",
-			global
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new FactorydroidCheck({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			global
-		});
-	}
-	validate() {
+	static getAggregatedCheckConfig() {
 		return {
-			success: true,
-			error: null
+			displayName: "Factory Droid",
+			toolTarget: "factorydroid",
+			fallbackCheckName: FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME,
+			handWrittenPreamble: "skip",
+			handWrittenWarning,
+			transformImportedContent: stripSkillFrontmatter
 		};
 	}
-	toRulesyncCheck() {
-		const first = this.toRulesyncChecks()[0];
-		if (!first) throw new Error(`No check instructions found in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
-		return first;
-	}
-	toRulesyncChecks() {
-		return splitCheckFile({
-			fileContent: stripSkillFrontmatter(this.getFileContent()),
-			fallbackName: FALLBACK_CHECK_NAME$1
-		});
-	}
 };
 //#endregion
 //#region src/constants/hermesagent-paths.ts
@@ -9906,7 +10596,6 @@ var HermesagentCheck = class HermesagentCheck extends ToolCheck {
 };
 //#endregion
 //#region src/features/checks/rovodev-check.ts
-const FALLBACK_CHECK_NAME = "review-agent";
 /**
 * Checks adapter for Rovo Dev CLI's code-review custom instructions
 * (`.rovodev/.review-agent.md`).
@@ -9915,9 +10604,9 @@ const FALLBACK_CHECK_NAME = "review-agent";
 * `.rovodev/` folder — no frontmatter, and note the leading dot in the file
 * name. Like Cursor Bugbot it is a single aggregated file rather than a file
 * per check, so every `.rulesync/checks/*.md` targeting Rovo Dev collapses into
-* it via {@link fromRulesyncChecks}, with each check written as a marked
-* section (see `aggregated-check-file.ts` for the marker convention the two
-* adapters share).
+* it via the `fromRulesyncChecks` on {@link AggregatedToolCheck}, with each
+* check written as a marked section (see `aggregated-check-file.ts` for the
+* marker convention the three aggregated adapters share).
 *
 * Rovo Dev reads the file as free prose, so a check's `severity` and `tools`
 * have no equivalent there: they are not written and do not come back on
@@ -9929,88 +10618,21 @@ const FALLBACK_CHECK_NAME = "review-agent";
 *
 * @see https://support.atlassian.com/rovo/docs/set-custom-instructions-for-code-reviews/
 */
-var RovodevCheck = class RovodevCheck extends ToolCheck {
+var RovodevCheck = class extends AggregatedToolCheck {
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: ROVODEV_DIR,
 			relativeFilePath: ROVODEV_REVIEW_AGENT_FILE_NAME
 		};
 	}
-	static isTargetedByRulesyncCheck(rulesyncCheck) {
-		return this.isTargetedByRulesyncCheckDefault({
-			rulesyncCheck,
-			toolTarget: "rovodev"
-		});
-	}
-	/**
-	* Ownership guard the processor consults before it deletes anything for this
-	* tool. `.review-agent.md` is a file Rovo Dev's own documentation tells users
-	* to hand-write, so anything in it that rulesync did not write is not
-	* rulesync's to remove — dropping the last check targeting Rovo Dev must not
-	* take somebody's hand-written review instructions with it.
-	*/
-	static async canDeleteAuxiliaryFiles({ outputRoot }) {
-		const paths = RovodevCheck.getSettablePaths();
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? ".review-agent.md"));
-		if (fileContent === null) return true;
-		return isOnlyGeneratedSections(fileContent);
-	}
-	static fromRulesyncCheck(_params) {
-		throw new Error("Rovo Dev checks are built from all checks at once; use fromRulesyncChecks.");
-	}
-	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
-		if (rulesyncChecks.length === 0) return [];
-		const paths = RovodevCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? ".review-agent.md";
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) logger?.warn(`Rovo Dev checks: ${filePath} holds instructions rulesync did not write, and generating replaces the whole file. Run \`rulesync import --targets rovodev --features checks\` first to keep them.`);
-		return [new RovodevCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: renderCheckFile(rulesyncChecks),
-			global
-		})];
-	}
-	static async fromFile({ outputRoot = process.cwd(), global = false }) {
-		const paths = RovodevCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? ".review-agent.md";
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		return new RovodevCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: await readFileContentOrNull(filePath) ?? "",
-			global
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new RovodevCheck({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			global
-		});
-	}
-	validate() {
+	static getAggregatedCheckConfig() {
 		return {
-			success: true,
-			error: null
+			displayName: "Rovo Dev",
+			toolTarget: "rovodev",
+			fallbackCheckName: "review-agent",
+			handWrittenPreamble: "replace"
 		};
 	}
-	toRulesyncCheck() {
-		const first = this.toRulesyncChecks()[0];
-		if (!first) throw new Error(`No check instructions found in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
-		return first;
-	}
-	toRulesyncChecks() {
-		return splitCheckFile({
-			fileContent: this.getFileContent(),
-			fallbackName: FALLBACK_CHECK_NAME
-		});
-	}
 };
 //#endregion
 //#region src/constants/codexcli-paths.ts
@@ -11218,7 +11840,7 @@ var ChecksProcessor = class extends FeatureProcessor {
 			this.logger.debug(`Rulesync checks directory not found: ${checksDir}`);
 			return [];
 		}
-		const mdFiles = (await listDirectoryFiles(checksDir)).filter((file) => file.endsWith(".md"));
+		const mdFiles = (await listDirectoryEntryNames(checksDir)).filter((file) => file.endsWith(".md"));
 		if (mdFiles.length === 0) {
 			this.logger.debug(`No markdown files found in rulesync checks directory: ${checksDir}`);
 			return [];
@@ -16040,6 +16662,7 @@ const ZCODE_SKILLS_DIR_PATH = (0, node_path.join)(ZCODE_DIR, "skills");
 const ZCODE_CONFIG_FILE_NAME = "config.json";
 const ZCODE_GLOBAL_CONFIG_DIR_PATH = (0, node_path.join)(ZCODE_DIR, "cli");
 const ZCODE_MCP_SERVERS_KEY = "servers";
+const ZCODE_AGENTS_DIR_PATH = (0, node_path.join)(ZCODE_DIR, "agents");
 //#endregion
 //#region src/features/commands/zcode-command.ts
 /**
@@ -17002,6 +17625,52 @@ function compact(obj) {
 	return result;
 }
 //#endregion
+//#region src/utils/quote-value.ts
+/**
+* How much of a value read off disk a diagnostic quotes.
+*
+* Enough to recognize which entry is meant, and no more. A warning names the
+* offending value so the reader can find it, but the values these warnings
+* quote come from files rulesync did not write — a tool's own settings, a
+* machine-local overrides file, a repository fetched from elsewhere — and they
+* no longer stop at a terminal: they travel into a `--json` document another
+* program parses and into an MCP result an agent reads as context. A command
+* line or a header is the shape most likely to carry a credential, and a long
+* value is the shape most likely to carry instructions aimed at the agent.
+*/
+const MAX_QUOTED_VALUE_LENGTH = 60;
+/**
+* A short, quotable rendering of a value for a diagnostic.
+*
+* Serialized rather than interpolated, because an unquoted value is what lets a
+* crafted one read as a second line; stripped of the control characters
+* `JSON.stringify` leaves intact (it escapes C0 only, not the C1 range or the
+* bidirectional overrides); and truncated.
+*/
+function quoteValueForWarning(value) {
+	return truncateText({
+		text: stripControlCharacters(serialize(value)),
+		maxLength: MAX_QUOTED_VALUE_LENGTH,
+		suffix: "…(truncated)"
+	});
+}
+function serialize(value) {
+	try {
+		return JSON.stringify(value, stripStrings) ?? String(value);
+	} catch {
+		return `[unserializable ${typeof value}]`;
+	}
+}
+/**
+* Strip the control characters out of every string before `JSON.stringify`
+* sees it, not only out of the document it produces: `JSON.stringify` escapes
+* a C0 character into the six literal characters `\u001b`, which no later pass
+* over the output can recognize as a control character again.
+*/
+function stripStrings(_key, value) {
+	return typeof value === "string" ? stripControlCharacters(value) : value;
+}
+//#endregion
 //#region src/features/hooks/tool-hooks-converter.ts
 function isToolMatcherEntry(x) {
 	if (x === null || typeof x !== "object") return false;
@@ -17103,7 +17772,7 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 		if (!isValid({
 			value,
 			canonical
-		})) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${JSON.stringify(value)} is not a value this tool can express as "${tool}".`);
+		})) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool can express as "${tool}".`);
 	}
 	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
 		commandOnly,
@@ -17198,7 +17867,7 @@ function describeScalarConstraint({ canonical, value }) {
 	if (issue === void 0) return `it is not a value the canonical "${canonical}" field accepts.`;
 	return `it does not satisfy the canonical "${canonical}" field: ${issue.message}.`;
 }
-const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${JSON.stringify(value)}) while importing a hook: ${describeScalarConstraint({
+const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${quoteValueForWarning(value)}) while importing a hook: ${describeScalarConstraint({
 	canonical,
 	value
 })} Importing it would fail validation on the next run.`;
@@ -17225,7 +17894,7 @@ function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }
 		if (first === void 0) continue;
 		const firstStable = stableJson(first);
 		const agrees = (value) => isGroupPassthroughValue(value, valueType) && stableJson(value) === firstStable;
-		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${JSON.stringify(first)} — including any that asked for something else, or for nothing.`);
+		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${quoteValueForWarning(first)} — including any that asked for something else, or for nothing.`);
 		emitted[tool] = first;
 	}
 	return emitted;
@@ -17712,7 +18381,7 @@ function describeGroupSkipReason({ rawEntry, converterConfig }) {
 	for (const { tool, valueType, subdividesGroup } of converterConfig.groupPassthroughFields ?? []) {
 		const value = entry[tool];
 		if (subdividesGroup !== true || value === void 0) continue;
-		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${JSON.stringify(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
+		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${quoteValueForWarning(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
 	}
 }
 /**
@@ -17729,7 +18398,7 @@ function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
 			value,
 			canonical: field
 		})) continue;
-		return `Skipping a hook while importing: its "${field}" (${JSON.stringify(value)}) is unusable — ${describeScalarConstraint({
+		return `Skipping a hook while importing: its "${field}" (${quoteValueForWarning(value)}) is unusable — ${describeScalarConstraint({
 			canonical: field,
 			value
 		})} Keeping the hook without it would change what it does, so the whole hook is skipped.`;
@@ -18051,7 +18720,22 @@ async function readSettingsWithLocalOverlay({ outputRoot, relativeDirPath, baseF
 }
 /** Quotes a name read off disk, the way every other such name is logged. */
 function quoteKey(key) {
-	return JSON.stringify(stripControlCharacters(key));
+	return quoteValueForWarning(key);
+}
+/**
+* How many keys the warning names before it stops counting.
+*
+* The keys come from a file rulesync did not write, and the warning now travels
+* into `--json` documents and MCP results as well as onto a console. A settings
+* file with hundreds of top-level keys is unusual but not impossible, and the
+* point of the sentence is to make the reader open the file — naming the first
+* few does that as well as naming all of them.
+*/
+const MAX_LISTED_KEYS = 20;
+function listKeys(keys) {
+	const named = keys.slice(0, MAX_LISTED_KEYS).map(quoteKey).join(", ");
+	const rest = keys.length - MAX_LISTED_KEYS;
+	return rest > 0 ? `${named} and ${rest} more` : named;
 }
 /**
 * Name the settings the machine-local file contributed, so nobody publishes one
@@ -18071,8 +18755,8 @@ function warnAboutLocalKeys({ localParsed, configPath, toolLabel, sensitiveKeys,
 	const keys = Object.keys(localParsed);
 	if (keys.length === 0) return;
 	const flagged = keys.filter((key) => sensitiveKeys.includes(key));
-	const guardrailSentence = flagged.length === 0 ? "" : ` ${flagged.map(quoteKey).join(", ")} ${flagged.length === 1 ? "decides" : "decide"} what ${toolLabel} is allowed to do, so a value meant for one machine would become the team's guardrail.`;
-	warnOnceWithFallback(logger, `${toolLabel}: ${configPath} is a machine-local overrides file, and importing read ${keys.map(quoteKey).join(", ")} from it. Whatever an import takes from there lands in files rulesync commits, so check the imported files and remove anything personal to this machine before sharing them.${guardrailSentence}`);
+	const guardrailSentence = flagged.length === 0 ? "" : ` ${listKeys(flagged)} ${flagged.length === 1 ? "decides" : "decide"} what ${toolLabel} is allowed to do, so a value meant for one machine would become the team's guardrail.`;
+	warnOnceWithFallback(logger, `${toolLabel}: ${configPath} is a machine-local overrides file, and importing read ${listKeys(keys)} from it. Whatever an import takes from there lands in files rulesync commits, so check the imported files and remove anything personal to this machine before sharing them.${guardrailSentence}`);
 }
 //#endregion
 //#region src/utils/augmentcode-settings.ts
@@ -22767,6 +23451,9 @@ function withToolTargetPrefix({ logger, toolTarget }) {
 		get silent() {
 			return logger.silent;
 		},
+		get reportsWhileSilent() {
+			return logger.reportsWhileSilent;
+		},
 		get jsonMode() {
 			return logger.jsonMode;
 		},
@@ -28881,7 +29568,7 @@ function convertFromMusecodeFormat(musecodeMcp) {
 			if (key === "mode") {
 				const mode = asMusecodeMode(value);
 				if (mode === void 0) {
-					warnWithFallback(void 0, `Muse Code MCP: dropping mode ${JSON.stringify(value)} on server ${JSON.stringify(name)} because it is neither "required" nor "optional", the only two modes Muse Code documents.`);
+					warnWithFallback(void 0, `Muse Code MCP: dropping mode ${quoteValueForWarning(value)} on server ${quoteValueForWarning(name)} because it is neither "required" nor "optional", the only two modes Muse Code documents.`);
 					continue;
 				}
 				converted.musecodeMode = mode;
@@ -30085,7 +30772,7 @@ function pointerLabels(global) {
 async function warnAtDocumentedDefault({ existing, outputRoot, logger }) {
 	const { pointer, configLabel, mcpLabel } = pointerLabels(true);
 	const displaced = await describeDisplacedGlobalServers({ outputRoot });
-	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${JSON.stringify(existing)} in ${configLabel}. That is the default Atlassian's settings reference documents, so it may be Rovo Dev's own value rather than one you chose — and while it stands, the generated ${mcpLabel} is never read. ` + (displaced === null ? `It defines no servers of its own, so setting mcp.mcpConfigPath to "${pointer}" costs nothing.` : `${displaced} — move the servers you want to keep into .rulesync/mcp.jsonc first, or none at all if it turns out to hold nothing you need, then change mcp.mcpConfigPath to "${pointer}".`));
+	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. That is the default Atlassian's settings reference documents, so it may be Rovo Dev's own value rather than one you chose — and while it stands, the generated ${mcpLabel} is never read. ` + (displaced === null ? `It defines no servers of its own, so setting mcp.mcpConfigPath to "${pointer}" costs nothing.` : `${displaced} — move the servers you want to keep into .rulesync/mcp.jsonc first, or none at all if it turns out to hold nothing you need, then change mcp.mcpConfigPath to "${pointer}".`));
 }
 /**
 * Announce a pointer that was just written. Warned rather than noted in global
@@ -30142,10 +30829,10 @@ async function applyMcpConfigPointer({ existingMcp, global, hasLiveServers, outp
 		return false;
 	}
 	if (global && normalizedExisting !== void 0 && envVarMcpFileSpellings({ fileName: "mcp.json" }).includes(normalizedExisting)) {
-		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${JSON.stringify(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${quoteValueForWarning(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
 		return false;
 	}
-	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${JSON.stringify(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
+	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
 	return false;
 }
 /**
@@ -31765,11 +32452,10 @@ var ToolPermissions = class extends ToolFile {
 		throw new Error("Please implement this method in the subclass.");
 	}
 	toRulesyncPermissionsDefault({ fileContent }) {
-		return new RulesyncPermissions({
+		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: this.outputRoot,
-			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
-			fileContent: withoutBlankPermissionPatterns({ fileContent })
+			fileContent,
+			sourcePath: this.getRelativePathFromCwd()
 		});
 	}
 	static async fromFile(_params) {
@@ -35527,7 +36213,7 @@ function asCursorPermissionEntryArray(value, logger, fieldLabel) {
 	if (!Array.isArray(value)) return [];
 	const result = [];
 	for (const item of value) if (typeof item === "string") result.push(item);
-	else logger?.warn(`Cursor CLI permissions${fieldLabel ? `.${fieldLabel}` : ""} contains a non-string entry; dropping ${JSON.stringify(item)}.`);
+	else logger?.warn(`Cursor CLI permissions${fieldLabel ? `.${fieldLabel}` : ""} contains a non-string entry; dropping ${quoteValueForWarning(item)}.`);
 	return result;
 }
 /**
@@ -37381,7 +38067,10 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			fileContent: this.getFileContent()
 		});
 		const rawProvenance = (isRecord$1(config.permissions) ? config.permissions : {}).rulesync;
-		const parsedProvenance = RulesyncPermissionsFileSchema.safeParse(isRecord$1(rawProvenance) ? withoutBlankPermissionPatternsIn({ config: rawProvenance }) : rawProvenance);
+		const parsedProvenance = RulesyncPermissionsFileSchema.safeParse(isRecord$1(rawProvenance) ? withoutBlankPermissionKeysIn({
+			config: rawProvenance,
+			sourcePath: this.getRelativePathFromCwd()
+		}) : rawProvenance);
 		const provenance = parsedProvenance.success ? parsedProvenance.data : { permission: {} };
 		const permission = clonePermissionBlock(provenance.permission);
 		reconcileCommandAllowlist({
@@ -37409,14 +38098,13 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			permission,
 			...Object.keys(hermes).length > 0 && { hermes }
 		};
-		return new RulesyncPermissions({
+		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
 				global: this.global
 			}),
-			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
-			fileContent: withoutBlankPermissionPatterns({ fileContent: JSON.stringify(imported, null, 2) })
+			sourcePath: this.getRelativePathFromCwd(),
+			fileContent: JSON.stringify(imported, null, 2)
 		});
 	}
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, global = false }) {
@@ -38317,17 +39005,16 @@ var KimiCodePermissions = class KimiCodePermissions extends ToolPermissions {
 			...nativeRules.length > 0 && { rules: nativeRules },
 			...tools && { tools }
 		};
-		return new RulesyncPermissions({
+		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: getKimiCodeRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
 				global: this.global
 			}),
-			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
-			fileContent: withoutBlankPermissionPatterns({ fileContent: JSON.stringify({
+			sourcePath: this.getRelativePathFromCwd(),
+			fileContent: JSON.stringify({
 				permission,
 				...Object.keys(toolOverride).length > 0 && { "kimi-code": toolOverride }
-			}, null, 2) })
+			}, null, 2)
 		});
 	}
 	static forDeletion({ outputRoot = process.cwd() }) {
@@ -40901,6 +41588,28 @@ function pickSecurityPolicies(source, report) {
 * Ambiguous-width characters are counted as one column, which is what a
 * terminal running a Latin font does.
 *
+* Two of the ranges are here for a narrower reason: a name the skill prompt can
+* offer may not be counted narrower here than the prompt's own renderer counts
+* it, or a label that fits the budget wraps anyway and paints the second row
+* the budget exists to prevent. `@inquirer/core` measures with
+* `fast-string-width`, which takes the whole of `Script=Hangul` as wide and
+* every `Emoji_Modifier_Base` as an emoji. So the Hangul jamo are taken to
+* U+11FF rather than stopping at the leading consonants, and the modifier bases
+* are named beside the emoji: U+261D, U+26F9 and the two hands of U+270C–U+270D
+* are `Emoji` without being `Emoji_Presentation`, and were the only characters
+* outside Hangul this counted at one column while the renderer counted two.
+*
+* The rule is over the names that can reach the prompt, which is a smaller set
+* than the characters that exist. The renderer counts a tab at eight columns and
+* the Hangul fillers at two, where this counts one and none: a name carrying
+* either is refused outright by `hasDeceptiveHiddenCharacters` — the tab as a
+* control character, the fillers as characters that draw as nothing — and never
+* becomes a row to be measured. The two joiners are the invisible characters
+* that check lets through, so they are counted below rather than left to the
+* zero-width rule. Where this is used to lay out text of the tool's own rather
+* than to bound an untrusted name, the difference is a column of alignment and
+* not a forged row.
+*
 * The wide planes are taken whole rather than range by range — Tangut, Khitan
 * and Nushu together are U+17000–U+18DFF, and the kana supplements are
 * U+1AFF0–U+1B2FF — because a gap between two of them is exactly the character
@@ -40913,7 +41622,7 @@ function pickSecurityPolicies(source, report) {
 * is canonically the ordinary ideograph U+8C48, and a range that starts there
 * instead silently swallows thirty thousand code points that are not wide.
 */
-const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|[\u2329\u232a\u2630-\u2637\u268a-\u268f\u4dc0-\u4dff]|[\u1100-\u115f\u2e80-\u303e\u3041-\u33ff\u3400-\u4dbf\u4e00-\u9fff\ua000-\ua4cf\ua960-\ua97f\uac00-\ud7a3\ud7b0-\ud7fb\uf900-\ufaff\ufe10-\ufe19\ufe30-\ufe6f\uff00-\uff60\uffe0-\uffe6]|[\u{16fe0}-\u{16ff6}]|[\u{17000}-\u{18dff}]|[\u{1aff0}-\u{1b2ff}]|[\u{1f000}-\u{1faff}]|[\u{20000}-\u{3fffd}]/u;
+const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|\p{Emoji_Modifier_Base}|[\u2329\u232a\u2630-\u2637\u268a-\u268f\u4dc0-\u4dff]|[\u1100-\u11ff\u2e80-\u303e\u3041-\u33ff\u3400-\u4dbf\u4e00-\u9fff\ua000-\ua4cf\ua960-\ua97f\uac00-\ud7a3\ud7b0-\ud7fb\uf900-\ufaff\ufe10-\ufe19\ufe30-\ufe6f\uff00-\uff60\uffe0-\uffe6]|[\u{16fe0}-\u{16ff6}]|[\u{17000}-\u{18dff}]|[\u{1aff0}-\u{1b2ff}]|[\u{1f000}-\u{1faff}]|[\u{20000}-\u{3fffd}]/u;
 /**
 * U+FE0F VARIATION SELECTOR-16, which takes no width of its own but asks the
 * character before it to be drawn as an emoji — that is, in two columns rather
@@ -40927,6 +41636,27 @@ const COMBINING_MARK_PATTERN = /[\p{Mn}\p{Me}]/u;
 /** The characters that take no width at all, marks aside. */
 const ZERO_WIDTH_CHARACTERS_PATTERN = /[\p{Cf}\p{Default_Ignorable_Code_Point}]/u;
 /**
+* The zero-width joiner and its non-joining twin, which the renderer spends a
+* column on apiece.
+*
+* A terminal draws neither, and every other character that draws as nothing is
+* counted at nothing here. These two are the exception because they are the
+* only invisible characters `hasDeceptiveHiddenCharacters` lets through — a
+* Persian or Indic name spells a word with one, and an emoji is a chain of them
+* — so they are the only ones an attacker can put in a name that reaches the
+* prompt. `fast-string-width`, which is where the prompt's own wrapping is
+* decided, counts each of them as a column, and 40 of them in a name is 40
+* columns of budget this would otherwise hand over for free: enough for a name
+* measured at 39 columns to be drawn at 77 and wrap a forged row underneath
+* itself.
+*
+* The cost is that an emoji built from a chain is overstated by a column per
+* joiner, on top of the two columns per component it is already overstated by.
+* Overstating shortens a label that did not need it; understating lets one
+* wrap.
+*/
+const RENDERER_COUNTED_JOINERS = /\u200c|\u200d/u;
+/**
 * How many marks a single character is allowed to carry for free.
 *
 * A written language stacks two or three at most — a Devanagari vowel sign and
@@ -40954,6 +41684,7 @@ function widthInContext(params) {
 	const { character, precedingMarks } = params;
 	if (character === EMOJI_PRESENTATION_SELECTOR) return 1;
 	if (isCombiningMark(character)) return precedingMarks < FREE_MARKS_PER_CHARACTER ? 0 : 1;
+	if (RENDERER_COUNTED_JOINERS.test(character)) return 1;
 	if (ZERO_WIDTH_CHARACTERS_PATTERN.test(character)) return 0;
 	return WIDE_CHARACTERS_PATTERN.test(character) ? 2 : 1;
 }
@@ -40976,6 +41707,8 @@ function displayWidthOf(text) {
 	}
 	return width;
 }
+/** The mark a cut string ends in. */
+const SHORTENING_ELLIPSIS = "…";
 /**
 * Cut `text` down to at most `budget` columns, marking the cut with an ellipsis.
 *
@@ -41001,7 +41734,7 @@ function shortenToWidth(params) {
 		width += characterWidth;
 		marks = isCombiningMark(character) ? marks + 1 : 0;
 	}
-	return `${kept.join("")}…`;
+	return `${kept.join("")}${SHORTENING_ELLIPSIS}`;
 }
 //#endregion
 //#region src/features/permissions/vibe-permissions.ts
@@ -44789,6 +45522,83 @@ const NESTED_SCAN_EXCLUDED_ROOT_DIRS = [
 ];
 //#endregion
 //#region src/features/skills/claudecode-skill.ts
+/**
+* The `.claude/skills` tail every scanned root is expected to end with, written
+* posix-separated so it can be compared against a resolved relative path, and
+* split into its segments so what sits above it can be taken apart.
+*
+* Split here rather than through the shared helper: this is evaluated as the
+* module loads, before a test that mocks the file utilities can supply one.
+*/
+const CLAUDECODE_SKILLS_DIR_SEGMENTS = CLAUDECODE_SKILLS_DIR_PATH.split(node_path.sep);
+const CLAUDECODE_SKILLS_DIR_POSIX_PATH = CLAUDECODE_SKILLS_DIR_SEGMENTS.join("/");
+/**
+* The segment that puts `relativeDirPath` inside a tree the nested scan
+* excludes, or `undefined` when none does. These are the same three rules the
+* scan states as glob `ignore` patterns below -- dependency trees at any depth,
+* build and vendoring directories at the project root, hidden directories other
+* than the `.claude` being matched -- and the two have to be kept in step.
+*
+* Saying them twice is what a second pass costs. globby matches its patterns
+* against the path it reports, before the `..` a rewritten directory name
+* carries is folded away and before a link in the path is resolved. A root
+* reported at `x/../node_modules/.claude/skills` matches none of the patterns
+* and then leads to the dependency tree they name, so the decision has to be
+* taken again on the path that is really read.
+*
+* The segments passed are the ones above the `.claude/skills` tail, taken from
+* the resolved path: a directory name may hold a backslash -- the whole reason a
+* path can arrive here misspelled -- so the split that produced them has to be on
+* `/`, the one separator no name can contain. The tail itself is the part the
+* glob matched and is not judged; `.claude` is hidden by definition and every
+* root the scan reports ends with it.
+*/
+function excludedNestedScanSegment(segments) {
+	return segments.find((segment, index) => NESTED_SCAN_EXCLUDED_DIRS_ANY_DEPTH.includes(segment) || index === 0 && NESTED_SCAN_EXCLUDED_ROOT_DIRS.includes(segment) || isHiddenPathSegment(segment));
+}
+/**
+* Whether a nested skills directory the scan reported can be used as an import
+* root: either the reason it cannot, or the path it resolves to relative to the
+* project, which the caller uses to tell two spellings of one root apart.
+*
+* A recursive glob cannot be swapped for a walk the way a flat one can, so the
+* path it hands back is checked instead. globby reads a backslash as a path
+* separator and rewrites it, so a root below a directory really named
+* `back\\slash` is reported at `back/slash`. Where that leads decides what to
+* do with it, and the spelling alone does not say: `back/slash` usually answers
+* to nothing, but `x\\..\\..\\outside` is reported at `x/../../outside`, which
+* climbs out of the project through the real sibling `x/`, and `a\\b` at `a/b`,
+* which may be a symbolic link out of the project that the scan — it passes
+* `followSymbolicLinks: false` — never meant to reach. Both are refused by
+* resolving the path rather than reading it.
+*
+* What is deliberately not refused is a rewritten path that stays inside the
+* project, such as `x\\..\\y` reported at `x/../y`. It names a real directory
+* `y`, and the scan reports that directory under this spelling *instead of* its
+* own, so refusing it would lose `y`'s skills rather than protect anything. The
+* skills under the directory that was really named are unreachable either way:
+* no path the scan can report leads back to a name holding a backslash.
+*
+* That last shape is the one case the scan cannot warn about. `a\\b` reported
+* at `a/b`, where `a/b` is itself a real directory, is indistinguishable from
+* the ordinary root `a/b` -- both are spelled the same and both are there -- so
+* the skills under `a\\b` are dropped without a word. Nothing in the path says
+* a second directory was ever involved.
+*/
+async function checkNestedSkillsRoot({ outputRoot, dirPath }) {
+	if (!await directoryExists(dirPath)) return { reason: "it could not be read under the path the scan reports, most often because a directory name above it contains a backslash." };
+	const realRelativeDirPath = await resolvedRelativePath({
+		rootPath: outputRoot,
+		targetPath: dirPath
+	});
+	if (posixRelativePathEscapesRoot(realRelativeDirPath)) return { reason: "it resolves outside the project." };
+	const segments = realRelativeDirPath.split("/");
+	const aboveTailSegments = segments.slice(0, -CLAUDECODE_SKILLS_DIR_SEGMENTS.length);
+	if (segments.slice(-CLAUDECODE_SKILLS_DIR_SEGMENTS.length).join("/") !== CLAUDECODE_SKILLS_DIR_POSIX_PATH) return { reason: `it resolves to ${realRelativeDirPath === "" ? "the project root" : JSON.stringify(stripControlCharacters(realRelativeDirPath))}, which is not a ${CLAUDECODE_SKILLS_DIR_POSIX_PATH} directory.` };
+	const excludedSegment = excludedNestedScanSegment(aboveTailSegments);
+	if (excludedSegment !== void 0) return { reason: `it resolves inside ${JSON.stringify(stripControlCharacters(excludedSegment))}, which the nested scan excludes.` };
+	return { realRelativeDirPath };
+}
 const ClaudecodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
@@ -45037,10 +45847,10 @@ var ClaudecodeSkill = class extends ToolSkill {
 	*
 	* @see https://code.claude.com/docs/en/skills
 	*/
-	static async getConfiguredImportRoots({ outputRoot, global = false }) {
+	static async getConfiguredImportRoots({ outputRoot, global = false, logger }) {
 		if (global) return [];
 		const root = toPosixPath(outputRoot);
-		return filterOutPathsInGitIgnoredDirectories({
+		const filteredDirPaths = filterOutPathsInGitIgnoredDirectories({
 			rootDir: outputRoot,
 			filePaths: await findFilesByGlobs([`${root}/*/**/${toPosixPath(CLAUDECODE_SKILLS_DIR_PATH)}`], {
 				type: "dir",
@@ -45051,10 +45861,27 @@ var ClaudecodeSkill = class extends ToolSkill {
 					...NESTED_SCAN_EXCLUDED_ROOT_DIRS.map((dir) => `${root}/${dir}/**`)
 				]
 			})
-		}).toSorted().map((dirPath) => ({
-			outputRoot,
-			relativeDirPath: (0, node_path.relative)(outputRoot, dirPath)
-		}));
+		}).toSorted();
+		const roots = [];
+		const seenRealRelativeDirPaths = /* @__PURE__ */ new Set([CLAUDECODE_SKILLS_DIR_POSIX_PATH]);
+		for (const dirPath of filteredDirPaths) {
+			const scannedDirPath = (0, node_path.resolve)(dirPath);
+			const check = await checkNestedSkillsRoot({
+				outputRoot,
+				dirPath: scannedDirPath
+			});
+			if ("reason" in check) {
+				logger?.warn(`Skipping the nested Claude Code skills directory ${JSON.stringify(stripControlCharacters(scannedDirPath))}: ${check.reason} Its skills are not imported.`);
+				continue;
+			}
+			if (seenRealRelativeDirPaths.has(check.realRelativeDirPath)) continue;
+			seenRealRelativeDirPaths.add(check.realRelativeDirPath);
+			roots.push({
+				outputRoot,
+				relativeDirPath: (0, node_path.relative)(outputRoot, scannedDirPath)
+			});
+		}
+		return roots;
 	}
 	getFrontmatter() {
 		return ClaudecodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -49941,7 +50768,8 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		const paths = factory.class.getSettablePaths({ global: this.global });
 		const configuredRoots = factory.class.getConfiguredImportRoots ? await factory.class.getConfiguredImportRoots({
 			outputRoot: this.outputRoot,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		}) : [];
 		const configuredRootPaths = new Set(configuredRoots.map((root) => root.relativeDirPath));
 		const roots = [...toolSkillImportRoots(paths), ...configuredRoots];
@@ -54657,6 +55485,152 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/zcode-subagent.ts
+const ZcodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	model: zod_mini.z.optional(zod_mini.z.string()),
+	thoughtLevel: zod_mini.z.optional(zod_mini.z.string()),
+	color: zod_mini.z.optional(zod_mini.z.string()),
+	tools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	disallowedTools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	maxTurns: zod_mini.z.optional(zod_mini.z.number().check(zod_mini.z.int(), zod_mini.z.positive())),
+	injectAgentsMd: zod_mini.z.optional(zod_mini.z.boolean()),
+	mcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+});
+/**
+* ZCode subagents.
+*
+* Each subagent is one Markdown file with YAML frontmatter, named after the
+* agent, under `~/.zcode/agents/`.
+*
+* Global scope only. The current Beta "manages global / user-level subagents
+* stored under `~/.zcode/agents/`", and creating or editing workspace /
+* project-level subagents "is not available yet" — so this adapter is
+* registered with `supportsProject: false` and never writes into a project's
+* own `.zcode/`. The relative path is nonetheless spelled against
+* {@link ZCODE_AGENTS_DIR_PATH} so the workspace scope needs nothing more than
+* flipping that flag if ZCode ships it.
+*
+* @see https://zcode.z.ai/en/docs/subagents
+*/
+var ZcodeSubagent = class ZcodeSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, fileContent, ...rest }) {
+		if (rest.validate !== false) {
+			const result = ZcodeSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: fileContent ?? stringifyFrontmatter(body, frontmatter)
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: ZCODE_AGENTS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, ...rest } = this.frontmatter;
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name,
+				description,
+				...Object.keys(rest).length > 0 && { zcode: rest }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const zcodeSection = rulesyncFrontmatter.zcode ?? {};
+		const zcodeFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...zcodeSection
+		};
+		const body = rulesyncSubagent.getBody();
+		const fileContent = stringifyFrontmatter(body, zcodeFrontmatter, { avoidBlockScalars: true });
+		const paths = this.getSettablePaths({ global });
+		return new ZcodeSubagent({
+			outputRoot,
+			frontmatter: zcodeFrontmatter,
+			body,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = ZcodeSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		else return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "zcode"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths({ global }).relativeDirPath;
+		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const result = ZcodeSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new ZcodeSubagent({
+			outputRoot,
+			relativeDirPath: dirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: content.trim(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new ZcodeSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/zoocode-subagent.ts
 /**
 * Subagent (custom-mode) generator for **Zoo Code**, the community
@@ -54721,6 +55695,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["agentsmd", {
 		class: AgentsmdSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: true,
 			supportsGlobal: false,
 			filePattern: "*.md"
@@ -54729,6 +55704,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["antigravity-cli", {
 		class: AntigravityCliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54737,6 +55713,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["antigravity-ide", {
 		class: AntigravityIdeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54745,6 +55722,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["antigravity-plugin", {
 		class: AntigravityPluginSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: "*.md"
@@ -54753,6 +55731,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["augmentcode", {
 		class: AugmentcodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54761,6 +55740,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["claudecode", {
 		class: ClaudecodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54769,6 +55749,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["claudecode-plugin", {
 		class: ClaudecodePluginSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: "*.md"
@@ -54777,6 +55758,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["claudecode-legacy", {
 		class: ClaudecodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54785,6 +55767,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["cline", {
 		class: ClineSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.{yaml,yml}"
@@ -54793,6 +55776,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["codexcli", {
 		class: CodexCliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.toml"
@@ -54801,6 +55785,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["copilot", {
 		class: CopilotSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54809,6 +55794,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["copilotcli", {
 		class: CopilotcliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.agent.md"
@@ -54817,6 +55803,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["cursor", {
 		class: CursorSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54825,6 +55812,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["deepagents", {
 		class: DeepagentsSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: (0, node_path.join)("*", "AGENTS.md")
@@ -54833,6 +55821,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["devin", {
 		class: DevinSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: (0, node_path.join)("*", "AGENT.md")
@@ -54841,6 +55830,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["factorydroid", {
 		class: FactorydroidSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54849,6 +55839,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["goose", {
 		class: GooseSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54857,6 +55848,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["hermesagent", {
 		class: HermesagentSubagent,
 		meta: {
+			supportsProject: true,
 			supportsGlobal: true,
 			supportsSimulated: false,
 			filePattern: "*.json"
@@ -54865,6 +55857,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["grokcli", {
 		class: GrokcliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54873,6 +55866,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["junie", {
 		class: JunieSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54881,6 +55875,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kiro", {
 		class: KiroSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: "*.json"
@@ -54889,6 +55884,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kiro-cli", {
 		class: KiroCliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.json"
@@ -54897,6 +55893,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kiro-ide", {
 		class: KiroIdeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54905,6 +55902,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kilo", {
 		class: KiloSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54913,6 +55911,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kimi-code", {
 		class: KimiCodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: (0, node_path.join)("**", "*.md")
@@ -54921,6 +55920,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["opencode", {
 		class: OpenCodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54929,6 +55929,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["qwencode", {
 		class: QwencodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54937,6 +55938,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["reasonix", {
 		class: ReasonixSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: (0, node_path.join)("*", "SKILL.md")
@@ -54945,6 +55947,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["roo", {
 		class: RooSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: ".roomodes"
@@ -54953,6 +55956,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["zoocode", {
 		class: ZoocodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: ".roomodes"
@@ -54961,6 +55965,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["rovodev", {
 		class: RovodevSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54969,6 +55974,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["takt", {
 		class: TaktSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54977,10 +55983,20 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["vibe", {
 		class: VibeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.toml"
 		}
+	}],
+	["zcode", {
+		class: ZcodeSubagent,
+		meta: {
+			supportsProject: false,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			filePattern: "*.md"
+		}
 	}]
 ]);
 const defaultGetFactory$1 = (target) => {
@@ -54989,7 +56005,9 @@ const defaultGetFactory$1 = (target) => {
 	return factory;
 };
 const allToolTargetKeys$1 = [...toolSubagentFactories.keys()];
-const subagentsProcessorToolTargets = allToolTargetKeys$1;
+const subagentsProcessorToolTargets = allToolTargetKeys$1.filter((target) => {
+	return toolSubagentFactories.get(target)?.meta.supportsProject ?? false;
+});
 const subagentsProcessorToolTargetsSimulated = allToolTargetKeys$1.filter((target) => {
 	return toolSubagentFactories.get(target)?.meta.supportsSimulated ?? false;
 });
@@ -55089,7 +56107,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			this.logger.debug(`Rulesync subagents directory not found: ${subagentsDir}`);
 			return [];
 		}
-		const mdFiles = (await listDirectoryFiles(subagentsDir)).filter((file) => file.endsWith(".md"));
+		const mdFiles = (await listDirectoryEntryNames(subagentsDir)).filter((file) => file.endsWith(".md"));
 		if (mdFiles.length === 0) {
 			this.logger.debug(`No markdown files found in rulesync subagents directory: ${subagentsDir}`);
 			return [];
@@ -63725,6 +64743,12 @@ Object.defineProperty(exports, "CONFLICTING_TARGET_PAIRS", {
 		return CONFLICTING_TARGET_PAIRS;
 	}
 });
+Object.defineProperty(exports, "CURATED_RULES_FEATURE_SUBDIR", {
+	enumerable: true,
+	get: function() {
+		return CURATED_RULES_FEATURE_SUBDIR;
+	}
+});
 Object.defineProperty(exports, "ChecksProcessor", {
 	enumerable: true,
 	get: function() {
@@ -64121,6 +65145,12 @@ Object.defineProperty(exports, "ToolTargetSchema", {
 		return ToolTargetSchema;
 	}
 });
+Object.defineProperty(exports, "WarningCollectingLogger", {
+	enumerable: true,
+	get: function() {
+		return WarningCollectingLogger;
+	}
+});
 Object.defineProperty(exports, "__toESM", {
 	enumerable: true,
 	get: function() {
@@ -64205,12 +65235,6 @@ Object.defineProperty(exports, "findControlCharacter", {
 		return findControlCharacter;
 	}
 });
-Object.defineProperty(exports, "findFilesByGlobs", {
-	enumerable: true,
-	get: function() {
-		return findFilesByGlobs;
-	}
-});
 Object.defineProperty(exports, "formatError", {
 	enumerable: true,
 	get: function() {
@@ -64259,6 +65283,12 @@ Object.defineProperty(exports, "getRulesyncSourceCandidates", {
 		return getRulesyncSourceCandidates;
 	}
 });
+Object.defineProperty(exports, "groupSpellingsByCaseFoldedIdentity", {
+	enumerable: true,
+	get: function() {
+		return groupSpellingsByCaseFoldedIdentity;
+	}
+});
 Object.defineProperty(exports, "hasDeceptiveHiddenCharacters", {
 	enumerable: true,
 	get: function() {
@@ -64283,6 +65313,12 @@ Object.defineProperty(exports, "isFileNotFoundError", {
 		return isFileNotFoundError;
 	}
 });
+Object.defineProperty(exports, "isFileSystemError", {
+	enumerable: true,
+	get: function() {
+		return isFileSystemError;
+	}
+});
 Object.defineProperty(exports, "isPackagingToolTarget", {
 	enumerable: true,
 	get: function() {
@@ -64295,10 +65331,16 @@ Object.defineProperty(exports, "isSymlink", {
 		return isSymlink;
 	}
 });
-Object.defineProperty(exports, "listDirectoryFiles", {
+Object.defineProperty(exports, "listDirectoryEntryNames", {
 	enumerable: true,
 	get: function() {
-		return listDirectoryFiles;
+		return listDirectoryEntryNames;
+	}
+});
+Object.defineProperty(exports, "listFilePathsRecursively", {
+	enumerable: true,
+	get: function() {
+		return listFilePathsRecursively;
 	}
 });
 Object.defineProperty(exports, "listSubdirectoryNames", {
@@ -64427,6 +65469,12 @@ Object.defineProperty(exports, "stripControlCharacters", {
 		return stripControlCharacters;
 	}
 });
+Object.defineProperty(exports, "stripControlCharactersKeepingLineFeeds", {
+	enumerable: true,
+	get: function() {
+		return stripControlCharactersKeepingLineFeeds;
+	}
+});
 Object.defineProperty(exports, "stripHiddenCharacters", {
 	enumerable: true,
 	get: function() {
@@ -64439,12 +65487,30 @@ Object.defineProperty(exports, "toPosixPath", {
 		return toPosixPath;
 	}
 });
+Object.defineProperty(exports, "truncateText", {
+	enumerable: true,
+	get: function() {
+		return truncateText;
+	}
+});
 Object.defineProperty(exports, "warnOnConflictingFlags", {
 	enumerable: true,
 	get: function() {
 		return warnOnConflictingFlags;
 	}
 });
+Object.defineProperty(exports, "withFallbackLoggerTarget", {
+	enumerable: true,
+	get: function() {
+		return withFallbackLoggerTarget;
+	}
+});
+Object.defineProperty(exports, "withWarnOnceScope", {
+	enumerable: true,
+	get: function() {
+		return withWarnOnceScope;
+	}
+});
 Object.defineProperty(exports, "writeFileBuffer", {
 	enumerable: true,
 	get: function() {