rulesync 16.19.0 → 16.20.0

package/dist/{import-q1SKbuFR.cjs → import-BlhbArzI.cjs}

@@ -10656,11 +10656,30 @@ const CODEXCLI_OVERRIDE_KEYS = [
 ];
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
+/**
+* Rebuild a parsed document without its prototype-pollution keys.
+*
+* Every object is rebuilt, not just the ones that are already plain: a literal
+* `"__proto__"` is assigned with `obj[key] = value` by `jsonc-parser`, which
+* *replaces the containing object's prototype* instead of adding a key. Such
+* an object is no longer a plain object, and the injected value is reachable
+* through it by plain property access while `Object.keys` and `JSON.stringify`
+* show nothing — so leaving it as it came out of the parser would both hide a
+* server or permission the file does not state and, at the root, cost the
+* whole document (see {@link parseSharedConfig}). Rebuilding gives every
+* object `Object.prototype` back and drops the injected value with the key.
+*
+* Dates are the one object the YAML and TOML parsers produce that is not a
+* mapping, so they are passed through rather than flattened into `{}`.
+*/
 function sanitizeSharedConfigValue(value) {
 	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
-	if (!isPlainObject$1(value)) return value;
+	if (value === null || typeof value !== "object" || value instanceof Date) return value;
 	const result = {};
-	for (const [key, nested] of Object.entries(omitPrototypePollutionKeys(value))) result[key] = sanitizeSharedConfigValue(nested);
+	for (const [key, nested] of Object.entries(value)) {
+		if (isPrototypePollutionKey(key)) continue;
+		result[key] = sanitizeSharedConfigValue(nested);
+	}
 	return result;
 }
 /**
@@ -10689,11 +10708,12 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (parsed === void 0 || parsed === null) return {};
-	if (!isPlainObject$1(parsed)) {
+	const sanitized = sanitizeSharedConfigValue(parsed);
+	if (!isPlainObject$1(sanitized)) {
 		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
 		return {};
 	}
-	return sanitizeSharedConfigValue(parsed);
+	return sanitized;
 }
 /**
 * Serialize a shared config document. YAML output always ends with exactly one
@@ -10710,6 +10730,571 @@ function stringifySharedConfig({ format, document }) {
 	return JSON.stringify(document, null, 2);
 }
 /**
+* Where the line holding `from` starts and where the line starting at `from`
+* ends: the nearest `\r` or `\n` in each direction, or the edge of the text.
+*
+* Both characters count in both directions, because the JSONC scanner treats
+* either as a line break. A file written with lone CRs parses without an error
+* and so reaches these paths, and a comment read only up to the next `\n`
+* would run past its own line and take the closing brace — or a whole sibling
+* key — with it.
+*/
+function endOfLineFrom({ text, from }) {
+	for (let index = from; index < text.length; index += 1) {
+		const character = text[index];
+		if (character === "\n" || character === "\r") return index;
+	}
+	return text.length;
+}
+function startOfLineAt({ text, from }) {
+	for (let index = from - 1; index >= 0; index -= 1) {
+		const character = text[index];
+		if (character === "\n" || character === "\r") return index + 1;
+	}
+	return 0;
+}
+/**
+* Read the indentation and line ending a JSONC document already uses, so
+* inserted properties match the surrounding file instead of imposing the
+* 2-space `JSON.stringify` shape on a file written with 4 spaces or tabs.
+*
+* The root object's first property decides, located through the syntax tree
+* rather than by scanning for the first indented line: a file opening with a
+* banner comment indents that comment's continuation lines too (` * ...`
+* aligns at three columns), and reading the width off one of those would leave
+* `modify` re-indenting the lines it touches to a width nothing else in the
+* file uses. A property that does not start its own line — a one-line object,
+* or an empty one — carries no indent to read, so those fall back to the
+* 2-space default the whole-document writer emits.
+*/
+function detectJsoncFormattingOptions({ text, root }) {
+	const eol = "\n";
+	const first = root.children?.[0];
+	const indent = first === void 0 ? "" : text.slice(startOfLineAt({
+		text,
+		from: first.offset
+	}), first.offset);
+	if (indent === "" || indent.length > 8 || !/^[ \t]+$/.test(indent)) return {
+		tabSize: 2,
+		insertSpaces: true,
+		eol
+	};
+	if (indent.includes("	")) return {
+		tabSize: 2,
+		insertSpaces: false,
+		eol
+	};
+	return {
+		tabSize: indent.length,
+		insertSpaces: true,
+		eol
+	};
+}
+/**
+* Whether the document states a key no edit-based write can be trusted with.
+*
+* Two kinds, both answered from the syntax tree because the parsed value no
+* longer knows about either:
+*
+* - A key stated twice. That is legal JSON text which every reader resolves
+*   last-wins, while `modify` edits the *first* occurrence — so an edit-based
+*   write would land on the dead copy and leave the live one saying whatever
+*   it said before. For an owned key that is a silent ownership failure: a
+*   `deny` rulesync just wrote would sit above the `allow` the tool reads.
+* - `__proto__`, `constructor` or `prototype`. None survives into the parsed
+*   document — a nested one is dropped, a root-level `__proto__` replaces the
+*   root's prototype — so an edit-based write would find no difference to
+*   apply and leave the key in the file.
+*
+* The whole-document writer resolves duplicates last-wins and drops pollution
+* keys, which is what it has always done, so those files go to it.
+*/
+function statesUneditableKeys(node) {
+	if (node.type === "array") return (node.children ?? []).some((child) => statesUneditableKeys(child));
+	if (node.type !== "object") return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const property of node.children ?? []) {
+		const key = property.children?.[0]?.value;
+		if (typeof key === "string") {
+			if (seen.has(key) || isPrototypePollutionKey(key)) return true;
+			seen.add(key);
+		}
+		const value = property.children?.[1];
+		if (value !== void 0 && statesUneditableKeys(value)) return true;
+	}
+	return false;
+}
+/**
+* The offset just past the whitespace and comments starting at `from`.
+*/
+function skipJsoncTrivia({ text, from }) {
+	let index = from;
+	while (index < text.length) {
+		const char = text[index];
+		if (char === " " || char === "	" || char === "\n" || char === "\r") {
+			index += 1;
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "/") {
+			index = endOfLineFrom({
+				text,
+				from: index
+			});
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "*") {
+			const commentEnd = text.indexOf("*/", index + 2);
+			index = commentEnd === -1 ? text.length : commentEnd + 2;
+			continue;
+		}
+		break;
+	}
+	return index;
+}
+/**
+* Where the deletion of a property whose text ends at `end` should stop.
+*
+* A comment written after the property on its own line is that property's
+* note — `"stale": {...}, // retired` says something about `stale` and nothing
+* about the key above it. Leaving it behind would re-attach it to whichever
+* property now ends that line, so a note about a server rulesync removed would
+* read as a note about the one before it. A comment with a sibling after it on
+* the same line is not claimed: it may belong to either.
+*/
+function endOfRemoval({ text, end }) {
+	const stop = endOfLineFrom({
+		text,
+		from: end
+	});
+	const tail = text.slice(end, stop);
+	return /^[ \t]*\/\/[^\r\n]*$/.test(tail) || /^[ \t]*\/\*(?:[^*]|\*(?!\/))*\*\/[ \t]*$/.test(tail) || /^[ \t]*$/.test(tail) ? stop : end;
+}
+/**
+* Where the deletion of a property ending at `end` should begin.
+*
+* A property that has its line to itself is removed with the line: its
+* indentation and the newline above it would otherwise be left as a blank gap.
+* A property sharing its line with something else — a sibling, or the object's
+* own `}` — is removed on its own, because swallowing the newline would splice
+* whatever follows onto the line above, and a line comment up there would
+* comment it out: a key rulesync means to write would vanish from the file, or
+* the closing brace would, leaving the document unparsable.
+*/
+function startOfRemoval({ text, propertyOffset, end }) {
+	let after = end;
+	while (text[after] === " " || text[after] === "	") after += 1;
+	if (!(after >= text.length || text[after] === "\n" || text[after] === "\r")) return propertyOffset;
+	let start = propertyOffset;
+	while (start > 0 && (text[start - 1] === " " || text[start - 1] === "	")) start -= 1;
+	if (start > 0 && text[start - 1] === "\n") start -= 1;
+	if (start > 0 && text[start - 1] === "\r") start -= 1;
+	return start;
+}
+/**
+* Delete the property at `path` from `text`, taking its own line and its
+* separating comma but nothing else.
+*
+* `modify(..., undefined)` would do this, but the range it deletes runs from
+* the end of the *previous* property to the end of this one — or, for the
+* first property of an object, all the way to where the *next* one starts. So
+* removing one key takes the comments sitting between it and the keys around
+* it, including the comment describing the key that survives.
+* Deleting the property's own text instead leaves the comments around it in
+* place. Only the note that follows the property on its own line goes with it
+* (see {@link endOfRemoval}); a comment written on the line *above* is left
+* behind rather than guessed at, which is the direction this whole path errs
+* in.
+*/
+function removeJsoncProperty({ text, path }) {
+	const root = (0, jsonc_parser.parseTree)(text, [], { allowTrailingComma: true });
+	const property = root === void 0 ? void 0 : (0, jsonc_parser.findNodeAtLocation)(root, [...path])?.parent;
+	const object = property?.parent;
+	if (property?.type !== "property" || object?.type !== "object") return text;
+	const siblings = object.children ?? [];
+	const edits = [];
+	let end = property.offset + property.length;
+	const afterProperty = skipJsoncTrivia({
+		text,
+		from: end
+	});
+	if (text[afterProperty] === ",") end = afterProperty + 1;
+	else {
+		const previous = siblings[siblings.indexOf(property) - 1];
+		if (previous !== void 0) {
+			const comma = skipJsoncTrivia({
+				text,
+				from: previous.offset + previous.length
+			});
+			if (text[comma] === ",") edits.push({
+				offset: comma,
+				length: 1,
+				content: ""
+			});
+		}
+	}
+	end = endOfRemoval({
+		text,
+		end
+	});
+	const start = startOfRemoval({
+		text,
+		propertyOffset: property.offset,
+		end
+	});
+	edits.push({
+		offset: start,
+		length: end - start,
+		content: ""
+	});
+	return (0, jsonc_parser.applyEdits)(text, edits);
+}
+/**
+* Where the comment written at `from` (past any spaces or tabs) ends, or
+* `undefined` if what stands there is not a comment.
+*/
+function endOfNoteAt({ text, from }) {
+	let cursor = from;
+	while (text[cursor] === " " || text[cursor] === "	") cursor += 1;
+	if (text.startsWith("//", cursor)) return endOfLineFrom({
+		text,
+		from: cursor
+	});
+	if (text.startsWith("/*", cursor)) {
+		const closing = text.indexOf("*/", cursor + 2);
+		return closing === -1 ? void 0 : closing + 2;
+	}
+}
+/**
+* Every comment written at `from`, as spans of `text`, each span running from
+* where the previous one stopped so the whitespace between them is carried
+* along. A comma is stepped over once (a file may spell one before its note,
+* or after it) but never collected, because the separator belongs to the
+* property rather than to its note. So a file that writes a note on each side
+* of its comma gets both of them back, in order, after the comma: the notes
+* stay with the key they describe, and the comma keeps the place the file gave
+* it. The run stops at the first thing that is neither: a newline ends it, so
+* a comment on the next line is left alone.
+*/
+function notesAt({ text, from }) {
+	const spans = [];
+	let cursor = from;
+	let steppedOverComma = false;
+	for (;;) {
+		const end = endOfNoteAt({
+			text,
+			from: cursor
+		});
+		if (end !== void 0) {
+			spans.push({
+				start: cursor,
+				end
+			});
+			cursor = end;
+			continue;
+		}
+		if (steppedOverComma) return spans;
+		let comma = cursor;
+		while (text[comma] === " " || text[comma] === "	") comma += 1;
+		if (text[comma] !== ",") return spans;
+		steppedOverComma = true;
+		cursor = comma + 1;
+	}
+}
+/**
+* Detach the notes written at the point where the object at `path` will take a
+* new key: after its last property (and around the comma a trailing-comma file
+* spells there), or just inside the `{` when it has no properties yet.
+*
+* `modify` computes its insert from exactly that point — in front of a note
+* written there — so applying the edit unchanged re-emits the note *after* the
+* key that was just inserted: `"stale": {...} // retired` turns into a note
+* about a server rulesync has only now written, and `{ /* none yet *\/ }`
+* turns into a note about the first entry rulesync puts in it. Lifting the
+* notes out before the insert and putting them back afterwards keeps them
+* where their author wrote them, matching what {@link endOfRemoval} does on
+* the way out.
+*
+* Returns `undefined` when there is no such note, which is the common case.
+*/
+function detachTrailingNote({ text, path }) {
+	const root = (0, jsonc_parser.parseTree)(text, [], { allowTrailingComma: true });
+	const object = root === void 0 ? void 0 : (0, jsonc_parser.findNodeAtLocation)(root, [...path]);
+	if (object?.type !== "object") return void 0;
+	const property = object.children?.at(-1);
+	const anchorKey = property?.children?.[0]?.value;
+	if (property !== void 0 && typeof anchorKey !== "string") return void 0;
+	const spans = notesAt({
+		text,
+		from: property === void 0 ? object.offset + 1 : property.offset + property.length
+	});
+	if (spans.length === 0) return void 0;
+	let stripped = text;
+	for (const span of spans.toReversed()) stripped = stripped.slice(0, span.start) + stripped.slice(span.end);
+	return {
+		text: stripped,
+		note: spans.map((span) => text.slice(span.start, span.end)).join(""),
+		anchorKey: typeof anchorKey === "string" ? anchorKey : void 0
+	};
+}
+/**
+* Put a note detached by {@link detachTrailingNote} back where it was: after
+* the property it describes (behind the comma the insert gave that property),
+* or just inside the `{` of the object it was written in when there was no
+* property to describe. Returns `undefined` if that place can no longer be
+* located, so the caller can fall back to the plain insert rather than drop
+* the note.
+*/
+function reattachTrailingNote({ text, path, anchorKey, note }) {
+	const root = (0, jsonc_parser.parseTree)(text, [], { allowTrailingComma: true });
+	const location = anchorKey === void 0 ? [...path] : [...path, anchorKey];
+	const anchor = root === void 0 ? void 0 : (0, jsonc_parser.findNodeAtLocation)(root, location);
+	if (anchor === void 0) return void 0;
+	if (anchorKey === void 0) {
+		if (anchor.type !== "object") return void 0;
+		const brace = anchor.offset + 1;
+		return text.slice(0, brace) + note + text.slice(brace);
+	}
+	let cursor = anchor.offset + anchor.length;
+	while (text[cursor] === " " || text[cursor] === "	") cursor += 1;
+	if (text[cursor] === ",") cursor += 1;
+	return text.slice(0, cursor) + note + text.slice(cursor);
+}
+/**
+* Write `value` at `[...path, key]`, keeping the trailing note of the property
+* the new key is inserted after (see {@link detachTrailingNote}). Replacing an
+* existing key needs none of this: `modify` rewrites the value's own span and
+* leaves every comment where it is.
+*/
+function insertJsoncProperty({ text, path, key, value, options }) {
+	const write = (source) => (0, jsonc_parser.applyEdits)(source, (0, jsonc_parser.modify)(source, [...path, key], value, options));
+	const detached = detachTrailingNote({
+		text,
+		path
+	});
+	if (detached === void 0) return write(text);
+	return reattachTrailingNote({
+		text: write(detached.text),
+		path,
+		anchorKey: detached.anchorKey,
+		note: detached.note
+	}) ?? write(text);
+}
+/**
+* How much work an edit-based write may cost, as the file's length times the
+* number of keys that differ.
+*
+* Each changed key re-parses the whole file, so a file whose keys nearly all
+* change costs quadratic work: an 823 KB `opencode.json` whose 6,400 servers
+* are all replaced took 40 seconds to write as edits, and cloning a
+* repository that ships such a file is enough to reach that. Past this budget
+* the file is written whole instead — it loses its comments, the same as a
+* file rulesync cannot parse does, which is the better of the two outcomes
+* against a `generate` that looks like it has hung. The limit is under a
+* second of editing for a replacement and a second or two for an insert,
+* which parses more; a hand-written config file is orders of magnitude below
+* either.
+*/
+const JSONC_EDIT_BUDGET_BYTES = 5e7;
+/**
+* How much text the edits of one write may put into the file, all of them
+* together.
+*
+* The budget above charges by the number of keys that differ, which prices an
+* insert of a whole subtree as one edit — but `modify` re-indents the text it
+* writes, and it does that in time quadratic in the length of that text: a
+* 127 KB value takes half a second to write, a 516 KB one 9 seconds, a 1 MB
+* one 35. The cost is quadratic in the total as well as in each part, because
+* every edit re-indents against the text the ones before it left, so a limit
+* on the widest single value would let a handful of values just under it cost
+* minutes between them. This is a limit on their sum, which holds the
+* re-indenting to about a second whether it arrives as one value or twenty.
+* A hand-written config file changes a few hundred bytes at a time.
+*/
+const JSONC_EDIT_WRITTEN_BYTES = 2e5;
+/**
+* How much text one edit writes: the value as `modify` formats it, plus the
+* indentation that formatting puts in front of every line of it.
+*
+* A value written deep in a document is written far wider than it reads on
+* its own — a 114 KB server list nested 1,200 deep is 36 MB of text once
+* every line of it carries 2,400 spaces — so measuring the value alone would
+* miss the whole of what makes that write expensive.
+*/
+function measureJsoncWrite({ value, depth }) {
+	const formatted = JSON.stringify(value, null, 2) ?? "";
+	let lines = 1;
+	for (let at = formatted.indexOf("\n"); at !== -1; at = formatted.indexOf("\n", at + 1)) lines += 1;
+	return formatted.length + lines * 2 * depth;
+}
+/**
+* How much {@link applyJsoncObjectEdits} would write, deciding each key
+* exactly the way it does — the two walk together, so a new case in one needs
+* the same case here. It reports both how many edits there would be and how
+* much text they would write between them, because the two are budgeted
+* separately: one stands for the parse each edit costs, the other for the
+* re-indenting each edit costs. Counting is a walk of the documents alone: no
+* text is touched, so the budgets above are spent on the write rather than on
+* finding out how large the write is.
+*/
+function countJsoncEdits({ base, next, depth }) {
+	let edits = 0;
+	let written = 0;
+	for (const [key, value] of Object.entries(next)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const present = Object.hasOwn(base, key);
+		const previous = present ? base[key] : void 0;
+		if (value === void 0) {
+			if (present) edits += 1;
+			continue;
+		}
+		if (isPlainObject$1(previous) && isPlainObject$1(value)) {
+			const nested = countJsoncEdits({
+				base: previous,
+				next: value,
+				depth: depth + 1
+			});
+			edits += nested.edits;
+			written += nested.written;
+			continue;
+		}
+		if (present && (0, node_util.isDeepStrictEqual)(previous, value)) continue;
+		edits += 1;
+		written += measureJsoncWrite({
+			value,
+			depth: depth + 1
+		});
+	}
+	for (const key of Object.keys(base)) if (!Object.hasOwn(next, key)) edits += 1;
+	return {
+		edits,
+		written
+	};
+}
+/**
+* Rewrite `text` so the object at `path` matches `next`, touching only the
+* spans that actually differ from `base`.
+*
+* Each difference is applied on its own — `modify` computes an edit against
+* the current text and `applyEdits` returns the text with that edit applied,
+* which is then the input for the next difference, because every edit shifts
+* the offsets the following ones would have been computed from. Nested objects
+* present on both sides are recursed into rather than replaced wholesale, so a
+* one-key change deep in the document leaves its siblings — and the comments
+* attached to them — byte-identical.
+*
+* Every difference re-parses the document, so the work is one parse of the
+* file per *changed* key rather than one parse overall. A regeneration that
+* changes nothing costs a single parse, and the files this runs on are config
+* files, so the shape is left simple rather than batched — with the file
+* large enough and enough of it changing, the product of the two is what
+* {@link JSONC_EDIT_BUDGET_BYTES} keeps off this path.
+*/
+function applyJsoncObjectEdits({ text, base, next, path, options }) {
+	let result = text;
+	for (const [key, value] of Object.entries(next)) {
+		if (isPrototypePollutionKey(key)) continue;
+		const present = Object.hasOwn(base, key);
+		const previous = present ? base[key] : void 0;
+		if (value === void 0) {
+			if (present) result = removeJsoncProperty({
+				text: result,
+				path: [...path, key]
+			});
+			continue;
+		}
+		if (isPlainObject$1(previous) && isPlainObject$1(value)) {
+			result = applyJsoncObjectEdits({
+				text: result,
+				base: previous,
+				next: value,
+				path: [...path, key],
+				options
+			});
+			continue;
+		}
+		if (present) {
+			if ((0, node_util.isDeepStrictEqual)(previous, value)) continue;
+			result = (0, jsonc_parser.applyEdits)(result, (0, jsonc_parser.modify)(result, [...path, key], value, options));
+			continue;
+		}
+		result = insertJsoncProperty({
+			text: result,
+			path,
+			key,
+			value,
+			options
+		});
+	}
+	for (const key of Object.keys(base)) if (!Object.hasOwn(next, key)) result = removeJsoncProperty({
+		text: result,
+		path: [...path, key]
+	});
+	return result;
+}
+/**
+* Serialize a document back over the file it was parsed from.
+*
+* For every format but JSONC this is {@link stringifySharedConfig}: those
+* files carry no comments, so re-serializing loses nothing. A JSONC file does
+* carry comments — `.vscode/settings.json` and `opencode.json` are hand-edited
+* far more often than they are generated — and re-serializing would delete
+* every one of them, along with the author's blank lines and key order. So a
+* JSONC document is written back as a set of edits against the existing text:
+* regions the merge did not change stay byte-identical, and a regeneration
+* that changes nothing leaves the file untouched.
+*
+* The whole-document writer is still used when there is nothing to preserve or
+* nothing to edit against:
+*
+* - an empty (or whitespace-only) file, which has no comments to keep;
+* - a file that does not parse, or whose root is not an object — editing it
+*   would mean guessing at the author's intent, and the callers that reach
+*   here have already decided (via `invalidRootPolicy`) that such a file is
+*   replaced;
+* - a file stating the same key twice, or using `__proto__`, `constructor` or
+*   `prototype` as a key (see {@link statesUneditableKeys});
+* - a file so large, with so much of it changing, that editing it key by key
+*   would take longer than a user would wait (see
+*   {@link JSONC_EDIT_BUDGET_BYTES}), or changed keys that write more new text
+*   between them than re-indenting can afford (see
+*   {@link JSONC_EDIT_WRITTEN_BYTES});
+* - a file the editor itself refuses, which it answers with an exception
+*   rather than a result.
+*/
+function serializeSharedConfig({ format, document, existingContent }) {
+	const whole = stringifySharedConfig({
+		format,
+		document
+	});
+	if (format !== "jsonc" || existingContent.trim() === "") return whole;
+	try {
+		const errors = [];
+		const root = (0, jsonc_parser.parseTree)(existingContent, errors, { allowTrailingComma: true });
+		if (root === void 0 || errors.length > 0 || root.type !== "object" || statesUneditableKeys(root)) return whole;
+		const base = sanitizeSharedConfigValue((0, jsonc_parser.getNodeValue)(root));
+		if (!isPlainObject$1(base)) return whole;
+		const span = Math.max(existingContent.length, whole.length);
+		const cost = countJsoncEdits({
+			base,
+			next: document,
+			depth: 0
+		});
+		if (cost.written > JSONC_EDIT_WRITTEN_BYTES || cost.edits * span > JSONC_EDIT_BUDGET_BYTES) return whole;
+		return applyJsoncObjectEdits({
+			text: existingContent,
+			base,
+			next: document,
+			path: [],
+			options: { formattingOptions: detectJsoncFormattingOptions({
+				text: existingContent,
+				root
+			}) }
+		});
+	} catch {
+		return whole;
+	}
+}
+/**
 * Shallow merge: every top-level key in `patch` replaces the base key
 * wholesale; all other base keys are preserved. The policy for a feature that
 * owns a fixed set of top-level keys.
@@ -10732,7 +11317,7 @@ function mergeSharedConfigShallow({ base, patch }) {
 function mergeSharedConfigDeep({ base, patch }) {
 	const result = { ...base };
 	for (const [key, patchValue] of Object.entries(patch)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (isPrototypePollutionKey(key)) continue;
 		if (patchValue === void 0) {
 			delete result[key];
 			continue;
@@ -11314,7 +11899,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 /**
 * Execute a feature's declared write to a gateway-managed shared file: parse
 * the existing content, merge the patch under the feature's declared policy,
-* and serialize. Throws when the file or feature is undeclared, when a
+* and serialize it back over the existing content (see
+* {@link serializeSharedConfig}, which keeps a JSONC file's comments and
+* formatting outside the spans the merge actually changed). Throws when the
+* file or feature is undeclared, when a
 * `replace-owned-keys` patch strays outside its owned keys, or when the
 * feature's policy is `custom` (those calls go to the named policy function
 * instead).
@@ -11340,9 +11928,10 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 			patch
 		});
 		for (const [key, value] of Object.entries(patch)) if (value === void 0) delete document[key];
-		return stringifySharedConfig({
+		return serializeSharedConfig({
 			format: declaration.format,
-			document
+			document,
+			existingContent
 		});
 	}
 	const merged = mergeSharedConfigDeep({
@@ -11350,9 +11939,10 @@ function applySharedConfigPatch({ fileKey, feature, existingContent, patch, file
 		patch
 	});
 	for (const key of policy.replaceKeys ?? []) if (patch[key] !== void 0) merged[key] = sanitizeSharedConfigValue(patch[key]);
-	return stringifySharedConfig({
+	return serializeSharedConfig({
 		format: declaration.format,
-		document: merged
+		document: merged,
+		existingContent
 	});
 }
 const READ_TOOL_NAME = "Read";
@@ -26754,7 +27344,7 @@ var CopilotMcp = class CopilotMcp extends ToolMcp {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = this.fileContent !== void 0 ? JSON.parse(this.fileContent) : {};
+		this.json = this.fileContent !== void 0 ? parseJsonc$8(this.fileContent) : {};
 	}
 	getJson() {
 		return this.json;
@@ -28977,7 +29567,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		}, null, 2) });
 	}
 	validate() {
-		const json = JSON.parse(this.fileContent || "{}");
+		const json = parseJsonc$8(this.fileContent || "{}");
 		const result = KiloConfigSchema.safeParse(json);
 		if (!result.success) return {
 			success: false,
@@ -30053,7 +30643,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 		}, null, 2) });
 	}
 	validate() {
-		const json = JSON.parse(this.fileContent || "{}");
+		const json = parseJsonc$8(this.fileContent || "{}");
 		const result = OpencodeConfigSchema.safeParse(json);
 		if (!result.success) return {
 			success: false,
@@ -33507,41 +34097,123 @@ function matchesGlobStep(step, character) {
 	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
 	return step.negated ? !admitted : admitted;
 }
+/** Whether two single-character steps can both match one same character. */
+function stepsShareACharacter(left, right) {
+	if (left.kind === "any" || right.kind === "any") return true;
+	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
+	if (left.kind === "literal") return matchesGlobStep(right, left.character);
+	if (right.kind === "literal") return matchesGlobStep(left, right.character);
+	return true;
+}
+/** Whether every step from `index` on can match the empty string. */
+function isAllStars(steps, index) {
+	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
+	return true;
+}
+/**
+* The most work one intersection walk will do, counted in cells times the cost
+* of one. Past it the two patterns are reported as intersecting without being
+* walked: the product of two lengths grows quadratically, and a pattern long
+* enough to reach this is pathological rather than a command anybody typed.
+* Answering `true` withholds an `allow`, which is the direction that fails
+* closed.
+*/
+const MAX_INTERSECTION_CELLS = 1e6;
+/**
+* The most work a whole run of comparisons will do. A caller holding R
+* restrictions and A allow rules asks R x A times, and a per-pair cap alone
+* bounds none of that: a hundred restrictions against a hundred allow rules,
+* each pattern just under the per-pair cap, is ten thousand affordable walks
+* that together take minutes. The shared budget is spent down across the run
+* and, once it is gone, every remaining pair is reported as intersecting —
+* again the direction that withholds an `allow` rather than writing one.
+*/
+const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
+/**
+* What a pair costs on top of the cells it walks: the call itself, sizing and
+* filling the two rows the table is held in, and collecting the answer.
+* Charging only cells would leave the *number* of pairs unbounded — a pair of
+* one-step patterns walks a single cell, so n short restrictions against n
+* short allow rules is n squared comparisons that never spend the budget down
+* however many of them there are. Charging a floor per pair puts pair count and
+* walk length on the same exhaustible resource.
+*
+* For the short patterns of an ordinary config the floor is the whole charge,
+* which lowers how many pairs a run compares from around a million to about
+* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
+* that line withholds every allow it has not yet compared, the same fail-closed
+* answer exhaustion gives everywhere else.
+*/
+const INTERSECTION_PAIR_COST = 64;
+/**
+* A budget for one caller's run of comparisons. Hand the same one to every
+* `parsedGlobsIntersect` call that belongs together — one adapter reading one
+* config — so the run as a whole stays bounded rather than only each pair in
+* it.
+*/
+function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
+	return { remaining };
+}
 /**
-* Parse `glob` once and return a predicate that walks it, for a caller that
-* tests the same glob against a whole list of names.
+* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
+* the same pattern against a whole list parses it once and reuses the result.
 */
-function compileGlob(glob) {
+function parseGlobPattern(glob) {
 	const steps = parseGlob(glob);
-	return (value) => matchesParsedGlob(steps, value);
+	return {
+		steps,
+		maxRanges: maxRangeCount(steps)
+	};
 }
-function matchesParsedGlob(steps, value) {
-	const characters = [...value];
-	let stepIndex = 0;
-	let characterIndex = 0;
-	let starStepIndex = -1;
-	let starCharacterIndex = 0;
-	while (characterIndex < characters.length) {
-		const step = steps[stepIndex];
-		if (step?.kind === "star") {
-			starStepIndex = stepIndex;
-			starCharacterIndex = characterIndex;
-			stepIndex += 1;
-			continue;
+/**
+* What one cell can cost, as a multiplier on the cell count. A literal met by a
+* `[a-z...]` class walks that class's ranges, so a single class carrying
+* thousands of them turns a walk that looks affordable by cell count alone into
+* a quadratic one — which is why the budget is spent on cells times this rather
+* than on cells.
+*/
+function maxRangeCount(steps) {
+	let most = 0;
+	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
+	return most;
+}
+/**
+* `globsIntersect` for two globs already parsed, optionally spending a budget
+* shared with the rest of the caller's run — see `createIntersectionBudget`.
+* Once that budget is exhausted every further pair answers `true` without being
+* walked, so a caller reading the answer as a reason to restrict stays on the
+* safe side.
+*/
+function parsedGlobsIntersect(left, right, budget) {
+	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
+	const cellCost = 1 + left.maxRanges + right.maxRanges;
+	const cost = rows.length * columns.length * cellCost;
+	if (cost > MAX_INTERSECTION_CELLS) return true;
+	if (budget !== void 0) {
+		const charge = cost + INTERSECTION_PAIR_COST;
+		if (charge > budget.remaining) {
+			budget.remaining = 0;
+			return true;
 		}
-		if (step !== void 0 && matchesGlobStep(step, characters[characterIndex] ?? "")) {
-			stepIndex += 1;
-			characterIndex += 1;
-			continue;
+		budget.remaining -= charge;
+	}
+	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
+	for (let i = rows.length - 1; i >= 0; i--) {
+		const row = Array.from({ length: columns.length + 1 }, () => false);
+		row[columns.length] = isAllStars(rows, i);
+		for (let j = columns.length - 1; j >= 0; j--) {
+			const rowStep = rows[i];
+			const columnStep = columns[j];
+			if (rowStep === void 0 || columnStep === void 0) continue;
+			if (rowStep.kind === "star" || columnStep.kind === "star") {
+				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
+				continue;
+			}
+			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
 		}
-		if (starStepIndex < 0) return false;
-		starCharacterIndex += 1;
-		stepIndex = starStepIndex + 1;
-		characterIndex = starCharacterIndex;
+		next = row;
 	}
-	let remaining = stepIndex;
-	while (steps[remaining]?.kind === "star") remaining += 1;
-	return remaining === steps.length;
+	return next[0] ?? false;
 }
 //#endregion
 //#region src/features/permissions/augmentcode-permissions.ts
@@ -34004,6 +34676,216 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	}
 	return { permission };
 }
+/**
+* Collect the canonical rules that govern shell commands, for the adapters
+* whose tool models commands and nothing else.
+*
+* The `bash` category contributes every rule. The all-tools `*` category
+* contributes its **restricting** rules — `deny` and `ask` — because a rule
+* written there covers shell commands too, and dropping it inverts the
+* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
+* an adapter that reads only `bash` auto-approves the very command the file
+* denies.
+*
+* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
+* need not be a command at all — `secrets/**` under `*` denies a path — and
+* carrying it in the restricting direction only over-restricts, while carrying
+* it in the permissive direction would grant something the author never said
+* about commands. Both directions therefore fail closed.
+*/
+function collectShellCommandRules(permission) {
+	const rules = [];
+	const foreignRestrictingCategories = [];
+	const ignoredAllToolsAllowPatterns = [];
+	for (const [category, categoryRules] of Object.entries(permission)) {
+		if (category === "bash") {
+			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
+				pattern,
+				action,
+				fromAllToolsCategory: false
+			});
+			continue;
+		}
+		if (category === "*") {
+			for (const [pattern, action] of Object.entries(categoryRules)) {
+				if (action === "allow") {
+					ignoredAllToolsAllowPatterns.push(pattern);
+					continue;
+				}
+				rules.push({
+					pattern,
+					action,
+					fromAllToolsCategory: true
+				});
+			}
+			continue;
+		}
+		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
+	}
+	return {
+		rules,
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns
+	};
+}
+/**
+* Build the test an adapter applies to an `allow` pattern before writing it:
+* which restrictions it cannot write name some of the same commands? The
+* answer is the list of those restrictions — empty when the `allow` may be
+* written — so a caller can report both the allow rules it withheld and the
+* restrictions that withheld nothing.
+*
+* Canonically the stricter rule wins **whatever its width** — rulesync collapses
+* colliding rules as `deny > ask > allow` — so the two patterns are compared by
+* asking whether any one command matches both. Width does not enter into it: an
+* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
+* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
+* on every `git ... --force` command even though neither pattern covers the
+* other's spelling. Comparing only identical spellings would let the most
+* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
+*
+* Identical spellings are still compared as strings first, as a shortcut past
+* the walk for the commonest case.
+*
+* `normalizePattern` rewrites a pattern written in the tool's own language into
+* the widest glob it could stand for, for a tool whose patterns are not globs.
+* It reaches the `bash` rules and the `allow` rules, which is where such a
+* pattern is written; an all-tools `*` pattern is canonical — it is read by
+* every tool, so it is a glob already — and is compared as it stands. The
+* rewrite must only ever widen what a pattern covers, so an inexact reading
+* withholds an allow rather than writing one the config restricts — see
+* `warpCommandPatternToGlob`.
+*/
+function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
+	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
+		pattern,
+		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
+	}));
+	return (allowPattern) => {
+		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
+		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
+		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
+	};
+}
+/**
+* Which of the given all-tools `*` restrictions look like they may not name a
+* command at all — the question a `deny` and an `ask` written there both raise.
+*
+* "Withheld no allow rule" alone does not answer it: a config with no `allow`
+* rules has nothing to withhold, and a pattern the author also wrote under
+* `bash` is a command on their own word. Both are excluded, so what remains is
+* a `*` pattern that had allow rules to overlap, overlapped none of them, and
+* is claimed as a command nowhere else — the shape `secrets/**` has.
+*
+* A `bash` restriction never belongs here: it names a command by construction,
+* so overlapping no allow rule says nothing is wrong with it.
+*/
+function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
+	if (!rules.some(({ action }) => action === "allow")) return [];
+	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
+	return (0, es_toolkit.uniq)(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
+}
+/**
+* Split shell-command rules into the allow and deny lists of a tool that models
+* commands with those two tiers and nothing else.
+*
+* `ask` has no list of its own — such a tool already prompts for whatever it
+* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
+* still has to *withhold* the `allow` rules it covers, though: the canonical
+* order is `deny > ask > allow`, so auto-approving a command the file also asks
+* about would answer the prompt the author wanted.
+*
+* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
+* from the all-tools `*` category. Warp's cannot: it matches commands with
+* regular expressions rather than globs, and writing any denylist **replaces**
+* Warp's built-in default one, so an inert `secrets/**` entry there would trade
+* the tool's own protection for a rule that matches no command. Where the deny
+* cannot be written it withholds the allow rules it covers instead, which
+* restricts in the same direction without touching the denylist.
+*
+* A `bash` deny withholds nothing: it names a command by construction, so the
+* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
+* and a narrow deny keeps carving an exception out of a wider allow (`git *`
+* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
+* even where it is written: a pattern under `*` need not name a command —
+* `secrets/**` there denies a path — so as a denylist entry it may match nothing
+* at all, and leaving an overlapping allow beside it would auto-approve the very
+* commands the author meant to stop. Over-restricting a `*` deny that *was* a
+* command pattern is reported; failing open would not be.
+*
+* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
+* patterns are not globs.
+*/
+function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
+	const deny = [];
+	const unwrittenDenyPatterns = [];
+	const restrictions = [];
+	const writtenAllToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	for (const rule of rules) {
+		const { pattern, action, fromAllToolsCategory } = rule;
+		if (action === "allow") continue;
+		if (action !== "deny") {
+			restrictions.push(rule);
+			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
+			continue;
+		}
+		if (writesAllToolsDeny || !fromAllToolsCategory) {
+			deny.push(pattern);
+			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
+		} else unwrittenDenyPatterns.push(pattern);
+		if (fromAllToolsCategory) restrictions.push(rule);
+	}
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
+		normalizePattern,
+		budget
+	});
+	const allow = [];
+	const shadowedAllowPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action } of rules) {
+		if (action !== "allow") continue;
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
+		}
+		allow.push(pattern);
+	}
+	return {
+		allow,
+		deny,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: writtenAllToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
+* Report, for one command-only tool, every canonical rule its two lists could
+* not carry. Every command-only adapter shares this reporting, so a rule
+* dropped in one is worded the same way in all.
+*/
+function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
+	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
+	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
+	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
+	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
+	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
+	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
+}
 //#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
@@ -34934,8 +35816,10 @@ function convertRulesyncToClaudePermissions({ config, logger }) {
 	const ask = [];
 	const deny = [];
 	const actionByEntry = /* @__PURE__ */ new Map();
+	const allToolsPatterns = [];
 	for (const [category, rules] of Object.entries(config.permission)) {
 		const claudeToolName = toClaudeToolName(category);
+		if (category === "*") allToolsPatterns.push(...Object.keys(rules));
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildClaudePermissionEntry(claudeToolName, pattern);
 			const previous = actionByEntry.get(entry);
@@ -34952,6 +35836,7 @@ function convertRulesyncToClaudePermissions({ config, logger }) {
 			}
 		}
 	}
+	if (allToolsPatterns.length > 0) logger?.warn(`Claude Code permissions: a rule names one tool, and there is no name standing for every tool, so the all-tools '*' rule(s) for ${allToolsPatterns.join(", ")} were written as '*(pattern)' entries that Claude Code matches against no tool. Write them under the categories they are meant for (for example 'bash' or 'read') to have them enforced.`);
 	return {
 		allow,
 		ask,
@@ -34996,34 +35881,64 @@ const ClineCommandPermissionsSchema = zod_mini.z.looseObject({
 });
 /**
 * Translate rulesync permission categories into Cline allow/deny command lists.
-* Non-bash categories and `ask` rules are tracked separately so a single
-* translation notice can be surfaced by the caller.
+* The `bash` category maps, and so do the restricting rules of the all-tools
+* `*` category — a rule written there covers shell commands too. Other
+* categories and `ask` rules are tracked separately so a single translation
+* notice can be surfaced by the caller.
 */
 function translateClinePermissions(permission) {
 	const allow = [];
 	const deny = [];
-	const droppedCategories = [];
 	const translatedAskPatterns = [];
-	for (const [category, rules] of Object.entries(permission)) {
-		if (category !== "bash") {
-			droppedCategories.push(category);
-			continue;
-		}
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (action === "ask") {
-				translatedAskPatterns.push(pattern);
-				deny.push(pattern);
+	const shadowedAllowPatterns = [];
+	const droppedCategories = Object.keys(permission).filter((category) => category !== "bash" && category !== "*");
+	const { rules, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permission);
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(rules.filter(({ fromAllToolsCategory }) => fromAllToolsCategory), { budget });
+	const allToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action, fromAllToolsCategory } of rules) {
+		if (action === "ask") {
+			if (fromAllToolsCategory) {
+				allToolsAskPatterns.push(pattern);
 				continue;
 			}
-			if (action === "allow") allow.push(pattern);
-			else if (action === "deny") deny.push(pattern);
+			translatedAskPatterns.push(pattern);
+			deny.push(pattern);
+			continue;
+		}
+		if (action === "deny") {
+			deny.push(pattern);
+			if (fromAllToolsCategory) allToolsDenyPatterns.push(pattern);
+			continue;
+		}
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
 		}
+		allow.push(pattern);
 	}
 	return {
 		allow,
 		deny,
 		droppedCategories,
-		translatedAskPatterns
+		translatedAskPatterns,
+		shadowedAllowPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted: budget.remaining === 0
 	};
 }
 /**
@@ -35032,11 +35947,16 @@ function translateClinePermissions(permission) {
 * project convention used by every other permissions translator, and
 * (b) the user still sees one prominent "WARNING" message describing the translation.
 */
-function warnClineTranslationNotices({ droppedCategories, translatedAskPatterns, logger }) {
-	if (droppedCategories.length === 0 && translatedAskPatterns.length === 0) return;
+function warnClineTranslationNotices({ droppedCategories, translatedAskPatterns, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, ignoredAllToolsAllowPatterns, intersectionBudgetExhausted, logger }) {
+	if (droppedCategories.length === 0 && translatedAskPatterns.length === 0 && shadowedAllowPatterns.length === 0 && unenforcedAllToolsDenyPatterns.length === 0 && unenforcedAllToolsAskPatterns.length === 0 && ignoredAllToolsAllowPatterns.length === 0 && !intersectionBudgetExhausted) return;
 	const parts = [];
 	if (droppedCategories.length > 0) parts.push(`non-bash categories [${droppedCategories.join(", ")}] (Cline only enforces shell commands; use the rulesync ignore feature for read/write restrictions)`);
 	if (translatedAskPatterns.length > 0) parts.push(`'ask' rules for bash patterns [${translatedAskPatterns.join(", ")}] translated to 'deny' for fail-closed safety, since Cline lacks 'ask'`);
+	if (shadowedAllowPatterns.length > 0) parts.push(`'allow' rules for [${shadowedAllowPatterns.join(", ")}] withheld because the all-tools '*' category restricts the same commands, and a pattern written there need not name a command Cline's own lists can act on. Cline's allowlist is a gate — once set, only the commands matching it run without approval — so withholding every entry leaves every command asking`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) parts.push(`'deny' rules for [${unenforcedAllToolsDenyPatterns.join(", ")}] under the all-tools '*' category written into the denylist as they stand, where they withheld none of the allow rules beside them — a pattern written there need not name a command, and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern`);
+	if (unenforcedAllToolsAskPatterns.length > 0) parts.push(`'ask' rules for [${unenforcedAllToolsAskPatterns.join(", ")}] under the all-tools '*' category left with nothing to do, since Cline has no ask tier and they withheld none of the allow rules beside them — a pattern written there need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns`);
+	if (ignoredAllToolsAllowPatterns.length > 0) parts.push(`'allow' rules for [${ignoredAllToolsAllowPatterns.join(", ")}] under the all-tools '*' category skipped (only its deny and ask rules are read, since a pattern written there need not be a command); write them under 'bash' to auto-approve them`);
+	if (intersectionBudgetExhausted) parts.push("the limit on how much work one generation may spend comparing allow rules against the all-tools '*' category's deny and ask rules was reached, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than .rulesync/permissions.jsonc asks for; write fewer or shorter command patterns to have them all compared");
 	logger?.warn(`WARNING: Cline command permissions translation notice: ${parts.join("; ")}.`);
 }
 var ClinePermissions = class ClinePermissions extends ToolPermissions {
@@ -35084,10 +36004,15 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Cline command-permissions at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const { allow, deny, droppedCategories, translatedAskPatterns } = translateClinePermissions(config.permission);
+		const { allow, deny, droppedCategories, translatedAskPatterns, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, ignoredAllToolsAllowPatterns, intersectionBudgetExhausted } = translateClinePermissions(config.permission);
 		warnClineTranslationNotices({
 			droppedCategories,
 			translatedAskPatterns,
+			shadowedAllowPatterns,
+			unenforcedAllToolsDenyPatterns,
+			unenforcedAllToolsAskPatterns,
+			ignoredAllToolsAllowPatterns,
+			intersectionBudgetExhausted,
 			logger
 		});
 		const dedupedAllow = (0, es_toolkit.uniq)(allow.toSorted());
@@ -35095,7 +36020,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		const mergedDeny = (0, es_toolkit.uniq)([...existing.deny ?? [], ...dedupedDeny]).toSorted();
 		const denySet = new Set(mergedDeny);
 		const collisions = dedupedAllow.filter((p) => denySet.has(p));
-		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline's evaluation order is not documented to guarantee deny-priority; the resulting behavior is undefined. Consider removing the duplicate rule from rulesync.`);
+		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline documents that deny rules always take precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
 		const next = {
 			...existing,
 			allow: dedupedAllow,
@@ -36514,7 +37439,9 @@ const TRAILING_ARGUMENT_WILDCARD_PATTERN = /:\*$/;
 * This surface is **global only** — dcode reads no project-level config file,
 * so there is nothing to write into a repository.
 *
-* Only the canonical `bash` category maps, and only its `allow` rules:
+* Only `allow` rules map, and only from the canonical `bash` category — the
+* all-tools `*` category contributes its restricting rules instead, since a rule
+* written there covers shell commands too (see `collectShellCommandRules`):
 *
 * - A pattern is reduced to its executable token, because that is all dcode
 *   matches on — `git *`, `git:*`, `git commit:*` and a bare `git` all become
@@ -36628,7 +37555,7 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			const shell = isPlainObject$1(existingShell) ? { ...existingShell } : {};
 			if (allowList.length > 0) shell[ALLOW_LIST_KEY] = allowList;
 			else if (shell[ALLOW_LIST_KEY] !== void 0) {
-				warnWithFallback(logger, `deepagents-cli: no bash allow rule maps to an executable name, so the existing [${SHELL_TABLE_KEY}].${ALLOW_LIST_KEY} in ${filePath} was removed and those commands will be asked about again.`);
+				warnWithFallback(logger, `deepagents-cli: no bash allow rule is left to auto-approve — none maps to an executable name, or every one of them is covered by a stricter rule — so the existing [${SHELL_TABLE_KEY}].${ALLOW_LIST_KEY} in ${filePath} was removed and those commands will be asked about again.`);
 				delete shell[ALLOW_LIST_KEY];
 			}
 			if (Object.keys(shell).length > 0) settings[SHELL_TABLE_KEY] = shell;
@@ -36687,35 +37614,69 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 	}
 };
 /**
+* Split the restricting rules by what the generated allowlist does to them, and
+* name the entries that have to go.
+*
+* An allowlist entry auto-approves its executable however it is invoked, so an
+* `ask` or `deny` on any command that entry would run — a narrower pattern
+* (`npm publish`) beside an allowed `npm *`, or one naming no executable at all
+* (`*delete*` beside an allowed `kubectl`) — collides with it. dcode has no
+* denylist, so the collision cannot be settled there: keeping the allow would
+* auto-approve the very command the author wanted stopped. The colliding
+* entries are therefore withheld — canonically the stricter rule wins whatever
+* its width — which leaves those executables prompting, which is what an `ask`
+* asks for and the closest dcode can come to a `deny`.
+*/
+function partitionRestrictingRules({ allowList, askPatterns, denyPatterns, willWrite }) {
+	const approved = allowList.map((token) => ({
+		token,
+		globs: [parseGlobPattern(token), parseGlobPattern(`${token} *`)]
+	}));
+	const budget = createIntersectionBudget();
+	const collidingTokens = (pattern) => {
+		if (!willWrite) return [];
+		if (budget.remaining === 0) return [...allowList];
+		const restriction = parseGlobPattern(pattern.trim().replace(TRAILING_ARGUMENT_WILDCARD_PATTERN, "*").replaceAll(SHLEX_STRIPPED_PATTERN, ""));
+		return approved.filter(({ globs }) => globs.some((glob) => parsedGlobsIntersect(restriction, glob, budget))).map(({ token }) => token);
+	};
+	const withheldTokens = /* @__PURE__ */ new Set();
+	const collect = (pattern) => {
+		const tokens = collidingTokens(pattern);
+		for (const token of tokens) withheldTokens.add(token);
+		return tokens.length > 0;
+	};
+	const shadowedAsk = (0, es_toolkit.uniq)(askPatterns).filter(collect);
+	const shadowedDeny = [];
+	const unenforcedDeny = [];
+	for (const pattern of (0, es_toolkit.uniq)(denyPatterns)) (collect(pattern) ? shadowedDeny : unenforcedDeny).push(pattern);
+	return {
+		shadowedAsk,
+		shadowedDeny,
+		unenforcedDeny,
+		withheldTokens,
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
 * Say what the reduction to executable names could not write. Split out from
 * `convertRulesyncToDeepagentsAllowList` because the rules it reports on
 * outnumber the ones it writes: every category dcode cannot express is a
 * sentence here.
 */
-function warnAboutUnwrittenBashRules({ allowList, allowAll, requestedAllowAll, askPatterns, denyPatterns, widenedPatterns, unmatchablePatterns, sentinelPatterns, willWrite, logger }) {
-	const allowedTokens = new Set(allowList);
-	const collidesWithAllow = (pattern) => {
-		if (!willWrite) return false;
-		if (allowAll) return true;
-		const leading = leadingToken(pattern).replaceAll(SHLEX_STRIPPED_PATTERN, "");
-		if (GLOB_CHARACTERS_PATTERN.test(leading)) {
-			const matches = compileGlob(leading);
-			return allowList.some((token) => matches(token));
-		}
-		return allowedTokens.has(leading);
-	};
-	const shadowedAsk = askPatterns.filter(collidesWithAllow);
-	const shadowedDeny = [];
-	const unenforcedDeny = [];
-	for (const pattern of denyPatterns) (collidesWithAllow(pattern) ? shadowedDeny : unenforcedDeny).push(pattern);
-	if (unenforcedDeny.length > 0) warnWithFallback(logger, `deepagents-cli has no command denylist — a command it does not auto-approve is asked about, not blocked — so ${unenforcedDeny.length} bash deny rule(s) from .rulesync/permissions.jsonc were skipped and those commands remain runnable on approval.`);
-	const shadowReason = allowAll ? `allow_list = ["all"] auto-approves every command` : `the generated allow_list auto-approves commands they cover`;
-	if (shadowedDeny.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name, so the deny rule(s) ${shadowedDeny.join(", ")} are not merely unenforced: ${shadowReason}, so those commands run without a prompt. Narrow or drop the allow rule that covers them.`);
-	if (shadowedAsk.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name, so the ask rule(s) ${shadowedAsk.join(", ")} run without a prompt: ${shadowReason}. Narrow or drop the allow rule that covers them.`);
+function warnAboutUnwrittenBashRules({ allowAll, requestedAllowAll, askPatterns, denyPatterns, foreignRestrictingCategories, shadowedAsk, shadowedDeny, unenforcedDeny, intersectionBudgetExhausted, widenedPatterns, unmatchablePatterns, sentinelPatterns, willWrite, logger }) {
+	if (unenforcedDeny.length > 0) warnWithFallback(logger, `deepagents-cli has no command denylist — a command it does not auto-approve is asked about, not blocked — so ${unenforcedDeny.length} command deny rule(s) from .rulesync/permissions.jsonc were skipped and those commands remain runnable on approval.`);
+	if (shadowedDeny.length > 0) warnWithFallback(logger, intersectionBudgetExhausted ? `deepagents-cli withheld the allow_list entries beside the deny rule(s) ${shadowedDeny.join(", ")} without comparing them, the comparison limit above having been reached. Those executables are asked about instead.` : `deepagents-cli matches only the executable name, so the allow rule(s) covered by the deny rule(s) ${shadowedDeny.join(", ")} were withheld from allow_list — keeping them would auto-approve the very commands those rules deny. Those executables are asked about instead; narrow the deny rule if you meant them auto-approved.`);
+	if (shadowedAsk.length > 0) warnWithFallback(logger, intersectionBudgetExhausted ? `deepagents-cli withheld the allow_list entries beside the ask rule(s) ${shadowedAsk.join(", ")} without comparing them, the comparison limit above having been reached. Those executables are asked about instead.` : `deepagents-cli matches only the executable name, so the allow rule(s) covered by the ask rule(s) ${shadowedAsk.join(", ")} were withheld from allow_list — keeping them would run those commands without the prompt the ask rule asks for. Narrow the ask rule if you meant them auto-approved.`);
 	if (willWrite && widenedPatterns.length > 0) warnWithFallback(logger, `deepagents-cli matches only the executable name of a command, so ${widenedPatterns.join(", ")} were widened to their first token — every invocation of those executables is now auto-approved, not just the listed arguments.`);
 	if (willWrite && unmatchablePatterns.length > 0) warnWithFallback(logger, `deepagents-cli compares an allow_list entry to the executable name exactly, so a glob in that name matches nothing, a name longer than ${MAX_EXECUTABLE_NAME_LENGTH} characters is longer than a command's own name can be, and a name holding a shell metacharacter, a quote or an escape is one dcode splits on, refuses outright, or reads differently than it is written — the pattern(s) ${unmatchablePatterns.join(", ")} were therefore skipped rather than written as a rule that cannot be relied on to fire.`);
 	if (willWrite && sentinelPatterns.length > 0) warnWithFallback(logger, `deepagents-cli reads 'all' and 'recommended' in allow_list as sentinels rather than command names, so ${sentinelPatterns.join(", ")} were skipped. Use the '*' pattern to allow every command.`);
-	if (willWrite && requestedAllowAll && !allowAll) warnWithFallback(logger, `The bash '*' allow rule was not written as allow_list = ["all"] for deepagents-cli, because 'all' also turns off its dangerous-pattern check (command substitution, redirects, process substitution) and ${denyPatterns.length > 0 ? `your config denies commands` : `your config has deny rules for other tools`} — the two together would be weaker than dcode's own default. List the executables you want auto-approved instead.`);
+	if (willWrite && requestedAllowAll && !allowAll) {
+		let restrictionReason = `your config restricts other tools`;
+		if (denyPatterns.length > 0) restrictionReason = `your config denies commands`;
+		else if (askPatterns.length > 0) restrictionReason = `your config asks before running commands`;
+		else if (foreignRestrictingCategories.length > 0) restrictionReason = `your config restricts '${foreignRestrictingCategories.join("', '")}'`;
+		warnWithFallback(logger, `The bash '*' allow rule was not written as allow_list = ["all"] for deepagents-cli, because 'all' also turns off its dangerous-pattern check (command substitution, redirects, process substitution) and ${restrictionReason} — the two together would be weaker than dcode's own default. List the executables you want auto-approved instead.`);
+	}
 	if (willWrite && allowAll) warnWithFallback(logger, "The bash '*' allow rule became allow_list = [\"all\"] for deepagents-cli, which auto-approves every command and skips its dangerous-pattern check (command substitution, redirects, process substitution). List the executables you want instead if that is more than you meant.");
 }
 /**
@@ -36862,62 +37823,78 @@ function toExecutableToken(pattern) {
 }
 /**
 * Convert rulesync permissions config to dcode's `[shell].allow_list`. Only
-* `bash` `allow` rules map; everything else is skipped, with a warning
+* `allow` rules map — from the `bash` category, and never from the all-tools
+* `*` one, whose restricting rules still count against them (see
+* `collectShellCommandRules`). Everything else is skipped, with a warning
 * wherever the skip loses a restriction rather than a redundancy.
 */
 function convertRulesyncToDeepagentsAllowList({ config, willWrite, logger }) {
 	const allowed = [];
-	const widenedPatterns = [];
+	const widened = [];
 	const unmatchablePatterns = [];
 	const sentinelPatterns = [];
 	const askPatterns = [];
 	const denyPatterns = [];
-	let hasForeignDeny = false;
 	let requestedAllowAll = false;
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny")) {
-				hasForeignDeny = true;
-				warnWithFallback(logger, `deepagents-cli only models shell-command permissions ([shell].allow_list), so '${category}' deny rules cannot be represented and were skipped.`);
-			}
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	for (const { pattern, action } of rules) {
+		if (action === "deny") {
+			denyPatterns.push(pattern);
 			continue;
 		}
-		for (const [pattern, action] of Object.entries(rules)) {
-			if (action === "deny") {
-				denyPatterns.push(pattern);
-				continue;
-			}
-			if (action === "ask") {
-				askPatterns.push(pattern);
-				continue;
-			}
-			if (leadingToken(pattern) === "*" && meansAnyArguments(pattern)) {
-				requestedAllowAll = true;
-				continue;
-			}
-			const reduced = toExecutableToken(pattern);
-			if (!reduced) {
-				unmatchablePatterns.push(pattern);
-				continue;
-			}
-			if (reduced.token.toLowerCase() === ALLOW_ALL_SENTINEL || reduced.token.toLowerCase() === RECOMMENDED_SENTINEL) {
-				sentinelPatterns.push(pattern);
-				continue;
-			}
-			if (reduced.widened) widenedPatterns.push(pattern);
-			allowed.push(reduced.token);
+		if (action === "ask") {
+			askPatterns.push(pattern);
+			continue;
+		}
+		if (leadingToken(pattern) === "*" && meansAnyArguments(pattern)) {
+			requestedAllowAll = true;
+			continue;
+		}
+		const reduced = toExecutableToken(pattern);
+		if (!reduced) {
+			unmatchablePatterns.push(pattern);
+			continue;
+		}
+		if (reduced.token.toLowerCase() === ALLOW_ALL_SENTINEL || reduced.token.toLowerCase() === RECOMMENDED_SENTINEL) {
+			sentinelPatterns.push(pattern);
+			continue;
 		}
+		if (reduced.widened) widened.push({
+			pattern,
+			token: reduced.token
+		});
+		allowed.push(reduced.token);
 	}
-	const hasDenyRule = hasForeignDeny || denyPatterns.length > 0;
-	const allowAll = requestedAllowAll && !hasDenyRule;
-	const allowList = allowAll ? [ALLOW_ALL_SENTINEL] : (0, es_toolkit.uniq)(allowed.toSorted());
+	const hasRestriction = foreignRestrictingCategories.length > 0 || denyPatterns.length > 0 || askPatterns.length > 0;
+	const allowAll = requestedAllowAll && !hasRestriction;
+	const candidates = (0, es_toolkit.uniq)(allowed.toSorted());
+	const { shadowedAsk, shadowedDeny, unenforcedDeny, withheldTokens, intersectionBudgetExhausted } = partitionRestrictingRules({
+		allowList: candidates,
+		askPatterns,
+		denyPatterns,
+		willWrite
+	});
+	const allowList = allowAll ? [ALLOW_ALL_SENTINEL] : candidates.filter((token) => !withheldTokens.has(token));
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "deepagents-cli",
+		surfaceLabel: "[shell].allow_list",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns: [],
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	warnAboutUnwrittenBashRules({
-		allowList,
 		allowAll,
 		requestedAllowAll,
 		askPatterns,
 		denyPatterns,
-		widenedPatterns,
+		foreignRestrictingCategories,
+		shadowedAsk,
+		shadowedDeny,
+		unenforcedDeny,
+		intersectionBudgetExhausted,
+		widenedPatterns: (0, es_toolkit.uniq)(widened.filter(({ token }) => !withheldTokens.has(token)).map(({ pattern }) => pattern)),
 		unmatchablePatterns,
 		sentinelPatterns,
 		willWrite,
@@ -37217,10 +38194,17 @@ function convertDevinToRulesyncPermissions(params) {
 *
 * rulesync's canonical `permission.bash` patterns map directly: `allow` →
 * `commandAllowlist`, `deny` → `commandDenylist`. Factory Droid has no separate
-* "ask" list (any command not in the allowlist already prompts), so `ask`
-* rules are intentionally dropped. The allow/deny lists only model shell
-* commands, so categories other than `bash` cannot be represented and are
-* skipped (with a warning when they carry `deny` rules, to surface the gap).
+* "ask" list (any command not in the allowlist already prompts), so `ask` rules
+* write nothing — they only withhold the allow rules they cover, since the
+* stricter rule wins whatever its width. The all-tools `*` category contributes
+* its restricting rules too, because a rule written there covers shell commands
+* as well. They withhold the allow rules they cover the way a `bash` `ask`
+* does, because a pattern written under `*` need not name a command at all: a
+* `deny` there is written to `commandDenylist` too, for the case where it *is*
+* one, but an entry naming no command enforces nothing by itself.
+* The allow/deny lists only model shell commands, so categories other
+* than `bash` and `*` cannot be represented and are skipped (with a warning
+* when they carry `deny` rules, to surface the gap).
 *
 * Factory Droid also has a stronger `commandBlocklist` tier — commands that can
 * never run, not even under full autonomy — plus other security controls
@@ -37337,24 +38321,28 @@ var FactorydroidPermissions = class FactorydroidPermissions extends ToolPermissi
 };
 /**
 * Convert rulesync permissions config to Factory Droid allow/deny command lists.
-* Only the `bash` category maps; `ask` rules and non-`bash` categories are
-* dropped (the latter with a warning when they carry `deny` rules).
+* The `bash` category maps, and so do the restricting rules of the all-tools
+* `*` category — a `deny` written there covers shell commands too, and skipping
+* it would auto-approve a command the file blocks. Other categories are dropped
+* (with a warning when they carry `deny` rules).
 */
 function convertRulesyncToFactorydroidPermissions({ config, logger }) {
-	const allow = [];
-	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny") && logger) logger.warn(`Factory Droid only models shell-command permissions (commandAllowlist/commandDenylist); '${category}' deny rules cannot be represented and were skipped.`);
-			continue;
-		}
-		for (const [pattern, action] of Object.entries(rules)) switch (action) {
-			case "allow":
-				allow.push(pattern);
-				break;
-			case "deny": deny.push(pattern);
-		}
-	}
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	const { allow, deny, shadowedAllowPatterns, unenforcedAllToolsDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+		rules,
+		writesAllToolsDeny: true
+	});
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "Factory Droid",
+		surfaceLabel: "commandAllowlist/commandDenylist",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns,
+		unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	return {
 		allow,
 		deny
@@ -39405,9 +40393,10 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
 		const parsed = (0, jsonc_parser.parse)(fileContent ?? "{}");
+		const record = isRecord$1(parsed) ? parsed : {};
 		const nextJson = {
-			...parsed,
-			permission: parsed.permission ?? {}
+			...record,
+			permission: Object.hasOwn(record, "permission") ? record.permission ?? {} : {}
 		};
 		return new OpencodePermissions({
 			outputRoot,
@@ -39476,7 +40465,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 	}
 	validate() {
 		try {
-			const json = JSON.parse(this.fileContent || "{}");
+			const json = parseJsonc$8(this.fileContent || "{}");
 			const result = OpencodePermissionsConfigSchema.safeParse(json);
 			if (!result.success) return {
 				success: false,
@@ -43177,9 +44166,13 @@ function warpSettingsDir() {
 * allowlist, `deny` → denylist). Warp matches commands with regular
 * expressions, so patterns are emitted verbatim — author canonical `bash`
 * patterns as regexes when targeting Warp (mirrors the Zed permissions
-* adapter). Warp has no per-command "ask" list, so `ask` rules are dropped; and
-* the command lists only model shell commands, so non-`bash` categories are
-* skipped (with a warning when they carry `deny` rules).
+* adapter). Warp has no per-command "ask" list, so `ask` rules write nothing —
+* they only withhold the allow rules they cover, since the stricter rule wins
+* whatever its width. The all-tools `*` category is read for its restricting
+* rules as well, but those only withhold allows too: writing any denylist
+* **replaces** Warp's built-in default one, and a `*` pattern need not name a
+* command at all. Categories other than `bash` and `*` are skipped (with a
+* warning when they carry `deny` rules).
 *
 * Warp's `[agents.profiles]` table also exposes file-read/read-only autonomy
 * knobs that do not fit the canonical `allow | ask | deny` per-command model:
@@ -43352,25 +44345,267 @@ function mergeIntoDefaultExecutionProfile({ agents, mergedAllow, mergedDeny, exe
 	if ((mergedDeny.length > 0 || hasOverrideKeys) && otherProfileIds.length > 0 && logger) logger.warn(`Warp command deny rules and execution_profile override keys were written to the 'default' execution profile only; they are not enforced while another profile (${otherProfileIds.join(", ")}) is active.`);
 }
 /**
-* Convert rulesync permissions config to Warp command allow/deny regex lists.
-* Only the `bash` category maps; `ask` rules and non-`bash` categories are
-* dropped (the latter with a warning when they carry `deny` rules).
+* Read a `[...]` class starting at its `[` and return the index just past its
+* `]`, or `undefined` when it cannot be read that simply. Regex class rules
+* apply: a `]` in the first position is a member rather than the terminator and
+* a backslash escapes the character after it. A nested `[` gives up: Rust's
+* `regex` crate — the engine Warp matches with — reads `[a[b]c]` as one class
+* built by set operations, so stopping at the first `]` would leave `c]` behind
+* as text the glob then requires. Giving up widens the whole pattern instead,
+* which is the only safe direction here.
+*/
+function skipRegexClass(body, start) {
+	let index = start + 1;
+	if (body.charAt(index) === "^") index += 1;
+	if (body.charAt(index) === "]") index += 1;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "\\") {
+			index += 2;
+			continue;
+		}
+		if (character === "[") return;
+		if (character === "]") return index + 1;
+		index += 1;
+	}
+}
+/**
+* Read a `(...)` group starting at its `(` and return the index just past its
+* `)`, or `undefined` when it never closes. Groups nest, so the depth is
+* counted — but a class inside one is skipped whole, since a `)` written there
+* is a member rather than a closer.
 */
-function convertRulesyncToWarpPermissions({ config, logger }) {
-	const allow = [];
-	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
-		if (category !== "bash") {
-			if (Object.values(rules).some((action) => action === "deny") && logger) logger.warn(`Warp only models shell-command permissions (agent_mode_command_execution_allowlist/denylist); '${category}' deny rules cannot be represented and were skipped.`);
+function skipRegexGroup(body, start) {
+	let depth = 0;
+	let index = start;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "\\") {
+			index += 2;
 			continue;
 		}
-		for (const [pattern, action] of Object.entries(rules)) switch (action) {
-			case "allow":
-				allow.push(pattern);
-				break;
-			case "deny": deny.push(pattern);
+		if (character === "[") {
+			const next = skipRegexClass(body, index);
+			if (next === void 0) return;
+			index = next;
+			continue;
+		}
+		if (character === "(") {
+			depth += 1;
+			index += 1;
+			continue;
+		}
+		if (character === ")") {
+			depth -= 1;
+			index += 1;
+			if (depth === 0) return index;
+			continue;
+		}
+		index += 1;
+	}
+}
+/**
+* Read a `{2,3}` quantifier starting at its `{`, or `undefined` when what
+* follows is not one. The shape is checked rather than scanned to the next `}`,
+* because a `{` that spells no repetition is a literal to the regex engine —
+* `{a|b}` is an alternation in braces, and reading it as a quantifier would skip
+* past the `|` that has to widen the whole pattern.
+*/
+const QUANTIFIER = /\{\d+(,\d*)?\}/y;
+function skipQuantifier(body, start) {
+	QUANTIFIER.lastIndex = start;
+	return QUANTIFIER.exec(body) === null ? void 0 : QUANTIFIER.lastIndex;
+}
+/**
+* Read the bracketed construct that opens at `start`, whichever kind it is, and
+* return the index just past it — or `undefined` when it never closes.
+*/
+function skipBracketedConstruct(body, start, open) {
+	if (open === "[") return skipRegexClass(body, start);
+	if (open === "(") return skipRegexGroup(body, start);
+	return skipQuantifier(body, start);
+}
+/**
+* Read the tail of a `\\x` / `\\u` escape — the hex run of `\\x20`, or the
+* braced `\\x{263A}` form — and return the index just past it. Such an escape
+* spells one character across several, so consuming only its introducer would
+* leave the hex digits behind as literal atoms and *narrow* the glob, the one
+* direction the rewrite must never take. Over-consuming only widens, so an
+* unterminated brace swallows the rest of the pattern.
+*/
+function skipHexEscapeTail(body, start) {
+	if (body.charAt(start) === "{") {
+		const closing = body.indexOf("}", start);
+		return closing === -1 ? body.length : closing + 1;
+	}
+	let index = start;
+	while (index < body.length && /^[0-9A-Fa-f]$/.test(body.charAt(index))) index += 1;
+	return index;
+}
+/**
+* Read the tail of a `\\p` / `\\P` Unicode-class escape — the braced `\\p{Greek}`
+* form, or the one-letter `\\pL` shorthand — and return the index just past it.
+* Like a hex escape, it spells its class across more than one character, so
+* leaving the shorthand letter behind would narrow the glob.
+*/
+function skipUnicodeClassTail(body, start) {
+	if (body.charAt(start) === "{") {
+		const closing = body.indexOf("}", start);
+		return closing === -1 ? body.length : closing + 1;
+	}
+	return Math.min(start + 1, body.length);
+}
+/**
+* Read the escape that opens at `start` — the `\\` and whatever it spells — and
+* say where it ends and which atom it stands for.
+*/
+function readEscape(body, start) {
+	const escaped = body.charAt(start + 1);
+	if (escaped === "x" || escaped === "u" || escaped === "U") return {
+		next: skipHexEscapeTail(body, start + 2),
+		atom: "*"
+	};
+	if (escaped === "p" || escaped === "P") return {
+		next: skipUnicodeClassTail(body, start + 2),
+		atom: "*"
+	};
+	return {
+		next: start + 2,
+		atom: escapedCharacterWidens(escaped) ? "*" : escaped
+	};
+}
+/**
+* Whether an escaped character has to widen to `*` rather than stand for
+* itself: a letter or a digit spells a class (`\s`, `\d`, `\w`), a glob
+* metacharacter would be read as a wildcard or a class by the comparison
+* instead of as the literal the escape asked for, and an empty string is a
+* trailing backslash spelling nothing at all.
+*/
+function escapedCharacterWidens(escaped) {
+	return escaped === "" || /^[A-Za-z0-9*?[\]]$/.test(escaped);
+}
+/**
+* Read one `[...]`, `(...)` or `{...}` construct starting at `start`, saying
+* where it ends and whether it repeats the atom in front of it (a quantifier)
+* or is an atom of its own (a class or a group) — or that the whole pattern has
+* to widen, which is the only safe reading of a construct that never closes and
+* of one that sets flags for everything after it.
+*/
+function readBracketedConstruct(body, start, open) {
+	const next = skipBracketedConstruct(body, start, open);
+	if (next === void 0) return "widens-pattern";
+	if (open === "(" && INLINE_FLAG_GROUP_PATTERN.test(body.slice(start, next))) return "widens-pattern";
+	return {
+		next,
+		widensLastAtom: open === "{"
+	};
+}
+/**
+* A group that only sets flags — `(?i)`, `(?im)`, `(?-i)` — as opposed to one
+* that scopes them to its own body (`(?i:...)`, which widens to `*` like any
+* other group).
+*/
+const INLINE_FLAG_GROUP_PATTERN = /^\(\?[A-Za-z]*-?[A-Za-z]*\)$/;
+/**
+* Approximate a Warp command pattern as a glob, so restrictions and allow rules
+* can be compared by `createShadowingRestrictionsTest`.
+*
+* Warp matches commands with regular expressions, and a glob reader would
+* misread the ordinary spellings: `.*` — Warp's catch-all — is a literal dot
+* followed by a wildcard, `[rf]` is a character class in one language and plain
+* text in the other, and an unanchored regex covers every command that merely
+* contains it. The rewrite therefore only ever widens what a pattern covers, so
+* an inexact reading withholds an allow rather than writing one the config
+* restricts.
+*
+* Widening means a construct is replaced whole rather than character by
+* character, because the characters inside it are not literals of the command:
+* a class (`[rf]`), a group (`(sudo )?`), a character escape (`\s`) and a
+* missing `^`/`$` anchor all become `*`, and a quantifier (`?`, `*`, `+`,
+* `{2}`) widens the atom in front of it — `git commits?` covers `git commit`,
+* so its glob has to as well. Both sides of a comparison are widened, so a
+* pattern that is really a glob still compares sensibly.
+*
+* A pattern the walk cannot read as one sequence widens to `*` whole: a
+* top-level `|` is two patterns rather than one, and a class, group or
+* quantifier that never closes leaves the rest of the pattern unreadable —
+* guessing at either could only narrow the result, which is the one direction
+* this rewrite must never take. An alternation *inside* a group needs no such
+* treatment: the group it sits in already widens to `*`.
+*/
+function warpCommandPatternToGlob(pattern) {
+	const anchoredStart = pattern.startsWith("^");
+	const anchoredEnd = pattern.endsWith("$") && !pattern.endsWith("\\$");
+	const body = pattern.slice(anchoredStart ? 1 : 0, anchoredEnd ? -1 : void 0);
+	const atoms = [];
+	const widenLastAtom = () => {
+		if (atoms.length === 0) {
+			atoms.push("*");
+			return;
 		}
+		atoms[atoms.length - 1] = "*";
+	};
+	let index = 0;
+	while (index < body.length) {
+		const character = body.charAt(index);
+		if (character === "|") return "*";
+		if (character === "\\") {
+			const escape = readEscape(body, index);
+			index = escape.next;
+			atoms.push(escape.atom);
+			continue;
+		}
+		if (character === "[" || character === "(" || character === "{") {
+			const read = readBracketedConstruct(body, index, character);
+			if (read === "widens-pattern") return "*";
+			index = read.next;
+			if (read.widensLastAtom) widenLastAtom();
+			else atoms.push("*");
+			continue;
+		}
+		if (character === "*" || character === "+" || character === "?") {
+			index += 1;
+			widenLastAtom();
+			continue;
+		}
+		const codePoint = body.codePointAt(index);
+		const atom = codePoint === void 0 ? character : String.fromCodePoint(codePoint);
+		index += atom.length;
+		atoms.push(atom === "." || ")]}^$".includes(atom) ? "*" : atom);
 	}
+	const glob = atoms.join("");
+	return `${anchoredStart ? "" : "*"}${glob}${anchoredEnd ? "" : "*"}`;
+}
+/**
+* Convert rulesync permissions config to Warp command allow/deny regex lists.
+* The `bash` category maps to both lists. The all-tools `*` category's
+* restricting rules are read too — a rule written there covers shell commands
+* as well, and ignoring it would auto-approve a command the file blocks — but
+* they only *withhold* the allow rules they cover: Warp's denylist is a regex
+* list that replaces the tool's built-in default one, so writing a pattern
+* there that may not even name a command would cost more protection than it
+* adds. Other categories are dropped (with a warning when they carry `deny`
+* rules).
+*/
+function convertRulesyncToWarpPermissions({ config, logger }) {
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	const { allow, deny, shadowedAllowPatterns, unwrittenDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+		rules,
+		writesAllToolsDeny: false,
+		normalizePattern: warpCommandPatternToGlob
+	});
+	warnAboutUnwrittenCommandRules({
+		toolLabel: "Warp",
+		surfaceLabel: "agent_mode_command_execution_allowlist/denylist",
+		foreignRestrictingCategories,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unwrittenDenyReason: "Writing any denylist replaces Warp's built-in default one, and a pattern written under '*' need not be a command at all.",
+		unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted,
+		logger
+	});
 	return {
 		allow,
 		deny