rulesync 16.19.0 → 16.20.0

package/dist/{import-DijDR24m.js → import-1-jjDDAm.js}

@@ -2,7 +2,7 @@ import { ZodError } from "zod";
 import { meta, minLength, nonnegative, optional, refine, z } from "zod/mini";
 import { chmod, cp, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
 import path, { basename, dirname, extname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
-import { parse, parseTree, printParseErrorCode } from "jsonc-parser";
+import { applyEdits, findNodeAtLocation, getNodeValue, modify, parse, parseTree, printParseErrorCode } from "jsonc-parser";
 import os from "node:os";
 import { intersection, kebabCase, uniq } from "es-toolkit";
 import { globbySync, isGitIgnoredSync } from "globby";
@@ -10631,11 +10631,30 @@ const CODEXCLI_OVERRIDE_KEYS = [
 ];
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
+/**
+* Rebuild a parsed document without its prototype-pollution keys.
+*
+* Every object is rebuilt, not just the ones that are already plain: a literal
+* `"__proto__"` is assigned with `obj[key] = value` by `jsonc-parser`, which
+* *replaces the containing object's prototype* instead of adding a key. Such
+* an object is no longer a plain object, and the injected value is reachable
+* through it by plain property access while `Object.keys` and `JSON.stringify`
+* show nothing — so leaving it as it came out of the parser would both hide a
+* server or permission the file does not state and, at the root, cost the
+* whole document (see {@link parseSharedConfig}). Rebuilding gives every
+* object `Object.prototype` back and drops the injected value with the key.
+*
+* Dates are the one object the YAML and TOML parsers produce that is not a
+* mapping, so they are passed through rather than flattened into `{}`.
+*/
 function sanitizeSharedConfigValue(value) {
 	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
-	if (!isPlainObject$1(value)) return value;
+	if (value === null || typeof value !== "object" || value instanceof Date) return value;
 	const result = {};
-	for (const [key, nested] of Object.entries(omitPrototypePollutionKeys(value))) result[key] = sanitizeSharedConfigValue(nested);
+	for (const [key, nested] of Object.entries(value)) {
+		if (isPrototypePollutionKey(key)) continue;
+		result[key] = sanitizeSharedConfigValue(nested);
+	}
 	return result;
 }
 /**
@@ -10664,11 +10683,12 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (parsed === void 0 || parsed === null) return {};
-	if (!isPlainObject$1(parsed)) {
+	const sanitized = sanitizeSharedConfigValue(parsed);
+	if (!isPlainObject$1(sanitized)) {
 		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
 		return {};
 	}
-	return sanitizeSharedConfigValue(parsed);
+	return sanitized;
 }
 /**
 * Serialize a shared config document. YAML output always ends with exactly one
@@ -10685,6 +10705,571 @@ function stringifySharedConfig({ format, document }) {
 	return JSON.stringify(document, null, 2);
 }
 /**
+* Where the line holding `from` starts and where the line starting at `from`
+* ends: the nearest `\r` or `\n` in each direction, or the edge of the text.
+*
+* Both characters count in both directions, because the JSONC scanner treats
+* either as a line break. A file written with lone CRs parses without an error
+* and so reaches these paths, and a comment read only up to the next `\n`
+* would run past its own line and take the closing brace — or a whole sibling
+* key — with it.
+*/
+function endOfLineFrom({ text, from }) {
+	for (let index = from; index < text.length; index += 1) {
+		const character = text[index];
+		if (character === "\n" || character === "\r") return index;
+	}
+	return text.length;
+}
+function startOfLineAt({ text, from }) {
+	for (let index = from - 1; index >= 0; index -= 1) {
+		const character = text[index];
+		if (character === "\n" || character === "\r") return index + 1;
+	}
+	return 0;
+}
+/**
+* Read the indentation and line ending a JSONC document already uses, so
+* inserted properties match the surrounding file instead of imposing the
+* 2-space `JSON.stringify` shape on a file written with 4 spaces or tabs.
+*
+* The root object's first property decides, located through the syntax tree
+* rather than by scanning for the first indented line: a file opening with a
+* banner comment indents that comment's continuation lines too (` * ...`
+* aligns at three columns), and reading the width off one of those would leave
+* `modify` re-indenting the lines it touches to a width nothing else in the
+* file uses. A property that does not start its own line — a one-line object,
+* or an empty one — carries no indent to read, so those fall back to the
+* 2-space default the whole-document writer emits.
+*/
+function detectJsoncFormattingOptions({ text, root }) {
+	const eol = "\n";
+	const first = root.children?.[0];
+	const indent = first === void 0 ? "" : text.slice(startOfLineAt({
+		text,
+		from: first.offset
+	}), first.offset);
+	if (indent === "" || indent.length > 8 || !/^[ \t]+$/.test(indent)) return {
+		tabSize: 2,
+		insertSpaces: true,
+		eol
+	};
+	if (indent.includes("	")) return {
+		tabSize: 2,
+		insertSpaces: false,
+		eol
+	};
+	return {
+		tabSize: indent.length,
+		insertSpaces: true,
+		eol
+	};
+}
+/**
+* Whether the document states a key no edit-based write can be trusted with.
+*
+* Two kinds, both answered from the syntax tree because the parsed value no
+* longer knows about either:
+*
+* - A key stated twice. That is legal JSON text which every reader resolves
+*   last-wins, while `modify` edits the *first* occurrence — so an edit-based
+*   write would land on the dead copy and leave the live one saying whatever
+*   it said before. For an owned key that is a silent ownership failure: a
+*   `deny` rulesync just wrote would sit above the `allow` the tool reads.
+* - `__proto__`, `constructor` or `prototype`. None survives into the parsed
+*   document — a nested one is dropped, a root-level `__proto__` replaces the
+*   root's prototype — so an edit-based write would find no difference to
+*   apply and leave the key in the file.
+*
+* The whole-document writer resolves duplicates last-wins and drops pollution
+* keys, which is what it has always done, so those files go to it.
+*/
+function statesUneditableKeys(node) {
+	if (node.type === "array") return (node.children ?? []).some((child) => statesUneditableKeys(child));
+	if (node.type !== "object") return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const property of node.children ?? []) {
+		const key = property.children?.[0]?.value;
+		if (typeof key === "string") {
+			if (seen.has(key) || isPrototypePollutionKey(key)) return true;
+			seen.add(key);
+		}
+		const value = property.children?.[1];
+		if (value !== void 0 && statesUneditableKeys(value)) return true;
+	}
+	return false;
+}
+/**
+* The offset just past the whitespace and comments starting at `from`.
+*/
+function skipJsoncTrivia({ text, from }) {
+	let index = from;
+	while (index < text.length) {
+		const char = text[index];
+		if (char === " " || char === "	" || char === "\n" || char === "\r") {
+			index += 1;
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "/") {
+			index = endOfLineFrom({
+				text,
+				from: index
+			});
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "*") {
+			const commentEnd = text.indexOf("*/", index + 2);
+			index = commentEnd === -1 ? text.length : commentEnd + 2;
+			continue;
+		}
+		break;
+	}
+	return index;
+}
+/**
+* Where the deletion of a property whose text ends at `end` should stop.
+*
+* A comment written after the property on its own line is that property's
+* note — `"stale": {...}, // retired` says something about `stale` and nothing
+* about the key above it. Leaving it behind would re-attach it to whichever
+* property now ends that line, so a note about a server rulesync removed would
+* read as a note about the one before it. A comment with a sibling after it on
+* the same line is not claimed: it may belong to either.
+*/
+function endOfRemoval({ text, end }) {
+	const stop = endOfLineFrom({
+		text,
+		from: end
+	});
+	const tail = text.slice(end, stop);
+	return /^[ \t]*\/\/[^\r\n]*$/.test(tail) || /^[ \t]*\/\*(?:[^*]|\*(?!\/))*\*\/[ \t]*$/.test(tail) || /^[ \t]*$/.test(tail) ? stop : end;
+}
+/**
+* Where the deletion of a property ending at `end` should begin.
+*
+* A property that has its line to itself is removed with the line: its
+* indentation and the newline above it would otherwise be left as a blank gap.
+* A property sharing its line with something else — a sibling, or the object's
+* own `}` — is removed on its own, because swallowing the newline would splice
+* whatever follows onto the line above, and a line comment up there would
+* comment it out: a key rulesync means to write would vanish from the file, or
+* the closing brace would, leaving the document unparsable.
+*/
+function startOfRemoval({ text, propertyOffset, end }) {
+	let after = end;
+	while (text[after] === " " || text[after] === "	") after += 1;
+	if (!(after >= text.length || text[after] === "\n" || text[after] === "\r")) return propertyOffset;
+	let start = propertyOffset;
+	while (start > 0 && (text[start - 1] === " " || text[start - 1] === "	")) start -= 1;
+	if (start > 0 && text[start - 1] === "\n") start -= 1;
+	if (start > 0 && text[start - 1] === "\r") start -= 1;
+	return start;
+}
+/**
+* Delete the property at `path` from `text`, taking its own line and its
+* separating comma but nothing else.
+*
+* `modify(..., undefined)` would do this, but the range it deletes runs from
+* the end of the *previous* property to the end of this one — or, for the
+* first property of an object, all the way to where the *next* one starts. So
+* removing one key takes the comments sitting between it and the keys around
+* it, including the comment describing the key that survives.
+* Deleting the property's own text instead leaves the comments around it in
+* place. Only the note that follows the property on its own line goes with it
+* (see {@link endOfRemoval}); a comment written on the line *above* is left
+* behind rather than guessed at, which is the direction this whole path errs
+* in.
+*/
+function removeJsoncProperty({ text, path }) {
+	const root = parseTree(text, [], { allowTrailingComma: true });
+	const property = root === void 0 ? void 0 : findNodeAtLocation(root, [...path])?.parent;
+	const object = property?.parent;
+	if (property?.type !== "property" || object?.type !== "object") return text;
+	const siblings = object.children ?? [];
+	const edits = [];
+	let end = property.offset + property.length;
+	const afterProperty = skipJsoncTrivia({
+		text,
+		from: end
+	});
+	if (text[afterProperty] === ",") end = afterProperty + 1;
+	else {
+		const previous = siblings[siblings.indexOf(property) - 1];
+		if (previous !== void 0) {
+			const comma = skipJsoncTrivia({
+				text,
+				from: previous.offset + previous.length
+			});
+			if (text[comma] === ",") edits.push({
+				offset: comma,
+				length: 1,
+				content: ""
+			});
+		}
+	}
+	end = endOfRemoval({
+		text,
+		end
+	});
+	const start = startOfRemoval({
+		text,
+		propertyOffset: property.offset,
+		end
+	});
+	edits.push({
+		offset: start,
+		length: end - start,
+		content: ""
+	});
+	return applyEdits(text, edits);
+}
+/**
+* Where the comment written at `from` (past any spaces or tabs) ends, or
+* `undefined` if what stands there is not a comment.
+*/
+function endOfNoteAt({ text, from }) {
+	let cursor = from;
+	while (text[cursor] === " " || text[cursor] === "	") cursor += 1;
+	if (text.startsWith("//", cursor)) return endOfLineFrom({
+		text,
+		from: cursor
+	});
+	if (text.startsWith("/*", cursor)) {
+		const closing = text.indexOf("*/", cursor + 2);
+		return closing === -1 ? void 0 : closing + 2;
+	}
+}
+/**
+* Every comment written at `from`, as spans of `text`, each span running from
+* where the previous one stopped so the whitespace between them is carried
+* along. A comma is stepped over once (a file may spell one before its note,
+* or after it) but never collected, because the separator belongs to the
+* property rather than to its note. So a file that writes a note on each side
+* of its comma gets both of them back, in order, after the comma: the notes
+* stay with the key they describe, and the comma keeps the place the file gave
+* it. The run stops at the first thing that is neither: a newline ends it, so
+* a comment on the next line is left alone.
+*/
+function notesAt({ text, from }) {
+	const spans = [];
+	let cursor = from;
+	let steppedOverComma = false;
+	for (;;) {
+		const end = endOfNoteAt({
+			text,
+			from: cursor
+		});
+		if (end !== void 0) {
+			spans.push({
+				start: cursor,
+				end
+			});
+			cursor = end;
+			continue;
+		}
+		if (steppedOverComma) return spans;
+		let comma = cursor;
+		while (text[comma] === " " || text[comma] === "	") comma += 1;
+		if (text[comma] !== ",") return spans;
+		steppedOverComma = true;
+		cursor = comma + 1;
+	}
+}
+/**
+* Detach the notes written at the point where the object at `path` will take a
+* new key: after its last property (and around the comma a trailing-comma file
+* spells there), or just inside the `{` when it has no properties yet.
+*
+* `modify` computes its insert from exactly that point — in front of a note
+* written there — so applying the edit unchanged re-emits the note *after* the
+* key that was just inserted: `"stale": {...} // retired` turns into a note
+* about a server rulesync has only now written, and `{ /* none yet *\/ }`
+* turns into a note about the first entry rulesync puts in it. Lifting the
+* notes out before the insert and putting them back afterwards keeps them
+* where their author wrote them, matching what {@link endOfRemoval} does on
+* the way out.
+*
+* Returns `undefined` when there is no such note, which is the common case.
+*/
+function detachTrailingNote({ text, path }) {
+	const root = parseTree(text, [], { allowTrailingComma: true });
+	const object = root === void 0 ? void 0 : findNodeAtLocation(root, [...path]);
+	if (object?.type !== "object") return void 0;
+	const property = object.children?.at(-1);
+	const anchorKey = property?.children?.[0]?.value;
+	if (property !== void 0 && typeof anchorKey !== "string") return void 0;
+	const spans = notesAt({
+		text,
+		from: property === void 0 ? object.offset + 1 : property.offset + property.length
+	});
+	if (spans.length === 0) return void 0;
+	let stripped = text;
+	for (const span of spans.toReversed()) stripped = stripped.slice(0, span.start) + stripped.slice(span.end);
+	return {
+		text: stripped,
+		note: spans.map((span) => text.slice(span.start, span.end)).join(""),
+		anchorKey: typeof anchorKey === "string" ? anchorKey : void 0
+	};
+}
+/**
+* Put a note detached by {@link detachTrailingNote} back where it was: after
+* the property it describes (behind the comma the insert gave that property),
+* or just inside the `{` of the object it was written in when there was no
+* property to describe. Returns `undefined` if that place can no longer be
+* located, so the caller can fall back to the plain insert rather than drop
+* the note.
+*/
+function reattachTrailingNote({ text, path, anchorKey, note }) {
+	const root = parseTree(text, [], { allowTrailingComma: true });
+	const location = anchorKey === void 0 ? [...path] : [...path, anchorKey];
+	const anchor = root === void 0 ? void 0 : findNodeAtLocation(root, location);
+	if (anchor === void 0) return void 0;
+	if (anchorKey === void 0) {
+		if (anchor.type !== "object") return void 0;
+		const brace = anchor.offset + 1;
+		return text.slice(0, brace) + note + text.slice(brace);
+	}
+	let cursor = anchor.offset + anchor.length;
+	while (text[cursor] === " " || text[cursor] === "	") cursor += 1;
+	if (text[cursor] === ",") cursor += 1;
+	return text.slice(0, cursor) + note + text.slice(cursor);
+}
+/**
+* Write `value` at `[...path, key]`, keeping the trailing note of the property
+* the new key is inserted after (see {@link detachTrailingNote}). Replacing an
+* existing key needs none of this: `modify` rewrites the value's own span and
+* leaves every comment where it is.
+*/
+function insertJsoncProperty({ text, path, key, value, options }) {
+	const write = (source) => applyEdits(source, modify(source, [...path, key], value, options));
+	const detached = detachTrailingNote({
+		text,
+		path
+	});
+	if (detached === void 0) return write(text);
+	return reattachTrailingNote({
+		text: write(detached.text),
+		path,
+		anchorKey: detached.anchorKey,
+		note: detached.note
+	}) ?? write(text);
+}
+/**
+* How much work an edit-based write may cost, as the file's length times the
+* number of keys that differ.
+*
+* Each changed key re-parses the whole file, so a file whose keys nearly all
+* change costs quadratic work: an 823 KB `opencode.json` whose 6,400 servers
+* are all replaced took 40 seconds to write as edits, and cloning a
+* repository that ships such a file is enough to reach that. Past this budget
+* the file is written whole instead — it loses its comments, the same as a
+* file rulesync cannot parse does, which is the better of the two outcomes
+* against a `generate` that looks like it has hung. The limit is under a
+* second of editing for a replacement and a second or two for an insert,
+* which parses more; a hand-written config file is orders of magnitude below
+* either.
+*/
+const JSONC_EDIT_BUDGET_BYTES = 5e7;
+/**
+* How much text the edits of one write may put into the file, all of them
+* together.
+*
+* The budget above charges by the number of keys that differ, which prices an
+* insert of a whole subtree as one edit — but `modify` re-indents the text it
+* writes, and it does that in time quadratic in the length of that text: a
+* 127 KB value takes half a second to write, a 516 KB one 9 seconds, a 1 MB
+* one 35. The cost is quadratic in the total as well as in each part, because
+* every edit re-indents against the text the ones before it left, so a limit
+* on the widest single value would let a handful of values just under it cost
+* minutes between them. This is a limit on their sum, which holds the
+* re-indenting to about a second whether it arrives as one value or twenty.
+* A hand-written config file changes a few hundred bytes at a time.
+*/
+const JSONC_EDIT_WRITTEN_BYTES = 2e5;
+/**
+* How much text one edit writes: the value as `modify` formats it, plus the
+* indentation that formatting puts in front of every line of it.
+*
+* A value written deep in a document is written far wider than it reads on
+* its own — a 114 KB server list nested 1,200 deep is 36 MB of text once
+* every line of it carries 2,400 spaces — so measuring the value alone would
+* miss the whole of what makes that write expensive.
+*/
+function measureJsoncWrite({ value, depth }) {
+	const formatted = JSON.stringify(value, null, 2) ?? "";
+	let lines = 1;
+	for (let at = formatted.indexOf("\n"); at !== -1; at = formatted.indexOf("\n", at + 1)) lines += 1;
+	return formatted.length + lines * 2 * depth;
+}
+/**
+* How much {@link applyJsoncObjectEdits} would write, deciding each key
+* exactly the way it does — the two walk together, so a new case in one needs
+* the same case here. It reports both how many edits there would be and how
+* much text they would write between them, because the two are budgeted
+* separately: one stands for the parse each edit costs, the other for the
+* re-indenting each edit costs. Counting is a walk of the documents alone: no
+* text is touched, so the budgets above are spent on the write rather than on
+* finding out how large the write is.
+*/
+function countJsoncEdits({ base, next, depth }) {
+	let edits = 0;
+	let written = 0;
+	for (const [key, value] of Object.entries(next)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const present = Object.hasOwn(base, key);
+		const previous = present ? base[key] : void 0;
+		if (value === void 0) {
+			if (present) edits += 1;
+			continue;
+		}
+		if (isPlainObject$1(previous) && isPlainObject$1(value)) {
+			const nested = countJsoncEdits({
+				base: previous,
+				next: value,
+				depth: depth + 1
+			});
+			edits += nested.edits;
+			written += nested.written;
+			continue;
+		}
+		if (present && isDeepStrictEqual(previous, value)) continue;
+		edits += 1;
+		written += measureJsoncWrite({
+			value,
+			depth: depth + 1
+		});
+	}
+	for (const key of Object.keys(base)) if (!Object.hasOwn(next, key)) edits += 1;
+	return {
+		edits,
+		written
+	};
+}
+/**
+* Rewrite `text` so the object at `path` matches `next`, touching only the
+* spans that actually differ from `base`.
+*
+* Each difference is applied on its own — `modify` computes an edit against
+* the current text and `applyEdits` returns the text with that edit applied,
+* which is then the input for the next difference, because every edit shifts
+* the offsets the following ones would have been computed from. Nested objects
+* present on both sides are recursed into rather than replaced wholesale, so a
+* one-key change deep in the document leaves its siblings — and the comments
+* attached to them — byte-identical.
+*
+* Every difference re-parses the document, so the work is one parse of the
+* file per *changed* key rather than one parse overall. A regeneration that
+* changes nothing costs a single parse, and the files this runs on are config
+* files, so the shape is left simple rather than batched — with the file
+* large enough and enough of it changing, the product of the two is what
+* {@link JSONC_EDIT_BUDGET_BYTES} keeps off this path.
+*/
+function applyJsoncObjectEdits({ text, base, next, path, options }) {
+	let result = text;
+	for (const [key, value] of Object.entries(next)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const present = Object.hasOwn(base, key);
+		const previous = present ? base[key] : void 0;
+		if (value === void 0) {
+			if (present) result = removeJsoncProperty({
+				text: result,
+				path: [...path, key]
+			});
+			continue;
+		}
+		if (isPlainObject$1(previous) && isPlainObject$1(value)) {
+			result = applyJsoncObjectEdits({
+				text: result,
+				base: previous,
+				next: value,
+				path: [...path, key],
+				options
+			});
+			continue;
+		}
+		if (present) {
+			if (isDeepStrictEqual(previous, value)) continue;
+			result = applyEdits(result, modify(result, [...path, key], value, options));
+			continue;
+		}
+		result = insertJsoncProperty({
+			text: result,
+			path,
+			key,
+			value,
+			options
+		});
+	}
+	for (const key of Object.keys(base)) if (!Object.hasOwn(next, key)) result = removeJsoncProperty({
+		text: result,
+		path: [...path, key]
+	});
+	return result;
+}
+/**
+* Serialize a document back over the file it was parsed from.
+*
+* For every format but JSONC this is {@link stringifySharedConfig}: those
+* files carry no comments, so re-serializing loses nothing. A JSONC file does
+* carry comments — `.vscode/settings.json` and `opencode.json` are hand-edited
+* far more often than they are generated — and re-serializing would delete
+* every one of them, along with the author's blank lines and key order. So a
+* JSONC document is written back as a set of edits against the existing text:
+* regions the merge did not change stay byte-identical, and a regeneration
+* that changes nothing leaves the file untouched.
+*
+* The whole-document writer is still used when there is nothing to preserve or
+* nothing to edit against:
+*
+* - an empty (or whitespace-only) file, which has no comments to keep;
+* - a file that does not parse, or whose root is not an object — editing it
+*   would mean guessing at the author's intent, and the callers that reach
+*   here have already decided (via `invalidRootPolicy`) that such a file is
+*   replaced;
+* - a file stating the same key twice, or using `__proto__`, `constructor` or
+*   `prototype` as a key (see {@link statesUneditableKeys});
+* - a file so large, with so much of it changing, that editing it key by key
+*   would take longer than a user would wait (see
+*   {@link JSONC_EDIT_BUDGET_BYTES}), or changed keys that write more new text
+*   between them than re-indenting can afford (see
+*   {@link JSONC_EDIT_WRITTEN_BYTES});
+* - a file the editor itself refuses, which it answers with an exception
+*   rather than a result.
+*/
+function serializeSharedConfig({ format, document, existingContent }) {
+	const whole = stringifySharedConfig({
+		format,
+		document
+	});
+	if (format !== "jsonc" || existingContent.trim() === "") return whole;
+	try {
+		const errors = [];
+		const root = parseTree(existingContent, errors, { allowTrailingComma: true });
+		if (root === void 0 || errors.length > 0 || root.type !== "object" || statesUneditableKeys(root)) return whole;
+		const base = sanitizeSharedConfigValue(getNodeValue(root));
+		if (!isPlainObject$1(base)) return whole;
+		const span = Math.max(existingContent.length, whole.length);
+		const cost = countJsoncEdits({
+			base,
+			next: document,
+			depth: 0
+		});
+		if (cost.written > JSONC_EDIT_WRITTEN_BYTES || cost.edits * span > JSONC_EDIT_BUDGET_BYTES) return whole;
+		return applyJsoncObjectEdits({
+			text: existingContent,
+			base,
+			next: document,
+			path: [],
+			options: { formattingOptions: detectJsoncFormattingOptions({
+				text: existingContent,
+				root
+			}) }
+		});
+	} catch {
+		return whole;
+	}
+}
+/**
 * Shallow merge: every top-level key in `patch` replaces the base key
 * wholesale; all other base keys are preserved. The policy for a feature that
 * owns a fixed set of top-level keys.
@@ -10707,7 +11292,7 @@ function mergeSharedConfigShallow({ base, patch }) {
 function mergeSharedConfigDeep({ base, patch }) {
 	const result = { ...base };
 	for (const [key, patchValue] of Object.entries(patch)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (isPrototypePollutionKey(key)) continue;
 		if (patchValue === void 0) {
 			delete result[key];
 			continue;
@@ -11289,7 +11874,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 /**
 * Execute a feature's declared write to a gateway-managed shared file: parse
 * the existing content, merge the patch under the feature's declared policy,
-* and serialize. Throws when the file or feature is undeclared, when a
+* and serialize it back over the existing content (see
+* {@link serializeSharedConfig}, which keeps a JSONC file's comments and
+* formatting outside the spans the merge actually changed). Throws when the
+* file or feature is undeclared, when a
 * `replace-owned-keys` patch strays outside its owned keys, or when the
 * feature's policy is `custom` (those calls go to the named policy function
 * instead).
@@ -11315,9 +11903,10 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 			patch
 		});
 		for (const [key, value] of Object.entries(patch)) if (value === void 0) delete document[key];
-		return stringifySharedConfig({
+		return serializeSharedConfig({
 			format: declaration.format,
-			document
+			document,
+			existingContent
 		});
 	}
 	const merged = mergeSharedConfigDeep({
@@ -11325,9 +11914,10 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 		patch
 	});
 	for (const key of policy.replaceKeys ?? []) if (patch[key] !== void 0) merged[key] = sanitizeSharedConfigValue(patch[key]);
-	return stringifySharedConfig({
+	return serializeSharedConfig({
 		format: declaration.format,
-		document: merged
+		document: merged,
+		existingContent
 	});
 }
 const READ_TOOL_NAME = "Read";
@@ -26729,7 +27319,7 @@ var CopilotMcp = class CopilotMcp extends ToolMcp {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = this.fileContent !== void 0 ? JSON.parse(this.fileContent) : {};
+		this.json = this.fileContent !== void 0 ? parseJsonc(this.fileContent) : {};
 	}
 	getJson() {
 		return this.json;
@@ -28952,7 +29542,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		}, null, 2) });
 	}
 	validate() {
-		const json = JSON.parse(this.fileContent || "{}");
+		const json = parseJsonc(this.fileContent || "{}");
 		const result = KiloConfigSchema.safeParse(json);
 		if (!result.success) return {
 			success: false,
@@ -30028,7 +30618,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 		}, null, 2) });
 	}
 	validate() {
-		const json = JSON.parse(this.fileContent || "{}");
+		const json = parseJsonc(this.fileContent || "{}");
 		const result = OpencodeConfigSchema.safeParse(json);
 		if (!result.success) return {
 			success: false,
@@ -33482,41 +34072,123 @@ function matchesGlobStep(step, character) {
 	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
 	return step.negated ? !admitted : admitted;
 }
+/** Whether two single-character steps can both match one same character. */
+function stepsShareACharacter(left, right) {
+	if (left.kind === "any" || right.kind === "any") return true;
+	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
+	if (left.kind === "literal") return matchesGlobStep(right, left.character);
+	if (right.kind === "literal") return matchesGlobStep(left, right.character);
+	return true;
+}
+/** Whether every step from `index` on can match the empty string. */
+function isAllStars(steps, index) {
+	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
+	return true;
+}
+/**
+* The most work one intersection walk will do, counted in cells times the cost
+* of one. Past it the two patterns are reported as intersecting without being
+* walked: the product of two lengths grows quadratically, and a pattern long
+* enough to reach this is pathological rather than a command anybody typed.
+* Answering `true` withholds an `allow`, which is the direction that fails
+* closed.
+*/
+const MAX_INTERSECTION_CELLS = 1e6;
+/**
+* The most work a whole run of comparisons will do. A caller holding R
+* restrictions and A allow rules asks R x A times, and a per-pair cap alone
+* bounds none of that: a hundred restrictions against a hundred allow rules,
+* each pattern just under the per-pair cap, is ten thousand affordable walks
+* that together take minutes. The shared budget is spent down across the run
+* and, once it is gone, every remaining pair is reported as intersecting —
+* again the direction that withholds an `allow` rather than writing one.
+*/
+const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
+/**
+* What a pair costs on top of the cells it walks: the call itself, sizing and
+* filling the two rows the table is held in, and collecting the answer.
+* Charging only cells would leave the *number* of pairs unbounded — a pair of
+* one-step patterns walks a single cell, so n short restrictions against n
+* short allow rules is n squared comparisons that never spend the budget down
+* however many of them there are. Charging a floor per pair puts pair count and
+* walk length on the same exhaustible resource.
+*
+* For the short patterns of an ordinary config the floor is the whole charge,
+* which lowers how many pairs a run compares from around a million to about
+* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
+* that line withholds every allow it has not yet compared, the same fail-closed
+* answer exhaustion gives everywhere else.
+*/
+const INTERSECTION_PAIR_COST = 64;
+/**
+* A budget for one caller's run of comparisons. Hand the same one to every
+* `parsedGlobsIntersect` call that belongs together — one adapter reading one
+* config — so the run as a whole stays bounded rather than only each pair in
+* it.
+*/
+function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
+	return { remaining };
+}
 /**
-* Parse `glob` once and return a predicate that walks it, for a caller that
-* tests the same glob against a whole list of names.
+* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
+* the same pattern against a whole list parses it once and reuses the result.
 */
-function compileGlob(glob) {
+function parseGlobPattern(glob) {
 	const steps = parseGlob(glob);
-	return (value) => matchesParsedGlob(steps, value);
+	return {
+		steps,
+		maxRanges: maxRangeCount(steps)
+	};
 }
-function matchesParsedGlob(steps, value) {
-	const characters = [...value];
-	let stepIndex = 0;
-	let characterIndex = 0;
-	let starStepIndex = -1;
-	let starCharacterIndex = 0;
-	while (characterIndex < characters.length) {
-		const step = steps[stepIndex];
-		if (step?.kind === "star") {
-			starStepIndex = stepIndex;
-			starCharacterIndex = characterIndex;
-			stepIndex += 1;
-			continue;
+/**
+* What one cell can cost, as a multiplier on the cell count. A literal met by a
+* `[a-z...]` class walks that class's ranges, so a single class carrying
+* thousands of them turns a walk that looks affordable by cell count alone into
+* a quadratic one — which is why the budget is spent on cells times this rather
+* than on cells.
+*/
+function maxRangeCount(steps) {
+	let most = 0;
+	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
+	return most;
+}
+/**
+* `globsIntersect` for two globs already parsed, optionally spending a budget
+* shared with the rest of the caller's run — see `createIntersectionBudget`.
+* Once that budget is exhausted every further pair answers `true` without being
+* walked, so a caller reading the answer as a reason to restrict stays on the
+* safe side.
+*/
+function parsedGlobsIntersect(left, right, budget) {
+	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
+	const cellCost = 1 + left.maxRanges + right.maxRanges;
+	const cost = rows.length * columns.length * cellCost;
+	if (cost > MAX_INTERSECTION_CELLS) return true;
+	if (budget !== void 0) {
+		const charge = cost + INTERSECTION_PAIR_COST;
+		if (charge > budget.remaining) {
+			budget.remaining = 0;
+			return true;
 		}
-		if (step !== void 0 && matchesGlobStep(step, characters[characterIndex] ?? "")) {
-			stepIndex += 1;
-			characterIndex += 1;
-			continue;
+		budget.remaining -= charge;
+	}
+	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
+	for (let i = rows.length - 1; i >= 0; i--) {
+		const row = Array.from({ length: columns.length + 1 }, () => false);
+		row[columns.length] = isAllStars(rows, i);
+		for (let j = columns.length - 1; j >= 0; j--) {
+			const rowStep = rows[i];
+			const columnStep = columns[j];
+			if (rowStep === void 0 || columnStep === void 0) continue;
+			if (rowStep.kind === "star" || columnStep.kind === "star") {
+				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
+				continue;
+			}
+			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
 		}
-		if (starStepIndex < 0) return false;
-		starCharacterIndex += 1;
-		stepIndex = starStepIndex + 1;
-		characterIndex = starCharacterIndex;
+		next = row;
 	}
-	let remaining = stepIndex;
-	while (steps[remaining]?.kind === "star") remaining += 1;
-	return remaining === steps.length;
+	return next[0] ?? false;
 }
 //#endregion
 //#region src/features/permissions/augmentcode-permissions.ts
@@ -33979,6 +34651,216 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	}
 	return { permission };
 }
+/**
+* Collect the canonical rules that govern shell commands, for the adapters
+* whose tool models commands and nothing else.
+*
+* The `bash` category contributes every rule. The all-tools `*` category
+* contributes its **restricting** rules — `deny` and `ask` — because a rule
+* written there covers shell commands too, and dropping it inverts the
+* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
+* an adapter that reads only `bash` auto-approves the very command the file
+* denies.
+*
+* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
+* need not be a command at all — `secrets/**` under `*` denies a path — and
+* carrying it in the restricting direction only over-restricts, while carrying
+* it in the permissive direction would grant something the author never said
+* about commands. Both directions therefore fail closed.
+*/
+function collectShellCommandRules(permission) {
+	const rules = [];
+	const foreignRestrictingCategories = [];
+	const ignoredAllToolsAllowPatterns = [];
+	for (const [category, categoryRules] of Object.entries(permission)) {
+		if (category === "bash") {
+			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
+				pattern,
+				action,
+				fromAllToolsCategory: false
+			});
+			continue;
+		}
+		if (category === "*") {
+			for (const [pattern, action] of Object.entries(categoryRules)) {
+				if (action === "allow") {
+					ignoredAllToolsAllowPatterns.push(pattern);
+					continue;
+				}
+				rules.push({
+					pattern,
+					action,
+					fromAllToolsCategory: true
+				});
+			}
+			continue;
+		}
+		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
+	}
+	return {
+		rules,
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns
+	};
+}
+/**
+* Build the test an adapter applies to an `allow` pattern before writing it:
+* which restrictions it cannot write name some of the same commands? The
+* answer is the list of those restrictions — empty when the `allow` may be
+* written — so a caller can report both the allow rules it withheld and the
+* restrictions that withheld nothing.
+*
+* Canonically the stricter rule wins **whatever its width** — rulesync collapses
+* colliding rules as `deny > ask > allow` — so the two patterns are compared by
+* asking whether any one command matches both. Width does not enter into it: an
+* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
+* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
+* on every `git ... --force` command even though neither pattern covers the
+* other's spelling. Comparing only identical spellings would let the most
+* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
+*
+* Identical spellings are still compared as strings first, as a shortcut past
+* the walk for the commonest case.
+*
+* `normalizePattern` rewrites a pattern written in the tool's own language into
+* the widest glob it could stand for, for a tool whose patterns are not globs.
+* It reaches the `bash` rules and the `allow` rules, which is where such a
+* pattern is written; an all-tools `*` pattern is canonical — it is read by
+* every tool, so it is a glob already — and is compared as it stands. The
+* rewrite must only ever widen what a pattern covers, so an inexact reading
+* withholds an allow rather than writing one the config restricts — see
+* `warpCommandPatternToGlob`.
+*/
+function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
+	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
+		pattern,
+		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
+	}));
+	return (allowPattern) => {
+		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
+		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
+		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
+	};
+}
+/**
+* Which of the given all-tools `*` restrictions look like they may not name a
+* command at all — the question a `deny` and an `ask` written there both raise.
+*
+* "Withheld no allow rule" alone does not answer it: a config with no `allow`
+* rules has nothing to withhold, and a pattern the author also wrote under
+* `bash` is a command on their own word. Both are excluded, so what remains is
+* a `*` pattern that had allow rules to overlap, overlapped none of them, and
+* is claimed as a command nowhere else — the shape `secrets/**` has.
+*
+* A `bash` restriction never belongs here: it names a command by construction,
+* so overlapping no allow rule says nothing is wrong with it.
+*/
+function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
+	if (!rules.some(({ action }) => action === "allow")) return [];
+	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
+	return uniq(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
+}
+/**
+* Split shell-command rules into the allow and deny lists of a tool that models
+* commands with those two tiers and nothing else.
+*
+* `ask` has no list of its own — such a tool already prompts for whatever it
+* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
+* still has to *withhold* the `allow` rules it covers, though: the canonical
+* order is `deny > ask > allow`, so auto-approving a command the file also asks
+* about would answer the prompt the author wanted.
+*
+* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
+* from the all-tools `*` category. Warp's cannot: it matches commands with
+* regular expressions rather than globs, and writing any denylist **replaces**
+* Warp's built-in default one, so an inert `secrets/**` entry there would trade
+* the tool's own protection for a rule that matches no command. Where the deny
+* cannot be written it withholds the allow rules it covers instead, which
+* restricts in the same direction without touching the denylist.
+*
+* A `bash` deny withholds nothing: it names a command by construction, so the
+* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
+* and a narrow deny keeps carving an exception out of a wider allow (`git *`
+* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
+* even where it is written: a pattern under `*` need not name a command —
+* `secrets/**` there denies a path — so as a denylist entry it may match nothing
+* at all, and leaving an overlapping allow beside it would auto-approve the very
+* commands the author meant to stop. Over-restricting a `*` deny that *was* a
+* command pattern is reported; failing open would not be.
+*
+* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
+* patterns are not globs.
+*/
+function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
+	const deny = [];
+	const unwrittenDenyPatterns = [];
+	const restrictions = [];
+	const writtenAllToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	for (const rule of rules) {
+		const { pattern, action, fromAllToolsCategory } = rule;
+		if (action === "allow") continue;
+		if (action !== "deny") {
+			restrictions.push(rule);
+			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
+			continue;
+		}
+		if (writesAllToolsDeny || !fromAllToolsCategory) {
+			deny.push(pattern);
+			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
+		} else unwrittenDenyPatterns.push(pattern);
+		if (fromAllToolsCategory) restrictions.push(rule);
+	}
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
+		normalizePattern,
+		budget
+	});
+	const allow = [];
+	const shadowedAllowPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action } of rules) {
+		if (action !== "allow") continue;
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
+		}
+		allow.push(pattern);
+	}
+	return {
+		allow,
+		deny,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: writtenAllToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
+* Report, for one command-only tool, every canonical rule its two lists could
+* not carry. Every command-only adapter shares this reporting, so a rule
+* dropped in one is worded the same way in all.
+*/
+function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
+	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
+	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
+	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
+	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
+	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
+	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
+}
 //#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
@@ -34909,8 +35791,10 @@ function convertRulesyncToClaudePermissions({ config, logger }) {
 	const ask = [];
 	const deny = [];
 	const actionByEntry = /* @__PURE__ */ new Map();
+	const allToolsPatterns = [];
 	for (const [category, rules] of Object.entries(config.permission)) {
 		const claudeToolName = toClaudeToolName(category);
+		if (category === "*") allToolsPatterns.push(...Object.keys(rules));
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildClaudePermissionEntry(claudeToolName, pattern);
 			const previous = actionByEntry.get(entry);
@@ -34927,6 +35811,7 @@ function convertRulesyncToClaudePermissions({ config, logger }) {
 			}
 		}
 	}
+	if (allToolsPatterns.length > 0) logger?.warn(`Claude Code permissions: a rule names one tool, and there is no name standing for every tool, so the all-tools '*' rule(s) for ${allToolsPatterns.join(", ")} were written as '*(pattern)' entries that Claude Code matches against no tool. Write them under the categories they are meant for (for example 'bash' or 'read') to have them enforced.`);
 	return {
 		allow,
 		ask,
@@ -34971,34 +35856,64 @@ const ClineCommandPermissionsSchema = z.looseObject({
 });
 /**
 * Translate rulesync permission categories into Cline allow/deny command lists.
-* Non-bash categories and `ask` rules are tracked separately so a single
-* translation notice can be surfaced by the caller.
+* The `bash` category maps, and so do the restricting rules of the all-tools
+* `*` category — a rule written there covers shell commands too. Other
+* categories and `ask` rules are tracked separately so a single translation
+* notice can be surfaced by the caller.
 */
 function translateClinePermissions(permission) {
 	const allow = [];
 	const deny = [];
-	const droppedCategories = [];
 	const translatedAskPatterns = [];
-	for (const [category, rules] of Object.entries(permission)) {
-		if (category !== "bash") {
-			droppedCategories.push(category);
-			continue;
-		}
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (action === "ask") {
-				translatedAskPatterns.push(pattern);
-				deny.push(pattern);
+	const shadowedAllowPatterns = [];
+	const droppedCategories = Object.keys(permission).filter((category) => category !== "bash" && category !== "*");
+	const { rules, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permission);
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(rules.filter(({ fromAllToolsCategory }) => fromAllToolsCategory), { budget });
+	const allToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action, fromAllToolsCategory } of rules) {
+		if (action === "ask") {
+			if (fromAllToolsCategory) {
+				allToolsAskPatterns.push(pattern);
 				continue;
 			}
-			if (action === "allow") allow.push(pattern);
-			else if (action === "deny") deny.push(pattern);
+			translatedAskPatterns.push(pattern);
+			deny.push(pattern);
+			continue;
+		}
+		if (action === "deny") {
+			deny.push(pattern);
+			if (fromAllToolsCategory) allToolsDenyPatterns.push(pattern);
+			continue;
+		}
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
 		}
+		allow.push(pattern);
 	}
 	return {
 		allow,
 		deny,
 		droppedCategories,
-		translatedAskPatterns
+		translatedAskPatterns,
+		shadowedAllowPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted: budget.remaining === 0
 	};
 }
 /**
@@ -35007,11 +35922,16 @@ function translateClinePermissions(permission) {
 * project convention used by every other permissions translator, and
 * (b) the user still sees one prominent "WARNING" message describing the translation.
 */
-function warnClineTranslationNotices({ droppedCategories, translatedAskPatterns, logger }) {
-	if (droppedCategories.length === 0 && translatedAskPatterns.length === 0) return;
+function warnClineTranslationNotices({ droppedCategories, translatedAskPatterns, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, ignoredAllToolsAllowPatterns, intersectionBudgetExhausted, logger }) {
+	if (droppedCategories.length === 0 && translatedAskPatterns.length === 0 && shadowedAllowPatterns.length === 0 && unenforcedAllToolsDenyPatterns.length === 0 && unenforcedAllToolsAskPatterns.length === 0 && ignoredAllToolsAllowPatterns.length === 0 && !intersectionBudgetExhausted) return;
 	const parts = [];
 	if (droppedCategories.length > 0) parts.push(`non-bash categories [${droppedCategories.join(", ")}] (Cline only enforces shell commands; use the rulesync ignore feature for read/write restrictions)`);
 	if (translatedAskPatterns.length > 0) parts.push(`'ask' rules for bash patterns [${translatedAskPatterns.join(", ")}] translated to 'deny' for fail-closed safety, since Cline lacks 'ask'`);
+	if (shadowedAllowPatterns.length > 0) parts.push(`'allow' rules for [${shadowedAllowPatterns.join(", ")}] withheld because the all-tools '*' category restricts the same commands, and a pattern written there need not name a command Cline's own lists can act on. Cline's allowlist is a gate — once set, only the commands matching it run without approval — so withholding every entry leaves every command asking`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) parts.push(`'deny' rules for [${unenforcedAllToolsDenyPatterns.join(", ")}] under the all-tools '*' category written into the denylist as they stand, where they withheld none of the allow rules beside them — a pattern written there need not name a command, and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern`);
+	if (unenforcedAllToolsAskPatterns.length > 0) parts.push(`'ask' rules for [${unenforcedAllToolsAskPatterns.join(", ")}] under the all-tools '*' category left with nothing to do, since Cline has no ask tier and they withheld none of the allow rules beside them — a pattern written there need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns`);
+	if (ignoredAllToolsAllowPatterns.length > 0) parts.push(`'allow' rules for [${ignoredAllToolsAllowPatterns.join(", ")}] under the all-tools '*' category skipped (only its deny and ask rules are read, since a pattern written there need not be a command); write them under 'bash' to auto-approve them`);
+	if (intersectionBudgetExhausted) parts.push("the limit on how much work one generation may spend comparing allow rules against the all-tools '*' category's deny and ask rules was reached, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than .rulesync/permissions.jsonc asks for; write fewer or shorter command patterns to have them all compared");
 	logger?.warn(`WARNING: Cline command permissions translation notice: ${parts.join("; ")}.`);
 }
 var ClinePermissions = class ClinePermissions extends ToolPermissions {
@@ -35059,10 +35979,15 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
+		const { allow, deny, droppedCategories, translatedAskPatterns, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, ignoredAllToolsAllowPatterns, intersectionBudgetExhausted } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
+			shadowedAllowPatterns,
+			unenforcedAllToolsDenyPatterns,
+			unenforcedAllToolsAskPatterns,
+			ignoredAllToolsAllowPatterns,
+			intersectionBudgetExhausted,
 			logger
 		});
 		const dedupedAllow = uniq(allow.toSorted());
@@ -35070,7 +35995,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		const mergedDeny = uniq([...existing.deny ?? [], ...dedupedDeny]).toSorted();
 		const denySet = new Set(mergedDeny);
 		const collisions = dedupedAllow.filter((p) => denySet.has(p));
-		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline's evaluation order is not documented to guarantee deny-priority; the resulting behavior is undefined. Consider removing the duplicate rule from rulesync.`);
+		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline documents that deny rules always take precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
 		const next = {
 			...existing,
 			allow: dedupedAllow,
@@ -36489,7 +37414,9 @@ const TRAILING_ARGUMENT_WILDCARD_PATTERN = /:\*$/;
 * This surface is **global only** — dcode reads no project-level config file,
 * so there is nothing to write into a repository.
 *
-* Only the canonical `bash` category maps, and only its `allow` rules:
+* Only `allow` rules map, and only from the canonical `bash` category — the
+* all-tools `*` category contributes its restricting rules instead, since a rule
+* written there covers shell commands too (see `collectShellCommandRules`):
 *
 * - A pattern is reduced to its executable token, because that is all dcode
 *   matches on — `git *`, `git:*`, `git commit:*` and a bare `git` all become
@@ -36603,7 +37530,7 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			const shell = isPlainObject$1(existingShell) ? { ...existingShell } : {};
 			if (allowList.length > 0) shell[ALLOW_LIST_KEY] = allowList;
 			else if (shell[ALLOW_LIST_KEY] !== void 0) {
-				warnWithFallback(logger, `deepagents-cli: no bash allow rule maps to an executable name, so the existing [${SHELL_TABLE_KEY}].${ALLOW_LIST_KEY} in ${filePath} was removed and those commands will be asked about again.`);
+				warnWithFallback(logger, `deepagents-cli: no bash allow rule is left to auto-approve — none maps to an executable name, or every one of them is covered by a stricter rule — so the existing [${SHELL_TABLE_KEY}].${ALLOW_LIST_KEY} in ${filePath} was removed and those commands will be asked about again.`);
 				delete shell[ALLOW_LIST_KEY];
 			}
 			if (Object.keys(shell).length > 0) settings[SHELL_TABLE_KEY] = shell;
@@ -36662,35 +37589,69 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 	}
 };
 /**
+* Split the restricting rules by what the generated allowlist does to them, and
+* name the entries that have to go.
+*
+* An allowlist entry auto-approves its executable however it is invoked, so an
+* `ask` or `deny` on any command that entry would run — a narrower pattern
+* (`npm publish`) beside an allowed `npm *`, or one naming no executable at all
+* (`*delete*` beside an allowed `kubectl`) — collides with it. dcode has no
+* denylist, so the collision cannot be settled there: keeping the allow would
+* auto-approve the very command the author wanted stopped. The colliding
+* entries are therefore withheld — canonically the stricter rule wins whatever
+* its width — which leaves those executables prompting, which is what an `ask`
+* asks for and the closest dcode can come to a `deny`.
+*/
+function partitionRestrictingRules({ allowList, askPatterns, denyPatterns, willWrite }) {
+	const approved = allowList.map((token) => ({
+		token,
+		globs: [parseGlobPattern(token), parseGlobPattern(`${token} *`)]
+	}));
+	const budget = createIntersectionBudget();
+	const collidingTokens = (pattern) => {
+		if (!willWrite) return [];
+		if (budget.remaining === 0) return [...allowList];
+		const restriction = parseGlobPattern(pattern.trim().replace(TRAILING_ARGUMENT_WILDCARD_PATTERN, "*").replaceAll(SHLEX_STRIPPED_PATTERN, ""));
+		return approved.filter(({ globs }) => globs.some((glob) => parsedGlobsIntersect(restriction, glob, budget))).map(({ token }) => token);
+	};
+	const withheldTokens = /* @__PURE__ */ new Set();
+	const collect = (pattern) => {
+		const tokens = collidingTokens(pattern);
+		for (const token of tokens) withheldTokens.add(token);
+		return tokens.length > 0;
+	};
+	const shadowedAsk = uniq(askPatterns).filter(collect);
+	const shadowedDeny = [];
+	const unenforcedDeny = [];
+	for (const pattern of uniq(denyPatterns)) (collect(pattern) ? shadowedDeny : unenforcedDeny).push(pattern);
+	return {
+		shadowedAsk,
+		shadowedDeny,
+		unenforcedDeny,
+		withheldTokens,
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
 * Say what the reduction to executable names could not write. Split out from
 * `convertRulesyncToDeepagentsAllowList` because the rules it reports on
 * outnumber the ones it writes: every category dcode cannot express is a
 * sentence here.
 */
-function warnAboutUnwrittenBashRules({ allowList, allowAll, requestedAllowAll, askPatterns, denyPatterns, widenedPatterns, unmatchablePatterns, sentinelPatterns, willWrite, logger }) {
-	const allowedTokens = new Set(allowList);
-	const collidesWithAllow = (pattern) => {
-		if (!willWrite) return false;
-		if (allowAll) return true;
-		const leading = leadingToken(pattern).replaceAll(SHLEX_STRIPPED_PATTERN, "");
-		if (GLOB_CHARACTERS_PATTERN.test(leading)) {
-			const matches = compileGlob(leading);
-			return allowList.some((token) => matches(token));
-		}
-		return allowedTokens.has(leading);
-	};
-	const shadowedAsk = askPatterns.filter(collidesWithAllow);
-	const shadowedDeny = [];
-	const unenforcedDeny = [];
-	for (const pattern of denyPatterns) (collidesWithAllow(pattern) ? shadowedDeny : unenforcedDeny).push(pattern);
-	if (unenforcedDeny.length > 0) warnWithFallback(logger, `deepagents-cli has no command denylist — a command it does not auto-approve is asked about, not blocked — so ${unenforcedDeny.length} bash deny rule(s) from .rulesync/permissions.jsonc were skipped and those commands remain runnable on approval.`);
-	const shadowReason = allowAll ? `allow_list = ["all"] auto-approves every command` : `the generated allow_list auto-approves commands they cover`;
-	if (shadowedDeny.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name, so the deny rule(s) ${shadowedDeny.join(", ")} are not merely unenforced: ${shadowReason}, so those commands run without a prompt. Narrow or drop the allow rule that covers them.`);
-	if (shadowedAsk.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name, so the ask rule(s) ${shadowedAsk.join(", ")} run without a prompt: ${shadowReason}. Narrow or drop the allow rule that covers them.`);
+function warnAboutUnwrittenBashRules({ allowAll, requestedAllowAll, askPatterns, denyPatterns, foreignRestrictingCategories, shadowedAsk, shadowedDeny, unenforcedDeny, intersectionBudgetExhausted, widenedPatterns, unmatchablePatterns, sentinelPatterns, willWrite, logger }) {
+	if (unenforcedDeny.length > 0) warnWithFallback(logger, `deepagents-cli has no command denylist — a command it does not auto-approve is asked about, not blocked — so ${unenforcedDeny.length} command deny rule(s) from .rulesync/permissions.jsonc were skipped and those commands remain runnable on approval.`);
+	if (shadowedDeny.length > 0) warnWithFallback(logger, intersectionBudgetExhausted ? `deepagents-cli withheld the allow_list entries beside the deny rule(s) ${shadowedDeny.join(", ")} without comparing them, the comparison limit above having been reached. Those executables are asked about instead.` : `deepagents-cli matches only the executable name, so the allow rule(s) covered by the deny rule(s) ${shadowedDeny.join(", ")} were withheld from allow_list — keeping them would auto-approve the very commands those rules deny. Those executables are asked about instead; narrow the deny rule if you meant them auto-approved.`);
+	if (shadowedAsk.length > 0) warnWithFallback(logger, intersectionBudgetExhausted ? `deepagents-cli withheld the allow_list entries beside the ask rule(s) ${shadowedAsk.join(", ")} without comparing them, the comparison limit above having been reached. Those executables are asked about instead.` : `deepagents-cli matches only the executable name, so the allow rule(s) covered by the ask rule(s) ${shadowedAsk.join(", ")} were withheld from allow_list — keeping them would run those commands without the prompt the ask rule asks for. Narrow the ask rule if you meant them auto-approved.`);
 	if (willWrite && widenedPatterns.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name of a command, so ${widenedPatterns.join(", ")} were widened to their first token — every invocation of those executables is now auto-approved, not just the listed arguments.`);
 	if (willWrite && unmatchablePatterns.length > 0) warnWithFallback(logger, `deepagents-cli compares an allow_list entry to the executable name exactly, so a glob in that name matches nothing, a name longer than ${MAX_EXECUTABLE_NAME_LENGTH} characters is longer than a command's own name can be, and a name holding a shell metacharacter, a quote or an escape is one dcode splits on, refuses outright, or reads differently than it is written — the pattern(s) ${unmatchablePatterns.join(", ")} were therefore skipped rather than written as a rule that cannot be relied on to fire.`);
 	if (willWrite && sentinelPatterns.length > 0) warnWithFallback(logger, `deepagents-cli reads 'all' and 'recommended' in allow_list as sentinels rather than command names, so ${sentinelPatterns.join(", ")} were skipped. Use the '*' pattern to allow every command.`);
-	if (willWrite && requestedAllowAll && !allowAll) warnWithFallback(logger, `The bash '*' allow rule was not written as allow_list = ["all"] for deepagents-cli, because 'all' also turns off its dangerous-pattern check (command substitution, redirects, process substitution) and ${denyPatterns.length > 0 ? `your config denies commands` : `your config has deny rules for other tools`} — the two together would be weaker than dcode's own default. List the executables you want auto-approved instead.`);
+	if (willWrite && requestedAllowAll && !allowAll) {
+		let restrictionReason = `your config restricts other tools`;
+		if (denyPatterns.length > 0) restrictionReason = `your config denies commands`;
+		else if (askPatterns.length > 0) restrictionReason = `your config asks before running commands`;
+		else if (foreignRestrictingCategories.length > 0) restrictionReason = `your config restricts '${foreignRestrictingCategories.join("', '")}'`;
+		warnWithFallback(logger, `The bash '*' allow rule was not written as allow_list = ["all"] for deepagents-cli, because 'all' also turns off its dangerous-pattern check (command substitution, redirects, process substitution) and ${restrictionReason} — the two together would be weaker than dcode's own default. List the executables you want auto-approved instead.`);
+	}
 	if (willWrite && allowAll) warnWithFallback(logger, "The bash '*' allow rule became allow_list = [\"all\"] for deepagents-cli, which auto-approves every command and skips its dangerous-pattern check (command substitution, redirects, process substitution). List the executables you want instead if that is more than you meant.");
 }
 /**
@@ -36837,62 +37798,78 @@ function toExecutableToken(pattern) {
 }
 /**
 * Convert rulesync permissions config to dcode's `[shell].allow_list`. Only
-* `bash` `allow` rules map; everything else is skipped, with a warning
+* `allow` rules map — from the `bash` category, and never from the all-tools
+* `*` one, whose restricting rules still count against them (see
+* `collectShellCommandRules`). Everything else is skipped, with a warning
 * wherever the skip loses a restriction rather than a redundancy.
 */
 function convertRulesyncToDeepagentsAllowList({ config, willWrite, logger }) {
 	const allowed = [];
-	const widenedPatterns = [];
+	const widened = [];
 	const unmatchablePatterns = [];
 	const sentinelPatterns = [];
 	const askPatterns = [];
 	const denyPatterns = [];
-	let hasForeignDeny = false;
 	let requestedAllowAll = false;
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny")) {
-				hasForeignDeny = true;
-				warnWithFallback(logger, `deepagents-cli only models shell-command permissions ([shell].allow_list), so '${category}' deny rules cannot be represented and were skipped.`);
-			}
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	for (const { pattern, action } of rules) {
+		if (action === "deny") {
+			denyPatterns.push(pattern);
 			continue;
 		}
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (action === "deny") {
-				denyPatterns.push(pattern);
-				continue;
-			}
-			if (action === "ask") {
-				askPatterns.push(pattern);
-				continue;
-			}
-			if (leadingToken(pattern) === "*" && meansAnyArguments(pattern)) {
-				requestedAllowAll = true;
-				continue;
-			}
-			const reduced = toExecutableToken(pattern);
-			if (!reduced) {
-				unmatchablePatterns.push(pattern);
-				continue;
-			}
-			if (reduced.token.toLowerCase() === ALLOW_ALL_SENTINEL || reduced.token.toLowerCase() === RECOMMENDED_SENTINEL) {
-				sentinelPatterns.push(pattern);
-				continue;
-			}
-			if (reduced.widened) widenedPatterns.push(pattern);
-			allowed.push(reduced.token);
+		if (action === "ask") {
+			askPatterns.push(pattern);
+			continue;
+		}
+		if (leadingToken(pattern) === "*" && meansAnyArguments(pattern)) {
+			requestedAllowAll = true;
+			continue;
+		}
+		const reduced = toExecutableToken(pattern);
+		if (!reduced) {
+			unmatchablePatterns.push(pattern);
+			continue;
+		}
+		if (reduced.token.toLowerCase() === ALLOW_ALL_SENTINEL || reduced.token.toLowerCase() === RECOMMENDED_SENTINEL) {
+			sentinelPatterns.push(pattern);
+			continue;
 		}
+		if (reduced.widened) widened.push({
+			pattern,
+			token: reduced.token
+		});
+		allowed.push(reduced.token);
 	}
-	const hasDenyRule = hasForeignDeny || denyPatterns.length > 0;
-	const allowAll = requestedAllowAll && !hasDenyRule;
-	const allowList = allowAll ? [ALLOW_ALL_SENTINEL] : uniq(allowed.toSorted());
+	const hasRestriction = foreignRestrictingCategories.length > 0 || denyPatterns.length > 0 || askPatterns.length > 0;
+	const allowAll = requestedAllowAll && !hasRestriction;
+	const candidates = uniq(allowed.toSorted());
+	const { shadowedAsk, shadowedDeny, unenforcedDeny, withheldTokens, intersectionBudgetExhausted } = partitionRestrictingRules({
+		allowList: candidates,
+		askPatterns,
+		denyPatterns,
+		willWrite
+	});
+	const allowList = allowAll ? [ALLOW_ALL_SENTINEL] : candidates.filter((token) => !withheldTokens.has(token));
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "deepagents-cli",
+		surfaceLabel: "[shell].allow_list",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns: [],
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	warnAboutUnwrittenBashRules({
-		allowList,
 		allowAll,
 		requestedAllowAll,
 		askPatterns,
 		denyPatterns,
-		widenedPatterns,
+		foreignRestrictingCategories,
+		shadowedAsk,
+		shadowedDeny,
+		unenforcedDeny,
+		intersectionBudgetExhausted,
+		widenedPatterns: uniq(widened.filter(({ token }) => !withheldTokens.has(token)).map(({ pattern }) => pattern)),
 		unmatchablePatterns,
 		sentinelPatterns,
 		willWrite,
@@ -37192,10 +38169,17 @@ function convertDevinToRulesyncPermissions(params) {
 *
 * rulesync's canonical `permission.bash` patterns map directly: `allow` →
 * `commandAllowlist`, `deny` → `commandDenylist`. Factory Droid has no separate
-* "ask" list (any command not in the allowlist already prompts), so `ask`
-* rules are intentionally dropped. The allow/deny lists only model shell
-* commands, so categories other than `bash` cannot be represented and are
-* skipped (with a warning when they carry `deny` rules, to surface the gap).
+* "ask" list (any command not in the allowlist already prompts), so `ask` rules
+* write nothing — they only withhold the allow rules they cover, since the
+* stricter rule wins whatever its width. The all-tools `*` category contributes
+* its restricting rules too, because a rule written there covers shell commands
+* as well. They withhold the allow rules they cover the way a `bash` `ask`
+* does, because a pattern written under `*` need not name a command at all: a
+* `deny` there is written to `commandDenylist` too, for the case where it *is*
+* one, but an entry naming no command enforces nothing by itself.
+* The allow/deny lists only model shell commands, so categories other
+* than `bash` and `*` cannot be represented and are skipped (with a warning
+* when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
 * never run, not even under full autonomy — plus other security controls
@@ -37312,24 +38296,28 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 };
 /**
 * Convert rulesync permissions config to Factory Droid allow/deny command lists.
-* Only the `bash` category maps; `ask` rules and non-`bash` categories are
-* dropped (the latter with a warning when they carry `deny` rules).
+* The `bash` category maps, and so do the restricting rules of the all-tools
+* `*` category — a `deny` written there covers shell commands too, and skipping
+* it would auto-approve a command the file blocks. Other categories are dropped
+* (with a warning when they carry `deny` rules).
 */
 function convertRulesyncToFactorydroidPermissions({ config, logger }) {
-	const allow = [];
-	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny") && logger) logger.warn(`Factory Droid only models shell-command permissions (commandAllowlist/commandDenylist); '${category}' deny rules cannot be represented and were skipped.`);
-			continue;
-		}
-		for (const [pattern, action] of Object.entries(rules)) switch (action) {
-			case "allow":
-				allow.push(pattern);
-				break;
-			case "deny": deny.push(pattern);
-		}
-	}
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	const { allow, deny, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+		rules,
+		writesAllToolsDeny: true
+	});
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "Factory Droid",
+		surfaceLabel: "commandAllowlist/commandDenylist",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns,
+		unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	return {
 		allow,
 		deny
@@ -39380,9 +40368,10 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
 		const parsed = parse(fileContent ?? "{}");
+		const record = isRecord$1(parsed) ? parsed : {};
 		const nextJson = {
-			...parsed,
-			permission: parsed.permission ?? {}
+			...record,
+			permission: Object.hasOwn(record, "permission") ? record.permission ?? {} : {}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -39451,7 +40440,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 	}
 	validate() {
 		try {
-			const json = JSON.parse(this.fileContent || "{}");
+			const json = parseJsonc(this.fileContent || "{}");
 			const result = OpencodePermissionsConfigSchema.safeParse(json);
 			if (!result.success) return {
 				success: false,
@@ -43152,9 +44141,13 @@ function warpSettingsDir() {
 * allowlist, `deny` → denylist). Warp matches commands with regular
 * expressions, so patterns are emitted verbatim — author canonical `bash`
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
-* adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
-* the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules).
+* adapter). Warp has no per-command "ask" list, so `ask` rules write nothing —
+* they only withhold the allow rules they cover, since the stricter rule wins
+* whatever its width. The all-tools `*` category is read for its restricting
+* rules as well, but those only withhold allows too: writing any denylist
+* **replaces** Warp's built-in default one, and a `*` pattern need not name a
+* command at all. Categories other than `bash` and `*` are skipped (with a
+* warning when they carry `deny` rules).
 *
 * Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
 * knobs that do not fit the canonical `allow | ask | deny` per-command model:
@@ -43327,25 +44320,267 @@ function mergeIntoDefaultExecutionProfile({ agents, mergedAllow, mergedDeny, exe
 	if ((mergedDeny.length > 0 || hasOverrideKeys) && otherProfileIds.length > 0 && logger) logger.warn(`Warp command deny rules and execution_profile override keys were written to the 'default' execution profile only; they are not enforced while another profile (${otherProfileIds.join(", ")}) is active.`);
 }
 /**
-* Convert rulesync permissions config to Warp command allow/deny regex lists.
-* Only the `bash` category maps; `ask` rules and non-`bash` categories are
-* dropped (the latter with a warning when they carry `deny` rules).
+* Read a `[...]` class starting at its `[` and return the index just past its
+* `]`, or `undefined` when it cannot be read that simply. Regex class rules
+* apply: a `]` in the first position is a member rather than the terminator and
+* a backslash escapes the character after it. A nested `[` gives up: Rust's
+* `regex` crate — the engine Warp matches with — reads `[a[b]c]` as one class
+* built by set operations, so stopping at the first `]` would leave `c]` behind
+* as text the glob then requires. Giving up widens the whole pattern instead,
+* which is the only safe direction here.
+*/
+function skipRegexClass(body, start) {
+	let index = start + 1;
+	if (body.charAt(index) === "^") index += 1;
+	if (body.charAt(index) === "]") index += 1;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "\\") {
+			index += 2;
+			continue;
+		}
+		if (character === "[") return;
+		if (character === "]") return index + 1;
+		index += 1;
+	}
+}
+/**
+* Read a `(...)` group starting at its `(` and return the index just past its
+* `)`, or `undefined` when it never closes. Groups nest, so the depth is
+* counted — but a class inside one is skipped whole, since a `)` written there
+* is a member rather than a closer.
 */
-function convertRulesyncToWarpPermissions({ config, logger }) {
-	const allow = [];
-	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny") && logger) logger.warn(`Warp only models shell-command permissions (agent_mode_command_execution_allowlist/denylist); '${category}' deny rules cannot be represented and were skipped.`);
+function skipRegexGroup(body, start) {
+	let depth = 0;
+	let index = start;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "\\") {
+			index += 2;
 			continue;
 		}
-		for (const [pattern, action] of Object.entries(rules)) switch (action) {
-			case "allow":
-				allow.push(pattern);
-				break;
-			case "deny": deny.push(pattern);
+		if (character === "[") {
+			const next = skipRegexClass(body, index);
+			if (next === void 0) return;
+			index = next;
+			continue;
+		}
+		if (character === "(") {
+			depth += 1;
+			index += 1;
+			continue;
+		}
+		if (character === ")") {
+			depth -= 1;
+			index += 1;
+			if (depth === 0) return index;
+			continue;
+		}
+		index += 1;
+	}
+}
+/**
+* Read a `{2,3}` quantifier starting at its `{`, or `undefined` when what
+* follows is not one. The shape is checked rather than scanned to the next `}`,
+* because a `{` that spells no repetition is a literal to the regex engine —
+* `{a|b}` is an alternation in braces, and reading it as a quantifier would skip
+* past the `|` that has to widen the whole pattern.
+*/
+const QUANTIFIER = /\{\d+(,\d*)?\}/y;
+function skipQuantifier(body, start) {
+	QUANTIFIER.lastIndex = start;
+	return QUANTIFIER.exec(body) === null ? void 0 : QUANTIFIER.lastIndex;
+}
+/**
+* Read the bracketed construct that opens at `start`, whichever kind it is, and
+* return the index just past it — or `undefined` when it never closes.
+*/
+function skipBracketedConstruct(body, start, open) {
+	if (open === "[") return skipRegexClass(body, start);
+	if (open === "(") return skipRegexGroup(body, start);
+	return skipQuantifier(body, start);
+}
+/**
+* Read the tail of a `\\x` / `\\u` escape — the hex run of `\\x20`, or the
+* braced `\\x{263A}` form — and return the index just past it. Such an escape
+* spells one character across several, so consuming only its introducer would
+* leave the hex digits behind as literal atoms and *narrow* the glob, the one
+* direction the rewrite must never take. Over-consuming only widens, so an
+* unterminated brace swallows the rest of the pattern.
+*/
+function skipHexEscapeTail(body, start) {
+	if (body.charAt(start) === "{") {
+		const closing = body.indexOf("}", start);
+		return closing === -1 ? body.length : closing + 1;
+	}
+	let index = start;
+	while (index < body.length && /^[0-9A-Fa-f]$/.test(body.charAt(index))) index += 1;
+	return index;
+}
+/**
+* Read the tail of a `\\p` / `\\P` Unicode-class escape — the braced `\\p{Greek}`
+* form, or the one-letter `\\pL` shorthand — and return the index just past it.
+* Like a hex escape, it spells its class across more than one character, so
+* leaving the shorthand letter behind would narrow the glob.
+*/
+function skipUnicodeClassTail(body, start) {
+	if (body.charAt(start) === "{") {
+		const closing = body.indexOf("}", start);
+		return closing === -1 ? body.length : closing + 1;
+	}
+	return Math.min(start + 1, body.length);
+}
+/**
+* Read the escape that opens at `start` — the `\\` and whatever it spells — and
+* say where it ends and which atom it stands for.
+*/
+function readEscape(body, start) {
+	const escaped = body.charAt(start + 1);
+	if (escaped === "x" || escaped === "u" || escaped === "U") return {
+		next: skipHexEscapeTail(body, start + 2),
+		atom: "*"
+	};
+	if (escaped === "p" || escaped === "P") return {
+		next: skipUnicodeClassTail(body, start + 2),
+		atom: "*"
+	};
+	return {
+		next: start + 2,
+		atom: escapedCharacterWidens(escaped) ? "*" : escaped
+	};
+}
+/**
+* Whether an escaped character has to widen to `*` rather than stand for
+* itself: a letter or a digit spells a class (`\s`, `\d`, `\w`), a glob
+* metacharacter would be read as a wildcard or a class by the comparison
+* instead of as the literal the escape asked for, and an empty string is a
+* trailing backslash spelling nothing at all.
+*/
+function escapedCharacterWidens(escaped) {
+	return escaped === "" || /^[A-Za-z0-9*?[\]]$/.test(escaped);
+}
+/**
+* Read one `[...]`, `(...)` or `{...}` construct starting at `start`, saying
+* where it ends and whether it repeats the atom in front of it (a quantifier)
+* or is an atom of its own (a class or a group) — or that the whole pattern has
+* to widen, which is the only safe reading of a construct that never closes and
+* of one that sets flags for everything after it.
+*/
+function readBracketedConstruct(body, start, open) {
+	const next = skipBracketedConstruct(body, start, open);
+	if (next === void 0) return "widens-pattern";
+	if (open === "(" && INLINE_FLAG_GROUP_PATTERN.test(body.slice(start, next))) return "widens-pattern";
+	return {
+		next,
+		widensLastAtom: open === "{"
+	};
+}
+/**
+* A group that only sets flags — `(?i)`, `(?im)`, `(?-i)` — as opposed to one
+* that scopes them to its own body (`(?i:...)`, which widens to `*` like any
+* other group).
+*/
+const INLINE_FLAG_GROUP_PATTERN = /^\(\?[A-Za-z]*-?[A-Za-z]*\)$/;
+/**
+* Approximate a Warp command pattern as a glob, so restrictions and allow rules
+* can be compared by `createShadowingRestrictionsTest`.
+*
+* Warp matches commands with regular expressions, and a glob reader would
+* misread the ordinary spellings: `.*` — Warp's catch-all — is a literal dot
+* followed by a wildcard, `[rf]` is a character class in one language and plain
+* text in the other, and an unanchored regex covers every command that merely
+* contains it. The rewrite therefore only ever widens what a pattern covers, so
+* an inexact reading withholds an allow rather than writing one the config
+* restricts.
+*
+* Widening means a construct is replaced whole rather than character by
+* character, because the characters inside it are not literals of the command:
+* a class (`[rf]`), a group (`(sudo )?`), a character escape (`\s`) and a
+* missing `^`/`$` anchor all become `*`, and a quantifier (`?`, `*`, `+`,
+* `{2}`) widens the atom in front of it — `git commits?` covers `git commit`,
+* so its glob has to as well. Both sides of a comparison are widened, so a
+* pattern that is really a glob still compares sensibly.
+*
+* A pattern the walk cannot read as one sequence widens to `*` whole: a
+* top-level `|` is two patterns rather than one, and a class, group or
+* quantifier that never closes leaves the rest of the pattern unreadable —
+* guessing at either could only narrow the result, which is the one direction
+* this rewrite must never take. An alternation *inside* a group needs no such
+* treatment: the group it sits in already widens to `*`.
+*/
+function warpCommandPatternToGlob(pattern) {
+	const anchoredStart = pattern.startsWith("^");
+	const anchoredEnd = pattern.endsWith("$") && !pattern.endsWith("\\$");
+	const body = pattern.slice(anchoredStart ? 1 : 0, anchoredEnd ? -1 : void 0);
+	const atoms = [];
+	const widenLastAtom = () => {
+		if (atoms.length === 0) {
+			atoms.push("*");
+			return;
 		}
+		atoms[atoms.length - 1] = "*";
+	};
+	let index = 0;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "|") return "*";
+		if (character === "\\") {
+			const escape = readEscape(body, index);
+			index = escape.next;
+			atoms.push(escape.atom);
+			continue;
+		}
+		if (character === "[" || character === "(" || character === "{") {
+			const read = readBracketedConstruct(body, index, character);
+			if (read === "widens-pattern") return "*";
+			index = read.next;
+			if (read.widensLastAtom) widenLastAtom();
+			else atoms.push("*");
+			continue;
+		}
+		if (character === "*" || character === "+" || character === "?") {
+			index += 1;
+			widenLastAtom();
+			continue;
+		}
+		const codePoint = body.codePointAt(index);
+		const atom = codePoint === void 0 ? character : String.fromCodePoint(codePoint);
+		index += atom.length;
+		atoms.push(atom === "." || ")]}^$".includes(atom) ? "*" : atom);
 	}
+	const glob = atoms.join("");
+	return `${anchoredStart ? "" : "*"}${glob}${anchoredEnd ? "" : "*"}`;
+}
+/**
+* Convert rulesync permissions config to Warp command allow/deny regex lists.
+* The `bash` category maps to both lists. The all-tools `*` category's
+* restricting rules are read too — a rule written there covers shell commands
+* as well, and ignoring it would auto-approve a command the file blocks — but
+* they only *withhold* the allow rules they cover: Warp's denylist is a regex
+* list that replaces the tool's built-in default one, so writing a pattern
+* there that may not even name a command would cost more protection than it
+* adds. Other categories are dropped (with a warning when they carry `deny`
+* rules).
+*/
+function convertRulesyncToWarpPermissions({ config, logger }) {
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	const { allow, deny, shadowedAllowPatterns, unwrittenDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+		rules,
+		writesAllToolsDeny: false,
+		normalizePattern: warpCommandPatternToGlob
+	});
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "Warp",
+		surfaceLabel: "agent_mode_command_execution_allowlist/denylist",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unwrittenDenyReason: "Writing any denylist replaces Warp's built-in default one, and a pattern written under '*' need not be a command at all.",
+		unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	return {
 		allow,
 		deny
@@ -64630,4 +65865,4 @@ async function importChecksCore(params) {
 //#endregion
 export { SHARED_USER_MANAGED_CONFIG_PATHS as $, MAX_FILE_SIZE as $t, groupSpellingsByCaseFoldedIdentity as A, DEPRECATED_FEATURE_REPLACEMENTS as An, isFileSystemError as At, RulesyncPermissions as B, removeFile as Bt, CLAUDECODE_SKILLS_DIR_PATH as C, RULESYNC_RULES_RELATIVE_DIR_PATH as Cn, createTempDirectory as Ct, FACTORYDROID_DIR as D, parseCommaSeparatedList as Dn, getFileSize as Dt, CODEXCLI_DIR as E, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as En, fileExists as Et, RulesyncSubagentFrontmatterSchema as F, stripControlCharactersKeepingLineFeeds as Fn, pathEscapesRoot as Ft, resolveRulesyncSourceWritePath as G, toPosixPath as Gt, RulesyncIgnore as H, removeTempDirectory as Ht, RulesyncSkill as I, stripHiddenCharacters as In, readFileContent as It, RulesyncCommandFrontmatterSchema as J, ALL_TOOL_TARGETS as Jt, parseJsonc as K, writeFileBuffer as Kt, RulesyncSkillFrontmatterSchema as L, readFileContentOrNull as Lt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as M, truncateText as Mn, listDirectoryEntryNames as Mt, getLocalSkillDirNames as N, hasDeceptiveHiddenCharacters as Nn, listFilePathsRecursively as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, ALL_FEATURES as On, getHomeDirectory as Ot, RulesyncSubagent as P, stripControlCharacters as Pn, listSubdirectoryNames as Pt, loadYaml as Q, CURATED_RULES_FEATURE_SUBDIR as Qt, RulesyncRule as R, removeDirectory as Rt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as S, RULESYNC_RELATIVE_DIR_PATH as Sn, checkPathTraversal as St, CODEXCLI_BASH_RULES_FILE_NAME as T, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Tn, ensureDir as Tt, RulesyncHooks as U, resolvePath as Ut, RulesyncMcp as V, removeFileStrict as Vt, getRulesyncSourceCandidates as W, runWithDirectoryRollback as Wt, RulesyncCheckFrontmatterSchema as X, PACKAGING_TOOL_TARGETS as Xt, RulesyncCheck as Y, ALL_TOOL_TARGETS_WITH_WILDCARD as Yt, stringifyFrontmatter as Z, ToolTargetSchema as Zt, QWENCODE_DIR as _, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as _n, CLIError as _t, getProcessorRegistryEntry as a, RULESYNC_CONFIG_SCHEMA_URL as an, ConfigFileSchema as at, CLAUDECODE_LOCAL_RULE_FILE_NAME as b, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as bn, assertTreeContainsNoSymlinks as bt, RulesProcessor as c, RULESYNC_HOOKS_FILE_NAME as cn, findControlCharacter as ct, displayWidthOf as d, RULESYNC_IGNORE_RELATIVE_FILE_PATH as dn, WarningCollectingLogger as dt, RULESYNC_AIIGNORE_FILE_NAME as en, SKILL_FILE_NAME as et, shortenToWidth as f, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as fn, fallbackLogger as ft, CommandsProcessor as g, RULESYNC_MCP_SCHEMA_URL as gn, withWarnOnceScope as gt, HooksProcessor as h, RULESYNC_MCP_RELATIVE_FILE_PATH as hn, resetWarnedOnceMessages as ht, inspectInputRoots as i, RULESYNC_CONFIG_RELATIVE_FILE_PATH as in, CONFLICTING_TARGET_PAIRS as it, AUGMENTCODE_DIR as j, formatError as jn, isSymlink as jt, caseFoldIdentity as k, ALL_FEATURES_WITH_WILDCARD as kn, isFileNotFoundError as kt, SubagentsProcessor as l, RULESYNC_HOOKS_LEGACY_FILE_NAME as ln, ConsoleLogger as lt, IgnoreProcessor as m, RULESYNC_MCP_LEGACY_FILE_NAME as mn, withFallbackLoggerTarget as mt, formatSourceLoadFailure as n, RULESYNC_CHECKS_RELATIVE_DIR_PATH as nn, mergeInputRootConfigs as nt, convertFromTool as o, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as on, GITIGNORE_DESTINATION_KEY as ot, McpProcessor as p, RULESYNC_MCP_FILE_NAME as pn, warnOnConflictingFlags as pt, RulesyncCommand as q, writeFileContent as qt, generate as r, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as rn, resolveEffectiveInputRoots as rt, isPackagingToolTarget as s, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as sn, SourceEntrySchema as st, importFromTool as t, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as tn, ConfigResolver as tt, SkillsProcessor as u, RULESYNC_HOOKS_RELATIVE_FILE_PATH as un, JsonLogger as ut, QWENCODE_LOCAL_RULE_FILE_NAME as v, RULESYNC_PERMISSIONS_FILE_NAME as vn, ErrorCodes as vt, ChecksProcessor as w, RULESYNC_SKILLS_RELATIVE_DIR_PATH as wn, directoryExists as wt, CLAUDECODE_MEMORIES_DIR_NAME as x, RULESYNC_PERMISSIONS_SCHEMA_URL as xn, assertWritablePathInsideRoot as xt, CLAUDECODE_DIR as y, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as yn, assertDirectoryIfExists as yt, RulesyncRuleFrontmatterSchema as z, removeDirectoryStrict as zt };
 
-//# sourceMappingURL=import-DijDR24m.js.map
+//# sourceMappingURL=import-1-jjDDAm.js.map