rulesync 16.18.0 → 16.20.0

package/dist/{import-BKnAc4rT.js → import-1-jjDDAm.js}

@@ -2,19 +2,225 @@ import { ZodError } from "zod";
 import { meta, minLength, nonnegative, optional, refine, z } from "zod/mini";
 import { chmod, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
 import path, { basename, dirname, extname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
-import { parse, parseTree, printParseErrorCode } from "jsonc-parser";
+import { applyEdits, findNodeAtLocation, getNodeValue, modify, parse, parseTree, printParseErrorCode } from "jsonc-parser";
 import os from "node:os";
 import { intersection, kebabCase, uniq } from "es-toolkit";
 import { globbySync, isGitIgnoredSync } from "globby";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { format, isDeepStrictEqual } from "node:util";
 import matter from "gray-matter";
 import { YAMLException, dump, load } from "js-yaml";
 import { omit } from "es-toolkit/object";
 import { constants } from "node:fs";
 import { createHash } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
 import * as smolToml from "smol-toml";
 import { parse as parse$1, stringify } from "smol-toml";
 import { encode } from "@toon-format/toon";
+//#region src/utils/control-characters.ts
+/**
+* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
+* introducer U+009B), the bidirectional overrides and isolates, the Unicode
+* line and paragraph separators, and the plain LRM/RLM/ALM marks. A name or
+* value copied out of an untrusted config file, a fetched repository, or a
+* tool's own settings file must never reach the terminal with these intact:
+* they let the text forge log lines, reorder what is printed around them, or
+* inject escape sequences. LRM, RLM and the Arabic letter mark open no bidi
+* scope of their own, but they still reorder the neutral characters beside
+* them, so they go too — a diagnostic line is not the place to preserve the
+* typography of a right-to-left name.
+*/
+const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
+/**
+* Removes every control character from `text` so it is safe to splice into a
+* log line or other terminal output.
+*/
+function stripControlCharacters(text) {
+	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
+}
+/**
+* Removes every control character from `text` except the line feed, so a
+* message written to be read over several lines still is.
+*
+* `stripControlCharacters` takes newlines out because a diagnostic is one line
+* and a name that carries one can forge a second. An error message is not: a
+* lock file names the process holding it over several lines, and the MCP
+* `generate` failure lists one unreadable source per line. The carriage return
+* still goes, since on its own it paints over the line already written — which
+* is why this splits on the line feed and strips each line rather than carrying
+* a second character class that has to be kept in step with the first.
+*/
+function stripControlCharactersKeepingLineFeeds(text) {
+	return text.split("\n").map(stripControlCharacters).join("\n");
+}
+/**
+* Matches the characters that take no width of their own.
+*
+* `Default_Ignorable_Code_Point` is the Unicode property for exactly this — the
+* zero-width joiners, the soft hyphen, the variation selectors, the Hangul
+* fillers, the tag characters — and the format category `Cf` covers the few
+* that sit outside it, such as the interlinear annotation marks. Both are used
+* rather than a list of ranges because a list has to be revisited every time
+* Unicode adds one, and the one that is missed is the one an attacker reaches
+* for: U+3164 HANGUL FILLER, the classic of the homograph domain names, is a
+* letter of the Hangul script and would pass every check aimed at Latin.
+*
+* The braille blank is named on its own. It carries no dots, so it draws as
+* nothing while belonging to neither set.
+*
+* None of these is a control character, so none is caught by
+* `stripControlCharacters` — and none of them shows. A name that differs from
+* another only by one of these is drawn exactly like it, which is why a name
+* that carries one is not a name a user can be asked to judge.
+*/
+const INVISIBLE_CHARACTERS_PATTERN = /[\p{Default_Ignorable_Code_Point}\p{Cf}\u2800]/gu;
+/**
+* Removes every zero-width and otherwise invisible character from `text`.
+*
+* Kept apart from `stripControlCharacters` because the two answer different
+* questions. That one asks what is safe to print; this one asks whether a name
+* shows everything it contains, which is what a prompt needs before it offers
+* the name as something to pick.
+*/
+function stripInvisibleCharacters(text) {
+	return text.replace(INVISIBLE_CHARACTERS_PATTERN, "");
+}
+/**
+* Removes every character that does not show: the control characters and the
+* invisible ones alike.
+*
+* This is the form a name has to survive unchanged before it can be offered as
+* something to choose. Callers that need the whole answer should reach for this
+* rather than composing the two strippers themselves, so that the order — and
+* the definition of "hidden" — lives in one place.
+*/
+function stripHiddenCharacters(text) {
+	return stripInvisibleCharacters(stripControlCharacters(text));
+}
+/**
+* The invisible characters that do a job in some scripts rather than only
+* hiding: the two zero-width joiners and the variation selectors.
+*
+* A Persian or Indic name spells a word with ZWNJ (U+200C) in it, and an emoji
+* name is a chain of ZWJ (U+200D) and variation selectors. Refusing those
+* outright would refuse names that are written the only way their script writes
+* them, so they are judged by where they sit rather than by what they are.
+*/
+const ZERO_WIDTH_JOINER_PATTERN = /\u200c|\u200d/u;
+const VARIATION_SELECTOR_PATTERN = /[\u{fe00}-\u{fe0f}]|[\u{e0100}-\u{e01ef}]/u;
+/** The twelve characters a keycap can be built on, per ED-14 of UTS #51. */
+const KEYCAP_BASE_PATTERN = /[0-9#*]/u;
+/** The selector that asks for the emoji form of the character before it. */
+const EMOJI_PRESENTATION_SELECTOR$1 = "️";
+/** U+20E3, which draws the box the base and the selector go inside. */
+const COMBINING_ENCLOSING_KEYCAP = "⃣";
+/**
+* Whether the three characters are an emoji keycap, spelled as UTS #51 spells
+* it: `Emoji_Keycap_Sequence := [0-9#*] FE0F 20E3`.
+*
+* The twelve bases are the only ASCII characters Unicode gives the `Emoji`
+* property to, and not one of them is a pictograph — `1` is a digit and `#` is
+* punctuation — so the joining list below cannot see the sequence, and a
+* directory named `1\u{fe0f}\u{20e3}` would be turned away as a digit padded
+* with a variation selector. It is not padding: the selector is what asks for
+* the emoji form of the digit, and the enclosing keycap behind it is what draws
+* the box around it. Both neighbors are required, which is what keeps the
+* exception to the sequence rather than handing it to every digit in every
+* name: `pdf1` with a variation selector and no keycap after it is padding
+* still, and is refused still.
+*
+* @see https://www.unicode.org/reports/tr51/#def_emoji_keycap_sequence
+*/
+function isKeycapSequence(params) {
+	const { base, selector, following } = params;
+	return base !== void 0 && KEYCAP_BASE_PATTERN.test(base) && selector === EMOJI_PRESENTATION_SELECTOR$1 && following === COMBINING_ENCLOSING_KEYCAP;
+}
+/**
+* The characters a joiner has work to do beside: the scripts whose words are
+* written with one, and the pictographs an emoji sequence is built from.
+*
+* A list of what may join rather than of what may not, because the two are not
+* the same size. `pdf` with a ZWNJ between the d and the f is `pdf` on screen
+* and a different directory underneath, and the same is true of `設定` with a
+* ZWJ after the first character: neither Latin nor Han joins anything that way,
+* and nor does Cyrillic, Greek, Hangul or kana. Naming the scripts that do —
+* the Arabic family, the Indic ones, Mongolian, and the pictographs — is what
+* keeps the exception to the names that need it, instead of handing it to every
+* writing system that is merely not Latin.
+*/
+const JOINING_CONTEXT_PATTERN = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}\p{Script=Nko}\p{Script=Mongolian}\p{Script=Devanagari}\p{Script=Bengali}\p{Script=Gurmukhi}\p{Script=Gujarati}\p{Script=Oriya}\p{Script=Tamil}\p{Script=Telugu}\p{Script=Kannada}\p{Script=Malayalam}\p{Script=Sinhala}\p{Script=Myanmar}\p{Script=Khmer}\p{Script=Tibetan}\p{Script=Adlam}\p{Extended_Pictographic}]/u;
+/** Non-global copies, because `test` on a global regex carries state between calls. */
+const CONTROL_CHARACTER_PATTERN = new RegExp(CONTROL_CHARACTERS_PATTERN.source, "u");
+const INVISIBLE_CHARACTER_PATTERN = new RegExp(INVISIBLE_CHARACTERS_PATTERN.source, "u");
+/**
+* Whether `text` carries a hidden character that is there to hide something.
+*
+* This is the question a name has to answer before it can be offered as
+* something to pick, and it is a narrower one than `stripHiddenCharacters`
+* answers. Every control character counts, and so does every invisible
+* character — except a joiner or variation selector standing where its own
+* script would put one, which is to say beside a character from a script that
+* is written with joiners, or beside a pictograph.
+*
+* A joiner is held to both of its neighbors, since it exists to bind two
+* characters and a name that ends in one is binding nothing: `設定` with a ZWJ
+* after it is `設定` on screen and a second directory underneath. A variation
+* selector is held only to the character before it, which is the one it selects
+* a form for, and which is why an emoji name may end in one.
+*
+* The keycap sequence is the one emoji the joining list cannot recognize on its
+* own, since what it is built on is a digit or an ASCII sign rather than a
+* pictograph, so it is matched whole instead.
+*
+* Han is not on the joining list, so an ideographic variation sequence — a Han
+* character followed by one of U+E0100 onward — is refused along with the rest.
+* That is the intended trade: no skill directory here is named with one, and
+* the pair is drawn as the bare character on every terminal that has no font
+* for the variant, which is the shape the check exists to refuse.
+*
+* The test is a heuristic in place of the CONTEXTJ joining rules of IDNA,
+* which decide the same question by the joining type of the characters around
+* the joiner. It errs toward accepting a name written in a script that needs
+* these characters, and toward rejecting one that mixes them into Latin, where
+* they can only be padding.
+*/
+function hasDeceptiveHiddenCharacters(text) {
+	const characters = [...text];
+	const joinsCharacter = (neighbor) => neighbor !== void 0 && JOINING_CONTEXT_PATTERN.test(neighbor);
+	return characters.some((character, index) => {
+		if (CONTROL_CHARACTER_PATTERN.test(character)) return true;
+		if (!INVISIBLE_CHARACTER_PATTERN.test(character)) return false;
+		if (VARIATION_SELECTOR_PATTERN.test(character)) {
+			if (isKeycapSequence({
+				base: characters[index - 1],
+				selector: character,
+				following: characters[index + 1]
+			})) return false;
+			return !joinsCharacter(characters[index - 1]);
+		}
+		if (!ZERO_WIDTH_JOINER_PATTERN.test(character)) return true;
+		return !joinsCharacter(characters[index - 1]) || !joinsCharacter(characters[index + 1]);
+	});
+}
+//#endregion
+//#region src/utils/truncate.ts
+/**
+* Cut `text` to `maxLength` without splitting a character in half.
+*
+* `String.prototype.slice` counts UTF-16 units, so cutting inside a surrogate
+* pair leaves a lone surrogate that the next encoder turns into a replacement
+* character, and cutting inside a `\uXXXX` escape that `JSON.stringify` wrote
+* leaves a dangling backslash. Diagnostics quote files rulesync did not write,
+* so both are reachable from a repository's own content rather than only from
+* a hand-crafted string.
+*/
+function truncateText({ text, maxLength, suffix }) {
+	if (text.length <= maxLength) return text;
+	const characters = Array.from(text.slice(0, maxLength * 2 + 2));
+	if (characters.length <= maxLength) return text;
+	const cut = characters.slice(0, maxLength).join("");
+	return `${(/\\*$/.exec(cut)?.[0].length ?? 0) % 2 === 0 ? cut : cut.slice(0, -1)}${suffix}`;
+}
+//#endregion
 //#region src/utils/error.ts
 /**
 * Convert various error types to a readable error message
@@ -39,10 +245,52 @@ import { encode } from "@toon-format/toon";
 function isZodErrorLike(error) {
 	return error !== null && typeof error === "object" && "issues" in error && Array.isArray(error.issues) && error.issues.every((issue) => issue !== null && typeof issue === "object" && "path" in issue && Array.isArray(issue.path) && "message" in issue && typeof issue.message === "string");
 }
+/**
+* How much of a Zod error the formatted message spells out.
+*
+* One `safeParse` of a large invalid document produces an issue per offending
+* node, each carrying the path and message, so the raw expansion is bounded by
+* the size of the input rather than by anything rulesync decides — and the
+* formatted message no longer stops at a terminal: it becomes the `message` of
+* a `--json` failure document and of an MCP result. The first few issues are
+* what tells the reader which file to open; the rest is the same information
+* again, at whatever length the input chose.
+*/
+const MAX_ZOD_ISSUES_LENGTH = 2e3;
+/**
+* How much of any other error the formatted message spells out.
+*
+* Larger than the Zod bound because the text is the error's own sentence rather
+* than a re-listing of one issue per offending node, and because the MCP
+* `generate` failure hands this one a line per unreadable source. Bounded all
+* the same: a parser quotes the offending line verbatim, and a minified file is
+* one line the length of the file.
+*/
+const MAX_ERROR_MESSAGE_LENGTH = 8e3;
+/**
+* Strip and bound an error message that is about to be read by something other
+* than a terminal — a `--json` failure document, an MCP result.
+*
+* The line feed stays: several messages are deliberately written over more than
+* one line, and running them together would cost more than the newline can do
+* here. Everything that reorders the text around it, or that an escape sequence
+* is written with, goes.
+*/
+function boundErrorMessage(text) {
+	return truncateText({
+		text: stripControlCharactersKeepingLineFeeds(text),
+		maxLength: MAX_ERROR_MESSAGE_LENGTH,
+		suffix: "…(truncated)"
+	});
+}
 function formatError(error) {
-	if (error instanceof ZodError || isZodErrorLike(error)) return `Zod raw error: ${JSON.stringify(error.issues)}`;
-	if (error instanceof Error) return `${error.name}: ${error.message}`;
-	return String(error);
+	if (error instanceof ZodError || isZodErrorLike(error)) return `Zod raw error: ${truncateText({
+		text: stripControlCharacters(JSON.stringify(error.issues)),
+		maxLength: MAX_ZOD_ISSUES_LENGTH,
+		suffix: "…(truncated)"
+	})}`;
+	if (error instanceof Error) return boundErrorMessage(`${error.name}: ${error.message}`);
+	return boundErrorMessage(String(error));
 }
 //#endregion
 //#region src/types/features.ts
@@ -336,7 +584,8 @@ const subagentsProcessorToolTargetTuple = [
 	"zoocode",
 	"rovodev",
 	"takt",
-	"vibe"
+	"vibe",
+	"zcode"
 ];
 const skillsProcessorToolTargetTuple = [
 	"agentsmd",
@@ -516,138 +765,6 @@ async function mapWithConcurrency({ items, limit, mapper }) {
 	return results;
 }
 //#endregion
-//#region src/utils/control-characters.ts
-/**
-* Matches C0 controls, DEL, the C1 range (which includes the 8-bit CSI
-* introducer U+009B), the bidirectional overrides and isolates, and the Unicode
-* line and paragraph separators, and the plain LRM/RLM/ALM marks. A name or value
-* copied out of an untrusted config file, a fetched repository, or a tool's own
-* settings file must never reach the terminal with these intact: they let the
-* text forge log lines, reorder what is printed around them, or inject escape
-* sequences. LRM, RLM and the Arabic letter mark open no bidi scope of their
-* own, but they still reorder the neutral characters beside them, so they go too — a diagnostic line is not the
-* place to preserve the typography of a right-to-left name.
-*/
-const CONTROL_CHARACTERS_PATTERN = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/g;
-/**
-* Removes every control character from `text` so it is safe to splice into a
-* log line or other terminal output.
-*/
-function stripControlCharacters(text) {
-	return text.replace(CONTROL_CHARACTERS_PATTERN, "");
-}
-/**
-* Matches the characters that take no width of their own.
-*
-* `Default_Ignorable_Code_Point` is the Unicode property for exactly this — the
-* zero-width joiners, the soft hyphen, the variation selectors, the Hangul
-* fillers, the tag characters — and the format category `Cf` covers the few
-* that sit outside it, such as the interlinear annotation marks. Both are used
-* rather than a list of ranges because a list has to be revisited every time
-* Unicode adds one, and the one that is missed is the one an attacker reaches
-* for: U+3164 HANGUL FILLER, the classic of the homograph domain names, is a
-* letter of the Hangul script and would pass every check aimed at Latin.
-*
-* The braille blank is named on its own. It carries no dots, so it draws as
-* nothing while belonging to neither set.
-*
-* None of these is a control character, so none is caught by
-* `stripControlCharacters` — and none of them shows. A name that differs from
-* another only by one of these is drawn exactly like it, which is why a name
-* that carries one is not a name a user can be asked to judge.
-*/
-const INVISIBLE_CHARACTERS_PATTERN = /[\p{Default_Ignorable_Code_Point}\p{Cf}\u2800]/gu;
-/**
-* Removes every zero-width and otherwise invisible character from `text`.
-*
-* Kept apart from `stripControlCharacters` because the two answer different
-* questions. That one asks what is safe to print; this one asks whether a name
-* shows everything it contains, which is what a prompt needs before it offers
-* the name as something to pick.
-*/
-function stripInvisibleCharacters(text) {
-	return text.replace(INVISIBLE_CHARACTERS_PATTERN, "");
-}
-/**
-* Removes every character that does not show: the control characters and the
-* invisible ones alike.
-*
-* This is the form a name has to survive unchanged before it can be offered as
-* something to choose. Callers that need the whole answer should reach for this
-* rather than composing the two strippers themselves, so that the order — and
-* the definition of "hidden" — lives in one place.
-*/
-function stripHiddenCharacters(text) {
-	return stripInvisibleCharacters(stripControlCharacters(text));
-}
-/**
-* The invisible characters that do a job in some scripts rather than only
-* hiding: the two zero-width joiners and the variation selectors.
-*
-* A Persian or Indic name spells a word with ZWNJ (U+200C) in it, and an emoji
-* name is a chain of ZWJ (U+200D) and variation selectors. Refusing those
-* outright would refuse names that are written the only way their script writes
-* them, so they are judged by where they sit rather than by what they are.
-*/
-const ZERO_WIDTH_JOINER_PATTERN = /\u200c|\u200d/u;
-const VARIATION_SELECTOR_PATTERN = /[\u{fe00}-\u{fe0f}]|[\u{e0100}-\u{e01ef}]/u;
-/**
-* The characters a joiner has work to do beside: the scripts whose words are
-* written with one, and the pictographs an emoji sequence is built from.
-*
-* A list of what may join rather than of what may not, because the two are not
-* the same size. `pdf` with a ZWNJ between the d and the f is `pdf` on screen
-* and a different directory underneath, and the same is true of `設定` with a
-* ZWJ after the first character: neither Latin nor Han joins anything that way,
-* and nor does Cyrillic, Greek, Hangul or kana. Naming the scripts that do —
-* the Arabic family, the Indic ones, Mongolian, and the pictographs — is what
-* keeps the exception to the names that need it, instead of handing it to every
-* writing system that is merely not Latin.
-*/
-const JOINING_CONTEXT_PATTERN = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}\p{Script=Nko}\p{Script=Mongolian}\p{Script=Devanagari}\p{Script=Bengali}\p{Script=Gurmukhi}\p{Script=Gujarati}\p{Script=Oriya}\p{Script=Tamil}\p{Script=Telugu}\p{Script=Kannada}\p{Script=Malayalam}\p{Script=Sinhala}\p{Script=Myanmar}\p{Script=Khmer}\p{Script=Tibetan}\p{Script=Adlam}\p{Extended_Pictographic}]/u;
-/** Non-global copies, because `test` on a global regex carries state between calls. */
-const CONTROL_CHARACTER_PATTERN = new RegExp(CONTROL_CHARACTERS_PATTERN.source, "u");
-const INVISIBLE_CHARACTER_PATTERN = new RegExp(INVISIBLE_CHARACTERS_PATTERN.source, "u");
-/**
-* Whether `text` carries a hidden character that is there to hide something.
-*
-* This is the question a name has to answer before it can be offered as
-* something to pick, and it is a narrower one than `stripHiddenCharacters`
-* answers. Every control character counts, and so does every invisible
-* character — except a joiner or variation selector standing where its own
-* script would put one, which is to say beside a character from a script that
-* is written with joiners, or beside a pictograph.
-*
-* A joiner is held to both of its neighbors, since it exists to bind two
-* characters and a name that ends in one is binding nothing: `設定` with a ZWJ
-* after it is `設定` on screen and a second directory underneath. A variation
-* selector is held only to the character before it, which is the one it selects
-* a form for, and which is why an emoji name may end in one.
-*
-* Han is not on the joining list, so an ideographic variation sequence — a Han
-* character followed by one of U+E0100 onward — is refused along with the rest.
-* That is the intended trade: no skill directory here is named with one, and
-* the pair is drawn as the bare character on every terminal that has no font
-* for the variant, which is the shape the check exists to refuse.
-*
-* The test is a heuristic in place of the CONTEXTJ joining rules of IDNA,
-* which decide the same question by the joining type of the characters around
-* the joiner. It errs toward accepting a name written in a script that needs
-* these characters, and toward rejecting one that mixes them into Latin, where
-* they can only be padding.
-*/
-function hasDeceptiveHiddenCharacters(text) {
-	const characters = [...text];
-	const joinsCharacter = (neighbor) => neighbor !== void 0 && JOINING_CONTEXT_PATTERN.test(neighbor);
-	return characters.some((character, index) => {
-		if (CONTROL_CHARACTER_PATTERN.test(character)) return true;
-		if (!INVISIBLE_CHARACTER_PATTERN.test(character)) return false;
-		if (VARIATION_SELECTOR_PATTERN.test(character)) return !joinsCharacter(characters[index - 1]);
-		if (!ZERO_WIDTH_JOINER_PATTERN.test(character)) return true;
-		return !joinsCharacter(characters[index - 1]) || !joinsCharacter(characters[index + 1]);
-	});
-}
-//#endregion
 //#region src/utils/vitest.ts
 function isEnvTest() {
 	return process.env.NODE_ENV === "test";
@@ -1004,7 +1121,16 @@ async function isSymlink(filepath) {
 		return false;
 	}
 }
-async function listDirectoryFiles(dir) {
+/**
+* Every entry name directly under `dir`, of whatever kind, in the order the
+* filesystem reports them.
+*
+* Named for what it returns, because {@link listFileNames} sits beside it and
+* answers a narrower question: this one reports directories and links as well
+* as files, and reads an unreadable directory as an empty one instead of
+* failing. Picking this where the other was meant brings both of those back.
+*/
+async function listDirectoryEntryNames(dir) {
 	try {
 		return await readdir(dir);
 	} catch {
@@ -1016,6 +1142,20 @@ function countHiddenSegments(filePath) {
 	return splitPathSegments(filePath).filter(isHiddenPathSegment).length;
 }
 /**
+* A path the running platform produced, written posix-separated.
+*
+* Not {@link toPosixPath}, which rewrites every backslash whatever it means. That
+* is right for a path a caller spelled, which may be spelled either way; it is
+* wrong for one the platform handed back. On a posix platform a backslash is an
+* ordinary character in a name, so rewriting it folds `a\b` onto `a/b` -- two
+* different directories, and wherever the result is used as a file's identity the
+* second one to be seen is taken for a repeat of the first and dropped. On
+* Windows no name can hold a backslash, so the rewrite there is lossless.
+*/
+function nativePathToPosix(filePath) {
+	return sep === "\\" ? filePath.replaceAll("\\", "/") : filePath;
+}
+/**
 * The real file a path denotes, posix-separated so it compares against the globby results
 * that produce it. Two paths share an identity when they resolve to the very same file --
 * a link beside its target, a link into a shared tree, or a cycle that walks back into an
@@ -1023,19 +1163,61 @@ function countHiddenSegments(filePath) {
 */
 async function realFileIdentity(filePath) {
 	try {
-		return toPosixPath(await realpath(filePath));
+		return nativePathToPosix(await realpath(filePath));
 	} catch {
-		return toPosixPath(filePath);
+		return nativePathToPosix(filePath);
 	}
 }
 /**
+* Where the file `targetPath` really denotes sits relative to the one `rootPath`
+* does, with every link on both sides resolved. Posix-separated, because the
+* resolved paths it is built from are; a caller that splits it must split on `/`
+* alone, which is also the only separator a real name can never contain.
+*
+* Both sides fall back to their literal path when they cannot be resolved, so an
+* unresolvable path reads as an escape rather than as a contained one.
+*/
+async function resolvedRelativePath({ rootPath, targetPath }) {
+	const [realRootPath, realTargetPath] = await Promise.all([realFileIdentity(rootPath), realFileIdentity(targetPath)]);
+	return posix.relative(realRootPath, realTargetPath);
+}
+/**
+* Whether a posix relative path -- one {@link resolvedRelativePath} returned, or any
+* built the same way -- leads out of the root it was taken against.
+*
+* Exported so a caller that already holds the relative path can ask this of the very
+* path it goes on to read, instead of resolving both sides a second time and judging
+* a result it then has to trust is the same one.
+*/
+function posixRelativePathEscapesRoot(relativePath) {
+	return relativePath === ".." || relativePath.startsWith("../") || posix.isAbsolute(relativePath);
+}
+/**
+* How many trailing segments `filePath` and `identity` have in common.
+*
+* A path that walked through no link at all shares all of its own segments with
+* the file's identity; one that walked through a link named differently from
+* its target parts from the identity at that segment and shares only what
+* follows it. Counting from the end rather than testing the two for equality is
+* what lets the comparison hold for a path that is not itself resolved: a glob
+* rooted at a directory that is a link of its own gives every candidate the
+* same unresolved prefix, and only the segments below it decide.
+*/
+function sharedTrailingSegments(filePath, identity) {
+	const left = splitPathSegments(nativePathToPosix(filePath));
+	const right = splitPathSegments(identity);
+	let shared = 0;
+	while (shared < left.length && shared < right.length && left[left.length - 1 - shared] === right[right.length - 1 - shared]) shared++;
+	return shared;
+}
+/**
 * Pick the one path that represents a file among the paths that resolve to it.
 *
-* The path that walked through no link at all wins outright: it is already the real one,
-* so it equals the file's identity. That keeps the real location of a file as the path
-* callers see, rather than an alias that happens to sort first -- a directory link named
-* `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a cycle must not replace
-* `sub/note.md` with the same file reached back through the cycle.
+* The path that walked through no link at all wins outright: it shares every one of its
+* segments with the file's identity, which no alias does. That keeps the real location of
+* a file as the path callers see, rather than an alias that happens to sort first -- a
+* directory link named `aaa` pointing at `zzz` must not make `zzz/x.md` disappear, and a
+* cycle must not replace `sub/note.md` with the same file reached back through the cycle.
 * Failing that, the fewest dot-prefixed segments wins: when only links are on offer, the
 * named one represents the entry rather than a hidden alias that a hidden-entry rule may
 * then drop, taking the named path's content with it. `candidates` arrives in sorted
@@ -1043,8 +1225,9 @@ async function realFileIdentity(filePath) {
 */
 function chooseRepresentative(candidates, identity) {
 	return candidates.reduce((best, candidate) => {
-		if (toPosixPath(best) === identity) return best;
-		if (toPosixPath(candidate) === identity) return candidate;
+		const bestShared = sharedTrailingSegments(best, identity);
+		const candidateShared = sharedTrailingSegments(candidate, identity);
+		if (candidateShared !== bestShared) return candidateShared > bestShared ? candidate : best;
 		return countHiddenSegments(candidate) < countHiddenSegments(best) ? candidate : best;
 	});
 }
@@ -1142,7 +1325,7 @@ async function dedupeNamesByFileIdentity(params) {
 	});
 	const entriesByIdentity = /* @__PURE__ */ new Map();
 	for (const [index, entry] of entries.entries()) {
-		const identity = identities[index] ?? toPosixPath(join(dirPath, entry.name));
+		const identity = identities[index] ?? nativePathToPosix(join(dirPath, entry.name));
 		const group = entriesByIdentity.get(identity);
 		if (group === void 0) entriesByIdentity.set(identity, [entry]);
 		else group.push(entry);
@@ -1194,6 +1377,94 @@ async function listFileNames(dirPath, options = {}) {
 		nameFilter: options.nameFilter
 	});
 }
+/**
+* The paths of every file below `dirPath`, relative to it, walked rather than
+* globbed.
+*
+* The recursive counterpart of {@link listFileNames}, and there for the same
+* reason: globby reads a backslash as a path separator and rewrites it in the
+* paths it returns, so a file named `back\\slash.md` comes back as
+* `back/slash.md` — a path that belongs to no file, under a name that belongs
+* to no file either.
+*
+* A root that is not there is an empty root. A root that is there but cannot be
+* read is reported, so it is never mistaken for an empty one — as is a
+* directory below it, since a subtree silently missing from the result is the
+* same mistake one level down.
+*
+* A directory link is followed like any other directory, but each real
+* directory is walked only once, so neither a cycle nor a mesh of links can
+* make the walk repeat itself -- taking every distinct route through a graph of
+* aliases would cost one traversal per route, which a handful of links is
+* enough to make hopeless. The name a twice-reachable directory is reported
+* under is therefore whichever the walk reaches first, and the walk goes level
+* by level with each level sorted, so that is the shortest path to it and the
+* first in sorted order among equals. Note the difference from
+* {@link findFilesByGlobs}, which resolves each of its results and keeps the
+* real one: here a link nearer the root than the directory it points at stands
+* in for it. `nameFilter` narrows the files, not the directories the walk
+* descends into.
+*
+* The cost is one round of `readdir` per directory, taken in sequence, and the
+* whole of a level is held at once, so residency follows the widest level
+* rather than the deepest path.
+*/
+async function listFilePathsRecursively(dirPath, options = {}) {
+	const { followSymbolicLinks = true, includeHidden = false, nameFilter, deduplicateByFileIdentity = false } = options;
+	if (!await directoryExists(dirPath)) return [];
+	const filePaths = [];
+	const walkedIdentities = /* @__PURE__ */ new Set();
+	let level = [{
+		currentPath: dirPath,
+		prefix: ""
+	}];
+	while (level.length > 0) {
+		const nextLevel = [];
+		for (const { currentPath, prefix } of level.toSorted((a, b) => a.prefix < b.prefix ? -1 : a.prefix > b.prefix ? 1 : 0)) {
+			const identity = await realFileIdentity(currentPath);
+			if (walkedIdentities.has(identity)) continue;
+			walkedIdentities.add(identity);
+			const [fileNames, dirNames] = await Promise.all([listFileNames(currentPath, {
+				followSymbolicLinks,
+				includeHidden,
+				nameFilter
+			}), listSubdirectoryNames(currentPath, {
+				followSymbolicLinks,
+				includeHidden
+			})]);
+			for (const fileName of fileNames) filePaths.push(prefix === "" ? fileName : join(prefix, fileName));
+			for (const dirName of dirNames) nextLevel.push({
+				currentPath: join(currentPath, dirName),
+				prefix: prefix === "" ? dirName : join(prefix, dirName)
+			});
+		}
+		level = nextLevel;
+	}
+	return deduplicateByFileIdentity ? await deduplicateRelativePathsByFileIdentity({
+		dirPath,
+		relativePaths: filePaths
+	}) : filePaths.toSorted();
+}
+/**
+* One path per real file, chosen the way {@link findFilesByGlobs} chooses it.
+*
+* The walk de-duplicates the directories it descends into, so it cannot loop,
+* but it still reports every name it walks past: a file reached under two names
+* is listed twice. A caller reading the result as a set of files has to fold
+* those aliases together, and has to fold them the same way the glob does, or
+* the two disagree about the name a file has.
+*/
+async function deduplicateRelativePathsByFileIdentity({ dirPath, relativePaths }) {
+	const candidatesByFile = /* @__PURE__ */ new Map();
+	for (const relativePath of relativePaths.toSorted()) {
+		const absolutePath = join(dirPath, relativePath);
+		const identity = await realFileIdentity(absolutePath);
+		const candidates = candidatesByFile.get(identity);
+		if (candidates === void 0) candidatesByFile.set(identity, [absolutePath]);
+		else candidates.push(absolutePath);
+	}
+	return [...candidatesByFile.entries()].map(([identity, candidates]) => relative(dirPath, chooseRepresentative(candidates, identity))).toSorted();
+}
 async function removeDirectory(dirPath) {
 	if ([
 		".",
@@ -1355,24 +1626,111 @@ var CLIError = class extends Error {
 //#region src/utils/warned-once.ts
 /**
 * The messages a once-per-run warning has already emitted in this process.
-* This lives in its own module, free of imports, so the vitest setup file can
-* clear it between tests without pulling `logger.js` into every test's module
-* graph (which would defeat the module mocks some of those tests install).
+* This lives in its own module, importing nothing of rulesync's, so the vitest
+* setup file can clear it between tests without pulling `logger.js` into every
+* test's module graph (which would defeat the module mocks some of those tests
+* install).
+*/
+const processWideMessages = /* @__PURE__ */ new Set();
+/**
+* The set an operation that opened its own scope uses instead.
+*
+* The MCP server does not serialize requests, so two runs can be in flight at
+* once. Sharing one set between them would let the first run spend the token
+* for a message and leave the second one's result silent about a diagnostic
+* that applies to it just as much. A scope gives each run its own bookkeeping.
 */
-const warnedOnceMessages = /* @__PURE__ */ new Set();
+const scopedMessages = new AsyncLocalStorage();
+function currentMessages() {
+	return scopedMessages.getStore() ?? processWideMessages;
+}
 /** Whether `message` has not been emitted yet; records it when it has not. */
 function claimWarnOnce(message) {
-	if (warnedOnceMessages.has(message)) return false;
-	warnedOnceMessages.add(message);
+	const messages = currentMessages();
+	if (messages.has(message)) return false;
+	messages.add(message);
 	return true;
 }
-/** Forget which warnings were already emitted, so each test starts silent. */
+/** Forget which warnings were already emitted, so the next run starts silent. */
 function resetWarnedOnceMessages() {
-	warnedOnceMessages.clear();
+	currentMessages().clear();
+}
+/**
+* Run `operation` with its own once-per-run bookkeeping, so a concurrent run
+* neither spends its tokens nor clears its record.
+*/
+async function withWarnOnceScope(operation) {
+	return await scopedMessages.run(/* @__PURE__ */ new Set(), operation);
 }
 //#endregion
 //#region src/utils/logger.ts
 /**
+* Formats a log line the way `console.warn` would, so a warning that is handed
+* back to a caller reads the same as the one that reaches a terminal.
+*/
+function formatLogLine({ message, args }) {
+	return args.length === 0 ? message : format(message, ...args);
+}
+/**
+* How much a collecting logger keeps: at most this many warnings, each at most
+* this long, and no more than this in total.
+*
+* Collected warnings travel to places a console line does not — a `--json`
+* document that another program parses, an MCP result that an agent reads as
+* context — and their text quotes files rulesync did not write. So the amount a
+* repository can push through has to be bounded twice over: a config with
+* thousands of odd keys is a plausible accident, and a report sized in hundreds
+* of kilobytes is a generous budget for text aimed at whoever reads it next.
+* The total is the binding limit; the per-line and per-count limits keep one
+* enormous warning, or one enormous number of them, from being the whole of it.
+*/
+const MAX_COLLECTED_WARNINGS = 100;
+const MAX_COLLECTED_WARNING_LENGTH = 1e3;
+const MAX_COLLECTED_TOTAL_LENGTH = 8e3;
+/**
+* How many distinct warnings the de-duplication remembers.
+*
+* The record has to outlive the reported lines — a line dropped for want of
+* budget must not be counted again the next time the same diagnostic repeats —
+* so it grows with the number of distinct warnings a run raises rather than
+* with the number reported. Bounded for the same reason everything else here
+* is: past this many, later repeats are counted rather than recognized, which
+* inflates the trailing count but cannot grow the record without end.
+*/
+const MAX_DEDUPLICATED_WARNINGS = 1e3;
+/**
+* A bounded list of warning lines.
+*/
+var WarningCollection = class {
+	lines = [];
+	seen = /* @__PURE__ */ new Set();
+	totalLength = 0;
+	omitted = 0;
+	add({ message, args }) {
+		const kept = truncateText({
+			text: stripControlCharacters(formatLogLine({
+				message,
+				args
+			})),
+			maxLength: MAX_COLLECTED_WARNING_LENGTH,
+			suffix: "…(truncated)"
+		});
+		if (this.seen.has(kept)) return;
+		if (this.lines.length >= MAX_COLLECTED_WARNINGS || this.totalLength + kept.length > MAX_COLLECTED_TOTAL_LENGTH) {
+			if (this.seen.size < MAX_DEDUPLICATED_WARNINGS) this.seen.add(kept);
+			this.omitted++;
+			return;
+		}
+		this.seen.add(kept);
+		this.lines.push(kept);
+		this.totalLength += kept.length;
+	}
+	toArray() {
+		if (this.omitted === 0) return [...this.lines];
+		return [...this.lines, `… and ${this.omitted} more warning(s) not reported`];
+	}
+};
+/**
 * Base class for shared verbose/silent state and configuration logic
 */
 var BaseLogger = class {
@@ -1388,6 +1746,9 @@ var BaseLogger = class {
 	get silent() {
 		return this._silent;
 	}
+	get reportsWhileSilent() {
+		return false;
+	}
 	configure({ verbose, silent }) {
 		this._silent = silent;
 		this._verbose = verbose && !silent;
@@ -1433,11 +1794,18 @@ var ConsoleLogger = class extends BaseLogger {
 /**
 * JsonLogger - structured JSON output to stdout/stderr
 *
-* All console output methods (info, success, warn, debug) are no-ops.
+* The console output methods (info, success, debug) are no-ops. `warn` is not:
+* a diagnostic that only reached the console would be invisible to a `--json`
+* consumer, which reads the document and nothing else, so warnings are
+* collected and emitted as the document's top-level `warnings` array instead.
+* Top-level rather than inside `data` so it can never collide with a key a
+* command captured, and so it survives on the failure document too — the case
+* where a diagnostic about the input is most likely to explain the failure.
 */
 var JsonLogger = class extends BaseLogger {
 	_jsonOutputDone = false;
 	_jsonData = {};
+	_warnings = new WarningCollection();
 	_commandName;
 	_version;
 	constructor({ command, version, verbose = false, silent = false }) {
@@ -1466,6 +1834,8 @@ var JsonLogger = class extends BaseLogger {
 			command: this._commandName,
 			version: this._version
 		};
+		const warnings = this._warnings.toArray();
+		if (warnings.length > 0) output.warnings = warnings;
 		if (success) output.data = this._jsonData;
 		else if (error) {
 			output.error = {
@@ -1481,7 +1851,13 @@ var JsonLogger = class extends BaseLogger {
 	}
 	info(_message, ..._args) {}
 	success(_message, ..._args) {}
-	warn(_message, ..._args) {}
+	warn(message, ...args) {
+		if (this._silent) return;
+		this._warnings.add({
+			message,
+			args
+		});
+	}
 	error(message, code, ..._args) {
 		if (isEnvTest()) return;
 		const errorMessage = message instanceof Error ? message.message : message;
@@ -1507,13 +1883,110 @@ function warnOnConflictingFlags({ verbose, silent, jsonMode }) {
 	console.warn("Both --verbose and --silent specified; --silent takes precedence");
 }
 /**
+* Where `fallbackLogger` sends what it is given, scoped to the operation that
+* adopted it.
+*
+* An `AsyncLocalStorage` rather than a plain variable because the target is
+* per-operation, not per-process: a long-lived MCP server can have two requests
+* in flight at once, and a save/restore pair would let the first one to finish
+* hand the still-running request's warnings back to a console nobody reads.
+* Each operation sees only its own store.
+*/
+const fallbackTargetStorage = new AsyncLocalStorage();
+/**
+* Where warnings go outside any adopted scope: a plain console logger, which is
+* what a code path with no logger threaded through would otherwise have used.
+*/
+const defaultFallbackTarget = new ConsoleLogger();
+function currentFallbackTarget() {
+	return fallbackTargetStorage.getStore() ?? defaultFallbackTarget;
+}
+/**
+* True while the forwarder is inside a call it is forwarding.
+*
+* The adopted target is supposed to be something other than the forwarder, but
+* a wrapper *around* it — `hooks-processor.ts` returns one that prefixes the
+* tool target onto every warning — passes the identity check in
+* {@link withFallbackLoggerTarget} and would forward straight back here. A
+* plain module-level flag is enough because the forwarding is synchronous: the
+* call returns before anything else can run.
+*/
+let forwarding = false;
+/**
+* Reads from, or writes to, whichever logger the running operation adopted,
+* with the wrapper case above cut off at one hop.
+*
+* Every member of the forwarder goes through here, not just the two that write:
+* `warnOnceWithFallback` reads `silent` and `reportsWhileSilent` before it ever
+* calls `warn`, so a guard on the writing side alone would still be reached
+* through a getter that never returns.
+*/
+function throughFallbackTarget(use) {
+	if (forwarding) return use(defaultFallbackTarget);
+	forwarding = true;
+	try {
+		return use(currentFallbackTarget());
+	} finally {
+		forwarding = false;
+	}
+}
+/**
 * Shared fallback logger for code paths that have no command logger threaded
 * through (module-level translators, `warnWithFallback(undefined, ...)`).
-* `wrapCommand` configures it from CLI flags and `ConfigResolver.resolve`
-* re-configures it from the resolved config, so `silent`/`verbose` settings
-* are honored even on paths where the command logger is not available.
+*
+* It is a thin forwarder rather than a logger of its own so that the operation
+* currently running can adopt it: `wrapCommand` points it at the command
+* logger, which is how a warning raised deep in a translator still reaches a
+* `--json` document or an MCP result instead of being written to a console that
+* nobody in those modes is reading. Modules that captured a reference to
+* `fallbackLogger` at import time follow the redirection too, which a
+* swapped-out binding would not give us.
+*/
+const fallbackLogger = {
+	configure(options) {
+		defaultFallbackTarget.configure(options);
+	},
+	get verbose() {
+		return throughFallbackTarget((target) => target.verbose);
+	},
+	get silent() {
+		return throughFallbackTarget((target) => target.silent);
+	},
+	get reportsWhileSilent() {
+		return throughFallbackTarget((target) => target.reportsWhileSilent);
+	},
+	get jsonMode() {
+		return throughFallbackTarget((target) => target.jsonMode);
+	},
+	captureData(_key, _value) {},
+	getJsonData() {
+		return {};
+	},
+	outputJson(_success, _error) {},
+	info(_message, ..._args) {},
+	success(_message, ..._args) {},
+	warn(message, ...args) {
+		throughFallbackTarget((target) => {
+			target.warn(message, ...args);
+		});
+	},
+	error(message, code, ...args) {
+		defaultFallbackTarget.error(message, code, ...args);
+	},
+	debug(_message, ..._args) {}
+};
+/**
+* Run `operation` with `fallbackLogger` pointed at `logger`, so warnings raised
+* where no logger was threaded through end up in the same place as the rest of
+* that operation's diagnostics.
+*
+* The redirection lasts exactly as long as the operation and is invisible to
+* anything running beside it.
 */
-const fallbackLogger = new ConsoleLogger();
+async function withFallbackLoggerTarget({ logger, operation }) {
+	if (logger === fallbackLogger) return await operation();
+	return await fallbackTargetStorage.run(logger, () => withWarnOnceScope(operation));
+}
 /**
 * Emit a warning through `logger.warn` if a logger is supplied, otherwise
 * fall through to the shared `fallbackLogger`. Centralizes the "logger may
@@ -1531,9 +2004,35 @@ function warnWithFallback(logger, message) {
 * varies with what the user should do next does not.
 */
 function warnOnceWithFallback(logger, message) {
+	const destination = logger ?? fallbackLogger;
+	if (destination.silent && !destination.reportsWhileSilent) return;
 	if (!claimWarnOnce(message)) return;
-	warnWithFallback(logger, message);
+	destination.warn(message);
 }
+/**
+* A `ConsoleLogger` that keeps the warnings it is given.
+*
+* A caller with no console to write to — an MCP tool answering over stdio, where
+* the server's stderr never reaches the agent — can hand this in and put what
+* was reported into its own result, so a diagnostic about the files it just read
+* is something the agent can act on rather than something it never hears.
+*/
+var WarningCollectingLogger = class extends ConsoleLogger {
+	warnings = new WarningCollection();
+	get reportsWhileSilent() {
+		return true;
+	}
+	warn(message, ...args) {
+		this.warnings.add({
+			message,
+			args
+		});
+		super.warn(message, ...args);
+	}
+	getWarnings() {
+		return this.warnings.toArray();
+	}
+};
 //#endregion
 //#region src/utils/validation.ts
 /**
@@ -4540,6 +5039,17 @@ function parseStrict(content) {
 	return result;
 }
 /**
+* The error a source document should fail with when
+* {@link parseJsoncReportingDroppedKeys} reports keys the parser removed.
+*
+* Shared by every source that reports them, so the three files a user can
+* author explain the same removal the same way rather than each inventing its
+* own wording.
+*/
+function droppedPollutionKeysError({ sourcePath, droppedKeys }) {
+	return /* @__PURE__ */ new Error(`${JSON.stringify(sourcePath)} uses ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")} as ${droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`);
+}
+/**
 * The same parse as {@link parseJsonc}, additionally reporting which
 * prototype-pollution keys were removed, as dotted paths
 * (`permission.bash.__proto__`).
@@ -4619,9 +5129,17 @@ async function resolveRulesyncSourceWritePath({ outputRoot, paths }) {
 //#region src/features/hooks/rulesync-hooks.ts
 var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 	json;
+	/**
+	* Prototype-pollution keys the parser removed. They are dropped before the
+	* schema ever sees them, so without this record a hook keyed `constructor`
+	* would produce neither an error nor an entry in any generated file.
+	*/
+	droppedKeys;
 	constructor(params) {
 		super({ ...params });
-		this.json = parseJsonc(this.fileContent);
+		const { value, droppedKeys } = parseJsoncReportingDroppedKeys({ content: this.fileContent });
+		this.json = value;
+		this.droppedKeys = droppedKeys;
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -4640,6 +5158,13 @@ var RulesyncHooks = class RulesyncHooks extends RulesyncFile {
 		};
 	}
 	validate() {
+		if (this.droppedKeys.length > 0) return {
+			success: false,
+			error: droppedPollutionKeysError({
+				sourcePath: this.getRelativePathFromCwd(),
+				droppedKeys: this.droppedKeys
+			})
+		};
 		const result = HooksConfigSchema.safeParse(this.json);
 		if (!result.success) return {
 			success: false,
@@ -4986,9 +5511,17 @@ function mergeMcpJsonOverlays({ base, overlay }) {
 }
 var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 	json;
+	/**
+	* Prototype-pollution keys the parser removed. They are dropped before the
+	* schema ever sees them, so without this record a server named `__proto__`
+	* would produce neither an error nor an entry in any generated file.
+	*/
+	droppedKeys;
 	constructor(params) {
 		super(params);
-		this.json = parseJsonc(this.fileContent);
+		const { value, droppedKeys } = parseJsoncReportingDroppedKeys({ content: this.fileContent });
+		this.json = value;
+		this.droppedKeys = droppedKeys;
 		if (params.validate) {
 			const result = this.validate();
 			if (!result.success) throw result.error;
@@ -5010,6 +5543,13 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 		};
 	}
 	validate() {
+		if (this.droppedKeys.length > 0) return {
+			success: false,
+			error: droppedPollutionKeysError({
+				sourcePath: this.getRelativePathFromCwd(),
+				droppedKeys: this.droppedKeys
+			})
+		};
 		const result = RulesyncMcpFileSchema.safeParse(this.json);
 		if (!result.success) return {
 			success: false,
@@ -5079,16 +5619,23 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 			}
 			const fileContent = await readFileContent(filePath);
 			let parsed;
+			let droppedKeys;
 			try {
-				parsed = parseJsonc(fileContent);
-				if (!isRecord$1(parsed)) throw new Error("Expected a JSON object.");
-				if (validate) {
-					const result = RulesyncMcpFileSchema.safeParse(parsed);
-					if (!result.success) throw result.error;
-				}
+				const result = parseJsoncReportingDroppedKeys({ content: fileContent });
+				if (!isRecord$1(result.value)) throw new Error("Expected a JSON object.");
+				parsed = result.value;
+				droppedKeys = result.droppedKeys;
 			} catch (error) {
 				throw new Error(`Invalid MCP source file '${filePath}': ${formatError(error)}`, { cause: error });
 			}
+			if (validate) {
+				if (droppedKeys.length > 0) throw droppedPollutionKeysError({
+					sourcePath: toPosixPath(relative(process.cwd(), filePath)),
+					droppedKeys
+				});
+				const result = RulesyncMcpFileSchema.safeParse(parsed);
+				if (!result.success) throw new Error(`Invalid MCP source file '${filePath}': ${formatError(result.error)}`, { cause: result.error });
+			}
 			rootSources.push({
 				record: parsed,
 				outputRoot: parent,
@@ -5334,12 +5881,13 @@ const PermissionActionSchema = z.enum([
 	"deny"
 ]);
 /**
-* Whether a permission pattern is blank — empty, or only whitespace. Shared
-* with the import-side filter so the key the schema rejects and the key that
-* filter removes can never drift apart.
+* Whether a key in a permission block — a category name or a pattern — is
+* blank, that is empty or only whitespace. Shared with the import-side filter
+* so the key the schema rejects and the key that filter removes can never
+* drift apart.
 */
-function isBlankPermissionPattern(pattern) {
-	return pattern.trim().length === 0;
+function isBlankPermissionKey(key) {
+	return key.trim().length === 0;
 }
 /**
 * A single permission pattern key.
@@ -5351,7 +5899,18 @@ function isBlankPermissionPattern(pattern) {
 * silently ignores it. Rather than let each target decide, reject it here so
 * the mistake surfaces once, on the source file.
 */
-const PermissionPatternSchema = z.string().check(z.refine((pattern) => !isBlankPermissionPattern(pattern), { message: "Permission pattern must not be blank" }));
+const PermissionPatternSchema = z.string().check(z.refine((pattern) => !isBlankPermissionKey(pattern), { message: "Permission pattern must not be blank" }));
+/**
+* A permission category key: the name of the tool surface a rules map applies
+* to (`bash`, `edit`, `webfetch`, ...).
+*
+* Blank is rejected for the same reason a blank pattern is, one step up. Every
+* translator reads categories by name, so `{"": {"git *": "allow"}}` reaches no
+* tool at all and the rules under it are silently dead — the mistake is only
+* visible as an entry missing from a generated config. Rejecting it here
+* surfaces it on the source file instead.
+*/
+const PermissionCategorySchema = z.string().check(z.refine((category) => !isBlankPermissionKey(category), { message: "Permission category must not be blank" }));
 /**
 * Permission rules for a single tool category.
 * Keys are glob patterns matching tool input (commands, file paths, etc.).
@@ -5372,7 +5931,7 @@ const PermissionRulesSchema = z.record(PermissionPatternSchema, PermissionAction
 * @example
 * { "claudecode": { "permission": { "bash": { "git push *": "deny" } } } }
 */
-const ToolScopedPermissionSchema = z.record(z.string(), PermissionRulesSchema);
+const ToolScopedPermissionSchema = z.record(PermissionCategorySchema, PermissionRulesSchema);
 /**
 * Generic tool-scoped override block for tools that have no tool-specific
 * override keys of their own; it carries only the canonical tool-scoped
@@ -5430,7 +5989,7 @@ const OpencodeOverridePermissionValueSchema = z.union([PermissionActionSchema, P
 * @example
 * { "permission": { "external_directory": "deny", "webfetch": "allow" } }
 */
-const OpencodePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(z.string(), OpencodeOverridePermissionValueSchema)) });
+const OpencodePermissionsOverrideSchema = z.looseObject({ permission: z.optional(z.record(PermissionCategorySchema, OpencodeOverridePermissionValueSchema)) });
 /**
 * Tool-scoped override block for Hermes Agent. Keys placed here are deep-merged
 * into Hermes's `~/.hermes/config.yaml` and never leak into other tools' configs.
@@ -5490,7 +6049,7 @@ const ClinePermissionsOverrideSchema = z.looseObject({
 * @see https://kilo.ai/docs/getting-started/settings/sandboxing
 */
 const KiloPermissionsOverrideSchema = z.looseObject({
-	permission: z.optional(z.record(z.string(), OpencodeOverridePermissionValueSchema)),
+	permission: z.optional(z.record(PermissionCategorySchema, OpencodeOverridePermissionValueSchema)),
 	sandbox: z.optional(z.looseObject({}))
 });
 /**
@@ -5561,7 +6120,7 @@ const ClaudecodePermissionsOverrideSchema = z.looseObject({
 * { "enabled_tools": ["bash", "read_file", "grep"] }
 */
 const VibePermissionsOverrideSchema = z.looseObject({
-	permission: z.optional(z.record(z.string(), z.looseObject({ sensitive_patterns: z.optional(z.array(z.string())) }))),
+	permission: z.optional(z.record(PermissionCategorySchema, z.looseObject({ sensitive_patterns: z.optional(z.array(z.string())) }))),
 	enabled_tools: z.optional(z.array(z.string()))
 });
 /**
@@ -6295,12 +6854,12 @@ const ZedPermissionsOverrideSchema = z.looseObject({
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
-* The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
-* `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie`/`takt`/`amp`/
-* `antigravity-cli`/`augmentcode`/`kiro`/`codexcli`/`zed` keys are tool-scoped
-* overrides consumed only by their respective translator (see the matching
-* `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
-* block and ignores them.
+* The optional tool keys below are tool-scoped overrides consumed only by their
+* respective translator (see the matching `*PermissionsOverrideSchema`); every
+* other tool reads the shared `permission` block and ignores them. The set of
+* keys is exactly `permissionsProcessorToolTargetTuple` mapped through
+* `PERMISSION_OVERRIDE_KEY_ALIASES` — a test asserts that, so this comment does
+* not enumerate them and go stale.
 *
 * Additionally, every permissions-capable tool accepts a canonical tool-scoped
 * `permission` block under its override key (`{toolname}.permission`, same
@@ -6318,7 +6877,7 @@ const ZedPermissionsOverrideSchema = z.looseObject({
 * }
 */
 const PermissionsConfigSchema = z.looseObject({
-	permission: z.record(z.string(), PermissionRulesSchema),
+	permission: z.record(PermissionCategorySchema, PermissionRulesSchema),
 	opencode: z.optional(OpencodePermissionsOverrideSchema),
 	hermes: z.optional(HermesPermissionsOverrideSchema),
 	cline: z.optional(ClinePermissionsOverrideSchema),
@@ -6347,7 +6906,9 @@ const PermissionsConfigSchema = z.looseObject({
 	goose: z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": z.optional(KimiCodePermissionsOverrideSchema),
-	rovodev: z.optional(CanonicalPermissionsOverrideSchema)
+	roo: z.optional(CanonicalPermissionsOverrideSchema),
+	rovodev: z.optional(CanonicalPermissionsOverrideSchema),
+	zoocode: z.optional(CanonicalPermissionsOverrideSchema)
 });
 /**
 * Full permissions file schema including optional $schema field.
@@ -6389,10 +6950,40 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 			}]
 		};
 	}
+	/**
+	* The canonical document an importer produces from a tool's own config.
+	*
+	* Every importer has to run the blank-key filter over what it is about to
+	* write: the canonical schema rejects a blank pattern and a blank category
+	* outright, so a source file carrying either would be refused by the very
+	* next `generate` — and that refusal takes the whole file with it, so one
+	* blank key imported from one tool stops every tool's permissions from being
+	* generated. Building the imported document here rather than calling the
+	* filter beside each `new RulesyncPermissions(...)` is what keeps the next
+	* importer from forgetting it.
+	*
+	* `sourcePath` is the tool config being read, used only to name it if
+	* something is dropped.
+	*/
+	static fromImportedFileContent({ outputRoot, fileContent, sourcePath, logger }) {
+		return new RulesyncPermissions({
+			outputRoot,
+			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
+			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
+			fileContent: withoutBlankPermissionKeys({
+				fileContent,
+				sourcePath,
+				logger
+			})
+		});
+	}
 	validate() {
 		if (this.droppedKeys.length > 0) return {
 			success: false,
-			error: /* @__PURE__ */ new Error(`${join(this.relativeDirPath, this.relativeFilePath)} uses ${this.droppedKeys.join(", ")} as ${this.droppedKeys.length === 1 ? "a key" : "keys"}. Rulesync removes __proto__, constructor and prototype from every source document it parses, because assigning them would reach the prototype chain instead of the object. They are therefore never written to any tool's config — rename them rather than leaving entries that silently do nothing.`)
+			error: droppedPollutionKeysError({
+				sourcePath: this.getRelativePathFromCwd(),
+				droppedKeys: this.droppedKeys
+			})
 		};
 		const result = RulesyncPermissionsFileSchema.safeParse(this.json);
 		if (!result.success) return {
@@ -6464,33 +7055,62 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 	}
 };
 /**
-* Strip every blank permission pattern from an already-parsed canonical
-* document, reporting how many were dropped from each block.
+* Tool-scoped override keys whose `permission` block maps a category to
+* something other than a pattern map. Vibe alone keeps
+* `{ sensitive_patterns: [...] }` objects there, so the keys one level down are
+* field names and the blank-pattern filter must not walk them. The category
+* names above them are still category names, and are filtered like any other.
+*
+* Typed as `ToolTarget` so a renamed target fails to compile here rather than
+* silently stopping to match, which would let the filter start deleting Vibe's
+* fields and reporting them as removed permission patterns. That only holds for
+* targets whose override key is the target name itself: a target that aliases
+* to another key (see `PERMISSION_OVERRIDE_KEY_ALIASES`) would have to be listed
+* under the alias, which this type would reject. None of them is non-pattern-map
+* today, so add that spelling only when one becomes so.
+*/
+const NON_PATTERN_MAP_PERMISSION_OVERRIDE_KEYS = /* @__PURE__ */ new Set(["vibe"]);
+/**
+* Strip every blank key — category or pattern — from an already-parsed
+* canonical document, reporting how many were dropped from each block.
 *
 * Both the shared `permission` block and every tool-scoped
 * `{toolname}.permission` block are walked, because import produces both:
 * OpenCode and Kilo route their tool-only categories into the tool-scoped block
-* verbatim, so a blank pattern in the user's own config lands there. A category
-* whose value is not a rules map is left exactly as it is, which is what keeps
-* the tool-native shapes intact — OpenCode's and Kilo's bare action strings
-* (`"external_directory": "deny"`) have no pattern key to inspect, Vibe's
-* `sensitive_patterns` objects carry no blank key, and Kilo's `sandbox` is not a
-* `permission` block at all.
-*/
-function stripBlankPermissionPatterns(config) {
-	const removed = /* @__PURE__ */ new Map();
-	const filterBlock = ({ block, blockPath }) => {
+* verbatim, so a blank key in the user's own config lands there. A category
+* whose value is not a rules map keeps its value exactly as it is, which is what
+* keeps the tool-native shapes intact — OpenCode's and Kilo's bare action
+* strings (`"external_directory": "deny"`) have no pattern key to inspect, and
+* Kilo's `sandbox` is not a `permission` block at all.
+*
+* Categories are filtered for the same reason patterns are, one level up: the
+* canonical schema rejects a blank category, so reproducing one would write a
+* source file the very next `generate` refuses — and it would refuse the whole
+* file, taking every tool's permissions generation down with it.
+*
+* The patterns inside {@link NON_PATTERN_MAP_PERMISSION_OVERRIDE_KEYS} blocks
+* are left alone: they are field names rather than patterns there. Their
+* category names are still filtered.
+*/
+function stripBlankPermissionKeys(config) {
+	const patterns = /* @__PURE__ */ new Map();
+	const categories = /* @__PURE__ */ new Map();
+	const filterBlock = ({ block, blockPath, filterPatterns }) => {
 		const filtered = {};
 		for (const [category, rules] of Object.entries(block)) {
-			if (!isRecord$1(rules)) {
+			if (isBlankPermissionKey(category)) {
+				categories.set(blockPath, (categories.get(blockPath) ?? 0) + 1);
+				continue;
+			}
+			if (!filterPatterns || !isRecord$1(rules)) {
 				filtered[category] = rules;
 				continue;
 			}
 			const kept = {};
 			for (const [pattern, action] of Object.entries(rules)) {
-				if (isBlankPermissionPattern(pattern)) {
+				if (isBlankPermissionKey(pattern)) {
 					const path = `${blockPath}.${category}`;
-					removed.set(path, (removed.get(path) ?? 0) + 1);
+					patterns.set(path, (patterns.get(path) ?? 0) + 1);
 					continue;
 				}
 				kept[pattern] = action;
@@ -6503,25 +7123,41 @@ function stripBlankPermissionPatterns(config) {
 	const next = { ...config };
 	if (isRecord$1(config.permission)) next.permission = filterBlock({
 		block: config.permission,
-		blockPath: "permission"
+		blockPath: "permission",
+		filterPatterns: true
 	});
 	for (const [key, value] of Object.entries(config)) {
 		if (key === "permission" || !isRecord$1(value) || !isRecord$1(value.permission)) continue;
-		next[key] = {
-			...value,
-			permission: filterBlock({
-				block: value.permission,
-				blockPath: `${key}.permission`
-			})
-		};
+		const permission = filterBlock({
+			block: value.permission,
+			blockPath: `${key}.permission`,
+			filterPatterns: !NON_PATTERN_MAP_PERMISSION_OVERRIDE_KEYS.has(key)
+		});
+		if (!(Object.keys(permission).length === 0 && Object.keys(value.permission).length > 0)) {
+			next[key] = {
+				...value,
+				permission
+			};
+			continue;
+		}
+		const { permission: _emptied, ...rest } = value;
+		if (Object.keys(rest).length === 0) {
+			delete next[key];
+			continue;
+		}
+		next[key] = rest;
 	}
 	return {
 		config: next,
-		removed
+		removed: {
+			patterns,
+			categories
+		}
 	};
 }
+const summarizeDroppedCounts = (counts) => [...counts.entries()].map(([path, count]) => `${count} in ${JSON.stringify(path)}`).join(", ");
 /**
-* Report the dropped patterns.
+* Report the dropped keys.
 *
 * Dropping an entry silently is the failure mode a permissions source must not
 * have. A blanket blank pattern can read as "deny everything by default";
@@ -6532,27 +7168,36 @@ function stripBlankPermissionPatterns(config) {
 * `logger` is optional because the import direction (`toRulesyncPermissions`)
 * takes no logger parameter; the shared `fallbackLogger` is configured from the
 * CLI flags and the resolved config, so `silent` is still honored.
+*
+* `sourcePath` names the tool config the keys came out of. A single import run
+* reads many tools, and the block paths alone (`permission.bash`) are the same
+* for all of them, so without it the user is told something was dropped but not
+* from where.
 */
-function warnAboutDroppedPatterns({ removed, logger }) {
-	warnWithFallback(logger, `Dropped blank permission patterns while reading a tool's permission configuration (${[...removed.entries()].map(([path, count]) => `${count} in "${path}"`).join(", ")}). An empty or whitespace-only pattern matches everything, and tools disagree on what it means — some apply it to every command, others ignore it entirely — so it is not carried into the rulesync permissions config. If one of them was a blanket deny, the imported configuration now allows more than the file it came from; re-add it with a real pattern.`);
+function warnAboutDroppedKeys({ removed, sourcePath, logger }) {
+	const source = sourcePath === void 0 ? "a tool's permission configuration" : JSON.stringify(sourcePath);
+	if (removed.patterns.size > 0) warnWithFallback(logger, `Dropped blank permission patterns while reading ${source} (${summarizeDroppedCounts(removed.patterns)}). An empty or whitespace-only pattern matches everything, and tools disagree on what it means — some apply it to every command, others ignore it entirely — so it is not carried into the rulesync permissions config. If one of them was a blanket deny, the imported configuration now allows more than the file it came from; re-add it with a real pattern.`);
+	if (removed.categories.size > 0) warnWithFallback(logger, `Dropped blank permission categories while reading ${source} (${summarizeDroppedCounts(removed.categories)}). A category name is how every tool finds the rules underneath it, so an empty or whitespace-only one reaches no tool at all and the rules below it were never going to be generated. Carrying one into the rulesync permissions config would make the next generate refuse the whole file, so it is removed here; re-add those rules under a real category name.`);
 }
 /**
-* Drop blank permission patterns from a canonical document produced by import.
+* Drop blank permission keys from a canonical document produced by import.
 *
-* The canonical schema rejects a blank pattern outright, and every tool that
-* has one in its own config already treats it as something other than a real
-* pattern (Roo Code, for instance, keeps only entries passing
-* `cmd.trim().length > 0`). Reproducing one in `.rulesync/permissions.jsonc`
-* would therefore write a source file that the very next `generate` refuses —
-* so it is removed here instead, and reported.
+* The canonical schema rejects a blank pattern and a blank category outright,
+* and every tool that has a blank pattern in its own config already treats it as
+* something other than a real pattern (Roo Code, for instance, keeps only
+* entries passing `cmd.trim().length > 0`). Reproducing either in
+* `.rulesync/permissions.jsonc` would therefore write a source file that the
+* very next `generate` refuses — the whole file, not just that entry — so they
+* are removed here instead, and reported.
 */
-function withoutBlankPermissionPatterns({ fileContent, logger }) {
+function withoutBlankPermissionKeys({ fileContent, sourcePath, logger }) {
 	const parsed = parseJsonc(fileContent);
 	if (!isRecord$1(parsed)) return fileContent;
-	const { config, removed } = stripBlankPermissionPatterns(parsed);
-	if (removed.size === 0) return fileContent;
-	warnAboutDroppedPatterns({
+	const { config, removed } = stripBlankPermissionKeys(parsed);
+	if (removed.patterns.size === 0 && removed.categories.size === 0) return fileContent;
+	warnAboutDroppedKeys({
 		removed,
+		sourcePath,
 		logger
 	});
 	return JSON.stringify(config, null, 2);
@@ -6561,14 +7206,15 @@ function withoutBlankPermissionPatterns({ fileContent, logger }) {
 * The same filter over an already-parsed document, for callers that validate a
 * canonical block before it is ever serialized. Hermes Agent stores its
 * rulesync provenance inside its own config and parses it back on import; left
-* unfiltered, one blank pattern would fail `safeParse` and discard the entire
-* provenance block without a word.
+* unfiltered, one blank pattern or category would fail `safeParse` and discard
+* the entire provenance block without a word.
 */
-function withoutBlankPermissionPatternsIn({ config, logger }) {
-	const { config: filtered, removed } = stripBlankPermissionPatterns(config);
-	if (removed.size === 0) return config;
-	warnAboutDroppedPatterns({
+function withoutBlankPermissionKeysIn({ config, sourcePath, logger }) {
+	const { config: filtered, removed } = stripBlankPermissionKeys(config);
+	if (removed.patterns.size === 0 && removed.categories.size === 0) return config;
+	warnAboutDroppedKeys({
 		removed,
+		sourcePath,
 		logger
 	});
 	return filtered;
@@ -6717,6 +7363,24 @@ var RulesyncRule = class RulesyncRule extends RulesyncFile {
 //#endregion
 //#region src/types/ai-dir.ts
 /**
+* Whether `name` is a path rather than a single name.
+*
+* Both separators are rejected on every platform, which is why neither
+* `path.sep` nor the platform is consulted: a backslash is a legal character in
+* a POSIX name, but a name carrying one is a path the moment it reaches
+* Windows, and `AiDir` names travel between the two — most tools take one
+* straight from a skill's frontmatter.
+*
+* Exported because the checks that run *before* a name reaches `AiDir` — so
+* that an unusable name is reported and skipped rather than thrown over — have
+* to reject exactly the set this guard does. Two spellings of one rule drift
+* apart the moment either is tightened, and the pre-filter drifting narrower
+* turns a reported name back into a failed run.
+*/
+function containsPathSeparator(name) {
+	return name.includes("/") || name.includes("\\");
+}
+/**
 * Directories that hold credentials. Excluding these protects something, so
 * their exclusion is reported rather than silent.
 */
@@ -7176,7 +7840,7 @@ var AiDir = class AiDir {
 	*/
 	global;
 	constructor({ outputRoot = process.cwd(), relativeDirPath, dirName, mainFile, otherFiles = [], global = false }) {
-		if (dirName.includes(path.sep) || dirName.includes("/") || dirName.includes("\\")) throw new Error(`Directory name cannot contain path separators: dirName="${dirName}"`);
+		if (containsPathSeparator(dirName)) throw new Error(`Directory name cannot contain path separators: dirName="${dirName}"`);
 		if (dirName === "" || dirName === "." || dirName === "..") throw new Error(`Directory name cannot be empty, ".", or "..": dirName="${dirName}"`);
 		this.outputRoot = outputRoot;
 		this.relativeDirPath = relativeDirPath;
@@ -7237,7 +7901,7 @@ var AiDir = class AiDir {
 		const mainFile = this.getMainFile();
 		if (mainFile === void 0) return;
 		const name = mainFile.name;
-		if (name === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\")) return;
+		if (name === "" || name === "." || name === ".." || containsPathSeparator(name)) return;
 		return path.join(this.getDirPath(), name);
 	}
 	getDirPath() {
@@ -7568,7 +8232,7 @@ var AiDir = class AiDir {
 * differ from the path the run claims, which turns it into an orphan.
 */
 function isUnsafeSkillDirName(name) {
-	return name === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.endsWith(".") || name.endsWith(" ");
+	return name === "" || name === "." || name === ".." || containsPathSeparator(name) || name.endsWith(".") || name.endsWith(" ");
 }
 const RulesyncSkillFrontmatterSchema = z.looseObject({
 	name: z.string().check(z.refine((name) => !isUnsafeSkillDirName(name), { message: "name is used as a directory name: it may not be empty, \".\" or \"..\", contain a path separator, or end with a dot or a space" })),
@@ -7828,6 +8492,16 @@ const RulesyncSubagentFrontmatterSchema = z.looseObject({
 	zoocode: z.optional(z.looseObject({ 
 	/** Per-mode MCP server allowlist (Zoo Code v3.60.0+); omitted = all. */
 allowedMcpServers: z.optional(z.array(z.string())) })),
+	zcode: z.optional(z.looseObject({
+		model: z.optional(z.string()),
+		thoughtLevel: z.optional(z.string()),
+		color: z.optional(z.string()),
+		tools: z.optional(z.array(z.string())),
+		disallowedTools: z.optional(z.array(z.string())),
+		maxTurns: z.optional(z.number().check(z.int(), z.positive())),
+		injectAgentsMd: z.optional(z.boolean()),
+		mcpServers: z.optional(z.array(z.string()))
+	})),
 	vibe: z.optional(z.looseObject({
 		agent_type: z.optional(z.enum(["agent", "subagent"])),
 		display_name: z.optional(z.string()),
@@ -7915,10 +8589,12 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 * lets a directory be *created* with a backslash in its name, so such a
 * directory can sit in a skills root that nothing here can name — it is
 * reported rather than passed on, since the alternative is a candidate built
-* from a name that belongs to no directory at all.
+* from a name that belongs to no directory at all. The test is `AiDir`'s own,
+* so this pre-filter cannot come to accept a name the guard behind it throws
+* over.
 */
 function isAddressableSkillName(name) {
-	return !name.includes("/") && !name.includes("\\");
+	return !containsPathSeparator(name);
 }
 /**
 * The names of the skill directories directly under `skillsRoot`.
@@ -9309,18 +9985,168 @@ function splitCheckFile({ fileContent, fallbackName }) {
 	});
 }
 //#endregion
+//#region src/features/checks/aggregated-tool-check.ts
+/**
+* Shared skeleton for the checks adapters whose output is a single aggregated
+* instruction file — one file whose sections are the marked blocks
+* `aggregated-check-file.ts` renders and splits, rather than a directory with a
+* file per check.
+*
+* That module already held the rendering and the splitting; what is here is the
+* adapter around it, which was near-verbatim in Cursor Bugbot, Rovo Dev and
+* Factory Droid. A subclass supplies {@link ToolCheck.getSettablePaths} and
+* {@link getAggregatedCheckConfig}, and inherits the rest — so a fix to how
+* these files are read or written lands once instead of three times.
+*
+* `fromRulesyncCheck` is refused here rather than implemented: sections share
+* one file, so an output cannot be produced from one check in isolation and the
+* processor calls {@link fromRulesyncChecks} instead.
+*
+* Not declared `abstract`, even though nothing instantiates it directly: the
+* statics below build the subclass with `new this(...)`, which an abstract
+* constructor type forbids. What a subclass owes is enforced the way the rest
+* of this codebase enforces it on a static — {@link getAggregatedCheckConfig}
+* throws until it is overridden.
+*/
+var AggregatedToolCheck = class extends ToolCheck {
+	/**
+	* The per-tool values the shared skeleton reads. Thrown rather than abstract
+	* because TypeScript has no abstract statics; a subclass that forgets it
+	* fails on its first use rather than silently taking a default.
+	*/
+	static getAggregatedCheckConfig() {
+		throw new Error("Please implement this method in the subclass.");
+	}
+	/**
+	* The settable paths with the file name required. An aggregated adapter names
+	* the one file it writes — that is what keeps consumers which would otherwise
+	* claim the whole tool directory, the gitignore derivation among them,
+	* narrowed to it — so a missing name is a mistake in the subclass rather than
+	* a case to fall back for.
+	*/
+	static getAggregatedPaths({ global = false } = {}) {
+		const paths = this.getSettablePaths({ global });
+		if (!paths.relativeFilePath) throw new Error(`${this.name} writes one aggregated file, so getSettablePaths must name it.`);
+		return {
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath
+		};
+	}
+	static getAggregatedFilePath({ outputRoot, global = false }) {
+		const paths = this.getAggregatedPaths({ global });
+		return {
+			...paths,
+			filePath: join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)
+		};
+	}
+	static isTargetedByRulesyncCheck(rulesyncCheck) {
+		return this.isTargetedByRulesyncCheckDefault({
+			rulesyncCheck,
+			toolTarget: this.getAggregatedCheckConfig().toolTarget
+		});
+	}
+	/**
+	* Ownership guard the processor consults before it deletes anything for this
+	* tool. Every one of these paths is one a user may well have written by hand,
+	* whether because the tool documents it as the place to write review
+	* instructions or because it is shared with something else the tool loads, so
+	* anything in it that rulesync did not write is not rulesync's to remove — dropping the last check targeting the tool must not
+	* take somebody's review instructions with it. Deletion is therefore allowed
+	* only for a file that is nothing but generated sections: one that carries no
+	* marker at all, or that carries hand-written text ahead of the first marker,
+	* stays.
+	*/
+	static async canDeleteAuxiliaryFiles({ outputRoot }) {
+		const { filePath } = this.getAggregatedFilePath({ outputRoot });
+		const fileContent = await readFileContentOrNull(filePath);
+		if (fileContent === null) return true;
+		return isOnlyGeneratedSections(fileContent);
+	}
+	static fromRulesyncCheck(_params) {
+		const { displayName } = this.getAggregatedCheckConfig();
+		throw new Error(`${displayName} checks are built from all checks at once; use fromRulesyncChecks.`);
+	}
+	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
+		if (rulesyncChecks.length === 0) return [];
+		const config = this.getAggregatedCheckConfig();
+		const { relativeDirPath, relativeFilePath, filePath } = this.getAggregatedFilePath({
+			outputRoot,
+			global
+		});
+		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) {
+			if (config.handWrittenPreamble === "skip") {
+				logger?.warn(config.handWrittenWarning({
+					filePath,
+					displayName: config.displayName,
+					toolTarget: config.toolTarget
+				}));
+				return [];
+			}
+			logger?.warn(`${config.displayName} checks: ${filePath} holds instructions rulesync did not write, and generating replaces the whole file. Run \`rulesync import --targets ${config.toolTarget} --features checks\` first to keep them.`);
+		}
+		return [new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: renderCheckFile(rulesyncChecks),
+			global
+		})];
+	}
+	static async fromFile({ outputRoot = process.cwd(), global = false }) {
+		const { relativeDirPath, relativeFilePath, filePath } = this.getAggregatedFilePath({
+			outputRoot,
+			global
+		});
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: await readFileContentOrNull(filePath) ?? "",
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncCheck() {
+		const first = this.toRulesyncChecks()[0];
+		if (!first) throw new Error(`No check instructions found in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
+		return first;
+	}
+	toRulesyncChecks() {
+		const config = this.constructor.getAggregatedCheckConfig();
+		const fileContent = this.getFileContent();
+		return splitCheckFile({
+			fileContent: config.transformImportedContent?.(fileContent) ?? fileContent,
+			fallbackName: config.fallbackCheckName
+		});
+	}
+};
+//#endregion
 //#region src/features/checks/cursor-check.ts
-const FALLBACK_CHECK_NAME$2 = "bugbot";
 /**
 * Checks adapter for Cursor Bugbot (`.cursor/BUGBOT.md`).
 *
 * Bugbot takes one aggregated instruction file per directory rather than a file
 * per check, so every `.rulesync/checks/*.md` targeting Cursor collapses into
-* the repository-root `.cursor/BUGBOT.md` — hence {@link fromRulesyncChecks}
-* rather than the usual per-check conversion. Each check becomes one section:
-* an HTML-comment marker carrying the check name, an `## <name>` heading, and
-* the check body as the instruction text (the `description` is used when the
-* body is empty).
+* the repository-root `.cursor/BUGBOT.md` — hence `fromRulesyncChecks` rather
+* than the usual per-check conversion, which {@link AggregatedToolCheck}
+* provides. Each check becomes one section: an HTML-comment marker carrying the
+* check name, an `## <name>` heading, and the check body as the instruction
+* text (the `description` is used when the body is empty).
 *
 * Bugbot reads the file as free prose, so a check's `severity` and `tools` have
 * no equivalent there: they are not written and do not come back on import. So
@@ -9336,97 +10162,26 @@ const FALLBACK_CHECK_NAME$2 = "bugbot";
 * before the first marker — and a hand-written file with no markers at all —
 * becomes a single `bugbot` check, so nothing in the file is dropped. A file
 * holding anything rulesync did not write is never deleted either (see
-* {@link canDeleteAuxiliaryFiles}), though generating checks for Cursor does
-* replace it — import first to keep what is there, which is warned about.
+* `canDeleteAuxiliaryFiles` on the base), though generating checks for Cursor
+* does replace it — import first to keep what is there, which is warned about.
 *
 * @see https://cursor.com/docs/bugbot
 */
-var CursorCheck = class CursorCheck extends ToolCheck {
+var CursorCheck = class extends AggregatedToolCheck {
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: CURSOR_DIR,
 			relativeFilePath: CURSOR_BUGBOT_FILE_NAME
 		};
 	}
-	static isTargetedByRulesyncCheck(rulesyncCheck) {
-		return this.isTargetedByRulesyncCheckDefault({
-			rulesyncCheck,
-			toolTarget: "cursor"
-		});
-	}
-	/**
-	* Ownership guard the processor consults before it deletes anything for this
-	* tool. `.cursor/BUGBOT.md` is a file Cursor's own documentation tells users
-	* to hand-write, so anything in it that rulesync did not write is not
-	* rulesync's to remove — dropping the last check targeting Cursor must not
-	* take somebody's hand-written review instructions with it. Deletion is
-	* therefore allowed only for a file that is nothing but generated sections:
-	* one that carries no marker at all, or that carries hand-written text ahead
-	* of the first marker, stays.
-	*/
-	static async canDeleteAuxiliaryFiles({ outputRoot }) {
-		const paths = CursorCheck.getSettablePaths();
-		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? "BUGBOT.md"));
-		if (fileContent === null) return true;
-		return isOnlyGeneratedSections(fileContent);
-	}
-	static fromRulesyncCheck(_params) {
-		throw new Error("Cursor checks are built from all checks at once; use fromRulesyncChecks.");
-	}
-	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
-		if (rulesyncChecks.length === 0) return [];
-		const paths = CursorCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "BUGBOT.md";
-		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) logger?.warn(`Cursor checks: ${filePath} holds instructions rulesync did not write, and generating replaces the whole file. Run \`rulesync import --targets cursor --features checks\` first to keep them.`);
-		const fileContent = renderCheckFile(rulesyncChecks);
-		return [new CursorCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent,
-			global
-		})];
-	}
-	static async fromFile({ outputRoot = process.cwd(), global = false }) {
-		const paths = CursorCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "BUGBOT.md";
-		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		return new CursorCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: await readFileContentOrNull(filePath) ?? "",
-			global
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new CursorCheck({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			global
-		});
-	}
-	validate() {
+	static getAggregatedCheckConfig() {
 		return {
-			success: true,
-			error: null
+			displayName: "Cursor",
+			toolTarget: "cursor",
+			fallbackCheckName: "bugbot",
+			handWrittenPreamble: "replace"
 		};
 	}
-	toRulesyncCheck() {
-		const first = this.toRulesyncChecks()[0];
-		if (!first) throw new Error(`No check instructions found in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
-		return first;
-	}
-	toRulesyncChecks() {
-		return splitCheckFile({
-			fileContent: this.getFileContent(),
-			fallbackName: FALLBACK_CHECK_NAME$2
-		});
-	}
 };
 //#endregion
 //#region src/constants/factorydroid-paths.ts
@@ -9463,7 +10218,6 @@ const FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME = "review-guidelines";
 const FACTORYDROID_REVIEW_GUIDELINES_DIR_PATH = join(FACTORYDROID_SKILLS_DIR_PATH, FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME);
 //#endregion
 //#region src/features/checks/factorydroid-check.ts
-const FALLBACK_CHECK_NAME$1 = FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME;
 /**
 * Drop the YAML frontmatter of a hand-authored `review-guidelines` skill before
 * the file is split into checks.
@@ -9498,6 +10252,9 @@ function stripSkillFrontmatter(fileContent) {
 		content = rest.slice(closing.index + closing[0].length).replace(LEADING_BLANK_LINE_PATTERN, "");
 	}
 }
+function handWrittenWarning({ filePath, displayName, toolTarget }) {
+	return `${displayName} checks: ${filePath} holds instructions rulesync did not write, so it is left as it is and no checks were generated for ${displayName}. Run \`rulesync import --targets ${toolTarget} --features checks\` to bring them into \`.rulesync/checks/\` and then delete the file, so the next generate writes it back from there; delete it outright if you no longer want it, or rename the directory if it is an ordinary skill rather than review guidelines. Importing alone leaves this file as it is, so it keeps blocking generation until it is gone. A rulesync skill named \`${FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME}\` is no longer generated here — Factory's reviewer reads this path, so the checks feature owns it — but a directory an older rulesync wrote can still be sitting there.`;
+}
 /**
 * Checks adapter for Factory Droid's code-review guidelines
 * (`.factory/skills/review-guidelines/SKILL.md`).
@@ -9506,9 +10263,10 @@ function stripSkillFrontmatter(fileContent) {
 * "repository-specific review guidelines" from a skill named
 * `review-guidelines` and injects them into every review run. That makes the
 * output a single aggregated file like Cursor Bugbot's and Rovo Dev's, so every
-* `.rulesync/checks/*.md` targeting Factory Droid collapses into it via
-* {@link fromRulesyncChecks}, each check written as a marked section (see
-* `aggregated-check-file.ts` for the marker convention the adapters share).
+* `.rulesync/checks/*.md` targeting Factory Droid collapses into it via the
+* `fromRulesyncChecks` on {@link AggregatedToolCheck}, each check written as a
+* marked section (see `aggregated-check-file.ts` for the marker convention the
+* three aggregated adapters share).
 *
 * The file is plain Markdown with no frontmatter, matching Factory's documented
 * example. Frontmatter would also be self-defeating here: `renderCheckFile`
@@ -9526,8 +10284,9 @@ function stripSkillFrontmatter(fileContent) {
 * The output lives inside the same `.factory/skills/` tree the `skills` feature
 * writes, so a user-authored `review-guidelines` skill collides with it. The
 * path has one owner rather than a merge rule, and the owner is this feature:
-* {@link fromRulesyncChecks} leaves a file holding anything rulesync did not
-* write untouched, and {@link canDeleteAuxiliaryFiles} refuses to remove one.
+* generating leaves a file holding anything rulesync did not write untouched —
+* the `skip` policy below — and the base's `canDeleteAuxiliaryFiles` refuses to
+* remove one.
 * Their content is somebody's own writing and rulesync cannot reconstruct it,
 * so neither direction guesses. That is stricter than Cursor Bugbot's
 * replace-and-warn, and deliberately: `.cursor/BUGBOT.md` is a path only the
@@ -9537,92 +10296,23 @@ function stripSkillFrontmatter(fileContent) {
 *
 * @see https://docs.factory.ai/software-factory/code-review-ci
 */
-var FactorydroidCheck = class FactorydroidCheck extends ToolCheck {
+var FactorydroidCheck = class extends AggregatedToolCheck {
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: FACTORYDROID_REVIEW_GUIDELINES_DIR_PATH,
 			relativeFilePath: SKILL_FILE_NAME
 		};
 	}
-	static isTargetedByRulesyncCheck(rulesyncCheck) {
-		return this.isTargetedByRulesyncCheckDefault({
-			rulesyncCheck,
-			toolTarget: "factorydroid"
-		});
-	}
-	/**
-	* Ownership guard the processor consults before it deletes anything for this
-	* tool. `review-guidelines` is an ordinary skill directory a user may have
-	* authored by hand, so dropping the last check targeting Factory Droid must
-	* not take their review instructions with it. Deletion is allowed only for a
-	* file that is nothing but generated sections.
-	*/
-	static async canDeleteAuxiliaryFiles({ outputRoot }) {
-		const paths = FactorydroidCheck.getSettablePaths();
-		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? "SKILL.md"));
-		if (fileContent === null) return true;
-		return isOnlyGeneratedSections(fileContent);
-	}
-	static fromRulesyncCheck(_params) {
-		throw new Error("Factory Droid checks are built from all checks at once; use fromRulesyncChecks.");
-	}
-	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
-		if (rulesyncChecks.length === 0) return [];
-		const paths = FactorydroidCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "SKILL.md";
-		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) {
-			logger?.warn(`Factory Droid checks: ${filePath} holds instructions rulesync did not write, so it is left as it is and no checks were generated for Factory Droid. Run \`rulesync import --targets factorydroid --features checks\` to bring them into \`.rulesync/checks/\` and then delete the file, so the next generate writes it back from there; delete it outright if you no longer want it, or rename the directory if it is an ordinary skill rather than review guidelines. Importing alone leaves this file as it is, so it keeps blocking generation until it is gone. A rulesync skill named \`${FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME}\` is no longer generated here — Factory's reviewer reads this path, so the checks feature owns it — but a directory an older rulesync wrote can still be sitting there.`);
-			return [];
-		}
-		const fileContent = renderCheckFile(rulesyncChecks);
-		return [new FactorydroidCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent,
-			global
-		})];
-	}
-	static async fromFile({ outputRoot = process.cwd(), global = false }) {
-		const paths = FactorydroidCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? "SKILL.md";
-		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		return new FactorydroidCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: await readFileContentOrNull(filePath) ?? "",
-			global
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new FactorydroidCheck({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			global
-		});
-	}
-	validate() {
+	static getAggregatedCheckConfig() {
 		return {
-			success: true,
-			error: null
+			displayName: "Factory Droid",
+			toolTarget: "factorydroid",
+			fallbackCheckName: FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME,
+			handWrittenPreamble: "skip",
+			handWrittenWarning,
+			transformImportedContent: stripSkillFrontmatter
 		};
 	}
-	toRulesyncCheck() {
-		const first = this.toRulesyncChecks()[0];
-		if (!first) throw new Error(`No check instructions found in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
-		return first;
-	}
-	toRulesyncChecks() {
-		return splitCheckFile({
-			fileContent: stripSkillFrontmatter(this.getFileContent()),
-			fallbackName: FALLBACK_CHECK_NAME$1
-		});
-	}
 };
 //#endregion
 //#region src/constants/hermesagent-paths.ts
@@ -9881,7 +10571,6 @@ var HermesagentCheck = class HermesagentCheck extends ToolCheck {
 };
 //#endregion
 //#region src/features/checks/rovodev-check.ts
-const FALLBACK_CHECK_NAME = "review-agent";
 /**
 * Checks adapter for Rovo Dev CLI's code-review custom instructions
 * (`.rovodev/.review-agent.md`).
@@ -9890,9 +10579,9 @@ const FALLBACK_CHECK_NAME = "review-agent";
 * `.rovodev/` folder — no frontmatter, and note the leading dot in the file
 * name. Like Cursor Bugbot it is a single aggregated file rather than a file
 * per check, so every `.rulesync/checks/*.md` targeting Rovo Dev collapses into
-* it via {@link fromRulesyncChecks}, with each check written as a marked
-* section (see `aggregated-check-file.ts` for the marker convention the two
-* adapters share).
+* it via the `fromRulesyncChecks` on {@link AggregatedToolCheck}, with each
+* check written as a marked section (see `aggregated-check-file.ts` for the
+* marker convention the three aggregated adapters share).
 *
 * Rovo Dev reads the file as free prose, so a check's `severity` and `tools`
 * have no equivalent there: they are not written and do not come back on
@@ -9904,88 +10593,21 @@ const FALLBACK_CHECK_NAME = "review-agent";
 *
 * @see https://support.atlassian.com/rovo/docs/set-custom-instructions-for-code-reviews/
 */
-var RovodevCheck = class RovodevCheck extends ToolCheck {
+var RovodevCheck = class extends AggregatedToolCheck {
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: ROVODEV_DIR,
 			relativeFilePath: ROVODEV_REVIEW_AGENT_FILE_NAME
 		};
 	}
-	static isTargetedByRulesyncCheck(rulesyncCheck) {
-		return this.isTargetedByRulesyncCheckDefault({
-			rulesyncCheck,
-			toolTarget: "rovodev"
-		});
-	}
-	/**
-	* Ownership guard the processor consults before it deletes anything for this
-	* tool. `.review-agent.md` is a file Rovo Dev's own documentation tells users
-	* to hand-write, so anything in it that rulesync did not write is not
-	* rulesync's to remove — dropping the last check targeting Rovo Dev must not
-	* take somebody's hand-written review instructions with it.
-	*/
-	static async canDeleteAuxiliaryFiles({ outputRoot }) {
-		const paths = RovodevCheck.getSettablePaths();
-		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? ".review-agent.md"));
-		if (fileContent === null) return true;
-		return isOnlyGeneratedSections(fileContent);
-	}
-	static fromRulesyncCheck(_params) {
-		throw new Error("Rovo Dev checks are built from all checks at once; use fromRulesyncChecks.");
-	}
-	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
-		if (rulesyncChecks.length === 0) return [];
-		const paths = RovodevCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? ".review-agent.md";
-		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		if (hasHandWrittenPreamble(await readFileContentOrNull(filePath) ?? "")) logger?.warn(`Rovo Dev checks: ${filePath} holds instructions rulesync did not write, and generating replaces the whole file. Run \`rulesync import --targets rovodev --features checks\` first to keep them.`);
-		return [new RovodevCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: renderCheckFile(rulesyncChecks),
-			global
-		})];
-	}
-	static async fromFile({ outputRoot = process.cwd(), global = false }) {
-		const paths = RovodevCheck.getSettablePaths({ global });
-		const relativeFilePath = paths.relativeFilePath ?? ".review-agent.md";
-		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		return new RovodevCheck({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath,
-			fileContent: await readFileContentOrNull(filePath) ?? "",
-			global
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new RovodevCheck({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			global
-		});
-	}
-	validate() {
+	static getAggregatedCheckConfig() {
 		return {
-			success: true,
-			error: null
+			displayName: "Rovo Dev",
+			toolTarget: "rovodev",
+			fallbackCheckName: "review-agent",
+			handWrittenPreamble: "replace"
 		};
 	}
-	toRulesyncCheck() {
-		const first = this.toRulesyncChecks()[0];
-		if (!first) throw new Error(`No check instructions found in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
-		return first;
-	}
-	toRulesyncChecks() {
-		return splitCheckFile({
-			fileContent: this.getFileContent(),
-			fallbackName: FALLBACK_CHECK_NAME
-		});
-	}
 };
 //#endregion
 //#region src/constants/codexcli-paths.ts
@@ -10009,11 +10631,30 @@ const CODEXCLI_OVERRIDE_KEYS = [
 ];
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
+/**
+* Rebuild a parsed document without its prototype-pollution keys.
+*
+* Every object is rebuilt, not just the ones that are already plain: a literal
+* `"__proto__"` is assigned with `obj[key] = value` by `jsonc-parser`, which
+* *replaces the containing object's prototype* instead of adding a key. Such
+* an object is no longer a plain object, and the injected value is reachable
+* through it by plain property access while `Object.keys` and `JSON.stringify`
+* show nothing — so leaving it as it came out of the parser would both hide a
+* server or permission the file does not state and, at the root, cost the
+* whole document (see {@link parseSharedConfig}). Rebuilding gives every
+* object `Object.prototype` back and drops the injected value with the key.
+*
+* Dates are the one object the YAML and TOML parsers produce that is not a
+* mapping, so they are passed through rather than flattened into `{}`.
+*/
 function sanitizeSharedConfigValue(value) {
 	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
-	if (!isPlainObject$1(value)) return value;
+	if (value === null || typeof value !== "object" || value instanceof Date) return value;
 	const result = {};
-	for (const [key, nested] of Object.entries(omitPrototypePollutionKeys(value))) result[key] = sanitizeSharedConfigValue(nested);
+	for (const [key, nested] of Object.entries(value)) {
+		if (isPrototypePollutionKey(key)) continue;
+		result[key] = sanitizeSharedConfigValue(nested);
+	}
 	return result;
 }
 /**
@@ -10042,11 +10683,12 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (parsed === void 0 || parsed === null) return {};
-	if (!isPlainObject$1(parsed)) {
+	const sanitized = sanitizeSharedConfigValue(parsed);
+	if (!isPlainObject$1(sanitized)) {
 		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
 		return {};
 	}
-	return sanitizeSharedConfigValue(parsed);
+	return sanitized;
 }
 /**
 * Serialize a shared config document. YAML output always ends with exactly one
@@ -10063,6 +10705,571 @@ function stringifySharedConfig({ format, document }) {
 	return JSON.stringify(document, null, 2);
 }
 /**
+* Where the line holding `from` starts and where the line starting at `from`
+* ends: the nearest `\r` or `\n` in each direction, or the edge of the text.
+*
+* Both characters count in both directions, because the JSONC scanner treats
+* either as a line break. A file written with lone CRs parses without an error
+* and so reaches these paths, and a comment read only up to the next `\n`
+* would run past its own line and take the closing brace — or a whole sibling
+* key — with it.
+*/
+function endOfLineFrom({ text, from }) {
+	for (let index = from; index < text.length; index += 1) {
+		const character = text[index];
+		if (character === "\n" || character === "\r") return index;
+	}
+	return text.length;
+}
+function startOfLineAt({ text, from }) {
+	for (let index = from - 1; index >= 0; index -= 1) {
+		const character = text[index];
+		if (character === "\n" || character === "\r") return index + 1;
+	}
+	return 0;
+}
+/**
+* Read the indentation and line ending a JSONC document already uses, so
+* inserted properties match the surrounding file instead of imposing the
+* 2-space `JSON.stringify` shape on a file written with 4 spaces or tabs.
+*
+* The root object's first property decides, located through the syntax tree
+* rather than by scanning for the first indented line: a file opening with a
+* banner comment indents that comment's continuation lines too (` * ...`
+* aligns at three columns), and reading the width off one of those would leave
+* `modify` re-indenting the lines it touches to a width nothing else in the
+* file uses. A property that does not start its own line — a one-line object,
+* or an empty one — carries no indent to read, so those fall back to the
+* 2-space default the whole-document writer emits.
+*/
+function detectJsoncFormattingOptions({ text, root }) {
+	const eol = "\n";
+	const first = root.children?.[0];
+	const indent = first === void 0 ? "" : text.slice(startOfLineAt({
+		text,
+		from: first.offset
+	}), first.offset);
+	if (indent === "" || indent.length > 8 || !/^[ \t]+$/.test(indent)) return {
+		tabSize: 2,
+		insertSpaces: true,
+		eol
+	};
+	if (indent.includes("	")) return {
+		tabSize: 2,
+		insertSpaces: false,
+		eol
+	};
+	return {
+		tabSize: indent.length,
+		insertSpaces: true,
+		eol
+	};
+}
+/**
+* Whether the document states a key no edit-based write can be trusted with.
+*
+* Two kinds, both answered from the syntax tree because the parsed value no
+* longer knows about either:
+*
+* - A key stated twice. That is legal JSON text which every reader resolves
+*   last-wins, while `modify` edits the *first* occurrence — so an edit-based
+*   write would land on the dead copy and leave the live one saying whatever
+*   it said before. For an owned key that is a silent ownership failure: a
+*   `deny` rulesync just wrote would sit above the `allow` the tool reads.
+* - `__proto__`, `constructor` or `prototype`. None survives into the parsed
+*   document — a nested one is dropped, a root-level `__proto__` replaces the
+*   root's prototype — so an edit-based write would find no difference to
+*   apply and leave the key in the file.
+*
+* The whole-document writer resolves duplicates last-wins and drops pollution
+* keys, which is what it has always done, so those files go to it.
+*/
+function statesUneditableKeys(node) {
+	if (node.type === "array") return (node.children ?? []).some((child) => statesUneditableKeys(child));
+	if (node.type !== "object") return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const property of node.children ?? []) {
+		const key = property.children?.[0]?.value;
+		if (typeof key === "string") {
+			if (seen.has(key) || isPrototypePollutionKey(key)) return true;
+			seen.add(key);
+		}
+		const value = property.children?.[1];
+		if (value !== void 0 && statesUneditableKeys(value)) return true;
+	}
+	return false;
+}
+/**
+* The offset just past the whitespace and comments starting at `from`.
+*/
+function skipJsoncTrivia({ text, from }) {
+	let index = from;
+	while (index < text.length) {
+		const char = text[index];
+		if (char === " " || char === "	" || char === "\n" || char === "\r") {
+			index += 1;
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "/") {
+			index = endOfLineFrom({
+				text,
+				from: index
+			});
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "*") {
+			const commentEnd = text.indexOf("*/", index + 2);
+			index = commentEnd === -1 ? text.length : commentEnd + 2;
+			continue;
+		}
+		break;
+	}
+	return index;
+}
+/**
+* Where the deletion of a property whose text ends at `end` should stop.
+*
+* A comment written after the property on its own line is that property's
+* note — `"stale": {...}, // retired` says something about `stale` and nothing
+* about the key above it. Leaving it behind would re-attach it to whichever
+* property now ends that line, so a note about a server rulesync removed would
+* read as a note about the one before it. A comment with a sibling after it on
+* the same line is not claimed: it may belong to either.
+*/
+function endOfRemoval({ text, end }) {
+	const stop = endOfLineFrom({
+		text,
+		from: end
+	});
+	const tail = text.slice(end, stop);
+	return /^[ \t]*\/\/[^\r\n]*$/.test(tail) || /^[ \t]*\/\*(?:[^*]|\*(?!\/))*\*\/[ \t]*$/.test(tail) || /^[ \t]*$/.test(tail) ? stop : end;
+}
+/**
+* Where the deletion of a property ending at `end` should begin.
+*
+* A property that has its line to itself is removed with the line: its
+* indentation and the newline above it would otherwise be left as a blank gap.
+* A property sharing its line with something else — a sibling, or the object's
+* own `}` — is removed on its own, because swallowing the newline would splice
+* whatever follows onto the line above, and a line comment up there would
+* comment it out: a key rulesync means to write would vanish from the file, or
+* the closing brace would, leaving the document unparsable.
+*/
+function startOfRemoval({ text, propertyOffset, end }) {
+	let after = end;
+	while (text[after] === " " || text[after] === "	") after += 1;
+	if (!(after >= text.length || text[after] === "\n" || text[after] === "\r")) return propertyOffset;
+	let start = propertyOffset;
+	while (start > 0 && (text[start - 1] === " " || text[start - 1] === "	")) start -= 1;
+	if (start > 0 && text[start - 1] === "\n") start -= 1;
+	if (start > 0 && text[start - 1] === "\r") start -= 1;
+	return start;
+}
+/**
+* Delete the property at `path` from `text`, taking its own line and its
+* separating comma but nothing else.
+*
+* `modify(..., undefined)` would do this, but the range it deletes runs from
+* the end of the *previous* property to the end of this one — or, for the
+* first property of an object, all the way to where the *next* one starts. So
+* removing one key takes the comments sitting between it and the keys around
+* it, including the comment describing the key that survives.
+* Deleting the property's own text instead leaves the comments around it in
+* place. Only the note that follows the property on its own line goes with it
+* (see {@link endOfRemoval}); a comment written on the line *above* is left
+* behind rather than guessed at, which is the direction this whole path errs
+* in.
+*/
+function removeJsoncProperty({ text, path }) {
+	const root = parseTree(text, [], { allowTrailingComma: true });
+	const property = root === void 0 ? void 0 : findNodeAtLocation(root, [...path])?.parent;
+	const object = property?.parent;
+	if (property?.type !== "property" || object?.type !== "object") return text;
+	const siblings = object.children ?? [];
+	const edits = [];
+	let end = property.offset + property.length;
+	const afterProperty = skipJsoncTrivia({
+		text,
+		from: end
+	});
+	if (text[afterProperty] === ",") end = afterProperty + 1;
+	else {
+		const previous = siblings[siblings.indexOf(property) - 1];
+		if (previous !== void 0) {
+			const comma = skipJsoncTrivia({
+				text,
+				from: previous.offset + previous.length
+			});
+			if (text[comma] === ",") edits.push({
+				offset: comma,
+				length: 1,
+				content: ""
+			});
+		}
+	}
+	end = endOfRemoval({
+		text,
+		end
+	});
+	const start = startOfRemoval({
+		text,
+		propertyOffset: property.offset,
+		end
+	});
+	edits.push({
+		offset: start,
+		length: end - start,
+		content: ""
+	});
+	return applyEdits(text, edits);
+}
+/**
+* Where the comment written at `from` (past any spaces or tabs) ends, or
+* `undefined` if what stands there is not a comment.
+*/
+function endOfNoteAt({ text, from }) {
+	let cursor = from;
+	while (text[cursor] === " " || text[cursor] === "	") cursor += 1;
+	if (text.startsWith("//", cursor)) return endOfLineFrom({
+		text,
+		from: cursor
+	});
+	if (text.startsWith("/*", cursor)) {
+		const closing = text.indexOf("*/", cursor + 2);
+		return closing === -1 ? void 0 : closing + 2;
+	}
+}
+/**
+* Every comment written at `from`, as spans of `text`, each span running from
+* where the previous one stopped so the whitespace between them is carried
+* along. A comma is stepped over once (a file may spell one before its note,
+* or after it) but never collected, because the separator belongs to the
+* property rather than to its note. So a file that writes a note on each side
+* of its comma gets both of them back, in order, after the comma: the notes
+* stay with the key they describe, and the comma keeps the place the file gave
+* it. The run stops at the first thing that is neither: a newline ends it, so
+* a comment on the next line is left alone.
+*/
+function notesAt({ text, from }) {
+	const spans = [];
+	let cursor = from;
+	let steppedOverComma = false;
+	for (;;) {
+		const end = endOfNoteAt({
+			text,
+			from: cursor
+		});
+		if (end !== void 0) {
+			spans.push({
+				start: cursor,
+				end
+			});
+			cursor = end;
+			continue;
+		}
+		if (steppedOverComma) return spans;
+		let comma = cursor;
+		while (text[comma] === " " || text[comma] === "	") comma += 1;
+		if (text[comma] !== ",") return spans;
+		steppedOverComma = true;
+		cursor = comma + 1;
+	}
+}
+/**
+* Detach the notes written at the point where the object at `path` will take a
+* new key: after its last property (and around the comma a trailing-comma file
+* spells there), or just inside the `{` when it has no properties yet.
+*
+* `modify` computes its insert from exactly that point — in front of a note
+* written there — so applying the edit unchanged re-emits the note *after* the
+* key that was just inserted: `"stale": {...} // retired` turns into a note
+* about a server rulesync has only now written, and `{ /* none yet *\/ }`
+* turns into a note about the first entry rulesync puts in it. Lifting the
+* notes out before the insert and putting them back afterwards keeps them
+* where their author wrote them, matching what {@link endOfRemoval} does on
+* the way out.
+*
+* Returns `undefined` when there is no such note, which is the common case.
+*/
+function detachTrailingNote({ text, path }) {
+	const root = parseTree(text, [], { allowTrailingComma: true });
+	const object = root === void 0 ? void 0 : findNodeAtLocation(root, [...path]);
+	if (object?.type !== "object") return void 0;
+	const property = object.children?.at(-1);
+	const anchorKey = property?.children?.[0]?.value;
+	if (property !== void 0 && typeof anchorKey !== "string") return void 0;
+	const spans = notesAt({
+		text,
+		from: property === void 0 ? object.offset + 1 : property.offset + property.length
+	});
+	if (spans.length === 0) return void 0;
+	let stripped = text;
+	for (const span of spans.toReversed()) stripped = stripped.slice(0, span.start) + stripped.slice(span.end);
+	return {
+		text: stripped,
+		note: spans.map((span) => text.slice(span.start, span.end)).join(""),
+		anchorKey: typeof anchorKey === "string" ? anchorKey : void 0
+	};
+}
+/**
+* Put a note detached by {@link detachTrailingNote} back where it was: after
+* the property it describes (behind the comma the insert gave that property),
+* or just inside the `{` of the object it was written in when there was no
+* property to describe. Returns `undefined` if that place can no longer be
+* located, so the caller can fall back to the plain insert rather than drop
+* the note.
+*/
+function reattachTrailingNote({ text, path, anchorKey, note }) {
+	const root = parseTree(text, [], { allowTrailingComma: true });
+	const location = anchorKey === void 0 ? [...path] : [...path, anchorKey];
+	const anchor = root === void 0 ? void 0 : findNodeAtLocation(root, location);
+	if (anchor === void 0) return void 0;
+	if (anchorKey === void 0) {
+		if (anchor.type !== "object") return void 0;
+		const brace = anchor.offset + 1;
+		return text.slice(0, brace) + note + text.slice(brace);
+	}
+	let cursor = anchor.offset + anchor.length;
+	while (text[cursor] === " " || text[cursor] === "	") cursor += 1;
+	if (text[cursor] === ",") cursor += 1;
+	return text.slice(0, cursor) + note + text.slice(cursor);
+}
+/**
+* Write `value` at `[...path, key]`, keeping the trailing note of the property
+* the new key is inserted after (see {@link detachTrailingNote}). Replacing an
+* existing key needs none of this: `modify` rewrites the value's own span and
+* leaves every comment where it is.
+*/
+function insertJsoncProperty({ text, path, key, value, options }) {
+	const write = (source) => applyEdits(source, modify(source, [...path, key], value, options));
+	const detached = detachTrailingNote({
+		text,
+		path
+	});
+	if (detached === void 0) return write(text);
+	return reattachTrailingNote({
+		text: write(detached.text),
+		path,
+		anchorKey: detached.anchorKey,
+		note: detached.note
+	}) ?? write(text);
+}
+/**
+* How much work an edit-based write may cost, as the file's length times the
+* number of keys that differ.
+*
+* Each changed key re-parses the whole file, so a file whose keys nearly all
+* change costs quadratic work: an 823 KB `opencode.json` whose 6,400 servers
+* are all replaced took 40 seconds to write as edits, and cloning a
+* repository that ships such a file is enough to reach that. Past this budget
+* the file is written whole instead — it loses its comments, the same as a
+* file rulesync cannot parse does, which is the better of the two outcomes
+* against a `generate` that looks like it has hung. The limit is under a
+* second of editing for a replacement and a second or two for an insert,
+* which parses more; a hand-written config file is orders of magnitude below
+* either.
+*/
+const JSONC_EDIT_BUDGET_BYTES = 5e7;
+/**
+* How much text the edits of one write may put into the file, all of them
+* together.
+*
+* The budget above charges by the number of keys that differ, which prices an
+* insert of a whole subtree as one edit — but `modify` re-indents the text it
+* writes, and it does that in time quadratic in the length of that text: a
+* 127 KB value takes half a second to write, a 516 KB one 9 seconds, a 1 MB
+* one 35. The cost is quadratic in the total as well as in each part, because
+* every edit re-indents against the text the ones before it left, so a limit
+* on the widest single value would let a handful of values just under it cost
+* minutes between them. This is a limit on their sum, which holds the
+* re-indenting to about a second whether it arrives as one value or twenty.
+* A hand-written config file changes a few hundred bytes at a time.
+*/
+const JSONC_EDIT_WRITTEN_BYTES = 2e5;
+/**
+* How much text one edit writes: the value as `modify` formats it, plus the
+* indentation that formatting puts in front of every line of it.
+*
+* A value written deep in a document is written far wider than it reads on
+* its own — a 114 KB server list nested 1,200 deep is 36 MB of text once
+* every line of it carries 2,400 spaces — so measuring the value alone would
+* miss the whole of what makes that write expensive.
+*/
+function measureJsoncWrite({ value, depth }) {
+	const formatted = JSON.stringify(value, null, 2) ?? "";
+	let lines = 1;
+	for (let at = formatted.indexOf("\n"); at !== -1; at = formatted.indexOf("\n", at + 1)) lines += 1;
+	return formatted.length + lines * 2 * depth;
+}
+/**
+* How much {@link applyJsoncObjectEdits} would write, deciding each key
+* exactly the way it does — the two walk together, so a new case in one needs
+* the same case here. It reports both how many edits there would be and how
+* much text they would write between them, because the two are budgeted
+* separately: one stands for the parse each edit costs, the other for the
+* re-indenting each edit costs. Counting is a walk of the documents alone: no
+* text is touched, so the budgets above are spent on the write rather than on
+* finding out how large the write is.
+*/
+function countJsoncEdits({ base, next, depth }) {
+	let edits = 0;
+	let written = 0;
+	for (const [key, value] of Object.entries(next)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const present = Object.hasOwn(base, key);
+		const previous = present ? base[key] : void 0;
+		if (value === void 0) {
+			if (present) edits += 1;
+			continue;
+		}
+		if (isPlainObject$1(previous) && isPlainObject$1(value)) {
+			const nested = countJsoncEdits({
+				base: previous,
+				next: value,
+				depth: depth + 1
+			});
+			edits += nested.edits;
+			written += nested.written;
+			continue;
+		}
+		if (present && isDeepStrictEqual(previous, value)) continue;
+		edits += 1;
+		written += measureJsoncWrite({
+			value,
+			depth: depth + 1
+		});
+	}
+	for (const key of Object.keys(base)) if (!Object.hasOwn(next, key)) edits += 1;
+	return {
+		edits,
+		written
+	};
+}
+/**
+* Rewrite `text` so the object at `path` matches `next`, touching only the
+* spans that actually differ from `base`.
+*
+* Each difference is applied on its own — `modify` computes an edit against
+* the current text and `applyEdits` returns the text with that edit applied,
+* which is then the input for the next difference, because every edit shifts
+* the offsets the following ones would have been computed from. Nested objects
+* present on both sides are recursed into rather than replaced wholesale, so a
+* one-key change deep in the document leaves its siblings — and the comments
+* attached to them — byte-identical.
+*
+* Every difference re-parses the document, so the work is one parse of the
+* file per *changed* key rather than one parse overall. A regeneration that
+* changes nothing costs a single parse, and the files this runs on are config
+* files, so the shape is left simple rather than batched — with the file
+* large enough and enough of it changing, the product of the two is what
+* {@link JSONC_EDIT_BUDGET_BYTES} keeps off this path.
+*/
+function applyJsoncObjectEdits({ text, base, next, path, options }) {
+	let result = text;
+	for (const [key, value] of Object.entries(next)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const present = Object.hasOwn(base, key);
+		const previous = present ? base[key] : void 0;
+		if (value === void 0) {
+			if (present) result = removeJsoncProperty({
+				text: result,
+				path: [...path, key]
+			});
+			continue;
+		}
+		if (isPlainObject$1(previous) && isPlainObject$1(value)) {
+			result = applyJsoncObjectEdits({
+				text: result,
+				base: previous,
+				next: value,
+				path: [...path, key],
+				options
+			});
+			continue;
+		}
+		if (present) {
+			if (isDeepStrictEqual(previous, value)) continue;
+			result = applyEdits(result, modify(result, [...path, key], value, options));
+			continue;
+		}
+		result = insertJsoncProperty({
+			text: result,
+			path,
+			key,
+			value,
+			options
+		});
+	}
+	for (const key of Object.keys(base)) if (!Object.hasOwn(next, key)) result = removeJsoncProperty({
+		text: result,
+		path: [...path, key]
+	});
+	return result;
+}
+/**
+* Serialize a document back over the file it was parsed from.
+*
+* For every format but JSONC this is {@link stringifySharedConfig}: those
+* files carry no comments, so re-serializing loses nothing. A JSONC file does
+* carry comments — `.vscode/settings.json` and `opencode.json` are hand-edited
+* far more often than they are generated — and re-serializing would delete
+* every one of them, along with the author's blank lines and key order. So a
+* JSONC document is written back as a set of edits against the existing text:
+* regions the merge did not change stay byte-identical, and a regeneration
+* that changes nothing leaves the file untouched.
+*
+* The whole-document writer is still used when there is nothing to preserve or
+* nothing to edit against:
+*
+* - an empty (or whitespace-only) file, which has no comments to keep;
+* - a file that does not parse, or whose root is not an object — editing it
+*   would mean guessing at the author's intent, and the callers that reach
+*   here have already decided (via `invalidRootPolicy`) that such a file is
+*   replaced;
+* - a file stating the same key twice, or using `__proto__`, `constructor` or
+*   `prototype` as a key (see {@link statesUneditableKeys});
+* - a file so large, with so much of it changing, that editing it key by key
+*   would take longer than a user would wait (see
+*   {@link JSONC_EDIT_BUDGET_BYTES}), or changed keys that write more new text
+*   between them than re-indenting can afford (see
+*   {@link JSONC_EDIT_WRITTEN_BYTES});
+* - a file the editor itself refuses, which it answers with an exception
+*   rather than a result.
+*/
+function serializeSharedConfig({ format, document, existingContent }) {
+	const whole = stringifySharedConfig({
+		format,
+		document
+	});
+	if (format !== "jsonc" || existingContent.trim() === "") return whole;
+	try {
+		const errors = [];
+		const root = parseTree(existingContent, errors, { allowTrailingComma: true });
+		if (root === void 0 || errors.length > 0 || root.type !== "object" || statesUneditableKeys(root)) return whole;
+		const base = sanitizeSharedConfigValue(getNodeValue(root));
+		if (!isPlainObject$1(base)) return whole;
+		const span = Math.max(existingContent.length, whole.length);
+		const cost = countJsoncEdits({
+			base,
+			next: document,
+			depth: 0
+		});
+		if (cost.written > JSONC_EDIT_WRITTEN_BYTES || cost.edits * span > JSONC_EDIT_BUDGET_BYTES) return whole;
+		return applyJsoncObjectEdits({
+			text: existingContent,
+			base,
+			next: document,
+			path: [],
+			options: { formattingOptions: detectJsoncFormattingOptions({
+				text: existingContent,
+				root
+			}) }
+		});
+	} catch {
+		return whole;
+	}
+}
+/**
 * Shallow merge: every top-level key in `patch` replaces the base key
 * wholesale; all other base keys are preserved. The policy for a feature that
 * owns a fixed set of top-level keys.
@@ -10085,7 +11292,7 @@ function mergeSharedConfigShallow({ base, patch }) {
 function mergeSharedConfigDeep({ base, patch }) {
 	const result = { ...base };
 	for (const [key, patchValue] of Object.entries(patch)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (isPrototypePollutionKey(key)) continue;
 		if (patchValue === void 0) {
 			delete result[key];
 			continue;
@@ -10667,7 +11874,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 /**
 * Execute a feature's declared write to a gateway-managed shared file: parse
 * the existing content, merge the patch under the feature's declared policy,
-* and serialize. Throws when the file or feature is undeclared, when a
+* and serialize it back over the existing content (see
+* {@link serializeSharedConfig}, which keeps a JSONC file's comments and
+* formatting outside the spans the merge actually changed). Throws when the
+* file or feature is undeclared, when a
 * `replace-owned-keys` patch strays outside its owned keys, or when the
 * feature's policy is `custom` (those calls go to the named policy function
 * instead).
@@ -10693,9 +11903,10 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 			patch
 		});
 		for (const [key, value] of Object.entries(patch)) if (value === void 0) delete document[key];
-		return stringifySharedConfig({
+		return serializeSharedConfig({
 			format: declaration.format,
-			document
+			document,
+			existingContent
 		});
 	}
 	const merged = mergeSharedConfigDeep({
@@ -10703,9 +11914,10 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 		patch
 	});
 	for (const key of policy.replaceKeys ?? []) if (patch[key] !== void 0) merged[key] = sanitizeSharedConfigValue(patch[key]);
-	return stringifySharedConfig({
+	return serializeSharedConfig({
 		format: declaration.format,
-		document: merged
+		document: merged,
+		existingContent
 	});
 }
 const READ_TOOL_NAME = "Read";
@@ -11193,7 +12405,7 @@ var ChecksProcessor = class extends FeatureProcessor {
 			this.logger.debug(`Rulesync checks directory not found: ${checksDir}`);
 			return [];
 		}
-		const mdFiles = (await listDirectoryFiles(checksDir)).filter((file) => file.endsWith(".md"));
+		const mdFiles = (await listDirectoryEntryNames(checksDir)).filter((file) => file.endsWith(".md"));
 		if (mdFiles.length === 0) {
 			this.logger.debug(`No markdown files found in rulesync checks directory: ${checksDir}`);
 			return [];
@@ -16015,6 +17227,7 @@ const ZCODE_SKILLS_DIR_PATH = join(ZCODE_DIR, "skills");
 const ZCODE_CONFIG_FILE_NAME = "config.json";
 const ZCODE_GLOBAL_CONFIG_DIR_PATH = join(ZCODE_DIR, "cli");
 const ZCODE_MCP_SERVERS_KEY = "servers";
+const ZCODE_AGENTS_DIR_PATH = join(ZCODE_DIR, "agents");
 //#endregion
 //#region src/features/commands/zcode-command.ts
 /**
@@ -16977,6 +18190,52 @@ function compact(obj) {
 	return result;
 }
 //#endregion
+//#region src/utils/quote-value.ts
+/**
+* How much of a value read off disk a diagnostic quotes.
+*
+* Enough to recognize which entry is meant, and no more. A warning names the
+* offending value so the reader can find it, but the values these warnings
+* quote come from files rulesync did not write — a tool's own settings, a
+* machine-local overrides file, a repository fetched from elsewhere — and they
+* no longer stop at a terminal: they travel into a `--json` document another
+* program parses and into an MCP result an agent reads as context. A command
+* line or a header is the shape most likely to carry a credential, and a long
+* value is the shape most likely to carry instructions aimed at the agent.
+*/
+const MAX_QUOTED_VALUE_LENGTH = 60;
+/**
+* A short, quotable rendering of a value for a diagnostic.
+*
+* Serialized rather than interpolated, because an unquoted value is what lets a
+* crafted one read as a second line; stripped of the control characters
+* `JSON.stringify` leaves intact (it escapes C0 only, not the C1 range or the
+* bidirectional overrides); and truncated.
+*/
+function quoteValueForWarning(value) {
+	return truncateText({
+		text: stripControlCharacters(serialize(value)),
+		maxLength: MAX_QUOTED_VALUE_LENGTH,
+		suffix: "…(truncated)"
+	});
+}
+function serialize(value) {
+	try {
+		return JSON.stringify(value, stripStrings) ?? String(value);
+	} catch {
+		return `[unserializable ${typeof value}]`;
+	}
+}
+/**
+* Strip the control characters out of every string before `JSON.stringify`
+* sees it, not only out of the document it produces: `JSON.stringify` escapes
+* a C0 character into the six literal characters `\u001b`, which no later pass
+* over the output can recognize as a control character again.
+*/
+function stripStrings(_key, value) {
+	return typeof value === "string" ? stripControlCharacters(value) : value;
+}
+//#endregion
 //#region src/features/hooks/tool-hooks-converter.ts
 function isToolMatcherEntry(x) {
 	if (x === null || typeof x !== "object") return false;
@@ -17078,7 +18337,7 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 		if (!isValid({
 			value,
 			canonical
-		})) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${JSON.stringify(value)} is not a value this tool can express as "${tool}".`);
+		})) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool can express as "${tool}".`);
 	}
 	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
 		commandOnly,
@@ -17173,7 +18432,7 @@ function describeScalarConstraint({ canonical, value }) {
 	if (issue === void 0) return `it is not a value the canonical "${canonical}" field accepts.`;
 	return `it does not satisfy the canonical "${canonical}" field: ${issue.message}.`;
 }
-const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${JSON.stringify(value)}) while importing a hook: ${describeScalarConstraint({
+const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${quoteValueForWarning(value)}) while importing a hook: ${describeScalarConstraint({
 	canonical,
 	value
 })} Importing it would fail validation on the next run.`;
@@ -17200,7 +18459,7 @@ function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }
 		if (first === void 0) continue;
 		const firstStable = stableJson(first);
 		const agrees = (value) => isGroupPassthroughValue(value, valueType) && stableJson(value) === firstStable;
-		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${JSON.stringify(first)} — including any that asked for something else, or for nothing.`);
+		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${quoteValueForWarning(first)} — including any that asked for something else, or for nothing.`);
 		emitted[tool] = first;
 	}
 	return emitted;
@@ -17687,7 +18946,7 @@ function describeGroupSkipReason({ rawEntry, converterConfig }) {
 	for (const { tool, valueType, subdividesGroup } of converterConfig.groupPassthroughFields ?? []) {
 		const value = entry[tool];
 		if (subdividesGroup !== true || value === void 0) continue;
-		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${JSON.stringify(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
+		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${quoteValueForWarning(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
 	}
 }
 /**
@@ -17704,7 +18963,7 @@ function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
 			value,
 			canonical: field
 		})) continue;
-		return `Skipping a hook while importing: its "${field}" (${JSON.stringify(value)}) is unusable — ${describeScalarConstraint({
+		return `Skipping a hook while importing: its "${field}" (${quoteValueForWarning(value)}) is unusable — ${describeScalarConstraint({
 			canonical: field,
 			value
 		})} Keeping the hook without it would change what it does, so the whole hook is skipped.`;
@@ -18026,7 +19285,22 @@ async function readSettingsWithLocalOverlay({ outputRoot, relativeDirPath, baseF
 }
 /** Quotes a name read off disk, the way every other such name is logged. */
 function quoteKey(key) {
-	return JSON.stringify(stripControlCharacters(key));
+	return quoteValueForWarning(key);
+}
+/**
+* How many keys the warning names before it stops counting.
+*
+* The keys come from a file rulesync did not write, and the warning now travels
+* into `--json` documents and MCP results as well as onto a console. A settings
+* file with hundreds of top-level keys is unusual but not impossible, and the
+* point of the sentence is to make the reader open the file — naming the first
+* few does that as well as naming all of them.
+*/
+const MAX_LISTED_KEYS = 20;
+function listKeys(keys) {
+	const named = keys.slice(0, MAX_LISTED_KEYS).map(quoteKey).join(", ");
+	const rest = keys.length - MAX_LISTED_KEYS;
+	return rest > 0 ? `${named} and ${rest} more` : named;
 }
 /**
 * Name the settings the machine-local file contributed, so nobody publishes one
@@ -18046,8 +19320,8 @@ function warnAboutLocalKeys({ localParsed, configPath, toolLabel, sensitiveKeys,
 	const keys = Object.keys(localParsed);
 	if (keys.length === 0) return;
 	const flagged = keys.filter((key) => sensitiveKeys.includes(key));
-	const guardrailSentence = flagged.length === 0 ? "" : ` ${flagged.map(quoteKey).join(", ")} ${flagged.length === 1 ? "decides" : "decide"} what ${toolLabel} is allowed to do, so a value meant for one machine would become the team's guardrail.`;
-	warnOnceWithFallback(logger, `${toolLabel}: ${configPath} is a machine-local overrides file, and importing read ${keys.map(quoteKey).join(", ")} from it. Whatever an import takes from there lands in files rulesync commits, so check the imported files and remove anything personal to this machine before sharing them.${guardrailSentence}`);
+	const guardrailSentence = flagged.length === 0 ? "" : ` ${listKeys(flagged)} ${flagged.length === 1 ? "decides" : "decide"} what ${toolLabel} is allowed to do, so a value meant for one machine would become the team's guardrail.`;
+	warnOnceWithFallback(logger, `${toolLabel}: ${configPath} is a machine-local overrides file, and importing read ${listKeys(keys)} from it. Whatever an import takes from there lands in files rulesync commits, so check the imported files and remove anything personal to this machine before sharing them.${guardrailSentence}`);
 }
 //#endregion
 //#region src/utils/augmentcode-settings.ts
@@ -22742,6 +24016,9 @@ function withToolTargetPrefix({ logger, toolTarget }) {
 		get silent() {
 			return logger.silent;
 		},
+		get reportsWhileSilent() {
+			return logger.reportsWhileSilent;
+		},
 		get jsonMode() {
 			return logger.jsonMode;
 		},
@@ -26042,7 +27319,7 @@ var CopilotMcp = class CopilotMcp extends ToolMcp {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = this.fileContent !== void 0 ? JSON.parse(this.fileContent) : {};
+		this.json = this.fileContent !== void 0 ? parseJsonc(this.fileContent) : {};
 	}
 	getJson() {
 		return this.json;
@@ -28265,7 +29542,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		}, null, 2) });
 	}
 	validate() {
-		const json = JSON.parse(this.fileContent || "{}");
+		const json = parseJsonc(this.fileContent || "{}");
 		const result = KiloConfigSchema.safeParse(json);
 		if (!result.success) return {
 			success: false,
@@ -28856,7 +30133,7 @@ function convertFromMusecodeFormat(musecodeMcp) {
 			if (key === "mode") {
 				const mode = asMusecodeMode(value);
 				if (mode === void 0) {
-					warnWithFallback(void 0, `Muse Code MCP: dropping mode ${JSON.stringify(value)} on server ${JSON.stringify(name)} because it is neither "required" nor "optional", the only two modes Muse Code documents.`);
+					warnWithFallback(void 0, `Muse Code MCP: dropping mode ${quoteValueForWarning(value)} on server ${quoteValueForWarning(name)} because it is neither "required" nor "optional", the only two modes Muse Code documents.`);
 					continue;
 				}
 				converted.musecodeMode = mode;
@@ -29341,7 +30618,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 		}, null, 2) });
 	}
 	validate() {
-		const json = JSON.parse(this.fileContent || "{}");
+		const json = parseJsonc(this.fileContent || "{}");
 		const result = OpencodeConfigSchema.safeParse(json);
 		if (!result.success) return {
 			success: false,
@@ -30060,7 +31337,7 @@ function pointerLabels(global) {
 async function warnAtDocumentedDefault({ existing, outputRoot, logger }) {
 	const { pointer, configLabel, mcpLabel } = pointerLabels(true);
 	const displaced = await describeDisplacedGlobalServers({ outputRoot });
-	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${JSON.stringify(existing)} in ${configLabel}. That is the default Atlassian's settings reference documents, so it may be Rovo Dev's own value rather than one you chose — and while it stands, the generated ${mcpLabel} is never read. ` + (displaced === null ? `It defines no servers of its own, so setting mcp.mcpConfigPath to "${pointer}" costs nothing.` : `${displaced} — move the servers you want to keep into .rulesync/mcp.jsonc first, or none at all if it turns out to hold nothing you need, then change mcp.mcpConfigPath to "${pointer}".`));
+	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. That is the default Atlassian's settings reference documents, so it may be Rovo Dev's own value rather than one you chose — and while it stands, the generated ${mcpLabel} is never read. ` + (displaced === null ? `It defines no servers of its own, so setting mcp.mcpConfigPath to "${pointer}" costs nothing.` : `${displaced} — move the servers you want to keep into .rulesync/mcp.jsonc first, or none at all if it turns out to hold nothing you need, then change mcp.mcpConfigPath to "${pointer}".`));
 }
 /**
 * Announce a pointer that was just written. Warned rather than noted in global
@@ -30117,10 +31394,10 @@ async function applyMcpConfigPointer({ existingMcp, global, hasLiveServers, outp
 		return false;
 	}
 	if (global && normalizedExisting !== void 0 && envVarMcpFileSpellings({ fileName: "mcp.json" }).includes(normalizedExisting)) {
-		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${JSON.stringify(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${quoteValueForWarning(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
 		return false;
 	}
-	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${JSON.stringify(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
+	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
 	return false;
 }
 /**
@@ -31740,11 +33017,10 @@ var ToolPermissions = class extends ToolFile {
 		throw new Error("Please implement this method in the subclass.");
 	}
 	toRulesyncPermissionsDefault({ fileContent }) {
-		return new RulesyncPermissions({
+		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: this.outputRoot,
-			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
-			fileContent: withoutBlankPermissionPatterns({ fileContent })
+			fileContent,
+			sourcePath: this.getRelativePathFromCwd()
 		});
 	}
 	static async fromFile(_params) {
@@ -32796,41 +34072,123 @@ function matchesGlobStep(step, character) {
 	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
 	return step.negated ? !admitted : admitted;
 }
+/** Whether two single-character steps can both match one same character. */
+function stepsShareACharacter(left, right) {
+	if (left.kind === "any" || right.kind === "any") return true;
+	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
+	if (left.kind === "literal") return matchesGlobStep(right, left.character);
+	if (right.kind === "literal") return matchesGlobStep(left, right.character);
+	return true;
+}
+/** Whether every step from `index` on can match the empty string. */
+function isAllStars(steps, index) {
+	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
+	return true;
+}
+/**
+* The most work one intersection walk will do, counted in cells times the cost
+* of one. Past it the two patterns are reported as intersecting without being
+* walked: the product of two lengths grows quadratically, and a pattern long
+* enough to reach this is pathological rather than a command anybody typed.
+* Answering `true` withholds an `allow`, which is the direction that fails
+* closed.
+*/
+const MAX_INTERSECTION_CELLS = 1e6;
+/**
+* The most work a whole run of comparisons will do. A caller holding R
+* restrictions and A allow rules asks R x A times, and a per-pair cap alone
+* bounds none of that: a hundred restrictions against a hundred allow rules,
+* each pattern just under the per-pair cap, is ten thousand affordable walks
+* that together take minutes. The shared budget is spent down across the run
+* and, once it is gone, every remaining pair is reported as intersecting —
+* again the direction that withholds an `allow` rather than writing one.
+*/
+const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
+/**
+* What a pair costs on top of the cells it walks: the call itself, sizing and
+* filling the two rows the table is held in, and collecting the answer.
+* Charging only cells would leave the *number* of pairs unbounded — a pair of
+* one-step patterns walks a single cell, so n short restrictions against n
+* short allow rules is n squared comparisons that never spend the budget down
+* however many of them there are. Charging a floor per pair puts pair count and
+* walk length on the same exhaustible resource.
+*
+* For the short patterns of an ordinary config the floor is the whole charge,
+* which lowers how many pairs a run compares from around a million to about
+* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
+* that line withholds every allow it has not yet compared, the same fail-closed
+* answer exhaustion gives everywhere else.
+*/
+const INTERSECTION_PAIR_COST = 64;
+/**
+* A budget for one caller's run of comparisons. Hand the same one to every
+* `parsedGlobsIntersect` call that belongs together — one adapter reading one
+* config — so the run as a whole stays bounded rather than only each pair in
+* it.
+*/
+function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
+	return { remaining };
+}
 /**
-* Parse `glob` once and return a predicate that walks it, for a caller that
-* tests the same glob against a whole list of names.
+* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
+* the same pattern against a whole list parses it once and reuses the result.
 */
-function compileGlob(glob) {
+function parseGlobPattern(glob) {
 	const steps = parseGlob(glob);
-	return (value) => matchesParsedGlob(steps, value);
+	return {
+		steps,
+		maxRanges: maxRangeCount(steps)
+	};
 }
-function matchesParsedGlob(steps, value) {
-	const characters = [...value];
-	let stepIndex = 0;
-	let characterIndex = 0;
-	let starStepIndex = -1;
-	let starCharacterIndex = 0;
-	while (characterIndex < characters.length) {
-		const step = steps[stepIndex];
-		if (step?.kind === "star") {
-			starStepIndex = stepIndex;
-			starCharacterIndex = characterIndex;
-			stepIndex += 1;
-			continue;
+/**
+* What one cell can cost, as a multiplier on the cell count. A literal met by a
+* `[a-z...]` class walks that class's ranges, so a single class carrying
+* thousands of them turns a walk that looks affordable by cell count alone into
+* a quadratic one — which is why the budget is spent on cells times this rather
+* than on cells.
+*/
+function maxRangeCount(steps) {
+	let most = 0;
+	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
+	return most;
+}
+/**
+* `globsIntersect` for two globs already parsed, optionally spending a budget
+* shared with the rest of the caller's run — see `createIntersectionBudget`.
+* Once that budget is exhausted every further pair answers `true` without being
+* walked, so a caller reading the answer as a reason to restrict stays on the
+* safe side.
+*/
+function parsedGlobsIntersect(left, right, budget) {
+	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
+	const cellCost = 1 + left.maxRanges + right.maxRanges;
+	const cost = rows.length * columns.length * cellCost;
+	if (cost > MAX_INTERSECTION_CELLS) return true;
+	if (budget !== void 0) {
+		const charge = cost + INTERSECTION_PAIR_COST;
+		if (charge > budget.remaining) {
+			budget.remaining = 0;
+			return true;
 		}
-		if (step !== void 0 && matchesGlobStep(step, characters[characterIndex] ?? "")) {
-			stepIndex += 1;
-			characterIndex += 1;
-			continue;
+		budget.remaining -= charge;
+	}
+	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
+	for (let i = rows.length - 1; i >= 0; i--) {
+		const row = Array.from({ length: columns.length + 1 }, () => false);
+		row[columns.length] = isAllStars(rows, i);
+		for (let j = columns.length - 1; j >= 0; j--) {
+			const rowStep = rows[i];
+			const columnStep = columns[j];
+			if (rowStep === void 0 || columnStep === void 0) continue;
+			if (rowStep.kind === "star" || columnStep.kind === "star") {
+				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
+				continue;
+			}
+			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
 		}
-		if (starStepIndex < 0) return false;
-		starCharacterIndex += 1;
-		stepIndex = starStepIndex + 1;
-		characterIndex = starCharacterIndex;
+		next = row;
 	}
-	let remaining = stepIndex;
-	while (steps[remaining]?.kind === "star") remaining += 1;
-	return remaining === steps.length;
+	return next[0] ?? false;
 }
 //#endregion
 //#region src/features/permissions/augmentcode-permissions.ts
@@ -33293,6 +34651,216 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	}
 	return { permission };
 }
+/**
+* Collect the canonical rules that govern shell commands, for the adapters
+* whose tool models commands and nothing else.
+*
+* The `bash` category contributes every rule. The all-tools `*` category
+* contributes its **restricting** rules — `deny` and `ask` — because a rule
+* written there covers shell commands too, and dropping it inverts the
+* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
+* an adapter that reads only `bash` auto-approves the very command the file
+* denies.
+*
+* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
+* need not be a command at all — `secrets/**` under `*` denies a path — and
+* carrying it in the restricting direction only over-restricts, while carrying
+* it in the permissive direction would grant something the author never said
+* about commands. Both directions therefore fail closed.
+*/
+function collectShellCommandRules(permission) {
+	const rules = [];
+	const foreignRestrictingCategories = [];
+	const ignoredAllToolsAllowPatterns = [];
+	for (const [category, categoryRules] of Object.entries(permission)) {
+		if (category === "bash") {
+			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
+				pattern,
+				action,
+				fromAllToolsCategory: false
+			});
+			continue;
+		}
+		if (category === "*") {
+			for (const [pattern, action] of Object.entries(categoryRules)) {
+				if (action === "allow") {
+					ignoredAllToolsAllowPatterns.push(pattern);
+					continue;
+				}
+				rules.push({
+					pattern,
+					action,
+					fromAllToolsCategory: true
+				});
+			}
+			continue;
+		}
+		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
+	}
+	return {
+		rules,
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns
+	};
+}
+/**
+* Build the test an adapter applies to an `allow` pattern before writing it:
+* which restrictions it cannot write name some of the same commands? The
+* answer is the list of those restrictions — empty when the `allow` may be
+* written — so a caller can report both the allow rules it withheld and the
+* restrictions that withheld nothing.
+*
+* Canonically the stricter rule wins **whatever its width** — rulesync collapses
+* colliding rules as `deny > ask > allow` — so the two patterns are compared by
+* asking whether any one command matches both. Width does not enter into it: an
+* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
+* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
+* on every `git ... --force` command even though neither pattern covers the
+* other's spelling. Comparing only identical spellings would let the most
+* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
+*
+* Identical spellings are still compared as strings first, as a shortcut past
+* the walk for the commonest case.
+*
+* `normalizePattern` rewrites a pattern written in the tool's own language into
+* the widest glob it could stand for, for a tool whose patterns are not globs.
+* It reaches the `bash` rules and the `allow` rules, which is where such a
+* pattern is written; an all-tools `*` pattern is canonical — it is read by
+* every tool, so it is a glob already — and is compared as it stands. The
+* rewrite must only ever widen what a pattern covers, so an inexact reading
+* withholds an allow rather than writing one the config restricts — see
+* `warpCommandPatternToGlob`.
+*/
+function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
+	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
+		pattern,
+		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
+	}));
+	return (allowPattern) => {
+		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
+		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
+		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
+	};
+}
+/**
+* Which of the given all-tools `*` restrictions look like they may not name a
+* command at all — the question a `deny` and an `ask` written there both raise.
+*
+* "Withheld no allow rule" alone does not answer it: a config with no `allow`
+* rules has nothing to withhold, and a pattern the author also wrote under
+* `bash` is a command on their own word. Both are excluded, so what remains is
+* a `*` pattern that had allow rules to overlap, overlapped none of them, and
+* is claimed as a command nowhere else — the shape `secrets/**` has.
+*
+* A `bash` restriction never belongs here: it names a command by construction,
+* so overlapping no allow rule says nothing is wrong with it.
+*/
+function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
+	if (!rules.some(({ action }) => action === "allow")) return [];
+	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
+	return uniq(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
+}
+/**
+* Split shell-command rules into the allow and deny lists of a tool that models
+* commands with those two tiers and nothing else.
+*
+* `ask` has no list of its own — such a tool already prompts for whatever it
+* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
+* still has to *withhold* the `allow` rules it covers, though: the canonical
+* order is `deny > ask > allow`, so auto-approving a command the file also asks
+* about would answer the prompt the author wanted.
+*
+* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
+* from the all-tools `*` category. Warp's cannot: it matches commands with
+* regular expressions rather than globs, and writing any denylist **replaces**
+* Warp's built-in default one, so an inert `secrets/**` entry there would trade
+* the tool's own protection for a rule that matches no command. Where the deny
+* cannot be written it withholds the allow rules it covers instead, which
+* restricts in the same direction without touching the denylist.
+*
+* A `bash` deny withholds nothing: it names a command by construction, so the
+* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
+* and a narrow deny keeps carving an exception out of a wider allow (`git *`
+* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
+* even where it is written: a pattern under `*` need not name a command —
+* `secrets/**` there denies a path — so as a denylist entry it may match nothing
+* at all, and leaving an overlapping allow beside it would auto-approve the very
+* commands the author meant to stop. Over-restricting a `*` deny that *was* a
+* command pattern is reported; failing open would not be.
+*
+* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
+* patterns are not globs.
+*/
+function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
+	const deny = [];
+	const unwrittenDenyPatterns = [];
+	const restrictions = [];
+	const writtenAllToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	for (const rule of rules) {
+		const { pattern, action, fromAllToolsCategory } = rule;
+		if (action === "allow") continue;
+		if (action !== "deny") {
+			restrictions.push(rule);
+			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
+			continue;
+		}
+		if (writesAllToolsDeny || !fromAllToolsCategory) {
+			deny.push(pattern);
+			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
+		} else unwrittenDenyPatterns.push(pattern);
+		if (fromAllToolsCategory) restrictions.push(rule);
+	}
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
+		normalizePattern,
+		budget
+	});
+	const allow = [];
+	const shadowedAllowPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action } of rules) {
+		if (action !== "allow") continue;
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
+		}
+		allow.push(pattern);
+	}
+	return {
+		allow,
+		deny,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: writtenAllToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
+* Report, for one command-only tool, every canonical rule its two lists could
+* not carry. Every command-only adapter shares this reporting, so a rule
+* dropped in one is worded the same way in all.
+*/
+function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
+	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
+	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
+	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
+	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
+	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
+	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
+}
 //#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
@@ -34223,8 +35791,10 @@ function convertRulesyncToClaudePermissions({ config, logger }) {
 	const ask = [];
 	const deny = [];
 	const actionByEntry = /* @__PURE__ */ new Map();
+	const allToolsPatterns = [];
 	for (const [category, rules] of Object.entries(config.permission)) {
 		const claudeToolName = toClaudeToolName(category);
+		if (category === "*") allToolsPatterns.push(...Object.keys(rules));
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildClaudePermissionEntry(claudeToolName, pattern);
 			const previous = actionByEntry.get(entry);
@@ -34241,6 +35811,7 @@ function convertRulesyncToClaudePermissions({ config, logger }) {
 			}
 		}
 	}
+	if (allToolsPatterns.length > 0) logger?.warn(`Claude Code permissions: a rule names one tool, and there is no name standing for every tool, so the all-tools '*' rule(s) for ${allToolsPatterns.join(", ")} were written as '*(pattern)' entries that Claude Code matches against no tool. Write them under the categories they are meant for (for example 'bash' or 'read') to have them enforced.`);
 	return {
 		allow,
 		ask,
@@ -34285,34 +35856,64 @@ const ClineCommandPermissionsSchema = z.looseObject({
 });
 /**
 * Translate rulesync permission categories into Cline allow/deny command lists.
-* Non-bash categories and `ask` rules are tracked separately so a single
-* translation notice can be surfaced by the caller.
+* The `bash` category maps, and so do the restricting rules of the all-tools
+* `*` category — a rule written there covers shell commands too. Other
+* categories and `ask` rules are tracked separately so a single translation
+* notice can be surfaced by the caller.
 */
 function translateClinePermissions(permission) {
 	const allow = [];
 	const deny = [];
-	const droppedCategories = [];
 	const translatedAskPatterns = [];
-	for (const [category, rules] of Object.entries(permission)) {
-		if (category !== "bash") {
-			droppedCategories.push(category);
-			continue;
-		}
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (action === "ask") {
-				translatedAskPatterns.push(pattern);
-				deny.push(pattern);
+	const shadowedAllowPatterns = [];
+	const droppedCategories = Object.keys(permission).filter((category) => category !== "bash" && category !== "*");
+	const { rules, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permission);
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(rules.filter(({ fromAllToolsCategory }) => fromAllToolsCategory), { budget });
+	const allToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action, fromAllToolsCategory } of rules) {
+		if (action === "ask") {
+			if (fromAllToolsCategory) {
+				allToolsAskPatterns.push(pattern);
 				continue;
 			}
-			if (action === "allow") allow.push(pattern);
-			else if (action === "deny") deny.push(pattern);
+			translatedAskPatterns.push(pattern);
+			deny.push(pattern);
+			continue;
+		}
+		if (action === "deny") {
+			deny.push(pattern);
+			if (fromAllToolsCategory) allToolsDenyPatterns.push(pattern);
+			continue;
+		}
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
 		}
+		allow.push(pattern);
 	}
 	return {
 		allow,
 		deny,
 		droppedCategories,
-		translatedAskPatterns
+		translatedAskPatterns,
+		shadowedAllowPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted: budget.remaining === 0
 	};
 }
 /**
@@ -34321,11 +35922,16 @@ function translateClinePermissions(permission) {
 * project convention used by every other permissions translator, and
 * (b) the user still sees one prominent "WARNING" message describing the translation.
 */
-function warnClineTranslationNotices({ droppedCategories, translatedAskPatterns, logger }) {
-	if (droppedCategories.length === 0 && translatedAskPatterns.length === 0) return;
+function warnClineTranslationNotices({ droppedCategories, translatedAskPatterns, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, ignoredAllToolsAllowPatterns, intersectionBudgetExhausted, logger }) {
+	if (droppedCategories.length === 0 && translatedAskPatterns.length === 0 && shadowedAllowPatterns.length === 0 && unenforcedAllToolsDenyPatterns.length === 0 && unenforcedAllToolsAskPatterns.length === 0 && ignoredAllToolsAllowPatterns.length === 0 && !intersectionBudgetExhausted) return;
 	const parts = [];
 	if (droppedCategories.length > 0) parts.push(`non-bash categories [${droppedCategories.join(", ")}] (Cline only enforces shell commands; use the rulesync ignore feature for read/write restrictions)`);
 	if (translatedAskPatterns.length > 0) parts.push(`'ask' rules for bash patterns [${translatedAskPatterns.join(", ")}] translated to 'deny' for fail-closed safety, since Cline lacks 'ask'`);
+	if (shadowedAllowPatterns.length > 0) parts.push(`'allow' rules for [${shadowedAllowPatterns.join(", ")}] withheld because the all-tools '*' category restricts the same commands, and a pattern written there need not name a command Cline's own lists can act on. Cline's allowlist is a gate — once set, only the commands matching it run without approval — so withholding every entry leaves every command asking`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) parts.push(`'deny' rules for [${unenforcedAllToolsDenyPatterns.join(", ")}] under the all-tools '*' category written into the denylist as they stand, where they withheld none of the allow rules beside them — a pattern written there need not name a command, and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern`);
+	if (unenforcedAllToolsAskPatterns.length > 0) parts.push(`'ask' rules for [${unenforcedAllToolsAskPatterns.join(", ")}] under the all-tools '*' category left with nothing to do, since Cline has no ask tier and they withheld none of the allow rules beside them — a pattern written there need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns`);
+	if (ignoredAllToolsAllowPatterns.length > 0) parts.push(`'allow' rules for [${ignoredAllToolsAllowPatterns.join(", ")}] under the all-tools '*' category skipped (only its deny and ask rules are read, since a pattern written there need not be a command); write them under 'bash' to auto-approve them`);
+	if (intersectionBudgetExhausted) parts.push("the limit on how much work one generation may spend comparing allow rules against the all-tools '*' category's deny and ask rules was reached, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than .rulesync/permissions.jsonc asks for; write fewer or shorter command patterns to have them all compared");
 	logger?.warn(`WARNING: Cline command permissions translation notice: ${parts.join("; ")}.`);
 }
 var ClinePermissions = class ClinePermissions extends ToolPermissions {
@@ -34373,10 +35979,15 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
+		const { allow, deny, droppedCategories, translatedAskPatterns, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, ignoredAllToolsAllowPatterns, intersectionBudgetExhausted } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
+			shadowedAllowPatterns,
+			unenforcedAllToolsDenyPatterns,
+			unenforcedAllToolsAskPatterns,
+			ignoredAllToolsAllowPatterns,
+			intersectionBudgetExhausted,
 			logger
 		});
 		const dedupedAllow = uniq(allow.toSorted());
@@ -34384,7 +35995,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		const mergedDeny = uniq([...existing.deny ?? [], ...dedupedDeny]).toSorted();
 		const denySet = new Set(mergedDeny);
 		const collisions = dedupedAllow.filter((p) => denySet.has(p));
-		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline's evaluation order is not documented to guarantee deny-priority; the resulting behavior is undefined. Consider removing the duplicate rule from rulesync.`);
+		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline documents that deny rules always take precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
 		const next = {
 			...existing,
 			allow: dedupedAllow,
@@ -35502,7 +37113,7 @@ function asCursorPermissionEntryArray(value, logger, fieldLabel) {
 	if (!Array.isArray(value)) return [];
 	const result = [];
 	for (const item of value) if (typeof item === "string") result.push(item);
-	else logger?.warn(`Cursor CLI permissions${fieldLabel ? `.${fieldLabel}` : ""} contains a non-string entry; dropping ${JSON.stringify(item)}.`);
+	else logger?.warn(`Cursor CLI permissions${fieldLabel ? `.${fieldLabel}` : ""} contains a non-string entry; dropping ${quoteValueForWarning(item)}.`);
 	return result;
 }
 /**
@@ -35803,7 +37414,9 @@ const TRAILING_ARGUMENT_WILDCARD_PATTERN = /:\*$/;
 * This surface is **global only** — dcode reads no project-level config file,
 * so there is nothing to write into a repository.
 *
-* Only the canonical `bash` category maps, and only its `allow` rules:
+* Only `allow` rules map, and only from the canonical `bash` category — the
+* all-tools `*` category contributes its restricting rules instead, since a rule
+* written there covers shell commands too (see `collectShellCommandRules`):
 *
 * - A pattern is reduced to its executable token, because that is all dcode
 *   matches on — `git *`, `git:*`, `git commit:*` and a bare `git` all become
@@ -35917,7 +37530,7 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			const shell = isPlainObject$1(existingShell) ? { ...existingShell } : {};
 			if (allowList.length > 0) shell[ALLOW_LIST_KEY] = allowList;
 			else if (shell[ALLOW_LIST_KEY] !== void 0) {
-				warnWithFallback(logger, `deepagents-cli: no bash allow rule maps to an executable name, so the existing [${SHELL_TABLE_KEY}].${ALLOW_LIST_KEY} in ${filePath} was removed and those commands will be asked about again.`);
+				warnWithFallback(logger, `deepagents-cli: no bash allow rule is left to auto-approve — none maps to an executable name, or every one of them is covered by a stricter rule — so the existing [${SHELL_TABLE_KEY}].${ALLOW_LIST_KEY} in ${filePath} was removed and those commands will be asked about again.`);
 				delete shell[ALLOW_LIST_KEY];
 			}
 			if (Object.keys(shell).length > 0) settings[SHELL_TABLE_KEY] = shell;
@@ -35976,35 +37589,69 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 	}
 };
 /**
+* Split the restricting rules by what the generated allowlist does to them, and
+* name the entries that have to go.
+*
+* An allowlist entry auto-approves its executable however it is invoked, so an
+* `ask` or `deny` on any command that entry would run — a narrower pattern
+* (`npm publish`) beside an allowed `npm *`, or one naming no executable at all
+* (`*delete*` beside an allowed `kubectl`) — collides with it. dcode has no
+* denylist, so the collision cannot be settled there: keeping the allow would
+* auto-approve the very command the author wanted stopped. The colliding
+* entries are therefore withheld — canonically the stricter rule wins whatever
+* its width — which leaves those executables prompting, which is what an `ask`
+* asks for and the closest dcode can come to a `deny`.
+*/
+function partitionRestrictingRules({ allowList, askPatterns, denyPatterns, willWrite }) {
+	const approved = allowList.map((token) => ({
+		token,
+		globs: [parseGlobPattern(token), parseGlobPattern(`${token} *`)]
+	}));
+	const budget = createIntersectionBudget();
+	const collidingTokens = (pattern) => {
+		if (!willWrite) return [];
+		if (budget.remaining === 0) return [...allowList];
+		const restriction = parseGlobPattern(pattern.trim().replace(TRAILING_ARGUMENT_WILDCARD_PATTERN, "*").replaceAll(SHLEX_STRIPPED_PATTERN, ""));
+		return approved.filter(({ globs }) => globs.some((glob) => parsedGlobsIntersect(restriction, glob, budget))).map(({ token }) => token);
+	};
+	const withheldTokens = /* @__PURE__ */ new Set();
+	const collect = (pattern) => {
+		const tokens = collidingTokens(pattern);
+		for (const token of tokens) withheldTokens.add(token);
+		return tokens.length > 0;
+	};
+	const shadowedAsk = uniq(askPatterns).filter(collect);
+	const shadowedDeny = [];
+	const unenforcedDeny = [];
+	for (const pattern of uniq(denyPatterns)) (collect(pattern) ? shadowedDeny : unenforcedDeny).push(pattern);
+	return {
+		shadowedAsk,
+		shadowedDeny,
+		unenforcedDeny,
+		withheldTokens,
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
 * Say what the reduction to executable names could not write. Split out from
 * `convertRulesyncToDeepagentsAllowList` because the rules it reports on
 * outnumber the ones it writes: every category dcode cannot express is a
 * sentence here.
 */
-function warnAboutUnwrittenBashRules({ allowList, allowAll, requestedAllowAll, askPatterns, denyPatterns, widenedPatterns, unmatchablePatterns, sentinelPatterns, willWrite, logger }) {
-	const allowedTokens = new Set(allowList);
-	const collidesWithAllow = (pattern) => {
-		if (!willWrite) return false;
-		if (allowAll) return true;
-		const leading = leadingToken(pattern).replaceAll(SHLEX_STRIPPED_PATTERN, "");
-		if (GLOB_CHARACTERS_PATTERN.test(leading)) {
-			const matches = compileGlob(leading);
-			return allowList.some((token) => matches(token));
-		}
-		return allowedTokens.has(leading);
-	};
-	const shadowedAsk = askPatterns.filter(collidesWithAllow);
-	const shadowedDeny = [];
-	const unenforcedDeny = [];
-	for (const pattern of denyPatterns) (collidesWithAllow(pattern) ? shadowedDeny : unenforcedDeny).push(pattern);
-	if (unenforcedDeny.length > 0) warnWithFallback(logger, `deepagents-cli has no command denylist — a command it does not auto-approve is asked about, not blocked — so ${unenforcedDeny.length} bash deny rule(s) from .rulesync/permissions.jsonc were skipped and those commands remain runnable on approval.`);
-	const shadowReason = allowAll ? `allow_list = ["all"] auto-approves every command` : `the generated allow_list auto-approves commands they cover`;
-	if (shadowedDeny.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name, so the deny rule(s) ${shadowedDeny.join(", ")} are not merely unenforced: ${shadowReason}, so those commands run without a prompt. Narrow or drop the allow rule that covers them.`);
-	if (shadowedAsk.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name, so the ask rule(s) ${shadowedAsk.join(", ")} run without a prompt: ${shadowReason}. Narrow or drop the allow rule that covers them.`);
+function warnAboutUnwrittenBashRules({ allowAll, requestedAllowAll, askPatterns, denyPatterns, foreignRestrictingCategories, shadowedAsk, shadowedDeny, unenforcedDeny, intersectionBudgetExhausted, widenedPatterns, unmatchablePatterns, sentinelPatterns, willWrite, logger }) {
+	if (unenforcedDeny.length > 0) warnWithFallback(logger, `deepagents-cli has no command denylist — a command it does not auto-approve is asked about, not blocked — so ${unenforcedDeny.length} command deny rule(s) from .rulesync/permissions.jsonc were skipped and those commands remain runnable on approval.`);
+	if (shadowedDeny.length > 0) warnWithFallback(logger, intersectionBudgetExhausted ? `deepagents-cli withheld the allow_list entries beside the deny rule(s) ${shadowedDeny.join(", ")} without comparing them, the comparison limit above having been reached. Those executables are asked about instead.` : `deepagents-cli matches only the executable name, so the allow rule(s) covered by the deny rule(s) ${shadowedDeny.join(", ")} were withheld from allow_list — keeping them would auto-approve the very commands those rules deny. Those executables are asked about instead; narrow the deny rule if you meant them auto-approved.`);
+	if (shadowedAsk.length > 0) warnWithFallback(logger, intersectionBudgetExhausted ? `deepagents-cli withheld the allow_list entries beside the ask rule(s) ${shadowedAsk.join(", ")} without comparing them, the comparison limit above having been reached. Those executables are asked about instead.` : `deepagents-cli matches only the executable name, so the allow rule(s) covered by the ask rule(s) ${shadowedAsk.join(", ")} were withheld from allow_list — keeping them would run those commands without the prompt the ask rule asks for. Narrow the ask rule if you meant them auto-approved.`);
 	if (willWrite && widenedPatterns.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name of a command, so ${widenedPatterns.join(", ")} were widened to their first token — every invocation of those executables is now auto-approved, not just the listed arguments.`);
 	if (willWrite && unmatchablePatterns.length > 0) warnWithFallback(logger, `deepagents-cli compares an allow_list entry to the executable name exactly, so a glob in that name matches nothing, a name longer than ${MAX_EXECUTABLE_NAME_LENGTH} characters is longer than a command's own name can be, and a name holding a shell metacharacter, a quote or an escape is one dcode splits on, refuses outright, or reads differently than it is written — the pattern(s) ${unmatchablePatterns.join(", ")} were therefore skipped rather than written as a rule that cannot be relied on to fire.`);
 	if (willWrite && sentinelPatterns.length > 0) warnWithFallback(logger, `deepagents-cli reads 'all' and 'recommended' in allow_list as sentinels rather than command names, so ${sentinelPatterns.join(", ")} were skipped. Use the '*' pattern to allow every command.`);
-	if (willWrite && requestedAllowAll && !allowAll) warnWithFallback(logger, `The bash '*' allow rule was not written as allow_list = ["all"] for deepagents-cli, because 'all' also turns off its dangerous-pattern check (command substitution, redirects, process substitution) and ${denyPatterns.length > 0 ? `your config denies commands` : `your config has deny rules for other tools`} — the two together would be weaker than dcode's own default. List the executables you want auto-approved instead.`);
+	if (willWrite && requestedAllowAll && !allowAll) {
+		let restrictionReason = `your config restricts other tools`;
+		if (denyPatterns.length > 0) restrictionReason = `your config denies commands`;
+		else if (askPatterns.length > 0) restrictionReason = `your config asks before running commands`;
+		else if (foreignRestrictingCategories.length > 0) restrictionReason = `your config restricts '${foreignRestrictingCategories.join("', '")}'`;
+		warnWithFallback(logger, `The bash '*' allow rule was not written as allow_list = ["all"] for deepagents-cli, because 'all' also turns off its dangerous-pattern check (command substitution, redirects, process substitution) and ${restrictionReason} — the two together would be weaker than dcode's own default. List the executables you want auto-approved instead.`);
+	}
 	if (willWrite && allowAll) warnWithFallback(logger, "The bash '*' allow rule became allow_list = [\"all\"] for deepagents-cli, which auto-approves every command and skips its dangerous-pattern check (command substitution, redirects, process substitution). List the executables you want instead if that is more than you meant.");
 }
 /**
@@ -36151,62 +37798,78 @@ function toExecutableToken(pattern) {
 }
 /**
 * Convert rulesync permissions config to dcode's `[shell].allow_list`. Only
-* `bash` `allow` rules map; everything else is skipped, with a warning
+* `allow` rules map — from the `bash` category, and never from the all-tools
+* `*` one, whose restricting rules still count against them (see
+* `collectShellCommandRules`). Everything else is skipped, with a warning
 * wherever the skip loses a restriction rather than a redundancy.
 */
 function convertRulesyncToDeepagentsAllowList({ config, willWrite, logger }) {
 	const allowed = [];
-	const widenedPatterns = [];
+	const widened = [];
 	const unmatchablePatterns = [];
 	const sentinelPatterns = [];
 	const askPatterns = [];
 	const denyPatterns = [];
-	let hasForeignDeny = false;
 	let requestedAllowAll = false;
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny")) {
-				hasForeignDeny = true;
-				warnWithFallback(logger, `deepagents-cli only models shell-command permissions ([shell].allow_list), so '${category}' deny rules cannot be represented and were skipped.`);
-			}
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	for (const { pattern, action } of rules) {
+		if (action === "deny") {
+			denyPatterns.push(pattern);
 			continue;
 		}
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (action === "deny") {
-				denyPatterns.push(pattern);
-				continue;
-			}
-			if (action === "ask") {
-				askPatterns.push(pattern);
-				continue;
-			}
-			if (leadingToken(pattern) === "*" && meansAnyArguments(pattern)) {
-				requestedAllowAll = true;
-				continue;
-			}
-			const reduced = toExecutableToken(pattern);
-			if (!reduced) {
-				unmatchablePatterns.push(pattern);
-				continue;
-			}
-			if (reduced.token.toLowerCase() === ALLOW_ALL_SENTINEL || reduced.token.toLowerCase() === RECOMMENDED_SENTINEL) {
-				sentinelPatterns.push(pattern);
-				continue;
-			}
-			if (reduced.widened) widenedPatterns.push(pattern);
-			allowed.push(reduced.token);
+		if (action === "ask") {
+			askPatterns.push(pattern);
+			continue;
+		}
+		if (leadingToken(pattern) === "*" && meansAnyArguments(pattern)) {
+			requestedAllowAll = true;
+			continue;
 		}
+		const reduced = toExecutableToken(pattern);
+		if (!reduced) {
+			unmatchablePatterns.push(pattern);
+			continue;
+		}
+		if (reduced.token.toLowerCase() === ALLOW_ALL_SENTINEL || reduced.token.toLowerCase() === RECOMMENDED_SENTINEL) {
+			sentinelPatterns.push(pattern);
+			continue;
+		}
+		if (reduced.widened) widened.push({
+			pattern,
+			token: reduced.token
+		});
+		allowed.push(reduced.token);
 	}
-	const hasDenyRule = hasForeignDeny || denyPatterns.length > 0;
-	const allowAll = requestedAllowAll && !hasDenyRule;
-	const allowList = allowAll ? [ALLOW_ALL_SENTINEL] : uniq(allowed.toSorted());
+	const hasRestriction = foreignRestrictingCategories.length > 0 || denyPatterns.length > 0 || askPatterns.length > 0;
+	const allowAll = requestedAllowAll && !hasRestriction;
+	const candidates = uniq(allowed.toSorted());
+	const { shadowedAsk, shadowedDeny, unenforcedDeny, withheldTokens, intersectionBudgetExhausted } = partitionRestrictingRules({
+		allowList: candidates,
+		askPatterns,
+		denyPatterns,
+		willWrite
+	});
+	const allowList = allowAll ? [ALLOW_ALL_SENTINEL] : candidates.filter((token) => !withheldTokens.has(token));
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "deepagents-cli",
+		surfaceLabel: "[shell].allow_list",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns: [],
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	warnAboutUnwrittenBashRules({
-		allowList,
 		allowAll,
 		requestedAllowAll,
 		askPatterns,
 		denyPatterns,
-		widenedPatterns,
+		foreignRestrictingCategories,
+		shadowedAsk,
+		shadowedDeny,
+		unenforcedDeny,
+		intersectionBudgetExhausted,
+		widenedPatterns: uniq(widened.filter(({ token }) => !withheldTokens.has(token)).map(({ pattern }) => pattern)),
 		unmatchablePatterns,
 		sentinelPatterns,
 		willWrite,
@@ -36506,10 +38169,17 @@ function convertDevinToRulesyncPermissions(params) {
 *
 * rulesync's canonical `permission.bash` patterns map directly: `allow` →
 * `commandAllowlist`, `deny` → `commandDenylist`. Factory Droid has no separate
-* "ask" list (any command not in the allowlist already prompts), so `ask`
-* rules are intentionally dropped. The allow/deny lists only model shell
-* commands, so categories other than `bash` cannot be represented and are
-* skipped (with a warning when they carry `deny` rules, to surface the gap).
+* "ask" list (any command not in the allowlist already prompts), so `ask` rules
+* write nothing — they only withhold the allow rules they cover, since the
+* stricter rule wins whatever its width. The all-tools `*` category contributes
+* its restricting rules too, because a rule written there covers shell commands
+* as well. They withhold the allow rules they cover the way a `bash` `ask`
+* does, because a pattern written under `*` need not name a command at all: a
+* `deny` there is written to `commandDenylist` too, for the case where it *is*
+* one, but an entry naming no command enforces nothing by itself.
+* The allow/deny lists only model shell commands, so categories other
+* than `bash` and `*` cannot be represented and are skipped (with a warning
+* when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
 * never run, not even under full autonomy — plus other security controls
@@ -36626,24 +38296,28 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 };
 /**
 * Convert rulesync permissions config to Factory Droid allow/deny command lists.
-* Only the `bash` category maps; `ask` rules and non-`bash` categories are
-* dropped (the latter with a warning when they carry `deny` rules).
+* The `bash` category maps, and so do the restricting rules of the all-tools
+* `*` category — a `deny` written there covers shell commands too, and skipping
+* it would auto-approve a command the file blocks. Other categories are dropped
+* (with a warning when they carry `deny` rules).
 */
 function convertRulesyncToFactorydroidPermissions({ config, logger }) {
-	const allow = [];
-	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny") && logger) logger.warn(`Factory Droid only models shell-command permissions (commandAllowlist/commandDenylist); '${category}' deny rules cannot be represented and were skipped.`);
-			continue;
-		}
-		for (const [pattern, action] of Object.entries(rules)) switch (action) {
-			case "allow":
-				allow.push(pattern);
-				break;
-			case "deny": deny.push(pattern);
-		}
-	}
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	const { allow, deny, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+		rules,
+		writesAllToolsDeny: true
+	});
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "Factory Droid",
+		surfaceLabel: "commandAllowlist/commandDenylist",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns,
+		unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	return {
 		allow,
 		deny
@@ -37356,7 +39030,10 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			fileContent: this.getFileContent()
 		});
 		const rawProvenance = (isRecord$1(config.permissions) ? config.permissions : {}).rulesync;
-		const parsedProvenance = RulesyncPermissionsFileSchema.safeParse(isRecord$1(rawProvenance) ? withoutBlankPermissionPatternsIn({ config: rawProvenance }) : rawProvenance);
+		const parsedProvenance = RulesyncPermissionsFileSchema.safeParse(isRecord$1(rawProvenance) ? withoutBlankPermissionKeysIn({
+			config: rawProvenance,
+			sourcePath: this.getRelativePathFromCwd()
+		}) : rawProvenance);
 		const provenance = parsedProvenance.success ? parsedProvenance.data : { permission: {} };
 		const permission = clonePermissionBlock(provenance.permission);
 		reconcileCommandAllowlist({
@@ -37384,14 +39061,13 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			permission,
 			...Object.keys(hermes).length > 0 && { hermes }
 		};
-		return new RulesyncPermissions({
+		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
 				global: this.global
 			}),
-			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
-			fileContent: withoutBlankPermissionPatterns({ fileContent: JSON.stringify(imported, null, 2) })
+			sourcePath: this.getRelativePathFromCwd(),
+			fileContent: JSON.stringify(imported, null, 2)
 		});
 	}
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, global = false }) {
@@ -38292,17 +39968,16 @@ var KimiCodePermissions = class KimiCodePermissions extends ToolPermissions {
 			...nativeRules.length > 0 && { rules: nativeRules },
 			...tools && { tools }
 		};
-		return new RulesyncPermissions({
+		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: getKimiCodeRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
 				global: this.global
 			}),
-			relativeDirPath: RULESYNC_RELATIVE_DIR_PATH,
-			relativeFilePath: RULESYNC_PERMISSIONS_FILE_NAME,
-			fileContent: withoutBlankPermissionPatterns({ fileContent: JSON.stringify({
+			sourcePath: this.getRelativePathFromCwd(),
+			fileContent: JSON.stringify({
 				permission,
 				...Object.keys(toolOverride).length > 0 && { "kimi-code": toolOverride }
-			}, null, 2) })
+			}, null, 2)
 		});
 	}
 	static forDeletion({ outputRoot = process.cwd() }) {
@@ -38693,9 +40368,10 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
 		const parsed = parse(fileContent ?? "{}");
+		const record = isRecord$1(parsed) ? parsed : {};
 		const nextJson = {
-			...parsed,
-			permission: parsed.permission ?? {}
+			...record,
+			permission: Object.hasOwn(record, "permission") ? record.permission ?? {} : {}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -38764,7 +40440,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 	}
 	validate() {
 		try {
-			const json = JSON.parse(this.fileContent || "{}");
+			const json = parseJsonc(this.fileContent || "{}");
 			const result = OpencodePermissionsConfigSchema.safeParse(json);
 			if (!result.success) return {
 				success: false,
@@ -40876,6 +42552,28 @@ function pickSecurityPolicies(source, report) {
 * Ambiguous-width characters are counted as one column, which is what a
 * terminal running a Latin font does.
 *
+* Two of the ranges are here for a narrower reason: a name the skill prompt can
+* offer may not be counted narrower here than the prompt's own renderer counts
+* it, or a label that fits the budget wraps anyway and paints the second row
+* the budget exists to prevent. `@inquirer/core` measures with
+* `fast-string-width`, which takes the whole of `Script=Hangul` as wide and
+* every `Emoji_Modifier_Base` as an emoji. So the Hangul jamo are taken to
+* U+11FF rather than stopping at the leading consonants, and the modifier bases
+* are named beside the emoji: U+261D, U+26F9 and the two hands of U+270C–U+270D
+* are `Emoji` without being `Emoji_Presentation`, and were the only characters
+* outside Hangul this counted at one column while the renderer counted two.
+*
+* The rule is over the names that can reach the prompt, which is a smaller set
+* than the characters that exist. The renderer counts a tab at eight columns and
+* the Hangul fillers at two, where this counts one and none: a name carrying
+* either is refused outright by `hasDeceptiveHiddenCharacters` — the tab as a
+* control character, the fillers as characters that draw as nothing — and never
+* becomes a row to be measured. The two joiners are the invisible characters
+* that check lets through, so they are counted below rather than left to the
+* zero-width rule. Where this is used to lay out text of the tool's own rather
+* than to bound an untrusted name, the difference is a column of alignment and
+* not a forged row.
+*
 * The wide planes are taken whole rather than range by range — Tangut, Khitan
 * and Nushu together are U+17000–U+18DFF, and the kana supplements are
 * U+1AFF0–U+1B2FF — because a gap between two of them is exactly the character
@@ -40888,7 +42586,7 @@ function pickSecurityPolicies(source, report) {
 * is canonically the ordinary ideograph U+8C48, and a range that starts there
 * instead silently swallows thirty thousand code points that are not wide.
 */
-const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|[\u2329\u232a\u2630-\u2637\u268a-\u268f\u4dc0-\u4dff]|[\u1100-\u115f\u2e80-\u303e\u3041-\u33ff\u3400-\u4dbf\u4e00-\u9fff\ua000-\ua4cf\ua960-\ua97f\uac00-\ud7a3\ud7b0-\ud7fb\uf900-\ufaff\ufe10-\ufe19\ufe30-\ufe6f\uff00-\uff60\uffe0-\uffe6]|[\u{16fe0}-\u{16ff6}]|[\u{17000}-\u{18dff}]|[\u{1aff0}-\u{1b2ff}]|[\u{1f000}-\u{1faff}]|[\u{20000}-\u{3fffd}]/u;
+const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|\p{Emoji_Modifier_Base}|[\u2329\u232a\u2630-\u2637\u268a-\u268f\u4dc0-\u4dff]|[\u1100-\u11ff\u2e80-\u303e\u3041-\u33ff\u3400-\u4dbf\u4e00-\u9fff\ua000-\ua4cf\ua960-\ua97f\uac00-\ud7a3\ud7b0-\ud7fb\uf900-\ufaff\ufe10-\ufe19\ufe30-\ufe6f\uff00-\uff60\uffe0-\uffe6]|[\u{16fe0}-\u{16ff6}]|[\u{17000}-\u{18dff}]|[\u{1aff0}-\u{1b2ff}]|[\u{1f000}-\u{1faff}]|[\u{20000}-\u{3fffd}]/u;
 /**
 * U+FE0F VARIATION SELECTOR-16, which takes no width of its own but asks the
 * character before it to be drawn as an emoji — that is, in two columns rather
@@ -40902,6 +42600,27 @@ const COMBINING_MARK_PATTERN = /[\p{Mn}\p{Me}]/u;
 /** The characters that take no width at all, marks aside. */
 const ZERO_WIDTH_CHARACTERS_PATTERN = /[\p{Cf}\p{Default_Ignorable_Code_Point}]/u;
 /**
+* The zero-width joiner and its non-joining twin, which the renderer spends a
+* column on apiece.
+*
+* A terminal draws neither, and every other character that draws as nothing is
+* counted at nothing here. These two are the exception because they are the
+* only invisible characters `hasDeceptiveHiddenCharacters` lets through — a
+* Persian or Indic name spells a word with one, and an emoji is a chain of them
+* — so they are the only ones an attacker can put in a name that reaches the
+* prompt. `fast-string-width`, which is where the prompt's own wrapping is
+* decided, counts each of them as a column, and 40 of them in a name is 40
+* columns of budget this would otherwise hand over for free: enough for a name
+* measured at 39 columns to be drawn at 77 and wrap a forged row underneath
+* itself.
+*
+* The cost is that an emoji built from a chain is overstated by a column per
+* joiner, on top of the two columns per component it is already overstated by.
+* Overstating shortens a label that did not need it; understating lets one
+* wrap.
+*/
+const RENDERER_COUNTED_JOINERS = /\u200c|\u200d/u;
+/**
 * How many marks a single character is allowed to carry for free.
 *
 * A written language stacks two or three at most — a Devanagari vowel sign and
@@ -40929,6 +42648,7 @@ function widthInContext(params) {
 	const { character, precedingMarks } = params;
 	if (character === EMOJI_PRESENTATION_SELECTOR) return 1;
 	if (isCombiningMark(character)) return precedingMarks < FREE_MARKS_PER_CHARACTER ? 0 : 1;
+	if (RENDERER_COUNTED_JOINERS.test(character)) return 1;
 	if (ZERO_WIDTH_CHARACTERS_PATTERN.test(character)) return 0;
 	return WIDE_CHARACTERS_PATTERN.test(character) ? 2 : 1;
 }
@@ -40951,6 +42671,8 @@ function displayWidthOf(text) {
 	}
 	return width;
 }
+/** The mark a cut string ends in. */
+const SHORTENING_ELLIPSIS = "…";
 /**
 * Cut `text` down to at most `budget` columns, marking the cut with an ellipsis.
 *
@@ -40976,7 +42698,7 @@ function shortenToWidth(params) {
 		width += characterWidth;
 		marks = isCombiningMark(character) ? marks + 1 : 0;
 	}
-	return `${kept.join("")}…`;
+	return `${kept.join("")}${SHORTENING_ELLIPSIS}`;
 }
 //#endregion
 //#region src/features/permissions/vibe-permissions.ts
@@ -42419,9 +44141,13 @@ function warpSettingsDir() {
 * allowlist, `deny` → denylist). Warp matches commands with regular
 * expressions, so patterns are emitted verbatim — author canonical `bash`
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
-* adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
-* the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules).
+* adapter). Warp has no per-command "ask" list, so `ask` rules write nothing —
+* they only withhold the allow rules they cover, since the stricter rule wins
+* whatever its width. The all-tools `*` category is read for its restricting
+* rules as well, but those only withhold allows too: writing any denylist
+* **replaces** Warp's built-in default one, and a `*` pattern need not name a
+* command at all. Categories other than `bash` and `*` are skipped (with a
+* warning when they carry `deny` rules).
 *
 * Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
 * knobs that do not fit the canonical `allow | ask | deny` per-command model:
@@ -42594,25 +44320,267 @@ function mergeIntoDefaultExecutionProfile({ agents, mergedAllow, mergedDeny, exe
 	if ((mergedDeny.length > 0 || hasOverrideKeys) && otherProfileIds.length > 0 && logger) logger.warn(`Warp command deny rules and execution_profile override keys were written to the 'default' execution profile only; they are not enforced while another profile (${otherProfileIds.join(", ")}) is active.`);
 }
 /**
-* Convert rulesync permissions config to Warp command allow/deny regex lists.
-* Only the `bash` category maps; `ask` rules and non-`bash` categories are
-* dropped (the latter with a warning when they carry `deny` rules).
+* Read a `[...]` class starting at its `[` and return the index just past its
+* `]`, or `undefined` when it cannot be read that simply. Regex class rules
+* apply: a `]` in the first position is a member rather than the terminator and
+* a backslash escapes the character after it. A nested `[` gives up: Rust's
+* `regex` crate — the engine Warp matches with — reads `[a[b]c]` as one class
+* built by set operations, so stopping at the first `]` would leave `c]` behind
+* as text the glob then requires. Giving up widens the whole pattern instead,
+* which is the only safe direction here.
+*/
+function skipRegexClass(body, start) {
+	let index = start + 1;
+	if (body.charAt(index) === "^") index += 1;
+	if (body.charAt(index) === "]") index += 1;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "\\") {
+			index += 2;
+			continue;
+		}
+		if (character === "[") return;
+		if (character === "]") return index + 1;
+		index += 1;
+	}
+}
+/**
+* Read a `(...)` group starting at its `(` and return the index just past its
+* `)`, or `undefined` when it never closes. Groups nest, so the depth is
+* counted — but a class inside one is skipped whole, since a `)` written there
+* is a member rather than a closer.
 */
-function convertRulesyncToWarpPermissions({ config, logger }) {
-	const allow = [];
-	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny") && logger) logger.warn(`Warp only models shell-command permissions (agent_mode_command_execution_allowlist/denylist); '${category}' deny rules cannot be represented and were skipped.`);
+function skipRegexGroup(body, start) {
+	let depth = 0;
+	let index = start;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "\\") {
+			index += 2;
 			continue;
 		}
-		for (const [pattern, action] of Object.entries(rules)) switch (action) {
-			case "allow":
-				allow.push(pattern);
-				break;
-			case "deny": deny.push(pattern);
+		if (character === "[") {
+			const next = skipRegexClass(body, index);
+			if (next === void 0) return;
+			index = next;
+			continue;
+		}
+		if (character === "(") {
+			depth += 1;
+			index += 1;
+			continue;
+		}
+		if (character === ")") {
+			depth -= 1;
+			index += 1;
+			if (depth === 0) return index;
+			continue;
 		}
+		index += 1;
 	}
+}
+/**
+* Read a `{2,3}` quantifier starting at its `{`, or `undefined` when what
+* follows is not one. The shape is checked rather than scanned to the next `}`,
+* because a `{` that spells no repetition is a literal to the regex engine —
+* `{a|b}` is an alternation in braces, and reading it as a quantifier would skip
+* past the `|` that has to widen the whole pattern.
+*/
+const QUANTIFIER = /\{\d+(,\d*)?\}/y;
+function skipQuantifier(body, start) {
+	QUANTIFIER.lastIndex = start;
+	return QUANTIFIER.exec(body) === null ? void 0 : QUANTIFIER.lastIndex;
+}
+/**
+* Read the bracketed construct that opens at `start`, whichever kind it is, and
+* return the index just past it — or `undefined` when it never closes.
+*/
+function skipBracketedConstruct(body, start, open) {
+	if (open === "[") return skipRegexClass(body, start);
+	if (open === "(") return skipRegexGroup(body, start);
+	return skipQuantifier(body, start);
+}
+/**
+* Read the tail of a `\\x` / `\\u` escape — the hex run of `\\x20`, or the
+* braced `\\x{263A}` form — and return the index just past it. Such an escape
+* spells one character across several, so consuming only its introducer would
+* leave the hex digits behind as literal atoms and *narrow* the glob, the one
+* direction the rewrite must never take. Over-consuming only widens, so an
+* unterminated brace swallows the rest of the pattern.
+*/
+function skipHexEscapeTail(body, start) {
+	if (body.charAt(start) === "{") {
+		const closing = body.indexOf("}", start);
+		return closing === -1 ? body.length : closing + 1;
+	}
+	let index = start;
+	while (index < body.length && /^[0-9A-Fa-f]$/.test(body.charAt(index))) index += 1;
+	return index;
+}
+/**
+* Read the tail of a `\\p` / `\\P` Unicode-class escape — the braced `\\p{Greek}`
+* form, or the one-letter `\\pL` shorthand — and return the index just past it.
+* Like a hex escape, it spells its class across more than one character, so
+* leaving the shorthand letter behind would narrow the glob.
+*/
+function skipUnicodeClassTail(body, start) {
+	if (body.charAt(start) === "{") {
+		const closing = body.indexOf("}", start);
+		return closing === -1 ? body.length : closing + 1;
+	}
+	return Math.min(start + 1, body.length);
+}
+/**
+* Read the escape that opens at `start` — the `\\` and whatever it spells — and
+* say where it ends and which atom it stands for.
+*/
+function readEscape(body, start) {
+	const escaped = body.charAt(start + 1);
+	if (escaped === "x" || escaped === "u" || escaped === "U") return {
+		next: skipHexEscapeTail(body, start + 2),
+		atom: "*"
+	};
+	if (escaped === "p" || escaped === "P") return {
+		next: skipUnicodeClassTail(body, start + 2),
+		atom: "*"
+	};
+	return {
+		next: start + 2,
+		atom: escapedCharacterWidens(escaped) ? "*" : escaped
+	};
+}
+/**
+* Whether an escaped character has to widen to `*` rather than stand for
+* itself: a letter or a digit spells a class (`\s`, `\d`, `\w`), a glob
+* metacharacter would be read as a wildcard or a class by the comparison
+* instead of as the literal the escape asked for, and an empty string is a
+* trailing backslash spelling nothing at all.
+*/
+function escapedCharacterWidens(escaped) {
+	return escaped === "" || /^[A-Za-z0-9*?[\]]$/.test(escaped);
+}
+/**
+* Read one `[...]`, `(...)` or `{...}` construct starting at `start`, saying
+* where it ends and whether it repeats the atom in front of it (a quantifier)
+* or is an atom of its own (a class or a group) — or that the whole pattern has
+* to widen, which is the only safe reading of a construct that never closes and
+* of one that sets flags for everything after it.
+*/
+function readBracketedConstruct(body, start, open) {
+	const next = skipBracketedConstruct(body, start, open);
+	if (next === void 0) return "widens-pattern";
+	if (open === "(" && INLINE_FLAG_GROUP_PATTERN.test(body.slice(start, next))) return "widens-pattern";
+	return {
+		next,
+		widensLastAtom: open === "{"
+	};
+}
+/**
+* A group that only sets flags — `(?i)`, `(?im)`, `(?-i)` — as opposed to one
+* that scopes them to its own body (`(?i:...)`, which widens to `*` like any
+* other group).
+*/
+const INLINE_FLAG_GROUP_PATTERN = /^\(\?[A-Za-z]*-?[A-Za-z]*\)$/;
+/**
+* Approximate a Warp command pattern as a glob, so restrictions and allow rules
+* can be compared by `createShadowingRestrictionsTest`.
+*
+* Warp matches commands with regular expressions, and a glob reader would
+* misread the ordinary spellings: `.*` — Warp's catch-all — is a literal dot
+* followed by a wildcard, `[rf]` is a character class in one language and plain
+* text in the other, and an unanchored regex covers every command that merely
+* contains it. The rewrite therefore only ever widens what a pattern covers, so
+* an inexact reading withholds an allow rather than writing one the config
+* restricts.
+*
+* Widening means a construct is replaced whole rather than character by
+* character, because the characters inside it are not literals of the command:
+* a class (`[rf]`), a group (`(sudo )?`), a character escape (`\s`) and a
+* missing `^`/`$` anchor all become `*`, and a quantifier (`?`, `*`, `+`,
+* `{2}`) widens the atom in front of it — `git commits?` covers `git commit`,
+* so its glob has to as well. Both sides of a comparison are widened, so a
+* pattern that is really a glob still compares sensibly.
+*
+* A pattern the walk cannot read as one sequence widens to `*` whole: a
+* top-level `|` is two patterns rather than one, and a class, group or
+* quantifier that never closes leaves the rest of the pattern unreadable —
+* guessing at either could only narrow the result, which is the one direction
+* this rewrite must never take. An alternation *inside* a group needs no such
+* treatment: the group it sits in already widens to `*`.
+*/
+function warpCommandPatternToGlob(pattern) {
+	const anchoredStart = pattern.startsWith("^");
+	const anchoredEnd = pattern.endsWith("$") && !pattern.endsWith("\\$");
+	const body = pattern.slice(anchoredStart ? 1 : 0, anchoredEnd ? -1 : void 0);
+	const atoms = [];
+	const widenLastAtom = () => {
+		if (atoms.length === 0) {
+			atoms.push("*");
+			return;
+		}
+		atoms[atoms.length - 1] = "*";
+	};
+	let index = 0;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "|") return "*";
+		if (character === "\\") {
+			const escape = readEscape(body, index);
+			index = escape.next;
+			atoms.push(escape.atom);
+			continue;
+		}
+		if (character === "[" || character === "(" || character === "{") {
+			const read = readBracketedConstruct(body, index, character);
+			if (read === "widens-pattern") return "*";
+			index = read.next;
+			if (read.widensLastAtom) widenLastAtom();
+			else atoms.push("*");
+			continue;
+		}
+		if (character === "*" || character === "+" || character === "?") {
+			index += 1;
+			widenLastAtom();
+			continue;
+		}
+		const codePoint = body.codePointAt(index);
+		const atom = codePoint === void 0 ? character : String.fromCodePoint(codePoint);
+		index += atom.length;
+		atoms.push(atom === "." || ")]}^$".includes(atom) ? "*" : atom);
+	}
+	const glob = atoms.join("");
+	return `${anchoredStart ? "" : "*"}${glob}${anchoredEnd ? "" : "*"}`;
+}
+/**
+* Convert rulesync permissions config to Warp command allow/deny regex lists.
+* The `bash` category maps to both lists. The all-tools `*` category's
+* restricting rules are read too — a rule written there covers shell commands
+* as well, and ignoring it would auto-approve a command the file blocks — but
+* they only *withhold* the allow rules they cover: Warp's denylist is a regex
+* list that replaces the tool's built-in default one, so writing a pattern
+* there that may not even name a command would cost more protection than it
+* adds. Other categories are dropped (with a warning when they carry `deny`
+* rules).
+*/
+function convertRulesyncToWarpPermissions({ config, logger }) {
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	const { allow, deny, shadowedAllowPatterns, unwrittenDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+		rules,
+		writesAllToolsDeny: false,
+		normalizePattern: warpCommandPatternToGlob
+	});
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "Warp",
+		surfaceLabel: "agent_mode_command_execution_allowlist/denylist",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unwrittenDenyReason: "Writing any denylist replaces Warp's built-in default one, and a pattern written under '*' need not be a command at all.",
+		unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	return {
 		allow,
 		deny
@@ -44764,6 +46732,83 @@ const NESTED_SCAN_EXCLUDED_ROOT_DIRS = [
 ];
 //#endregion
 //#region src/features/skills/claudecode-skill.ts
+/**
+* The `.claude/skills` tail every scanned root is expected to end with, written
+* posix-separated so it can be compared against a resolved relative path, and
+* split into its segments so what sits above it can be taken apart.
+*
+* Split here rather than through the shared helper: this is evaluated as the
+* module loads, before a test that mocks the file utilities can supply one.
+*/
+const CLAUDECODE_SKILLS_DIR_SEGMENTS = CLAUDECODE_SKILLS_DIR_PATH.split(sep);
+const CLAUDECODE_SKILLS_DIR_POSIX_PATH = CLAUDECODE_SKILLS_DIR_SEGMENTS.join("/");
+/**
+* The segment that puts `relativeDirPath` inside a tree the nested scan
+* excludes, or `undefined` when none does. These are the same three rules the
+* scan states as glob `ignore` patterns below -- dependency trees at any depth,
+* build and vendoring directories at the project root, hidden directories other
+* than the `.claude` being matched -- and the two have to be kept in step.
+*
+* Saying them twice is what a second pass costs. globby matches its patterns
+* against the path it reports, before the `..` a rewritten directory name
+* carries is folded away and before a link in the path is resolved. A root
+* reported at `x/../node_modules/.claude/skills` matches none of the patterns
+* and then leads to the dependency tree they name, so the decision has to be
+* taken again on the path that is really read.
+*
+* The segments passed are the ones above the `.claude/skills` tail, taken from
+* the resolved path: a directory name may hold a backslash -- the whole reason a
+* path can arrive here misspelled -- so the split that produced them has to be on
+* `/`, the one separator no name can contain. The tail itself is the part the
+* glob matched and is not judged; `.claude` is hidden by definition and every
+* root the scan reports ends with it.
+*/
+function excludedNestedScanSegment(segments) {
+	return segments.find((segment, index) => NESTED_SCAN_EXCLUDED_DIRS_ANY_DEPTH.includes(segment) || index === 0 && NESTED_SCAN_EXCLUDED_ROOT_DIRS.includes(segment) || isHiddenPathSegment(segment));
+}
+/**
+* Whether a nested skills directory the scan reported can be used as an import
+* root: either the reason it cannot, or the path it resolves to relative to the
+* project, which the caller uses to tell two spellings of one root apart.
+*
+* A recursive glob cannot be swapped for a walk the way a flat one can, so the
+* path it hands back is checked instead. globby reads a backslash as a path
+* separator and rewrites it, so a root below a directory really named
+* `back\\slash` is reported at `back/slash`. Where that leads decides what to
+* do with it, and the spelling alone does not say: `back/slash` usually answers
+* to nothing, but `x\\..\\..\\outside` is reported at `x/../../outside`, which
+* climbs out of the project through the real sibling `x/`, and `a\\b` at `a/b`,
+* which may be a symbolic link out of the project that the scan — it passes
+* `followSymbolicLinks: false` — never meant to reach. Both are refused by
+* resolving the path rather than reading it.
+*
+* What is deliberately not refused is a rewritten path that stays inside the
+* project, such as `x\\..\\y` reported at `x/../y`. It names a real directory
+* `y`, and the scan reports that directory under this spelling *instead of* its
+* own, so refusing it would lose `y`'s skills rather than protect anything. The
+* skills under the directory that was really named are unreachable either way:
+* no path the scan can report leads back to a name holding a backslash.
+*
+* That last shape is the one case the scan cannot warn about. `a\\b` reported
+* at `a/b`, where `a/b` is itself a real directory, is indistinguishable from
+* the ordinary root `a/b` -- both are spelled the same and both are there -- so
+* the skills under `a\\b` are dropped without a word. Nothing in the path says
+* a second directory was ever involved.
+*/
+async function checkNestedSkillsRoot({ outputRoot, dirPath }) {
+	if (!await directoryExists(dirPath)) return { reason: "it could not be read under the path the scan reports, most often because a directory name above it contains a backslash." };
+	const realRelativeDirPath = await resolvedRelativePath({
+		rootPath: outputRoot,
+		targetPath: dirPath
+	});
+	if (posixRelativePathEscapesRoot(realRelativeDirPath)) return { reason: "it resolves outside the project." };
+	const segments = realRelativeDirPath.split("/");
+	const aboveTailSegments = segments.slice(0, -CLAUDECODE_SKILLS_DIR_SEGMENTS.length);
+	if (segments.slice(-CLAUDECODE_SKILLS_DIR_SEGMENTS.length).join("/") !== CLAUDECODE_SKILLS_DIR_POSIX_PATH) return { reason: `it resolves to ${realRelativeDirPath === "" ? "the project root" : JSON.stringify(stripControlCharacters(realRelativeDirPath))}, which is not a ${CLAUDECODE_SKILLS_DIR_POSIX_PATH} directory.` };
+	const excludedSegment = excludedNestedScanSegment(aboveTailSegments);
+	if (excludedSegment !== void 0) return { reason: `it resolves inside ${JSON.stringify(stripControlCharacters(excludedSegment))}, which the nested scan excludes.` };
+	return { realRelativeDirPath };
+}
 const ClaudecodeSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
@@ -45012,10 +47057,10 @@ var ClaudecodeSkill = class extends ToolSkill {
 	*
 	* @see https://code.claude.com/docs/en/skills
 	*/
-	static async getConfiguredImportRoots({ outputRoot, global = false }) {
+	static async getConfiguredImportRoots({ outputRoot, global = false, logger }) {
 		if (global) return [];
 		const root = toPosixPath(outputRoot);
-		return filterOutPathsInGitIgnoredDirectories({
+		const filteredDirPaths = filterOutPathsInGitIgnoredDirectories({
 			rootDir: outputRoot,
 			filePaths: await findFilesByGlobs([`${root}/*/**/${toPosixPath(CLAUDECODE_SKILLS_DIR_PATH)}`], {
 				type: "dir",
@@ -45026,10 +47071,27 @@ var ClaudecodeSkill = class extends ToolSkill {
 					...NESTED_SCAN_EXCLUDED_ROOT_DIRS.map((dir) => `${root}/${dir}/**`)
 				]
 			})
-		}).toSorted().map((dirPath) => ({
-			outputRoot,
-			relativeDirPath: relative(outputRoot, dirPath)
-		}));
+		}).toSorted();
+		const roots = [];
+		const seenRealRelativeDirPaths = /* @__PURE__ */ new Set([CLAUDECODE_SKILLS_DIR_POSIX_PATH]);
+		for (const dirPath of filteredDirPaths) {
+			const scannedDirPath = resolve(dirPath);
+			const check = await checkNestedSkillsRoot({
+				outputRoot,
+				dirPath: scannedDirPath
+			});
+			if ("reason" in check) {
+				logger?.warn(`Skipping the nested Claude Code skills directory ${JSON.stringify(stripControlCharacters(scannedDirPath))}: ${check.reason} Its skills are not imported.`);
+				continue;
+			}
+			if (seenRealRelativeDirPaths.has(check.realRelativeDirPath)) continue;
+			seenRealRelativeDirPaths.add(check.realRelativeDirPath);
+			roots.push({
+				outputRoot,
+				relativeDirPath: relative(outputRoot, scannedDirPath)
+			});
+		}
+		return roots;
 	}
 	getFrontmatter() {
 		return ClaudecodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -49916,7 +51978,8 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		const paths = factory.class.getSettablePaths({ global: this.global });
 		const configuredRoots = factory.class.getConfiguredImportRoots ? await factory.class.getConfiguredImportRoots({
 			outputRoot: this.outputRoot,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		}) : [];
 		const configuredRootPaths = new Set(configuredRoots.map((root) => root.relativeDirPath));
 		const roots = [...toolSkillImportRoots(paths), ...configuredRoots];
@@ -54632,6 +56695,152 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/zcode-subagent.ts
+const ZcodeSubagentFrontmatterSchema = z.looseObject({
+	name: z.string(),
+	description: z.optional(z.string()),
+	model: z.optional(z.string()),
+	thoughtLevel: z.optional(z.string()),
+	color: z.optional(z.string()),
+	tools: z.optional(z.array(z.string())),
+	disallowedTools: z.optional(z.array(z.string())),
+	maxTurns: z.optional(z.number().check(z.int(), z.positive())),
+	injectAgentsMd: z.optional(z.boolean()),
+	mcpServers: z.optional(z.array(z.string()))
+});
+/**
+* ZCode subagents.
+*
+* Each subagent is one Markdown file with YAML frontmatter, named after the
+* agent, under `~/.zcode/agents/`.
+*
+* Global scope only. The current Beta "manages global / user-level subagents
+* stored under `~/.zcode/agents/`", and creating or editing workspace /
+* project-level subagents "is not available yet" — so this adapter is
+* registered with `supportsProject: false` and never writes into a project's
+* own `.zcode/`. The relative path is nonetheless spelled against
+* {@link ZCODE_AGENTS_DIR_PATH} so the workspace scope needs nothing more than
+* flipping that flag if ZCode ships it.
+*
+* @see https://zcode.z.ai/en/docs/subagents
+*/
+var ZcodeSubagent = class ZcodeSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, fileContent, ...rest }) {
+		if (rest.validate !== false) {
+			const result = ZcodeSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: fileContent ?? stringifyFrontmatter(body, frontmatter)
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: ZCODE_AGENTS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, ...rest } = this.frontmatter;
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name,
+				description,
+				...Object.keys(rest).length > 0 && { zcode: rest }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const zcodeSection = rulesyncFrontmatter.zcode ?? {};
+		const zcodeFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...zcodeSection
+		};
+		const body = rulesyncSubagent.getBody();
+		const fileContent = stringifyFrontmatter(body, zcodeFrontmatter, { avoidBlockScalars: true });
+		const paths = this.getSettablePaths({ global });
+		return new ZcodeSubagent({
+			outputRoot,
+			frontmatter: zcodeFrontmatter,
+			body,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = ZcodeSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		else return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "zcode"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
+		const dirPath = relativeDirPath ?? this.getSettablePaths({ global }).relativeDirPath;
+		const filePath = join(outputRoot, dirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const result = ZcodeSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new ZcodeSubagent({
+			outputRoot,
+			relativeDirPath: dirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: content.trim(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new ZcodeSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/zoocode-subagent.ts
 /**
 * Subagent (custom-mode) generator for **Zoo Code**, the community
@@ -54696,6 +56905,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["agentsmd", {
 		class: AgentsmdSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: true,
 			supportsGlobal: false,
 			filePattern: "*.md"
@@ -54704,6 +56914,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["antigravity-cli", {
 		class: AntigravityCliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54712,6 +56923,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["antigravity-ide", {
 		class: AntigravityIdeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54720,6 +56932,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["antigravity-plugin", {
 		class: AntigravityPluginSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: "*.md"
@@ -54728,6 +56941,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["augmentcode", {
 		class: AugmentcodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54736,6 +56950,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["claudecode", {
 		class: ClaudecodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54744,6 +56959,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["claudecode-plugin", {
 		class: ClaudecodePluginSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: "*.md"
@@ -54752,6 +56968,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["claudecode-legacy", {
 		class: ClaudecodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54760,6 +56977,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["cline", {
 		class: ClineSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.{yaml,yml}"
@@ -54768,6 +56986,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["codexcli", {
 		class: CodexCliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.toml"
@@ -54776,6 +56995,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["copilot", {
 		class: CopilotSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54784,6 +57004,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["copilotcli", {
 		class: CopilotcliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.agent.md"
@@ -54792,6 +57013,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["cursor", {
 		class: CursorSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54800,6 +57022,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["deepagents", {
 		class: DeepagentsSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: join("*", "AGENTS.md")
@@ -54808,6 +57031,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["devin", {
 		class: DevinSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: join("*", "AGENT.md")
@@ -54816,6 +57040,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["factorydroid", {
 		class: FactorydroidSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54824,6 +57049,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["goose", {
 		class: GooseSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54832,6 +57058,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["hermesagent", {
 		class: HermesagentSubagent,
 		meta: {
+			supportsProject: true,
 			supportsGlobal: true,
 			supportsSimulated: false,
 			filePattern: "*.json"
@@ -54840,6 +57067,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["grokcli", {
 		class: GrokcliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54848,6 +57076,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["junie", {
 		class: JunieSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54856,6 +57085,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kiro", {
 		class: KiroSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: "*.json"
@@ -54864,6 +57094,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kiro-cli", {
 		class: KiroCliSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.json"
@@ -54872,6 +57103,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kiro-ide", {
 		class: KiroIdeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54880,6 +57112,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kilo", {
 		class: KiloSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54888,6 +57121,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["kimi-code", {
 		class: KimiCodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: join("**", "*.md")
@@ -54896,6 +57130,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["opencode", {
 		class: OpenCodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54904,6 +57139,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["qwencode", {
 		class: QwencodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54912,6 +57148,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["reasonix", {
 		class: ReasonixSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: join("*", "SKILL.md")
@@ -54920,6 +57157,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["roo", {
 		class: RooSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: ".roomodes"
@@ -54928,6 +57166,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["zoocode", {
 		class: ZoocodeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: false,
 			filePattern: ".roomodes"
@@ -54936,6 +57175,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["rovodev", {
 		class: RovodevSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54944,6 +57184,7 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["takt", {
 		class: TaktSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.md"
@@ -54952,10 +57193,20 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 	["vibe", {
 		class: VibeSubagent,
 		meta: {
+			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
 			filePattern: "*.toml"
 		}
+	}],
+	["zcode", {
+		class: ZcodeSubagent,
+		meta: {
+			supportsProject: false,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			filePattern: "*.md"
+		}
 	}]
 ]);
 const defaultGetFactory$1 = (target) => {
@@ -54964,7 +57215,9 @@ const defaultGetFactory$1 = (target) => {
 	return factory;
 };
 const allToolTargetKeys$1 = [...toolSubagentFactories.keys()];
-const subagentsProcessorToolTargets = allToolTargetKeys$1;
+const subagentsProcessorToolTargets = allToolTargetKeys$1.filter((target) => {
+	return toolSubagentFactories.get(target)?.meta.supportsProject ?? false;
+});
 const subagentsProcessorToolTargetsSimulated = allToolTargetKeys$1.filter((target) => {
 	return toolSubagentFactories.get(target)?.meta.supportsSimulated ?? false;
 });
@@ -55064,7 +57317,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			this.logger.debug(`Rulesync subagents directory not found: ${subagentsDir}`);
 			return [];
 		}
-		const mdFiles = (await listDirectoryFiles(subagentsDir)).filter((file) => file.endsWith(".md"));
+		const mdFiles = (await listDirectoryEntryNames(subagentsDir)).filter((file) => file.endsWith(".md"));
 		if (mdFiles.length === 0) {
 			this.logger.debug(`No markdown files found in rulesync subagents directory: ${subagentsDir}`);
 			return [];
@@ -63610,6 +65863,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { SKILL_FILE_NAME as $, RULESYNC_CHECKS_RELATIVE_DIR_PATH as $t, AUGMENTCODE_DIR as A, pathEscapesRoot as At, RulesyncMcp as B, toPosixPath as Bt, CLAUDECODE_SKILLS_DIR_PATH as C, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Cn, findFilesByGlobs as Ct, FACTORYDROID_DIR as D, DEPRECATED_FEATURE_REPLACEMENTS as Dn, isSymlink as Dt, CODEXCLI_DIR as E, ALL_FEATURES_WITH_WILDCARD as En, isFileNotFoundError as Et, RulesyncSkill as F, removeFile as Ft, parseJsonc as G, stripHiddenCharacters as Gt, RulesyncHooks as H, writeFileContent as Ht, RulesyncSkillFrontmatterSchema as I, removeFileStrict as It, RulesyncCheck as J, PACKAGING_TOOL_TARGETS as Jt, RulesyncCommand as K, ALL_TOOL_TARGETS as Kt, RulesyncRule as L, removeTempDirectory as Lt, getLocalSkillDirNames as M, readFileContentOrNull as Mt, RulesyncSubagent as N, removeDirectory as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, formatError as On, listDirectoryFiles as Ot, RulesyncSubagentFrontmatterSchema as P, removeDirectoryStrict as Pt, SHARED_USER_MANAGED_CONFIG_PATHS as Q, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Qt, RulesyncRuleFrontmatterSchema as R, resolvePath as Rt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as S, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Sn, fileExists as St, CODEXCLI_BASH_RULES_FILE_NAME as T, ALL_FEATURES as Tn, getHomeDirectory as Tt, getRulesyncSourceCandidates as U, hasDeceptiveHiddenCharacters as Ut, RulesyncIgnore as V, writeFileBuffer as Vt, resolveRulesyncSourceWritePath as W, stripControlCharacters as Wt, stringifyFrontmatter as X, MAX_FILE_SIZE as Xt, RulesyncCheckFrontmatterSchema as Y, ToolTargetSchema as Yt, loadYaml as Z, RULESYNC_AIIGNORE_FILE_NAME as Zt, QWENCODE_DIR as _, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as _n, assertWritablePathInsideRoot as _t, getProcessorRegistryEntry as a, RULESYNC_HOOKS_FILE_NAME as an, GITIGNORE_DESTINATION_KEY as at, CLAUDECODE_LOCAL_RULE_FILE_NAME as b, RULESYNC_RULES_RELATIVE_DIR_PATH as bn, directoryExists as bt, RulesProcessor as c, RULESYNC_IGNORE_RELATIVE_FILE_PATH as cn, ConsoleLogger as ct, displayWidthOf as d, RULESYNC_MCP_LEGACY_FILE_NAME as dn, warnOnConflictingFlags as dt, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as en, ConfigResolver as et, shortenToWidth as f, RULESYNC_MCP_RELATIVE_FILE_PATH as fn, resetWarnedOnceMessages as ft, CommandsProcessor as g, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as gn, assertTreeContainsNoSymlinks as gt, HooksProcessor as h, RULESYNC_PERMISSIONS_FILE_NAME as hn, assertDirectoryIfExists as ht, inspectInputRoots as i, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as in, ConfigFileSchema as it, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as j, readFileContent as jt, caseFoldIdentity as k, listSubdirectoryNames as kt, SubagentsProcessor as l, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as ln, JsonLogger as lt, IgnoreProcessor as m, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as mn, ErrorCodes as mt, formatSourceLoadFailure as n, RULESYNC_CONFIG_SCHEMA_URL as nn, resolveEffectiveInputRoots as nt, convertFromTool as o, RULESYNC_HOOKS_LEGACY_FILE_NAME as on, SourceEntrySchema as ot, McpProcessor as p, RULESYNC_MCP_SCHEMA_URL as pn, CLIError as pt, RulesyncCommandFrontmatterSchema as q, ALL_TOOL_TARGETS_WITH_WILDCARD as qt, generate as r, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as rn, CONFLICTING_TARGET_PAIRS as rt, isPackagingToolTarget as s, RULESYNC_HOOKS_RELATIVE_FILE_PATH as sn, findControlCharacter as st, importFromTool as t, RULESYNC_CONFIG_RELATIVE_FILE_PATH as tn, mergeInputRootConfigs as tt, SkillsProcessor as u, RULESYNC_MCP_FILE_NAME as un, fallbackLogger as ut, QWENCODE_LOCAL_RULE_FILE_NAME as v, RULESYNC_PERMISSIONS_SCHEMA_URL as vn, checkPathTraversal as vt, ChecksProcessor as w, parseCommaSeparatedList as wn, getFileSize as wt, CLAUDECODE_MEMORIES_DIR_NAME as x, RULESYNC_SKILLS_RELATIVE_DIR_PATH as xn, ensureDir as xt, CLAUDECODE_DIR as y, RULESYNC_RELATIVE_DIR_PATH as yn, createTempDirectory as yt, RulesyncPermissions as z, runWithDirectoryRollback as zt };
+export { SHARED_USER_MANAGED_CONFIG_PATHS as $, MAX_FILE_SIZE as $t, groupSpellingsByCaseFoldedIdentity as A, DEPRECATED_FEATURE_REPLACEMENTS as An, isFileSystemError as At, RulesyncPermissions as B, removeFile as Bt, CLAUDECODE_SKILLS_DIR_PATH as C, RULESYNC_RULES_RELATIVE_DIR_PATH as Cn, createTempDirectory as Ct, FACTORYDROID_DIR as D, parseCommaSeparatedList as Dn, getFileSize as Dt, CODEXCLI_DIR as E, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as En, fileExists as Et, RulesyncSubagentFrontmatterSchema as F, stripControlCharactersKeepingLineFeeds as Fn, pathEscapesRoot as Ft, resolveRulesyncSourceWritePath as G, toPosixPath as Gt, RulesyncIgnore as H, removeTempDirectory as Ht, RulesyncSkill as I, stripHiddenCharacters as In, readFileContent as It, RulesyncCommandFrontmatterSchema as J, ALL_TOOL_TARGETS as Jt, parseJsonc as K, writeFileBuffer as Kt, RulesyncSkillFrontmatterSchema as L, readFileContentOrNull as Lt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as M, truncateText as Mn, listDirectoryEntryNames as Mt, getLocalSkillDirNames as N, hasDeceptiveHiddenCharacters as Nn, listFilePathsRecursively as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, ALL_FEATURES as On, getHomeDirectory as Ot, RulesyncSubagent as P, stripControlCharacters as Pn, listSubdirectoryNames as Pt, loadYaml as Q, CURATED_RULES_FEATURE_SUBDIR as Qt, RulesyncRule as R, removeDirectory as Rt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as S, RULESYNC_RELATIVE_DIR_PATH as Sn, checkPathTraversal as St, CODEXCLI_BASH_RULES_FILE_NAME as T, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Tn, ensureDir as Tt, RulesyncHooks as U, resolvePath as Ut, RulesyncMcp as V, removeFileStrict as Vt, getRulesyncSourceCandidates as W, runWithDirectoryRollback as Wt, RulesyncCheckFrontmatterSchema as X, PACKAGING_TOOL_TARGETS as Xt, RulesyncCheck as Y, ALL_TOOL_TARGETS_WITH_WILDCARD as Yt, stringifyFrontmatter as Z, ToolTargetSchema as Zt, QWENCODE_DIR as _, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as _n, CLIError as _t, getProcessorRegistryEntry as a, RULESYNC_CONFIG_SCHEMA_URL as an, ConfigFileSchema as at, CLAUDECODE_LOCAL_RULE_FILE_NAME as b, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as bn, assertTreeContainsNoSymlinks as bt, RulesProcessor as c, RULESYNC_HOOKS_FILE_NAME as cn, findControlCharacter as ct, displayWidthOf as d, RULESYNC_IGNORE_RELATIVE_FILE_PATH as dn, WarningCollectingLogger as dt, RULESYNC_AIIGNORE_FILE_NAME as en, SKILL_FILE_NAME as et, shortenToWidth as f, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as fn, fallbackLogger as ft, CommandsProcessor as g, RULESYNC_MCP_SCHEMA_URL as gn, withWarnOnceScope as gt, HooksProcessor as h, RULESYNC_MCP_RELATIVE_FILE_PATH as hn, resetWarnedOnceMessages as ht, inspectInputRoots as i, RULESYNC_CONFIG_RELATIVE_FILE_PATH as in, CONFLICTING_TARGET_PAIRS as it, AUGMENTCODE_DIR as j, formatError as jn, isSymlink as jt, caseFoldIdentity as k, ALL_FEATURES_WITH_WILDCARD as kn, isFileNotFoundError as kt, SubagentsProcessor as l, RULESYNC_HOOKS_LEGACY_FILE_NAME as ln, ConsoleLogger as lt, IgnoreProcessor as m, RULESYNC_MCP_LEGACY_FILE_NAME as mn, withFallbackLoggerTarget as mt, formatSourceLoadFailure as n, RULESYNC_CHECKS_RELATIVE_DIR_PATH as nn, mergeInputRootConfigs as nt, convertFromTool as o, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as on, GITIGNORE_DESTINATION_KEY as ot, McpProcessor as p, RULESYNC_MCP_FILE_NAME as pn, warnOnConflictingFlags as pt, RulesyncCommand as q, writeFileContent as qt, generate as r, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as rn, resolveEffectiveInputRoots as rt, isPackagingToolTarget as s, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as sn, SourceEntrySchema as st, importFromTool as t, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as tn, ConfigResolver as tt, SkillsProcessor as u, RULESYNC_HOOKS_RELATIVE_FILE_PATH as un, JsonLogger as ut, QWENCODE_LOCAL_RULE_FILE_NAME as v, RULESYNC_PERMISSIONS_FILE_NAME as vn, ErrorCodes as vt, ChecksProcessor as w, RULESYNC_SKILLS_RELATIVE_DIR_PATH as wn, directoryExists as wt, CLAUDECODE_MEMORIES_DIR_NAME as x, RULESYNC_PERMISSIONS_SCHEMA_URL as xn, assertWritablePathInsideRoot as xt, CLAUDECODE_DIR as y, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as yn, assertDirectoryIfExists as yt, RulesyncRuleFrontmatterSchema as z, removeDirectoryStrict as zt };
 
-//# sourceMappingURL=import-BKnAc4rT.js.map
+//# sourceMappingURL=import-1-jjDDAm.js.map