rulesync 16.21.0 → 16.22.1

package/dist/{import-7UmDF35I.cjs → import-B7o8So93.cjs}

@@ -246,6 +246,35 @@ function hasDeceptiveHiddenCharacters(text) {
 		return !joinsCharacter(characters[index - 1]) || !joinsCharacter(characters[index + 1]);
 	});
 }
+/** A mark that draws around the character before it — a circle, a square, a keycap box. */
+const ENCLOSING_MARK_PATTERN = /\p{Me}/u;
+/**
+* Whether `text` carries an enclosing mark that is not the keycap of an emoji
+* keycap sequence.
+*
+* An enclosing mark (`\p{Me}`: U+20DD COMBINING ENCLOSING CIRCLE, U+20E3
+* COMBINING ENCLOSING KEYCAP, the Cyrillic and Vedic ones) is drawn over the
+* character before it and takes no column of its own, so `pdf` with one after
+* it occupies the three columns of `pdf` and is a fourth directory underneath.
+* Unlike a joiner or a variation selector it is not invisible — the box is
+* drawn — which is why `hasDeceptiveHiddenCharacters` does not refuse it and
+* why it is a question for the confusable-name note instead: the row is drawn,
+* only not the way its name reads. The one place an enclosing mark belongs in
+* a name is the keycap sequence of UTS #51, which `isKeycapSequence` matches
+* whole; every other one is left over.
+*
+* Restricted to `\p{Me}` on purpose: a non-spacing mark (`\p{Mn}`) is how
+* Devanagari, Arabic and Vietnamese write, and folding those would mark
+* ordinary names in every one of them.
+*/
+function hasEnclosingMarkOutsideKeycap(text) {
+	const characters = [...text];
+	return characters.some((character, index) => ENCLOSING_MARK_PATTERN.test(character) && !isKeycapSequence({
+		base: characters[index - 2],
+		selector: characters[index - 1] ?? "",
+		following: character
+	}));
+}
 //#endregion
 //#region src/utils/truncate.ts
 /**
@@ -415,34 +444,34 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$299 } = node_path.posix;
+const { join: join$304 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$299(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$304(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$299(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$299(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$304(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$304(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$299(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$304(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -469,9 +498,11 @@ const rulesProcessorToolTargetTuple = [
 	"claudecode",
 	"claudecode-legacy",
 	"cline",
+	"codebuddy",
 	"codexcli",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -507,6 +538,7 @@ const ignoreProcessorToolTargetTuple = [
 	"claudecode",
 	"claudecode-legacy",
 	"cline",
+	"crush",
 	"cursor",
 	"hermesagent",
 	"junie",
@@ -648,6 +680,7 @@ const skillsProcessorToolTargetTuple = [
 	"codexcli",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -3352,6 +3385,83 @@ var RulesyncFile = class extends AiFile {
 	}
 };
 //#endregion
+//#region src/utils/bounded-walk.ts
+const ALIAS_HINT = "(a chain of YAML aliases may be amplifying the document)";
+/**
+* Create the bookkeeping for one walk. `subject` names the document kind in
+* every error ("Frontmatter", "Shared config"); `root`, when given, is entered
+* up front so the root object counts as the first nesting level, matching the
+* +1 that `enter` applies to every container nested inside it.
+*/
+function createBoundedWalk({ subject, limits, root }) {
+	const ancestors = /* @__PURE__ */ new WeakSet();
+	let valuesRemaining = limits.maxValues;
+	let stringCharsRemaining = limits.maxStringChars;
+	let depth = 0;
+	const chargeChars = (chars) => {
+		stringCharsRemaining -= chars;
+		if (stringCharsRemaining < 0) throw new Error(`${subject}'s string values expand to more than ${limits.maxStringChars} characters; refusing to process it ${ALIAS_HINT}`);
+	};
+	const chargeValue = (stringChars = 0) => {
+		valuesRemaining -= 1;
+		if (valuesRemaining < 0) throw new Error(`${subject} expands to more than ${limits.maxValues} values; refusing to process it ${ALIAS_HINT}`);
+		chargeChars(stringChars);
+	};
+	const enter = (container) => {
+		depth += 1;
+		if (depth > limits.maxDepth) throw new Error(`${subject} nests more than ${limits.maxDepth} levels deep; refusing to process it ${ALIAS_HINT}`);
+		ancestors.add(container);
+	};
+	const leave = (container) => {
+		ancestors.delete(container);
+		depth -= 1;
+	};
+	if (root !== void 0) enter(root);
+	return {
+		chargeValue,
+		chargeChars,
+		isAncestor: (container) => ancestors.has(container),
+		enter,
+		leave
+	};
+}
+//#endregion
+//#region src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+//#endregion
 //#region src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -3416,67 +3526,154 @@ function loadYaml(content) {
 }
 //#endregion
 //#region src/utils/frontmatter.ts
-function deepRemoveNullishValue(value) {
+/**
+* Upper bound on the number of values a frontmatter document may expand to
+* once every YAML alias is written out.
+*
+* A YAML alias makes one parsed container reachable from many keys, and the
+* cleaners below copy each reachable value, so a small file with a few levels
+* of nested aliases (an "alias bomb") can expand into megabytes of output or
+* exhaust the heap. Counting every visited value against this budget turns
+* that into an error instead. Real frontmatter is a handful of keys; even a
+* generous skill manifest stays orders of magnitude below the limit.
+*/
+const MAX_FRONTMATTER_VALUES = 1e5;
+/**
+* Upper bound on the total character count of string leaves a frontmatter
+* document may expand to.
+*
+* {@link MAX_FRONTMATTER_VALUES} bounds how many values are visited, but a
+* single long string aliased thousands of times still fits that budget while
+* the duplicated output balloons: one scalar of a few KB, chained through a
+* handful of aliases within the value budget, can multiply into a document
+* many megabytes larger than it started. Charging every visited string's
+* length against this separate budget bounds that output regardless of how
+* many aliases point at it.
+*/
+const MAX_FRONTMATTER_STRING_CHARS = 4e6;
+/**
+* Upper bound on the raw character length of the `---`-delimited frontmatter
+* block itself, checked before it is ever handed to the YAML parser.
+*
+* The budgets above only bound the *parsed* document — the walk over
+* `matter()`'s output — but a complex YAML key (an array or mapping used as a
+* mapping key) is joined into a string by js-yaml while it parses, and a
+* mapping with many such keys can cost real memory before that walk ever
+* starts, or even before `matter()` returns. Capping the raw block size keeps
+* that parse-time cost bounded regardless of what the block contains. Real
+* frontmatter blocks are a few hundred bytes at most; even a large project
+* manifest stays well under this.
+*/
+const MAX_FRONTMATTER_RAW_CHARS = 65536;
+/**
+* Estimate the serialized character cost of a leaf that is not a string (a
+* string leaf is charged by its own length instead).
+*
+* js-yaml's default schema resolves `!!binary` scalars to a `Uint8Array`, and
+* its dumper writes one back out as base64 — roughly 4 output characters per
+* 3 input bytes. Without this, an aliased binary blob would walk the budget
+* for free even though it can dominate the emitted document's size.
+*/
+function estimateLeafChars(value) {
+	if (value instanceof Uint8Array) return Math.ceil(value.byteLength / 3) * 4;
+	return 0;
+}
+/**
+* Copy one parsed value, dropping nullish leaves and cyclic references.
+*
+* Every alias is still written out as an independent copy, as gray-matter's
+* default YAML engine would otherwise serialize shared references as `&ref_0`
+* anchors that simplified frontmatter parsers cannot read; the expansion is
+* bounded by {@link MAX_FRONTMATTER_VALUES} instead.
+*/
+function deepCleanValue(value, options) {
+	const leafChars = typeof value === "string" ? value.length : estimateLeafChars(value);
+	options.walk.chargeValue(leafChars);
 	if (value === null || value === void 0) return;
-	if (Array.isArray(value)) return value.map((item) => deepRemoveNullishValue(item)).filter((item) => item !== void 0);
+	if (typeof value === "string") return options.transformString ? options.transformString(value) : value;
+	if (Array.isArray(value)) {
+		if (options.walk.isAncestor(value)) return;
+		options.walk.enter(value);
+		const cleanedArray = [];
+		for (const item of value) {
+			const cleaned = deepCleanValue(item, options);
+			if (cleaned !== void 0) cleanedArray.push(cleaned);
+		}
+		options.walk.leave(value);
+		return cleanedArray;
+	}
 	if (isPlainObject$1(value)) {
-		const result = {};
-		for (const [key, val] of Object.entries(value)) {
-			const cleaned = deepRemoveNullishValue(val);
-			if (cleaned !== void 0) result[key] = cleaned;
-		}
+		if (options.walk.isAncestor(value)) return;
+		options.walk.enter(value);
+		const result = cleanOwnEntries(value, options);
+		options.walk.leave(value);
 		return result;
 	}
 	return value;
 }
-function deepRemoveNullishObject(obj) {
-	if (!obj || typeof obj !== "object") return {};
+/**
+* Copy the cleaned own entries of a parsed object into a fresh record.
+*
+* A YAML parser defines a `__proto__:` key as an own property, and assigning
+* it back with bracket notation would instead replace the new record's
+* prototype, whose members zod's loose object schemas then promote to real
+* keys. So a fetched skill could hide `allowed-tools` under an innocuous
+* looking `__proto__:` block. That key, `constructor` and `prototype` are
+* therefore dropped rather than copied, and cannot be used as frontmatter
+* keys.
+*/
+function cleanOwnEntries(obj, options) {
 	const result = {};
 	for (const [key, val] of Object.entries(obj)) {
-		const cleaned = deepRemoveNullishValue(val);
+		options.walk.chargeChars(key.length);
+		const cleaned = deepCleanValue(val, options);
+		if (isPrototypePollutionKey(key)) continue;
 		if (cleaned !== void 0) result[key] = cleaned;
 	}
 	return result;
 }
-function deepFlattenStringsValue(value) {
-	if (value === null || value === void 0) return;
-	if (typeof value === "string") return value.replace(/\n+/g, " ").trim();
-	if (Array.isArray(value)) return value.map((item) => deepFlattenStringsValue(item)).filter((item) => item !== void 0);
-	if (isPlainObject$1(value)) {
-		const result = {};
-		for (const [key, val] of Object.entries(value)) {
-			const cleaned = deepFlattenStringsValue(val);
-			if (cleaned !== void 0) result[key] = cleaned;
-		}
-		return result;
-	}
-	return value;
+function deepCleanObject(obj, options) {
+	if (!obj || typeof obj !== "object") return {};
+	return cleanOwnEntries(obj, {
+		...options,
+		walk: createBoundedWalk({
+			subject: "Frontmatter",
+			limits: {
+				maxValues: MAX_FRONTMATTER_VALUES,
+				maxStringChars: MAX_FRONTMATTER_STRING_CHARS,
+				maxDepth: 64
+			},
+			root: obj
+		})
+	});
+}
+/** Drop null and undefined values, recursively. */
+function deepRemoveNullishObject(obj) {
+	return deepCleanObject(obj, {});
 }
+/** Drop nullish values and collapse every string onto a single line. */
 function deepFlattenStringsObject(obj) {
-	if (!obj || typeof obj !== "object") return {};
-	const result = {};
-	for (const [key, val] of Object.entries(obj)) {
-		const cleaned = deepFlattenStringsValue(val);
-		if (cleaned !== void 0) result[key] = cleaned;
-	}
-	return result;
+	return deepCleanObject(obj, { transformString: (value) => value.replace(/\n+/g, " ").trim() });
 }
 function stringifyFrontmatter(body, frontmatter, options) {
 	const { avoidBlockScalars = false } = options ?? {};
 	const cleanFrontmatter = avoidBlockScalars ? deepFlattenStringsObject(frontmatter) : deepRemoveNullishObject(frontmatter);
-	if (avoidBlockScalars) return gray_matter.default.stringify(body, cleanFrontmatter, { engines: { yaml: {
+	const file = { content: body };
+	if (avoidBlockScalars) return gray_matter.default.stringify(file, cleanFrontmatter, { engines: { yaml: {
 		parse: (input) => loadYaml(input) ?? {},
 		stringify: (data) => (0, js_yaml.dump)(data, { lineWidth: -1 })
 	} } });
-	return gray_matter.default.stringify(body, cleanFrontmatter);
+	return gray_matter.default.stringify(file, cleanFrontmatter);
 }
 function parseFrontmatter(content, filePath) {
 	let frontmatter;
 	let body;
 	let hasFrontmatter;
 	try {
+		const bounds = findFrontmatterBlockBounds(content);
+		if (bounds && bounds.blockEnd - bounds.blockStart > 65536) throw new Error(`Frontmatter block is larger than ${MAX_FRONTMATTER_RAW_CHARS} characters; refusing to parse it (a complex YAML key can cost memory while parsing, before any post-parse budget applies)`);
 		const result = (0, gray_matter.default)(content, {});
-		frontmatter = result.data;
+		frontmatter = deepRemoveNullishObject(result.data);
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
 	} catch (error) {
@@ -3484,7 +3681,7 @@ function parseFrontmatter(content, filePath) {
 		throw error;
 	}
 	return {
-		frontmatter: deepRemoveNullishObject(frontmatter),
+		frontmatter,
 		body,
 		hasFrontmatter
 	};
@@ -3533,17 +3730,34 @@ function repairFrontmatterLine(line) {
 	};
 }
 /**
-* Quote the unquoted scalars that make a frontmatter block unparseable, or
-* return `undefined` when there is nothing to repair. Only the frontmatter
-* block is rewritten; the body is passed through untouched.
+* Locate a raw `---`-delimited frontmatter block's bounds within `content`,
+* without parsing it. Shared by the size guard in {@link parseFrontmatter} and
+* the YAML repair pass below, so both agree on exactly what gray-matter would
+* treat as the block: gray-matter ends it at the first `\n---`, with no
+* requirement that the delimiter be alone on its line, so a stricter pattern
+* here would run past gray-matter's delimiter and act on text that is really
+* the body.
 */
-function repairMalformedFrontmatterYaml(content) {
+function findFrontmatterBlockBounds(content) {
 	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
 	if (!opening) return;
 	const blockStart = opening[0].length;
 	const closing = /\r?\n---/.exec(content.slice(blockStart));
 	if (!closing) return;
-	const blockEnd = blockStart + closing.index;
+	return {
+		blockStart,
+		blockEnd: blockStart + closing.index
+	};
+}
+/**
+* Quote the unquoted scalars that make a frontmatter block unparseable, or
+* return `undefined` when there is nothing to repair. Only the frontmatter
+* block is rewritten; the body is passed through untouched.
+*/
+function repairMalformedFrontmatterYaml(content) {
+	const bounds = findFrontmatterBlockBounds(content);
+	if (!bounds) return;
+	const { blockStart, blockEnd } = bounds;
 	const block = content.slice(blockStart, blockEnd);
 	const repairedLines = block.split("\n").map(repairFrontmatterLine);
 	const repairedBlock = repairedLines.map(({ line }) => line).join("\n");
@@ -5222,42 +5436,6 @@ const CANONICAL_TO_GROKCLI_EVENT_NAMES = {
 */
 const GROKCLI_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_GROKCLI_EVENT_NAMES).map(([k, v]) => [v, k]));
 //#endregion
-//#region src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-//#endregion
 //#region src/utils/jsonc.ts
 /**
 * Rebuild the parsed value from its own enumerable entries, dropping
@@ -6008,6 +6186,17 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 		const fallbackDirPath = overrideDirPath ?? paths.recommended.relativeDirPath;
 		throw new RulesyncSourceNotFoundError(`No ${(0, node_path.join)(outputRoot, fallbackDirPath, paths.recommended.relativeFilePath)} found.`);
 	}
+	/**
+	* Return one server exactly as authored, before `getMcpServers()` strips
+	* rulesync- and tool-specific fields. Keep this lookup here so every target
+	* that re-merges one of those fields shares the same own-property and
+	* prototype-pollution guards.
+	*/
+	getRawMcpServer(name) {
+		if (isPrototypePollutionKey(name)) return void 0;
+		const mcpServers = isRecord$1(this.json) ? this.json.mcpServers : void 0;
+		return isRecord$1(mcpServers) && Object.hasOwn(mcpServers, name) ? mcpServers[name] : void 0;
+	}
 	getMcpServers() {
 		const mcpServers = this.json.mcpServers ?? {};
 		const entries = Object.entries(mcpServers);
@@ -7634,6 +7823,11 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 	globs: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	agentsmd: zod_mini.z.optional(zod_mini.z.looseObject({ subprojectPath: zod_mini.z.optional(zod_mini.z.string()) })),
 	claudecode: zod_mini.z.optional(zod_mini.z.looseObject({ paths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })),
+	codebuddy: zod_mini.z.optional(zod_mini.z.looseObject({
+		paths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
+		description: zod_mini.z.optional(zod_mini.z.string())
+	})),
 	cursor: zod_mini.z.optional(zod_mini.z.looseObject({
 		alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
 		description: zod_mini.z.optional(zod_mini.z.string()),
@@ -7675,7 +7869,8 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 		name: zod_mini.z.optional(zod_mini.z.string()),
 		extends: zod_mini.z.optional(zod_mini.z.string()),
 		facet: zod_mini.z.optional(zod_mini.z.enum(["policies", "output-contracts"]))
-	}))
+	})),
+	factorydroid: zod_mini.z.optional(zod_mini.z.looseObject({ channel: zod_mini.z.optional(zod_mini.z.enum(["design"])) }))
 });
 /**
 * The `agentsmd.subprojectPath` every consumer should act on, resolved once so
@@ -8790,15 +8985,15 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	})),
 	opencode: zod_mini.z.optional(zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
-		license: zod_mini.z.optional(zod_mini.z.string()),
-		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
-		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+		license: zod_mini.z.optional(zod_mini.z.unknown()),
+		compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+		metadata: zod_mini.z.optional(zod_mini.z.unknown())
 	})),
 	kilo: zod_mini.z.optional(zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
-		license: zod_mini.z.optional(zod_mini.z.string()),
-		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
-		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+		license: zod_mini.z.optional(zod_mini.z.unknown()),
+		compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+		metadata: zod_mini.z.optional(zod_mini.z.unknown())
 	})),
 	kiro: zod_mini.z.optional(zod_mini.z.looseObject({
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -8807,9 +9002,9 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	})),
 	deepagents: zod_mini.z.optional(zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
-		license: zod_mini.z.optional(zod_mini.z.string()),
-		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
-		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+		license: zod_mini.z.optional(zod_mini.z.unknown()),
+		compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+		metadata: zod_mini.z.optional(zod_mini.z.unknown())
 	})),
 	copilot: zod_mini.z.optional(zod_mini.z.looseObject({
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -8916,6 +9111,13 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	takt: zod_mini.z.optional(zod_mini.z.looseObject({
 		name: zod_mini.z.optional(zod_mini.z.string()),
 		extends: zod_mini.z.optional(zod_mini.z.string())
+	})),
+	crush: zod_mini.z.optional(zod_mini.z.looseObject({
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+		license: zod_mini.z.optional(zod_mini.z.string()),
+		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	}))
 });
 /**
@@ -9141,7 +9343,7 @@ async function getLocalSkillDirNames(sourceTree) {
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
+* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -9160,7 +9362,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, cursor, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
+* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -9625,8 +9827,8 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 	* This only deletes files that are no longer in the rulesync source, not files that will be overwritten.
 	*/
 	async removeOrphanAiFiles(existingFiles, generatedFiles) {
-		const generatedPaths = new Set(generatedFiles.map((f) => f.getFilePath()));
-		const orphanFiles = existingFiles.filter((f) => !generatedPaths.has(f.getFilePath()));
+		const generatedPaths = new Set(generatedFiles.map((f) => caseFoldIdentity(f.getFilePath())));
+		const orphanFiles = existingFiles.filter((f) => !generatedPaths.has(caseFoldIdentity(f.getFilePath())));
 		for (const aiFile of orphanFiles) {
 			const filePath = aiFile.getFilePath();
 			const loggedPath = stripControlCharacters(filePath);
@@ -10753,6 +10955,15 @@ const FACTORYDROID_COMMANDS_DIR_PATH = (0, node_path.join)(FACTORYDROID_DIR, "co
 const FACTORYDROID_SKILLS_DIR_PATH = (0, node_path.join)(FACTORYDROID_DIR, "skills");
 const FACTORYDROID_DROIDS_DIR_PATH = (0, node_path.join)(FACTORYDROID_DIR, "droids");
 const FACTORYDROID_RULE_FILE_NAME = "AGENTS.md";
+/**
+* Factory Droid's design-guidelines instruction file: "Always-on design-system,
+* UX, visual, and interaction guidance", loaded separately from `AGENTS.md`'s
+* coding guidelines. Project scope only — Factory's docs describe root and
+* nested `DESIGN.md` files like `AGENTS.md`, but document no personal/global
+* home-directory equivalent.
+* @see https://docs.factory.ai/cli/configuration/agents-md
+*/
+const FACTORYDROID_DESIGN_FILE_NAME = "DESIGN.md";
 const FACTORYDROID_MCP_FILE_NAME = "mcp.json";
 const FACTORYDROID_SETTINGS_FILE_NAME = "settings.json";
 const FACTORYDROID_HOOKS_FILE_NAME = "hooks.json";
@@ -11275,6 +11486,21 @@ function stripStrings(_key, value) {
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
 /**
+* Upper bound on the number of values a shared config document may expand
+* to once every YAML alias is written out. Real config files hold a few
+* hundred values at most; even a large MCP server catalog stays orders of
+* magnitude below the limit.
+*/
+const MAX_SHARED_CONFIG_VALUES = 1e5;
+/**
+* Upper bound on the total character count of the string leaves and keys a
+* shared config document may expand to. The value budget bounds how many
+* values are visited, but one long string aliased thousands of times fits
+* that budget while the duplicated output balloons; charging every visited
+* string's length separately bounds the output regardless of alias count.
+*/
+const MAX_SHARED_CONFIG_STRING_CHARS = 4e6;
+/**
 * Rebuild a parsed document without its prototype-pollution keys.
 *
 * Every object is rebuilt, not just the ones that are already plain: a literal
@@ -11289,15 +11515,61 @@ function stripStrings(_key, value) {
 *
 * Dates are the one object the YAML and TOML parsers produce that is not a
 * mapping, so they are passed through rather than flattened into `{}`.
+*
+* The rebuild is bounded, because a YAML alias makes one parsed container
+* reachable from many keys and every alias is copied out independently (the
+* writers dump with `noRefs: true`, so memoizing here would only move the
+* blowup into serialization). A small "alias bomb" of nested anchors would
+* otherwise cost exponential time and memory, and a self-referencing anchor
+* would recurse until the stack overflowed — both reachable from a config
+* file committed to a cloned repository. The walk therefore charges every
+* value against {@link MAX_SHARED_CONFIG_VALUES}, every string and key
+* against {@link MAX_SHARED_CONFIG_STRING_CHARS}, caps nesting at
+* {@link MAX_SHARED_CONFIG_DEPTH}, and refuses a reference back to an
+* ancestor outright, each with a clear error instead of a hang or a crash.
 */
 function sanitizeSharedConfigValue(value) {
-	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
+	return sanitizeSharedConfigValueBounded(value, createBoundedWalk({
+		subject: "Shared config",
+		limits: {
+			maxValues: MAX_SHARED_CONFIG_VALUES,
+			maxStringChars: MAX_SHARED_CONFIG_STRING_CHARS,
+			maxDepth: 64
+		}
+	}));
+}
+/**
+* Refuse a container that is already on the descent path. Unlike the
+* frontmatter cleaner, which drops such a cycle and keeps the rest of the
+* document, a shared config file is refused outright: silently dropping part
+* of a user's settings file would let a later write-back persist the loss.
+*/
+function enterSharedConfigContainer(walk, container) {
+	if (walk.isAncestor(container)) throw new Error("Shared config contains a value that refers back to itself (a circular YAML alias); refusing to process it");
+	walk.enter(container);
+}
+function sanitizeSharedConfigValueBounded(value, walk) {
+	if (typeof value === "string") {
+		walk.chargeValue(value.length);
+		return value;
+	}
+	walk.chargeValue();
+	if (Array.isArray(value)) {
+		enterSharedConfigContainer(walk, value);
+		const items = value.map((item) => sanitizeSharedConfigValueBounded(item, walk));
+		walk.leave(value);
+		return items;
+	}
 	if (value === null || typeof value !== "object" || value instanceof Date) return value;
+	enterSharedConfigContainer(walk, value);
 	const result = {};
 	for (const [key, nested] of Object.entries(value)) {
+		walk.chargeChars(key.length);
+		const sanitized = sanitizeSharedConfigValueBounded(nested, walk);
 		if (isPrototypePollutionKey(key)) continue;
-		result[key] = sanitizeSharedConfigValue(nested);
+		result[key] = sanitized;
 	}
+	walk.leave(value);
 	return result;
 }
 /**
@@ -11326,7 +11598,12 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (parsed === void 0 || parsed === null) return {};
-	const sanitized = sanitizeSharedConfigValue(parsed);
+	let sanitized;
+	try {
+		sanitized = sanitizeSharedConfigValue(parsed);
+	} catch (error) {
+		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
+	}
 	if (!isPlainObject$1(sanitized)) {
 		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
 		return {};
@@ -15652,6 +15929,10 @@ function toAllowedToolsArray(value) {
 * The spec types `compatibility` as a free-form string. An object from a legacy
 * rulesync input is flattened to `key: value` pairs instead of being emitted as
 * a YAML mapping, which conformant clients reject.
+*
+* Exported for `CrushSkill`, which requires the same bare-string shape (Crush's
+* Go struct types `Compatibility` as a plain `string`) and reuses this
+* implementation rather than maintaining a second, divergent copy.
 */
 function toCompatibilityString(value) {
 	if (typeof value === "string") return value;
@@ -15660,6 +15941,10 @@ function toCompatibilityString(value) {
 /**
 * The spec types `metadata` as "a map from string keys to string values", so
 * non-string values (e.g. a YAML number `version: 1`) are stringified.
+*
+* Exported for `CrushSkill`, which requires the same `map[string]string`
+* shape (Crush's Go struct types `Metadata` that way) and reuses this
+* implementation rather than maintaining a second, divergent copy.
 */
 function toStringMetadata(metadata) {
 	return Object.fromEntries(Object.entries(metadata).map(([key, value]) => [key, stringifyValue(value)]));
@@ -18670,7 +18955,13 @@ var CommandsProcessor = class extends FeatureProcessor {
 				if (!matchByBasename || flatOnly && (0, node_path.dirname)(key) !== ".") return [key];
 				return [key, (0, node_path.basename)(key)];
 			};
-			const seen = new Set(toolCommands.flatMap((command) => keysOf(command)));
+			const claimedKeys = new ClaimedIdentities();
+			const primarySource = paths.relativeDirPath;
+			const secondarySource = "a secondary source";
+			for (const command of toolCommands) for (const candidate of keysOf(command)) claimedKeys.claim({
+				identity: candidate,
+				source: primarySource
+			});
 			const additionalCommands = await factory.class.loadAdditionalImportFiles({
 				outputRoot: this.outputRoot,
 				global: this.global,
@@ -18678,11 +18969,26 @@ var CommandsProcessor = class extends FeatureProcessor {
 			});
 			for (const command of additionalCommands) {
 				const key = command.getRelativeFilePath();
-				if (keysOf(command, true).some((candidate) => seen.has(candidate))) {
-					this.logger.warn(`Duplicate ${this.toolTarget} command "${key}" from a secondary source; keeping the one already loaded.`);
+				const collision = [...new Set(keysOf(command, true))].map((candidate) => {
+					const claimed = claimedKeys.claim({
+						identity: candidate,
+						source: secondarySource
+					});
+					return claimed === null ? void 0 : {
+						candidate,
+						claimed
+					};
+				}).find((hit) => hit !== void 0);
+				if (collision) {
+					const { candidate, claimed } = collision;
+					if (claimed.spelling === candidate) this.logger.warn(`Duplicate ${this.toolTarget} command "${stripControlCharacters(key)}" from ${secondarySource}; keeping the one already loaded.`);
+					else this.logger.warn(`Case-insensitive ${this.toolTarget} command collision: "${stripControlCharacters(claimed.spelling)}" and "${stripControlCharacters(candidate)}" resolve to the same command file. Keeping "${stripControlCharacters(claimed.spelling)}" from ${claimed.source === secondarySource ? "earlier in the same source" : `the higher-precedence ${claimed.source}`} and ignoring "${stripControlCharacters(key)}" from ${secondarySource}, which is not imported.`);
 					continue;
 				}
-				for (const candidate of keysOf(command)) seen.add(candidate);
+				for (const candidate of keysOf(command)) claimedKeys.claim({
+					identity: candidate,
+					source: secondarySource
+				});
 				toolCommands.push(command);
 			}
 		}
@@ -18972,6 +19278,21 @@ var AmpHooks = class AmpHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/utils/own-lookup.ts
+/**
+* Read a key from a plain string map without walking its prototype chain.
+*
+* A bracket read on an object literal resolves inherited members too, so a
+* user-supplied key such as `toString` or `constructor` "succeeds" with an
+* `Object.prototype` function instead of falling through to the caller's
+* `?? fallback`. Hook adapters translate native event names this way from
+* `Object.entries()` over a config file, so route the read through here to keep
+* the fallback honest: only a key the map itself defines yields a value.
+*/
+function lookupOwn({ record, key }) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
+//#endregion
 //#region src/utils/object.ts
 /**
 * Return a shallow copy of `obj` keeping only the entries whose value is
@@ -19356,7 +19677,10 @@ function canonicalToToolHooks({ config, toolOverrideHooks, converterConfig, logg
 	const warn = warnOnce(logger);
 	const result = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const toolEventName = converterConfig.canonicalToToolEventNames[eventName] ?? eventName;
+		const toolEventName = lookupOwn({
+			record: converterConfig.canonicalToToolEventNames,
+			key: eventName
+		}) ?? eventName;
 		const byMatcher = groupDefinitionsByMatcher({
 			definitions,
 			converterConfig
@@ -19784,7 +20108,10 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 	const warn = warnOnce(logger);
 	const canonical = {};
 	for (const [toolEventName, matcherEntries] of Object.entries(hooks)) {
-		const eventName = converterConfig.toolToCanonicalEventNames[toolEventName] ?? toolEventName;
+		const eventName = lookupOwn({
+			record: converterConfig.toolToCanonicalEventNames,
+			key: toolEventName
+		}) ?? toolEventName;
 		if (!Array.isArray(matcherEntries)) continue;
 		const defs = [];
 		for (const rawEntry of matcherEntries) {
@@ -19840,7 +20167,10 @@ function flattenAntigravityHooks(parsed) {
 	const flat = {};
 	const addEvent = (event, entries) => {
 		if (isPrototypePollutionKey(event) || !Array.isArray(entries)) return;
-		const existing = Object.hasOwn(flat, event) ? flat[event] : void 0;
+		const existing = lookupOwn({
+			record: flat,
+			key: event
+		});
 		flat[event] = existing ? [...existing, ...entries] : [...entries];
 	};
 	for (const [key, value] of Object.entries(parsed)) if (Array.isArray(value)) addEvent(key, value);
@@ -20227,6 +20557,16 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 		const paths = AugmentcodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
+		let existingHooks = {};
+		try {
+			const parsed = JSON.parse(existingContent);
+			const candidate = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.hooks : void 0;
+			if (candidate && typeof candidate === "object" && !Array.isArray(candidate)) existingHooks = candidate;
+		} catch {
+			existingHooks = {};
+		}
+		const nativeEventKeys = new Set(Object.values(CANONICAL_TO_AUGMENTCODE_EVENT_NAMES));
+		const preservedHooks = Object.fromEntries(Object.entries(existingHooks).filter(([key]) => !nativeEventKeys.has(key)));
 		const config = rulesyncHooks.getJson();
 		const augmentHooks = canonicalToToolHooks({
 			config,
@@ -20238,7 +20578,10 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
 			existingContent,
-			patch: { hooks: augmentHooks },
+			patch: { hooks: {
+				...preservedHooks,
+				...augmentHooks
+			} },
 			filePath
 		});
 		return new AugmentcodeHooks({
@@ -20996,7 +21339,10 @@ function canonicalToCopilotHooks(config) {
 	};
 	const copilot = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const copilotEventName = CANONICAL_TO_COPILOT_EVENT_NAMES[eventName] ?? eventName;
+		const copilotEventName = lookupOwn({
+			record: CANONICAL_TO_COPILOT_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const entries = [];
 		for (const def of definitions) {
 			const hookType = def.type ?? "command";
@@ -21073,7 +21419,10 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 	if (copilotHooks === null || copilotHooks === void 0 || typeof copilotHooks !== "object") return {};
 	const canonical = {};
 	for (const [copilotEventName, hookEntries] of Object.entries(copilotHooks)) {
-		const eventName = COPILOT_TO_CANONICAL_EVENT_NAMES[copilotEventName] ?? copilotEventName;
+		const eventName = lookupOwn({
+			record: COPILOT_TO_CANONICAL_EVENT_NAMES,
+			key: copilotEventName
+		}) ?? copilotEventName;
 		if (!Array.isArray(hookEntries)) continue;
 		const defs = [];
 		for (const rawEntry of hookEntries) {
@@ -21343,7 +21692,10 @@ function canonicalToCopilotCliHooks(config, logger) {
 	};
 	const out = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const copilotEventName = CANONICAL_TO_COPILOTCLI_EVENT_NAMES[eventName] ?? eventName;
+		const copilotEventName = lookupOwn({
+			record: CANONICAL_TO_COPILOTCLI_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const entries = buildCopilotCliEntriesForEvent({
 			eventName,
 			definitions,
@@ -21400,7 +21752,10 @@ function copilotCliHooksToCanonical(rawHooks, logger) {
 	if (rawHooks === null || rawHooks === void 0 || typeof rawHooks !== "object") return {};
 	const canonical = {};
 	for (const [copilotEventName, hookEntries] of Object.entries(rawHooks)) {
-		const eventName = COPILOTCLI_TO_CANONICAL_EVENT_NAMES[copilotEventName] ?? copilotEventName;
+		const eventName = lookupOwn({
+			record: COPILOTCLI_TO_CANONICAL_EVENT_NAMES,
+			key: copilotEventName
+		}) ?? copilotEventName;
 		if (!Array.isArray(hookEntries)) continue;
 		const defs = [];
 		for (const rawEntry of hookEntries) {
@@ -21552,7 +21907,10 @@ var CursorHooks = class CursorHooks extends ToolHooks {
 		const mappedHooks = {};
 		const cursorSupportedTypes = /* @__PURE__ */ new Set(["command", "prompt"]);
 		for (const [eventName, defs] of Object.entries(mergedHooks)) {
-			const cursorEventName = CANONICAL_TO_CURSOR_EVENT_NAMES[eventName] ?? eventName;
+			const cursorEventName = lookupOwn({
+				record: CANONICAL_TO_CURSOR_EVENT_NAMES,
+				key: eventName
+			}) ?? eventName;
 			const mappedDefs = defs.filter((def) => cursorSupportedTypes.has(def.type ?? "command")).map((def) => ({
 				...def.type !== void 0 && def.type !== null && { type: def.type },
 				...def.command !== void 0 && def.command !== null && { command: def.command },
@@ -21585,7 +21943,10 @@ var CursorHooks = class CursorHooks extends ToolHooks {
 		const cursorHooks = parsed.hooks ?? {};
 		const canonicalHooks = {};
 		for (const [cursorEventName, defs] of Object.entries(cursorHooks)) {
-			const eventName = CURSOR_TO_CANONICAL_EVENT_NAMES[cursorEventName] ?? cursorEventName;
+			const eventName = lookupOwn({
+				record: CURSOR_TO_CANONICAL_EVENT_NAMES,
+				key: cursorEventName
+			}) ?? cursorEventName;
 			canonicalHooks[eventName] = defs;
 		}
 		const version = parsed.version ?? 1;
@@ -21655,7 +22016,10 @@ function canonicalToDeepagentsHooks(config) {
 	const hooks = {};
 	for (const [canonicalEvent, definitions] of Object.entries(effectiveHooks)) {
 		if (!supported.has(canonicalEvent)) continue;
-		const deepagentsEvent = CANONICAL_TO_DEEPAGENTS_EVENT_NAMES[canonicalEvent];
+		const deepagentsEvent = lookupOwn({
+			record: CANONICAL_TO_DEEPAGENTS_EVENT_NAMES,
+			key: canonicalEvent
+		});
 		if (!deepagentsEvent) continue;
 		for (const def of definitions) {
 			if ((def.type ?? "command") !== "command") continue;
@@ -21684,7 +22048,10 @@ function canonicalToDeepagentsHooks(config) {
 function deepagentsToCanonicalHooks(hooks) {
 	const canonical = {};
 	for (const [deepagentsEvent, groups] of Object.entries(hooks)) {
-		const canonicalEvent = DEEPAGENTS_TO_CANONICAL_EVENT_NAMES[deepagentsEvent];
+		const canonicalEvent = lookupOwn({
+			record: DEEPAGENTS_TO_CANONICAL_EVENT_NAMES,
+			key: deepagentsEvent
+		});
 		if (!canonicalEvent || !Array.isArray(groups)) continue;
 		for (const group of groups) {
 			if (!isRecord(group) || !Array.isArray(group.hooks)) continue;
@@ -21717,7 +22084,10 @@ function deepagentsLegacyToCanonicalHooks(entries) {
 		const command = argv.length === 3 && argv[0] === "bash" && argv[1] === "-c" ? String(argv[2] ?? "") : argv.join(" ");
 		const events = Array.isArray(entry.events) ? entry.events : [];
 		for (const legacyEvent of events) {
-			const canonicalEvent = typeof legacyEvent === "string" ? DEEPAGENTS_LEGACY_TO_CANONICAL_EVENT_NAMES[legacyEvent] : void 0;
+			const canonicalEvent = typeof legacyEvent === "string" ? lookupOwn({
+				record: DEEPAGENTS_LEGACY_TO_CANONICAL_EVENT_NAMES,
+				key: legacyEvent
+			}) : void 0;
 			if (!canonicalEvent) continue;
 			(canonical[canonicalEvent] ??= []).push({
 				type: "command",
@@ -22438,7 +22808,10 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	const result = {};
 	for (const [canonicalEvent, definitions] of Object.entries(config.hooks)) {
 		if (!HERMESAGENT_CANONICAL_EVENTS.has(canonicalEvent)) continue;
-		const nativeEvent = CANONICAL_TO_HERMESAGENT_EVENT_NAMES[canonicalEvent];
+		const nativeEvent = lookupOwn({
+			record: CANONICAL_TO_HERMESAGENT_EVENT_NAMES,
+			key: canonicalEvent
+		});
 		if (nativeEvent) setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -22449,7 +22822,10 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	}
 	for (const [canonicalEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (!HERMESAGENT_CANONICAL_EVENTS.has(canonicalEvent)) continue;
-		const nativeEvent = CANONICAL_TO_HERMESAGENT_EVENT_NAMES[canonicalEvent];
+		const nativeEvent = lookupOwn({
+			record: CANONICAL_TO_HERMESAGENT_EVENT_NAMES,
+			key: canonicalEvent
+		});
 		if (nativeEvent) setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -22515,7 +22891,10 @@ function hermesHooksToCanonical(hooks) {
 	for (const [nativeEvent, entries] of Object.entries(hooks)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(nativeEvent) || !Array.isArray(entries)) continue;
 		if (!isHermesHookEventEntry(nativeEvent, entries)) continue;
-		const rulesyncEvent = HERMESAGENT_TO_CANONICAL_EVENT_NAMES[nativeEvent] ?? nativeEvent;
+		const rulesyncEvent = lookupOwn({
+			record: HERMESAGENT_TO_CANONICAL_EVENT_NAMES,
+			key: nativeEvent
+		}) ?? nativeEvent;
 		const defs = entries.map((raw) => hermesEntryToDefinition({
 			nativeEvent,
 			raw
@@ -23152,7 +23531,10 @@ function canonicalToKimiCodeHooks({ config, toolOverrideHooks, trustedDirectory,
 	const result = [];
 	const nativeEvents = new Set(KIMI_CODE_NATIVE_HOOK_EVENTS);
 	for (const [event, definitions] of Object.entries(buildEffectiveHooks(config, toolOverrideHooks))) {
-		const nativeEvent = CANONICAL_TO_KIMI_CODE_EVENT_NAMES[event] ?? event;
+		const nativeEvent = lookupOwn({
+			record: CANONICAL_TO_KIMI_CODE_EVENT_NAMES,
+			key: event
+		}) ?? event;
 		if (!nativeEvents.has(nativeEvent)) {
 			logger?.warn(`Kimi Code hooks: skipping unsupported event "${event}".`);
 			continue;
@@ -23186,14 +23568,22 @@ function kimiCodeHooksToCanonical(hooks) {
 		if (raw === null || typeof raw !== "object" || Array.isArray(raw)) continue;
 		const entry = raw;
 		if (typeof entry.event !== "string" || typeof entry.command !== "string") continue;
-		const event = KIMI_CODE_TO_CANONICAL_EVENT_NAMES[entry.event] ?? entry.event;
+		const event = lookupOwn({
+			record: KIMI_CODE_TO_CANONICAL_EVENT_NAMES,
+			key: entry.event
+		}) ?? entry.event;
 		const definition = {
 			type: "command",
 			command: stripTrustedDirectoryWrapper(entry.command),
 			...typeof entry.matcher === "string" && { matcher: entry.matcher },
 			...typeof entry.timeout === "number" && { timeout: entry.timeout }
 		};
-		(result[event] ??= []).push(definition);
+		const list = lookupOwn({
+			record: result,
+			key: event
+		}) ?? [];
+		list.push(definition);
+		result[event] = list;
 	}
 	return result;
 }
@@ -23396,7 +23786,13 @@ function canonicalToKiroIdeHooks(config) {
 	};
 	const entries = [];
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const trigger = CANONICAL_TO_KIRO_IDE_EVENT_NAMES[eventName] ?? KIRO_LEGACY_TO_KIRO_IDE_TRIGGER_NAMES[eventName] ?? eventName;
+		const trigger = lookupOwn({
+			record: CANONICAL_TO_KIRO_IDE_EVENT_NAMES,
+			key: eventName
+		}) ?? lookupOwn({
+			record: KIRO_LEGACY_TO_KIRO_IDE_TRIGGER_NAMES,
+			key: eventName
+		}) ?? eventName;
 		entries.push(...buildKiroIdeEntriesForEvent(trigger, definitions));
 	}
 	return entries;
@@ -23405,7 +23801,10 @@ function kiroIdeHooksToCanonical(entries) {
 	const canonical = {};
 	for (const entry of entries) {
 		if (entry.trigger === void 0 || entry.action === void 0) continue;
-		const eventName = KIRO_IDE_TO_CANONICAL_EVENT_NAMES[entry.trigger] ?? entry.trigger;
+		const eventName = lookupOwn({
+			record: KIRO_IDE_TO_CANONICAL_EVENT_NAMES,
+			key: entry.trigger
+		}) ?? entry.trigger;
 		if (isPrototypePollutionKey(eventName)) continue;
 		const def = {};
 		if (entry.action.type === "command") {
@@ -23422,7 +23821,12 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
 		if (entry.enabled === false) def.enabled = false;
-		(canonical[eventName] ??= []).push(def);
+		const list = lookupOwn({
+			record: canonical,
+			key: eventName
+		}) ?? [];
+		list.push(def);
+		canonical[eventName] = list;
 	}
 	return canonical;
 }
@@ -23603,7 +24007,10 @@ function canonicalToKiroHooks({ config, logger }) {
 	};
 	const kiro = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const kiroEventName = CANONICAL_TO_KIRO_EVENT_NAMES[eventName] ?? eventName;
+		const kiroEventName = lookupOwn({
+			record: CANONICAL_TO_KIRO_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const entries = buildKiroEntriesForEvent(definitions);
 		if (entries.length > 0) if (kiro[kiroEventName]) kiro[kiroEventName].push(...entries);
 		else kiro[kiroEventName] = entries;
@@ -23634,7 +24041,10 @@ function kiroHooksToCanonical(kiroHooks) {
 	if (kiroHooks === null || kiroHooks === void 0 || typeof kiroHooks !== "object") return {};
 	const canonical = {};
 	for (const [kiroEventName, entries] of Object.entries(kiroHooks)) {
-		const eventName = KIRO_TO_CANONICAL_EVENT_NAMES[kiroEventName] ?? kiroEventName;
+		const eventName = lookupOwn({
+			record: KIRO_TO_CANONICAL_EVENT_NAMES,
+			key: kiroEventName
+		}) ?? kiroEventName;
 		if (!Array.isArray(entries)) continue;
 		const defs = [];
 		for (const rawEntry of entries) {
@@ -24193,7 +24603,10 @@ function canonicalToQwencodeHooks(config, logger) {
 	]);
 	const qwencode = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const qwencodeEventName = CANONICAL_TO_QWENCODE_EVENT_NAMES[eventName] ?? eventName;
+		const qwencodeEventName = lookupOwn({
+			record: CANONICAL_TO_QWENCODE_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const byMatcher = /* @__PURE__ */ new Map();
 		for (const def of definitions) {
 			if (!qwencodeSupportedTypes.has(def.type ?? "command")) continue;
@@ -24298,7 +24711,10 @@ function qwencodeHooksToCanonical(qwencodeHooks) {
 	if (qwencodeHooks === null || qwencodeHooks === void 0 || typeof qwencodeHooks !== "object") return {};
 	const canonical = {};
 	for (const [qwencodeEventName, matcherEntries] of Object.entries(qwencodeHooks)) {
-		const eventName = QWENCODE_TO_CANONICAL_EVENT_NAMES[qwencodeEventName] ?? qwencodeEventName;
+		const eventName = lookupOwn({
+			record: QWENCODE_TO_CANONICAL_EVENT_NAMES,
+			key: qwencodeEventName
+		}) ?? qwencodeEventName;
 		if (!Array.isArray(matcherEntries)) continue;
 		const defs = [];
 		for (const rawEntry of matcherEntries) {
@@ -24413,7 +24829,10 @@ function canonicalToReasonixHooks({ config, toolOverrideHooks, logger }) {
 	const result = {};
 	for (const [event, defs] of Object.entries(effectiveHooks)) {
 		if (!SUPPORTED_REASONIX_EVENTS.has(event)) continue;
-		const reasonixEvent = CANONICAL_TO_REASONIX_EVENT_NAMES[event] ?? event;
+		const reasonixEvent = lookupOwn({
+			record: CANONICAL_TO_REASONIX_EVENT_NAMES,
+			key: event
+		}) ?? event;
 		const isMatcherEvent = REASONIX_MATCHER_EVENTS.has(reasonixEvent);
 		const entries = [];
 		for (const def of defs) {
@@ -24426,7 +24845,10 @@ function canonicalToReasonixHooks({ config, toolOverrideHooks, logger }) {
 			if (typeof def.timeout === "number") entry.timeout = Math.round(def.timeout * 1e3);
 			entries.push(entry);
 		}
-		if (entries.length > 0) result[reasonixEvent] = [...result[reasonixEvent] ?? [], ...entries];
+		if (entries.length > 0) result[reasonixEvent] = [...lookupOwn({
+			record: result,
+			key: reasonixEvent
+		}) ?? [], ...entries];
 	}
 	return result;
 }
@@ -24439,7 +24861,10 @@ function reasonixHooksToCanonical(hooks) {
 	if (hooks === null || hooks === void 0 || typeof hooks !== "object" || Array.isArray(hooks)) return canonical;
 	for (const [reasonixEvent, rawEntries] of Object.entries(hooks)) {
 		if (!Array.isArray(rawEntries)) continue;
-		const canonicalEvent = REASONIX_TO_CANONICAL_EVENT_NAMES[reasonixEvent] ?? reasonixEvent;
+		const canonicalEvent = lookupOwn({
+			record: REASONIX_TO_CANONICAL_EVENT_NAMES,
+			key: reasonixEvent
+		}) ?? reasonixEvent;
 		const defs = [];
 		for (const rawEntry of rawEntries) {
 			if (rawEntry === null || typeof rawEntry !== "object" || Array.isArray(rawEntry)) continue;
@@ -24454,7 +24879,10 @@ function reasonixHooksToCanonical(hooks) {
 			if (typeof entry.timeout === "number") def.timeout = entry.timeout / 1e3;
 			defs.push(def);
 		}
-		if (defs.length > 0) canonical[canonicalEvent] = [...canonical[canonicalEvent] ?? [], ...defs];
+		if (defs.length > 0) canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
 	}
 	return canonical;
 }
@@ -24582,7 +25010,10 @@ function canonicalToVibeHooks(config, toolOverride) {
 	const hooks = [];
 	for (const [event, defs] of Object.entries(effective)) {
 		if (!SUPPORTED_VIBE_EVENTS.has(event)) continue;
-		const vibeEvent = CANONICAL_TO_VIBE_EVENT_NAMES[event] ?? event;
+		const vibeEvent = lookupOwn({
+			record: CANONICAL_TO_VIBE_EVENT_NAMES,
+			key: event
+		}) ?? event;
 		let index = 0;
 		for (const def of defs) {
 			if ((def.type ?? "command") !== "command") continue;
@@ -24612,7 +25043,10 @@ function vibeEntryToCanonicalDef(raw) {
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
 	if (isPrototypePollutionKey(vibeEvent)) return null;
-	const canonicalEvent = VIBE_TO_CANONICAL_EVENT_NAMES[vibeEvent] ?? vibeEvent;
+	const canonicalEvent = lookupOwn({
+		record: VIBE_TO_CANONICAL_EVENT_NAMES,
+		key: vibeEvent
+	}) ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
 	if (typeof entry.match === "string" && entry.match !== "" && entry.match !== "*") def.matcher = entry.match;
@@ -24637,7 +25071,10 @@ function vibeHooksToCanonical(parsed) {
 	for (const raw of rawHooks) {
 		const result = vibeEntryToCanonicalDef(raw);
 		if (result === null) continue;
-		const list = canonical[result.canonicalEvent] ?? [];
+		const list = lookupOwn({
+			record: canonical,
+			key: result.canonicalEvent
+		}) ?? [];
 		list.push(result.def);
 		canonical[result.canonicalEvent] = list;
 	}
@@ -25716,6 +26153,68 @@ var ClineIgnore = class ClineIgnore extends ToolIgnore {
 	}
 };
 //#endregion
+//#region src/constants/crush-paths.ts
+const CRUSH_RULE_FILE_NAME = "CRUSH.md";
+const CRUSH_GLOBAL_DIR = (0, node_path.join)(".config", "crush");
+const CRUSH_IGNORE_FILE_NAME = ".crushignore";
+const CRUSH_SKILLS_PROJECT_DIR = (0, node_path.join)(".crush", "skills");
+const CRUSH_SKILLS_GLOBAL_DIR = (0, node_path.join)(CRUSH_GLOBAL_DIR, "skills");
+//#endregion
+//#region src/features/ignore/crush-ignore.ts
+/**
+* Ignore generator for Crush.
+*
+* Crush excludes files from tool access via a `.crushignore` file, read
+* hierarchically (root and any subdirectory, the same way it walks
+* `.gitignore`) using gitignore syntax. Crush documents no global/user-scope
+* ignore file, so this is project-only.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/fsext/fileutil.go
+*/
+var CrushIgnore = class CrushIgnore extends ToolIgnore {
+	static getSettablePaths() {
+		return {
+			relativeDirPath: ".",
+			relativeFilePath: CRUSH_IGNORE_FILE_NAME
+		};
+	}
+	toRulesyncIgnore() {
+		return new RulesyncIgnore({
+			outputRoot: ".",
+			relativeDirPath: ".",
+			relativeFilePath: RULESYNC_AIIGNORE_RELATIVE_FILE_PATH,
+			fileContent: this.fileContent
+		});
+	}
+	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore }) {
+		const body = rulesyncIgnore.getFileContent();
+		return new CrushIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent: body
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, this.getSettablePaths().relativeDirPath, this.getSettablePaths().relativeFilePath));
+		return new CrushIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new CrushIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/ignore/cursor-ignore.ts
 /**
 * Cursor ignore adapter.
@@ -26712,6 +27211,7 @@ const toolIgnoreFactories = /* @__PURE__ */ new Map([
 	["claudecode", { class: ClaudecodeIgnore }],
 	["claudecode-legacy", { class: ClaudecodeIgnore }],
 	["cline", { class: ClineIgnore }],
+	["crush", { class: CrushIgnore }],
 	["cursor", { class: CursorIgnore }],
 	["hermesagent", { class: HermesagentIgnore }],
 	["junie", { class: JunieIgnore }],
@@ -28016,9 +28516,8 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 			throw new Error(`Failed to parse existing Codex CLI config at ${configTomlFilePath}: ${formatError(error)}`, { cause: error });
 		}
 		const strippedMcpServers = rulesyncMcp.getMcpServers();
-		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const converted = convertToCodexFormat(Object.fromEntries(Object.entries(strippedMcpServers).map(([serverName, serverConfig]) => {
-			const rawServer = isRecord$1(rawMcpServers) ? rawMcpServers[serverName] : void 0;
+			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
 			return [serverName, {
 				...serverConfig,
 				...isRecord$1(rawServer) && isEnvVarEntryArray(rawServer.envVars) ? { envVars: rawServer.envVars } : {},
@@ -30981,9 +31480,8 @@ var MusecodeMcp = class MusecodeMcp extends ToolMcp {
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const existing = parseMusecodeSettings(existingContent, filePath);
-		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const converted = convertToMusecodeFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => {
-			const rawServer = isRecord$1(rawMcpServers) ? rawMcpServers[serverName] : void 0;
+			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
 			const mode = asMusecodeMode(isRecord$1(rawServer) ? rawServer.musecodeMode : void 0);
 			return [serverName, {
 				...serverConfig,
@@ -31932,6 +32430,66 @@ async function readRovodevConfigYaml({ outputRoot }) {
 		filePath: (0, node_path.join)(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)
 	});
 }
+/**
+* Decide the absolute path a configured `mcpConfigPath` would name in the
+* given scope, without yet checking whether that path stays inside it. Split
+* out of resolveRovodevMcpImportPath so each function's branching stays
+* within the project's complexity budget.
+*/
+function resolveMcpConfigCandidatePath({ outputRoot, global, normalizedPath, configuredPath }) {
+	if (global && normalizedPath.startsWith("~/")) return { path: (0, node_path.resolve)(outputRoot, normalizedPath.slice(2)) };
+	if (!global && normalizedPath.startsWith("~/")) return { rejectionMessage: `Rovo Dev MCP: mcp.mcpConfigPath is ${quoteValueForWarning(configuredPath)} in project scope. A home-anchored path cannot be imported as part of a project, so importing ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.` };
+	if ((0, node_path.isAbsolute)(normalizedPath)) return { path: (0, node_path.resolve)(normalizedPath) };
+	if (!global) return { path: (0, node_path.resolve)(outputRoot, normalizedPath) };
+	return { rejectionMessage: `Rovo Dev MCP: mcp.mcpConfigPath is ${quoteValueForWarning(configuredPath)} in global scope. Only home-anchored or absolute paths can be imported safely, so importing ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.` };
+}
+/**
+* Resolve the active Rovo Dev MCP config without following a pointer outside
+* the import scope. The implementation is deliberately separate from
+* fromFile: it keeps path-policy decisions testable without changing the
+* public ToolMcp contract.
+*/
+async function resolveRovodevMcpImportPath({ outputRoot, global, config, logger }) {
+	const fallback = {
+		filePath: (0, node_path.join)(outputRoot, ROVODEV_DIR, ROVODEV_MCP_FILE_NAME),
+		relativeDirPath: ROVODEV_DIR,
+		relativeFilePath: ROVODEV_MCP_FILE_NAME
+	};
+	const configuredPath = (config && isRecord$1(config.mcp) ? config.mcp : {}).mcpConfigPath;
+	if (configuredPath === void 0) {
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath is unset in ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)}. Importing ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)}, which may not be the file Rovo Dev reads.`);
+		return fallback;
+	}
+	if (typeof configuredPath !== "string" || configuredPath.trim() === "") {
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)} must be a non-empty string. Importing ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.`);
+		return fallback;
+	}
+	const normalizedPath = normalizeMcpConfigPathValue(configuredPath.trim());
+	const candidateResult = resolveMcpConfigCandidatePath({
+		outputRoot,
+		global,
+		normalizedPath,
+		configuredPath
+	});
+	if ("rejectionMessage" in candidateResult) {
+		logger?.warn(candidateResult.rejectionMessage);
+		return fallback;
+	}
+	const candidatePath = candidateResult.path;
+	const relativePath = (0, node_path.relative)((0, node_path.resolve)(outputRoot), candidatePath);
+	if (relativePath === "" || splitPathSegments(normalizedPath).includes("..") || pathEscapesRoot(relativePath) || await resolvedPathEscapesRoot({
+		rootPath: outputRoot,
+		targetPath: candidatePath
+	})) {
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath is ${quoteValueForWarning(configuredPath)}, which is outside the import scope or traverses a symbolic link. Importing ${(0, node_path.join)(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.`);
+		return fallback;
+	}
+	return {
+		filePath: candidatePath,
+		relativeDirPath: (0, node_path.dirname)(relativePath),
+		relativeFilePath: (0, node_path.basename)(relativePath)
+	};
+}
 function disabledNamesOf(config) {
 	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
 	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
@@ -32037,6 +32595,25 @@ function envVarMcpFileSpellings({ fileName }) {
 	return [`$HOME/${tail}`, `\${HOME}/${tail}`];
 }
 /**
+* Classify the existing `mcpConfigPath` without deciding how to report it.
+* Keep the known-file checks in this order: the generated file is valid in
+* either scope, while the documented default and environment-variable
+* spellings are global-only alternatives that need their own warnings.
+*/
+function classifyExistingPointer({ existing, global, outputRoot }) {
+	if (existing === void 0) return { kind: "unset" };
+	const normalized = typeof existing === "string" ? normalizeMcpConfigPathValue(existing) : void 0;
+	const namesFile = (fileName) => normalized !== void 0 && mcpFileSpellings({
+		fileName,
+		global,
+		outputRoot
+	}).includes(normalized);
+	if (namesFile("mcp.json")) return { kind: "already-generated" };
+	if (global && namesFile(ROVODEV_ALTERNATE_MCP_FILE_NAME)) return { kind: "documented-default" };
+	if (global && normalized !== void 0 && envVarMcpFileSpellings({ fileName: "mcp.json" }).includes(normalized)) return { kind: "env-var-spelling" };
+	return { kind: "unrelated" };
+}
+/**
 * Point `mcp.mcpConfigPath` at the `mcp.json` rulesync writes for this scope,
 * and report whether the block gained a value it did not already carry.
 *
@@ -32147,45 +32724,44 @@ function announcePointer({ global, logger }) {
 async function applyMcpConfigPointer({ existingMcp, global, hasLiveServers, outputRoot, logger }) {
 	const { pointer, configLabel, mcpLabel } = pointerLabels(global);
 	const existing = existingMcp.mcpConfigPath;
-	const normalizedExisting = typeof existing === "string" ? normalizeMcpConfigPathValue(existing) : void 0;
-	const namesFile = (fileName) => normalizedExisting !== void 0 && mcpFileSpellings({
-		fileName,
+	const classification = classifyExistingPointer({
+		existing,
 		global,
 		outputRoot
-	}).includes(normalizedExisting);
-	const pointsAtGeneratedFile = namesFile(ROVODEV_MCP_FILE_NAME);
+	});
 	if (!hasLiveServers) {
-		if (pointsAtGeneratedFile) logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} points at ${mcpLabel}, which now has no enabled server. Rovo Dev reads MCP servers from that file and nowhere else, so ${global ? "Rovo Dev has" : "this project has"} no MCP servers at all until one targeting rovodev is added back — remove the mcp.mcpConfigPath line to fall back to ${global ? "Rovo Dev's own default" : "the global config"}.`);
+		if (classification.kind === "already-generated") logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} points at ${mcpLabel}, which now has no enabled server. Rovo Dev reads MCP servers from that file and nowhere else, so ${global ? "Rovo Dev has" : "this project has"} no MCP servers at all until one targeting rovodev is added back — remove the mcp.mcpConfigPath line to fall back to ${global ? "Rovo Dev's own default" : "the global config"}.`);
 		return false;
 	}
-	if (existing === void 0) {
-		const displaced = global ? await describeDisplacedGlobalServers({ outputRoot }) : null;
-		if (displaced !== null) {
-			logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath unset in ${configLabel}, because ${displaced}. Atlassian documents that path and ${mcpLabel} as two different defaults for the setting, and mcpConfigPath names one config rather than merging, so pointing it at ${mcpLabel} would stop those servers being read on every project. Move the ones you want to keep into .rulesync/mcp.jsonc — or none at all, if it turns out to hold nothing you need — then set mcp.mcpConfigPath to "${pointer}" yourself, which rulesync will not overwrite.`);
-			return false;
+	switch (classification.kind) {
+		case "unset": {
+			const displaced = global ? await describeDisplacedGlobalServers({ outputRoot }) : null;
+			if (displaced !== null) {
+				logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath unset in ${configLabel}, because ${displaced}. Atlassian documents that path and ${mcpLabel} as two different defaults for the setting, and mcpConfigPath names one config rather than merging, so pointing it at ${mcpLabel} would stop those servers being read on every project. Move the ones you want to keep into .rulesync/mcp.jsonc — or none at all, if it turns out to hold nothing you need — then set mcp.mcpConfigPath to "${pointer}" yourself, which rulesync will not overwrite.`);
+				return false;
+			}
+			existingMcp.mcpConfigPath = pointer;
+			announcePointer({
+				global,
+				logger
+			});
+			return true;
 		}
-		existingMcp.mcpConfigPath = pointer;
-		announcePointer({
-			global,
-			logger
-		});
-		return true;
-	}
-	if (pointsAtGeneratedFile) return false;
-	if (global && namesFile(ROVODEV_ALTERNATE_MCP_FILE_NAME)) {
-		await warnAtDocumentedDefault({
-			existing,
-			outputRoot,
-			logger
-		});
-		return false;
-	}
-	if (global && normalizedExisting !== void 0 && envVarMcpFileSpellings({ fileName: "mcp.json" }).includes(normalizedExisting)) {
-		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${quoteValueForWarning(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
-		return false;
+		case "already-generated": return false;
+		case "documented-default":
+			await warnAtDocumentedDefault({
+				existing,
+				outputRoot,
+				logger
+			});
+			return false;
+		case "env-var-spelling":
+			logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${quoteValueForWarning(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
+			return false;
+		case "unrelated":
+			logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
+			return false;
 	}
-	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
-	return false;
 }
 /**
 * Auxiliary writer for the `mcp:` block of `.rovodev/config.yml` (project) /
@@ -32227,14 +32803,20 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			relativeFilePath: ROVODEV_MCP_FILE_NAME
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = this.getSettablePaths({ global });
-		const json = parseRovodevMcpJson(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}", paths.relativeDirPath, paths.relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
+		const rovodevConfig = await readRovodevConfigYaml({ outputRoot });
+		const paths = await resolveRovodevMcpImportPath({
+			outputRoot,
+			global,
+			config: rovodevConfig,
+			logger
+		});
+		const json = parseRovodevMcpJson(await readFileContentOrNull(paths.filePath) ?? "{\"mcpServers\":{}}", paths.relativeDirPath, paths.relativeFilePath);
 		const newJson = {
 			...json,
 			mcpServers: json.mcpServers ?? {}
 		};
-		const disabledNames = disabledNamesOf(await readRovodevConfigYaml({ outputRoot }));
+		const disabledNames = disabledNamesOf(rovodevConfig);
 		if (disabledNames.length > 0 && isMcpServers(newJson.mcpServers)) {
 			const servers = newJson.mcpServers;
 			for (const name of disabledNames) {
@@ -32264,9 +32846,8 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 		} catch {
 			canWriteDisableToggle = false;
 		}
-		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const mcpServers = Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => {
-			const rawServer = isRecord$1(rawMcpServers) && Object.hasOwn(rawMcpServers, name) ? rawMcpServers[name] : void 0;
+			const rawServer = rulesyncMcp.getRawMcpServer(name);
 			const record = {
 				...server,
 				...readEnableInstructions(rawServer) && { rovodevEnableInstructions: true }
@@ -34254,6 +34835,518 @@ function convertAmpToRulesync({ disable, permissions }) {
 	return { permission };
 }
 //#endregion
+//#region src/utils/glob.ts
+/**
+* Convert a glob-like pattern into an anchored regex source string.
+*
+* Only `*` (any run of characters) and `?` (one character) carry meaning;
+* every other regex metacharacter is escaped so it matches literally. The
+* result is anchored at both ends, because the callers ask "is this the whole
+* name?" rather than "does this appear somewhere in it?".
+*
+* Note that `[` and `]` are escaped along with everything else, so a bracket
+* class is a literal here while `matchesGlob` below reads it as a class. The
+* one caller wants exactly that: AugmentCode writes this source into its own
+* config as the tool's own shell-command regex, and never executes it, so it
+* has to say what the tool would read rather than what a glob means. Use
+* `matchesGlob` for an actual comparison.
+*/
+function globToAnchoredRegexSource(glob) {
+	let source = "";
+	for (const char of glob) if (char === "*") source += ".*";
+	else if (char === "?") source += ".";
+	else if (/[\\^$.|+(){}[\]]/.test(char)) source += `\\${char}`;
+	else source += char;
+	return `^${source}$`;
+}
+/**
+* Read a `[...]` class body starting just past the `[`, or `undefined` when the
+* bracket is never closed — in which case it is an ordinary character.
+*/
+function parseGlobClass(characters, start) {
+	let index = start;
+	const negated = characters[index] === "!" || characters[index] === "^";
+	if (negated) index += 1;
+	const members = /* @__PURE__ */ new Set();
+	const ranges = [];
+	let first = true;
+	while (index < characters.length) {
+		const character = characters[index] ?? "";
+		if (character === "]" && !first) return {
+			step: {
+				kind: "class",
+				negated,
+				members,
+				ranges
+			},
+			next: index + 1
+		};
+		first = false;
+		const high = characters[index + 2];
+		if (characters[index + 1] === "-" && high !== void 0 && high !== "]") {
+			ranges.push([character.codePointAt(0) ?? 0, high.codePointAt(0) ?? 0]);
+			index += 3;
+			continue;
+		}
+		members.add(character);
+		index += 1;
+	}
+}
+/** Split a glob into the steps `matchesGlob` walks. */
+function parseGlob(glob) {
+	const characters = [...glob];
+	const steps = [];
+	let index = 0;
+	let bracketsAreClosed = true;
+	while (index < characters.length) {
+		const character = characters[index] ?? "";
+		index += 1;
+		if (character === "*") {
+			if (steps.at(-1)?.kind !== "star") steps.push({ kind: "star" });
+			continue;
+		}
+		if (character === "?") {
+			steps.push({ kind: "any" });
+			continue;
+		}
+		if (character === "[" && bracketsAreClosed) {
+			const parsed = parseGlobClass(characters, index);
+			if (parsed === void 0) bracketsAreClosed = false;
+			else {
+				steps.push(parsed.step);
+				index = parsed.next;
+				continue;
+			}
+		}
+		steps.push({
+			kind: "literal",
+			character
+		});
+	}
+	return steps;
+}
+function matchesGlobStep(step, character) {
+	if (step.kind === "star") return false;
+	if (step.kind === "any") return true;
+	if (step.kind === "literal") return step.character === character;
+	const code = character.codePointAt(0) ?? 0;
+	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
+	return step.negated ? !admitted : admitted;
+}
+/** Whether two single-character steps can both match one same character. */
+function stepsShareACharacter(left, right) {
+	if (left.kind === "any" || right.kind === "any") return true;
+	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
+	if (left.kind === "literal") return matchesGlobStep(right, left.character);
+	if (right.kind === "literal") return matchesGlobStep(left, right.character);
+	return true;
+}
+/** Whether every step from `index` on can match the empty string. */
+function isAllStars(steps, index) {
+	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
+	return true;
+}
+/**
+* The most work one intersection walk will do, counted in cells times the cost
+* of one. Past it the two patterns are reported as intersecting without being
+* walked: the product of two lengths grows quadratically, and a pattern long
+* enough to reach this is pathological rather than a command anybody typed.
+* Answering `true` withholds an `allow`, which is the direction that fails
+* closed.
+*/
+const MAX_INTERSECTION_CELLS = 1e6;
+/**
+* The most work a whole run of comparisons will do. A caller holding R
+* restrictions and A allow rules asks R x A times, and a per-pair cap alone
+* bounds none of that: a hundred restrictions against a hundred allow rules,
+* each pattern just under the per-pair cap, is ten thousand affordable walks
+* that together take minutes. The shared budget is spent down across the run
+* and, once it is gone, every remaining pair is reported as intersecting —
+* again the direction that withholds an `allow` rather than writing one.
+*/
+const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
+/**
+* What a pair costs on top of the cells it walks: the call itself, sizing and
+* filling the two rows the table is held in, and collecting the answer.
+* Charging only cells would leave the *number* of pairs unbounded — a pair of
+* one-step patterns walks a single cell, so n short restrictions against n
+* short allow rules is n squared comparisons that never spend the budget down
+* however many of them there are. Charging a floor per pair puts pair count and
+* walk length on the same exhaustible resource.
+*
+* For the short patterns of an ordinary config the floor is the whole charge,
+* which lowers how many pairs a run compares from around a million to about
+* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
+* that line withholds every allow it has not yet compared, the same fail-closed
+* answer exhaustion gives everywhere else.
+*/
+const INTERSECTION_PAIR_COST = 64;
+/**
+* A budget for one caller's run of comparisons. Hand the same one to every
+* `parsedGlobsIntersect` call that belongs together — one adapter reading one
+* config — so the run as a whole stays bounded rather than only each pair in
+* it.
+*/
+function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
+	return { remaining };
+}
+/**
+* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
+* the same pattern against a whole list parses it once and reuses the result.
+*/
+function parseGlobPattern(glob) {
+	const steps = parseGlob(glob);
+	return {
+		steps,
+		maxRanges: maxRangeCount(steps)
+	};
+}
+/**
+* What one cell can cost, as a multiplier on the cell count. A literal met by a
+* `[a-z...]` class walks that class's ranges, so a single class carrying
+* thousands of them turns a walk that looks affordable by cell count alone into
+* a quadratic one — which is why the budget is spent on cells times this rather
+* than on cells.
+*/
+function maxRangeCount(steps) {
+	let most = 0;
+	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
+	return most;
+}
+/**
+* `globsIntersect` for two globs already parsed, optionally spending a budget
+* shared with the rest of the caller's run — see `createIntersectionBudget`.
+* Once that budget is exhausted every further pair answers `true` without being
+* walked, so a caller reading the answer as a reason to restrict stays on the
+* safe side.
+*/
+function parsedGlobsIntersect(left, right, budget) {
+	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
+	const cellCost = 1 + left.maxRanges + right.maxRanges;
+	const cost = rows.length * columns.length * cellCost;
+	if (cost > MAX_INTERSECTION_CELLS) return true;
+	if (budget !== void 0) {
+		const charge = cost + INTERSECTION_PAIR_COST;
+		if (charge > budget.remaining) {
+			budget.remaining = 0;
+			return true;
+		}
+		budget.remaining -= charge;
+	}
+	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
+	for (let i = rows.length - 1; i >= 0; i--) {
+		const row = Array.from({ length: columns.length + 1 }, () => false);
+		row[columns.length] = isAllStars(rows, i);
+		for (let j = columns.length - 1; j >= 0; j--) {
+			const rowStep = rows[i];
+			const columnStep = columns[j];
+			if (rowStep === void 0 || columnStep === void 0) continue;
+			if (rowStep.kind === "star" || columnStep.kind === "star") {
+				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
+				continue;
+			}
+			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
+		}
+		next = row;
+	}
+	return next[0] ?? false;
+}
+//#endregion
+//#region src/features/permissions/shell-command-categories.ts
+/** The canonical category that names a shell command's permissions. */
+const SHELL_PERMISSION_CATEGORY = "bash";
+/**
+* Collect the canonical rules that govern shell commands, for the adapters
+* whose tool models commands and nothing else.
+*
+* The `bash` category contributes every rule. The all-tools `*` category
+* contributes its **restricting** rules — `deny` and `ask` — because a rule
+* written there covers shell commands too, and dropping it inverts the
+* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
+* an adapter that reads only `bash` auto-approves the very command the file
+* denies.
+*
+* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
+* need not be a command at all — `secrets/**` under `*` denies a path — and
+* carrying it in the restricting direction only over-restricts, while carrying
+* it in the permissive direction would grant something the author never said
+* about commands. Both directions therefore fail closed.
+*/
+function collectShellCommandRules(permission) {
+	const rules = [];
+	const foreignRestrictingCategories = [];
+	const ignoredAllToolsAllowPatterns = [];
+	for (const [category, categoryRules] of Object.entries(permission)) {
+		if (category === "bash") {
+			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
+				pattern,
+				action,
+				fromAllToolsCategory: false
+			});
+			continue;
+		}
+		if (category === "*") {
+			for (const [pattern, action] of Object.entries(categoryRules)) {
+				if (action === "allow") {
+					ignoredAllToolsAllowPatterns.push(pattern);
+					continue;
+				}
+				rules.push({
+					pattern,
+					action,
+					fromAllToolsCategory: true
+				});
+			}
+			continue;
+		}
+		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
+	}
+	return {
+		rules,
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns
+	};
+}
+/**
+* Build the test an adapter applies to an `allow` pattern before writing it:
+* which restrictions it cannot write name some of the same commands? The
+* answer is the list of those restrictions — empty when the `allow` may be
+* written — so a caller can report both the allow rules it withheld and the
+* restrictions that withheld nothing.
+*
+* Canonically the stricter rule wins **whatever its width** — rulesync collapses
+* colliding rules as `deny > ask > allow` — so the two patterns are compared by
+* asking whether any one command matches both. Width does not enter into it: an
+* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
+* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
+* on every `git ... --force` command even though neither pattern covers the
+* other's spelling. Comparing only identical spellings would let the most
+* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
+*
+* Identical spellings are still compared as strings first, as a shortcut past
+* the walk for the commonest case.
+*
+* `normalizePattern` rewrites a pattern written in the tool's own language into
+* the widest glob it could stand for, for a tool whose patterns are not globs.
+* It reaches the `bash` rules and the `allow` rules, which is where such a
+* pattern is written; an all-tools `*` pattern is canonical — it is read by
+* every tool, so it is a glob already — and is compared as it stands. The
+* rewrite must only ever widen what a pattern covers, so an inexact reading
+* withholds an allow rather than writing one the config restricts — see
+* `warpCommandPatternToGlob`.
+*/
+function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
+	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
+		pattern,
+		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
+	}));
+	return (allowPattern) => {
+		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
+		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
+		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
+	};
+}
+/**
+* Which of the given all-tools `*` restrictions look like they may not name a
+* command at all — the question a `deny` and an `ask` written there both raise.
+*
+* "Withheld no allow rule" alone does not answer it: a config with no `allow`
+* rules has nothing to withhold, and a pattern the author also wrote under
+* `bash` is a command on their own word. Both are excluded, so what remains is
+* a `*` pattern that had allow rules to overlap, overlapped none of them, and
+* is claimed as a command nowhere else — the shape `secrets/**` has.
+*
+* A `bash` restriction never belongs here: it names a command by construction,
+* so overlapping no allow rule says nothing is wrong with it.
+*/
+function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
+	if (!rules.some(({ action }) => action === "allow")) return [];
+	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
+	return (0, es_toolkit.uniq)(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
+}
+/**
+* Split shell-command rules into the allow and deny lists of a tool that models
+* commands with those two tiers and nothing else.
+*
+* `ask` has no list of its own — such a tool already prompts for whatever it
+* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
+* still has to *withhold* the `allow` rules it covers, though: the canonical
+* order is `deny > ask > allow`, so auto-approving a command the file also asks
+* about would answer the prompt the author wanted.
+*
+* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
+* from the all-tools `*` category. Warp's cannot: it matches commands with
+* regular expressions rather than globs, and writing any denylist **replaces**
+* Warp's built-in default one, so an inert `secrets/**` entry there would trade
+* the tool's own protection for a rule that matches no command. Where the deny
+* cannot be written it withholds the allow rules it covers instead, which
+* restricts in the same direction without touching the denylist.
+*
+* A `bash` deny withholds nothing: it names a command by construction, so the
+* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
+* and a narrow deny keeps carving an exception out of a wider allow (`git *`
+* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
+* even where it is written: a pattern under `*` need not name a command —
+* `secrets/**` there denies a path — so as a denylist entry it may match nothing
+* at all, and leaving an overlapping allow beside it would auto-approve the very
+* commands the author meant to stop. Over-restricting a `*` deny that *was* a
+* command pattern is reported; failing open would not be.
+*
+* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
+* patterns are not globs.
+*/
+function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
+	const deny = [];
+	const unwrittenDenyPatterns = [];
+	const restrictions = [];
+	const writtenAllToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	for (const rule of rules) {
+		const { pattern, action, fromAllToolsCategory } = rule;
+		if (action === "allow") continue;
+		if (action !== "deny") {
+			restrictions.push(rule);
+			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
+			continue;
+		}
+		if (writesAllToolsDeny || !fromAllToolsCategory) {
+			deny.push(pattern);
+			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
+		} else unwrittenDenyPatterns.push(pattern);
+		if (fromAllToolsCategory) restrictions.push(rule);
+	}
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
+		normalizePattern,
+		budget
+	});
+	const allow = [];
+	const shadowedAllowPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action } of rules) {
+		if (action !== "allow") continue;
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
+		}
+		allow.push(pattern);
+	}
+	return {
+		allow,
+		deny,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: writtenAllToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
+* Report, for one command-only tool, every canonical rule its two lists could
+* not carry. Every command-only adapter shares this reporting, so a rule
+* dropped in one is worded the same way in all.
+*/
+function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
+	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
+	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
+	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
+	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
+	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
+	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
+}
+function resolveShellCommandState(permission, writesAllToolsDeny) {
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permission);
+	const partitioned = partitionCommandRules({
+		rules,
+		writesAllToolsDeny
+	});
+	return {
+		allow: partitioned.allow,
+		deny: partitioned.deny,
+		bash: bashRulesHonoringAllTools(permission),
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns,
+		shadowedAllowPatterns: partitioned.shadowedAllowPatterns,
+		unwrittenDenyPatterns: partitioned.unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: partitioned.unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns: partitioned.unenforcedAllToolsAskPatterns,
+		intersectionBudgetExhausted: partitioned.intersectionBudgetExhausted
+	};
+}
+/**
+* Collect shell-command allow/deny lists the way the command-only adapters do,
+* and report every restriction the surface cannot carry.
+*/
+function resolveShellCommandLists({ permission, writesAllToolsDeny, toolLabel, surfaceLabel, logger }) {
+	const resolved = resolveShellCommandState(permission, writesAllToolsDeny);
+	warnAboutUnwrittenCommandRules({
+		toolLabel,
+		surfaceLabel,
+		foreignRestrictingCategories: resolved.foreignRestrictingCategories,
+		shadowedAllowPatterns: resolved.shadowedAllowPatterns,
+		unwrittenDenyPatterns: resolved.unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: resolved.unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns: resolved.unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns: resolved.ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted: resolved.intersectionBudgetExhausted,
+		logger
+	});
+	return {
+		allow: resolved.allow,
+		deny: resolved.deny,
+		bash: resolved.bash
+	};
+}
+/**
+* The `bash` category after all-tools `*` restrictions have been applied. A
+* `deny`/`ask` written under `*` covers shell commands too, so a bash `allow`
+* it overlaps is withheld, a `*` deny is copied in, and a `*` ask is copied in
+* wherever `bash` says nothing about that exact pattern yet — otherwise it
+* would vanish from the resolved category entirely rather than falling back to
+* a tier that still prompts. An existing `bash` entry for the same pattern is
+* never downgraded by a `*` ask (a bash `allow` was already dropped above, and
+* a bash `deny`/`ask` there is at least as strict already).
+*/
+function bashRulesHonoringAllTools(permission) {
+	const { rules } = collectShellCommandRules(permission);
+	const allToolsRestrictions = rules.filter(({ fromAllToolsCategory }) => fromAllToolsCategory);
+	const shadowingRestrictions = createShadowingRestrictionsTest(allToolsRestrictions);
+	const bash = { ...permission.bash };
+	for (const [pattern, action] of Object.entries(bash)) if (action === "allow" && shadowingRestrictions(pattern).length > 0) delete bash[pattern];
+	for (const { pattern, action } of allToolsRestrictions) {
+		if (isPrototypePollutionKey(pattern)) continue;
+		if (action === "deny") {
+			if (bash[pattern] !== "ask") bash[pattern] = "deny";
+			continue;
+		}
+		if (bash[pattern] === void 0) bash[pattern] = "ask";
+	}
+	return bash;
+}
+/**
+* Return a permission block whose `bash` category honors all-tools `*`
+* restrictions. Other categories are unchanged, so adapters that already model
+* `*` keep doing so.
+*/
+function honorAllToolsOnBash(permission) {
+	if (permission.bash === void 0) return permission;
+	return {
+		...permission,
+		bash: bashRulesHonoringAllTools(permission)
+	};
+}
+//#endregion
 //#region src/features/permissions/antigravity-cli-permissions.ts
 /**
 * Top-level `~/.gemini/antigravity-cli/settings.json` keys the `antigravity-cli`
@@ -34501,7 +35594,7 @@ function convertRulesyncToAntigravityCliPermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const cliToolName = toAntigravityCliToolName(category);
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildPermissionEntry$1(cliToolName, pattern);
@@ -34712,7 +35805,7 @@ function convertRulesyncToAntigravityIdePermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const action = toIdeAction(category);
 		for (const [pattern, permissionAction] of Object.entries(rules)) {
 			const entry = buildPermissionEntry(action, pattern);
@@ -34752,223 +35845,6 @@ function convertAntigravityIdeToRulesyncPermissions(params) {
 	return { permission };
 }
 //#endregion
-//#region src/utils/glob.ts
-/**
-* Convert a glob-like pattern into an anchored regex source string.
-*
-* Only `*` (any run of characters) and `?` (one character) carry meaning;
-* every other regex metacharacter is escaped so it matches literally. The
-* result is anchored at both ends, because the callers ask "is this the whole
-* name?" rather than "does this appear somewhere in it?".
-*
-* Note that `[` and `]` are escaped along with everything else, so a bracket
-* class is a literal here while `matchesGlob` below reads it as a class. The
-* one caller wants exactly that: AugmentCode writes this source into its own
-* config as the tool's own shell-command regex, and never executes it, so it
-* has to say what the tool would read rather than what a glob means. Use
-* `matchesGlob` for an actual comparison.
-*/
-function globToAnchoredRegexSource(glob) {
-	let source = "";
-	for (const char of glob) if (char === "*") source += ".*";
-	else if (char === "?") source += ".";
-	else if (/[\\^$.|+(){}[\]]/.test(char)) source += `\\${char}`;
-	else source += char;
-	return `^${source}$`;
-}
-/**
-* Read a `[...]` class body starting just past the `[`, or `undefined` when the
-* bracket is never closed — in which case it is an ordinary character.
-*/
-function parseGlobClass(characters, start) {
-	let index = start;
-	const negated = characters[index] === "!" || characters[index] === "^";
-	if (negated) index += 1;
-	const members = /* @__PURE__ */ new Set();
-	const ranges = [];
-	let first = true;
-	while (index < characters.length) {
-		const character = characters[index] ?? "";
-		if (character === "]" && !first) return {
-			step: {
-				kind: "class",
-				negated,
-				members,
-				ranges
-			},
-			next: index + 1
-		};
-		first = false;
-		const high = characters[index + 2];
-		if (characters[index + 1] === "-" && high !== void 0 && high !== "]") {
-			ranges.push([character.codePointAt(0) ?? 0, high.codePointAt(0) ?? 0]);
-			index += 3;
-			continue;
-		}
-		members.add(character);
-		index += 1;
-	}
-}
-/** Split a glob into the steps `matchesGlob` walks. */
-function parseGlob(glob) {
-	const characters = [...glob];
-	const steps = [];
-	let index = 0;
-	let bracketsAreClosed = true;
-	while (index < characters.length) {
-		const character = characters[index] ?? "";
-		index += 1;
-		if (character === "*") {
-			if (steps.at(-1)?.kind !== "star") steps.push({ kind: "star" });
-			continue;
-		}
-		if (character === "?") {
-			steps.push({ kind: "any" });
-			continue;
-		}
-		if (character === "[" && bracketsAreClosed) {
-			const parsed = parseGlobClass(characters, index);
-			if (parsed === void 0) bracketsAreClosed = false;
-			else {
-				steps.push(parsed.step);
-				index = parsed.next;
-				continue;
-			}
-		}
-		steps.push({
-			kind: "literal",
-			character
-		});
-	}
-	return steps;
-}
-function matchesGlobStep(step, character) {
-	if (step.kind === "star") return false;
-	if (step.kind === "any") return true;
-	if (step.kind === "literal") return step.character === character;
-	const code = character.codePointAt(0) ?? 0;
-	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
-	return step.negated ? !admitted : admitted;
-}
-/** Whether two single-character steps can both match one same character. */
-function stepsShareACharacter(left, right) {
-	if (left.kind === "any" || right.kind === "any") return true;
-	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
-	if (left.kind === "literal") return matchesGlobStep(right, left.character);
-	if (right.kind === "literal") return matchesGlobStep(left, right.character);
-	return true;
-}
-/** Whether every step from `index` on can match the empty string. */
-function isAllStars(steps, index) {
-	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
-	return true;
-}
-/**
-* The most work one intersection walk will do, counted in cells times the cost
-* of one. Past it the two patterns are reported as intersecting without being
-* walked: the product of two lengths grows quadratically, and a pattern long
-* enough to reach this is pathological rather than a command anybody typed.
-* Answering `true` withholds an `allow`, which is the direction that fails
-* closed.
-*/
-const MAX_INTERSECTION_CELLS = 1e6;
-/**
-* The most work a whole run of comparisons will do. A caller holding R
-* restrictions and A allow rules asks R x A times, and a per-pair cap alone
-* bounds none of that: a hundred restrictions against a hundred allow rules,
-* each pattern just under the per-pair cap, is ten thousand affordable walks
-* that together take minutes. The shared budget is spent down across the run
-* and, once it is gone, every remaining pair is reported as intersecting —
-* again the direction that withholds an `allow` rather than writing one.
-*/
-const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
-/**
-* What a pair costs on top of the cells it walks: the call itself, sizing and
-* filling the two rows the table is held in, and collecting the answer.
-* Charging only cells would leave the *number* of pairs unbounded — a pair of
-* one-step patterns walks a single cell, so n short restrictions against n
-* short allow rules is n squared comparisons that never spend the budget down
-* however many of them there are. Charging a floor per pair puts pair count and
-* walk length on the same exhaustible resource.
-*
-* For the short patterns of an ordinary config the floor is the whole charge,
-* which lowers how many pairs a run compares from around a million to about
-* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
-* that line withholds every allow it has not yet compared, the same fail-closed
-* answer exhaustion gives everywhere else.
-*/
-const INTERSECTION_PAIR_COST = 64;
-/**
-* A budget for one caller's run of comparisons. Hand the same one to every
-* `parsedGlobsIntersect` call that belongs together — one adapter reading one
-* config — so the run as a whole stays bounded rather than only each pair in
-* it.
-*/
-function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
-	return { remaining };
-}
-/**
-* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
-* the same pattern against a whole list parses it once and reuses the result.
-*/
-function parseGlobPattern(glob) {
-	const steps = parseGlob(glob);
-	return {
-		steps,
-		maxRanges: maxRangeCount(steps)
-	};
-}
-/**
-* What one cell can cost, as a multiplier on the cell count. A literal met by a
-* `[a-z...]` class walks that class's ranges, so a single class carrying
-* thousands of them turns a walk that looks affordable by cell count alone into
-* a quadratic one — which is why the budget is spent on cells times this rather
-* than on cells.
-*/
-function maxRangeCount(steps) {
-	let most = 0;
-	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
-	return most;
-}
-/**
-* `globsIntersect` for two globs already parsed, optionally spending a budget
-* shared with the rest of the caller's run — see `createIntersectionBudget`.
-* Once that budget is exhausted every further pair answers `true` without being
-* walked, so a caller reading the answer as a reason to restrict stays on the
-* safe side.
-*/
-function parsedGlobsIntersect(left, right, budget) {
-	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
-	const cellCost = 1 + left.maxRanges + right.maxRanges;
-	const cost = rows.length * columns.length * cellCost;
-	if (cost > MAX_INTERSECTION_CELLS) return true;
-	if (budget !== void 0) {
-		const charge = cost + INTERSECTION_PAIR_COST;
-		if (charge > budget.remaining) {
-			budget.remaining = 0;
-			return true;
-		}
-		budget.remaining -= charge;
-	}
-	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
-	for (let i = rows.length - 1; i >= 0; i--) {
-		const row = Array.from({ length: columns.length + 1 }, () => false);
-		row[columns.length] = isAllStars(rows, i);
-		for (let j = columns.length - 1; j >= 0; j--) {
-			const rowStep = rows[i];
-			const columnStep = columns[j];
-			if (rowStep === void 0 || columnStep === void 0) continue;
-			if (rowStep.kind === "star" || columnStep.kind === "star") {
-				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
-				continue;
-			}
-			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
-		}
-		next = row;
-	}
-	return next[0] ?? false;
-}
-//#endregion
 //#region src/features/permissions/augmentcode-permissions.ts
 const moduleLogger$2 = fallbackLogger;
 zod_mini.z.enum([
@@ -35220,6 +36096,7 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 		const basicExistingEntries = existingEntries.filter((entry) => !isSpecialEntry(entry));
 		const generatedKeys = new Set(generated.map((e) => `${e.toolName}|${e.shellInputRegex ?? ""}|${e.permission.type}`));
 		const preservedBasicEntries = basicExistingEntries.filter((entry) => {
+			if (entry.toolName === "*") return false;
 			if (!MANAGED_AUGMENT_TOOL_NAMES.has(entry.toolName)) return true;
 			if (entry.permission.type === "deny") {
 				const key = `${entry.toolName}|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
@@ -35297,7 +36174,18 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 };
 function convertRulesyncToAugmentEntries({ config, logger }) {
 	const entries = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	const resolvedBashRules = bashRulesHonoringAllTools(config.permission);
+	const permission = config.permission.bash !== void 0 || Object.keys(resolvedBashRules).length > 0 ? {
+		...config.permission,
+		bash: resolvedBashRules
+	} : config.permission;
+	const allToolsFailClosedType = computeAllToolsFailClosedType(config.permission["*"]);
+	const categoriesWithOwnEntries = /* @__PURE__ */ new Set();
+	for (const [category, rules] of Object.entries(permission)) {
+		if (category === "*") {
+			logger?.warn("AugmentCode permissions: the all-tools '*' category cannot be emitted as a single entry because AugmentCode has no wildcard toolName. Deny/ask rules are folded into 'launch-process' and, for any other managed tool that has no explicit rules of its own, applied as a blanket deny/ask; all-tools allow rules and tools that already define their own rules are left untouched.");
+			continue;
+		}
 		const augmentToolName = toAugmentToolName(category);
 		if (!MANAGED_AUGMENT_TOOL_NAMES.has(augmentToolName) && augmentToolName === category) logger?.warn(`AugmentCode permissions: passing through unknown tool category '${category}' as toolName.`);
 		if (augmentToolName === "launch-process") {
@@ -35322,19 +36210,50 @@ function convertRulesyncToAugmentEntries({ config, logger }) {
 				toolName: augmentToolName,
 				permission: { type: "deny" }
 			});
+			categoriesWithOwnEntries.add(category);
 			continue;
 		}
 		const droppedPatterns = [];
-		for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") entries.push({
-			toolName: augmentToolName,
-			permission: { type: actionToAugmentType(action) }
-		});
-		else droppedPatterns.push(pattern);
+		for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") {
+			entries.push({
+				toolName: augmentToolName,
+				permission: { type: actionToAugmentType(action) }
+			});
+			categoriesWithOwnEntries.add(category);
+		} else droppedPatterns.push(pattern);
 		if (droppedPatterns.length > 0) logger?.warn(`AugmentCode permissions: dropping non-wildcard patterns for category '${category}' (${droppedPatterns.join(", ")}); AugmentCode does not document a per-input matcher for this tool. Use a 'deny' rule with pattern '*' if you need to block this tool entirely.`);
 	}
+	entries.push(...synthesizeManagedToolFallbackEntries(categoriesWithOwnEntries, allToolsFailClosedType));
 	return entries;
 }
 /**
+* The strictest action the all-tools `*` category imposes, for tools with no per-input matcher to
+* narrow it onto (see {@link synthesizeManagedToolFallbackEntries}). `deny` wins over `ask`,
+* and an all-tools `allow` never forces an entry — there is nothing to fail closed on.
+*/
+function computeAllToolsFailClosedType(allToolsRules) {
+	if (!allToolsRules) return void 0;
+	const actions = Object.values(allToolsRules);
+	if (actions.some((action) => action === "deny")) return "deny";
+	if (actions.some((action) => action === "ask")) return "ask-user";
+}
+/**
+* Extend the same fail-closed treatment `bash` gets (via {@link bashRulesHonoringAllTools}) to the
+* other managed tools: one that produced no entries of its own above must not fall back to
+* AugmentCode's own default just because it has no per-input matcher to narrow the all-tools
+* restriction onto. A category can be stated yet still emit nothing (e.g. only non-`*` allow/ask
+* patterns, dropped with a warning), so this checks emitted entries rather than whether the
+* category was merely present in the source config. A tool whose own rules did emit entries is
+* left untouched here.
+*/
+function synthesizeManagedToolFallbackEntries(categoriesWithOwnEntries, allToolsFailClosedType) {
+	if (allToolsFailClosedType === void 0) return [];
+	return Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).filter(([canonicalName]) => canonicalName !== "bash" && !categoriesWithOwnEntries.has(canonicalName)).map(([, augmentToolName]) => ({
+		toolName: augmentToolName,
+		permission: { type: allToolsFailClosedType }
+	}));
+}
+/**
 * Sort AugmentCode tool-permission entries to make the `first-match-wins` semantics safe and predictable.
 *
 * Augment evaluates `toolPermissions` top-to-bottom and stops at the first match. To prevent a
@@ -35429,216 +36348,6 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	}
 	return { permission };
 }
-/**
-* Collect the canonical rules that govern shell commands, for the adapters
-* whose tool models commands and nothing else.
-*
-* The `bash` category contributes every rule. The all-tools `*` category
-* contributes its **restricting** rules — `deny` and `ask` — because a rule
-* written there covers shell commands too, and dropping it inverts the
-* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
-* an adapter that reads only `bash` auto-approves the very command the file
-* denies.
-*
-* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
-* need not be a command at all — `secrets/**` under `*` denies a path — and
-* carrying it in the restricting direction only over-restricts, while carrying
-* it in the permissive direction would grant something the author never said
-* about commands. Both directions therefore fail closed.
-*/
-function collectShellCommandRules(permission) {
-	const rules = [];
-	const foreignRestrictingCategories = [];
-	const ignoredAllToolsAllowPatterns = [];
-	for (const [category, categoryRules] of Object.entries(permission)) {
-		if (category === "bash") {
-			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
-				pattern,
-				action,
-				fromAllToolsCategory: false
-			});
-			continue;
-		}
-		if (category === "*") {
-			for (const [pattern, action] of Object.entries(categoryRules)) {
-				if (action === "allow") {
-					ignoredAllToolsAllowPatterns.push(pattern);
-					continue;
-				}
-				rules.push({
-					pattern,
-					action,
-					fromAllToolsCategory: true
-				});
-			}
-			continue;
-		}
-		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
-	}
-	return {
-		rules,
-		foreignRestrictingCategories,
-		ignoredAllToolsAllowPatterns
-	};
-}
-/**
-* Build the test an adapter applies to an `allow` pattern before writing it:
-* which restrictions it cannot write name some of the same commands? The
-* answer is the list of those restrictions — empty when the `allow` may be
-* written — so a caller can report both the allow rules it withheld and the
-* restrictions that withheld nothing.
-*
-* Canonically the stricter rule wins **whatever its width** — rulesync collapses
-* colliding rules as `deny > ask > allow` — so the two patterns are compared by
-* asking whether any one command matches both. Width does not enter into it: an
-* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
-* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
-* on every `git ... --force` command even though neither pattern covers the
-* other's spelling. Comparing only identical spellings would let the most
-* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
-*
-* Identical spellings are still compared as strings first, as a shortcut past
-* the walk for the commonest case.
-*
-* `normalizePattern` rewrites a pattern written in the tool's own language into
-* the widest glob it could stand for, for a tool whose patterns are not globs.
-* It reaches the `bash` rules and the `allow` rules, which is where such a
-* pattern is written; an all-tools `*` pattern is canonical — it is read by
-* every tool, so it is a glob already — and is compared as it stands. The
-* rewrite must only ever widen what a pattern covers, so an inexact reading
-* withholds an allow rather than writing one the config restricts — see
-* `warpCommandPatternToGlob`.
-*/
-function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
-	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
-		pattern,
-		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
-	}));
-	return (allowPattern) => {
-		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
-		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
-		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
-	};
-}
-/**
-* Which of the given all-tools `*` restrictions look like they may not name a
-* command at all — the question a `deny` and an `ask` written there both raise.
-*
-* "Withheld no allow rule" alone does not answer it: a config with no `allow`
-* rules has nothing to withhold, and a pattern the author also wrote under
-* `bash` is a command on their own word. Both are excluded, so what remains is
-* a `*` pattern that had allow rules to overlap, overlapped none of them, and
-* is claimed as a command nowhere else — the shape `secrets/**` has.
-*
-* A `bash` restriction never belongs here: it names a command by construction,
-* so overlapping no allow rule says nothing is wrong with it.
-*/
-function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
-	if (!rules.some(({ action }) => action === "allow")) return [];
-	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
-	return (0, es_toolkit.uniq)(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
-}
-/**
-* Split shell-command rules into the allow and deny lists of a tool that models
-* commands with those two tiers and nothing else.
-*
-* `ask` has no list of its own — such a tool already prompts for whatever it
-* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
-* still has to *withhold* the `allow` rules it covers, though: the canonical
-* order is `deny > ask > allow`, so auto-approving a command the file also asks
-* about would answer the prompt the author wanted.
-*
-* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
-* from the all-tools `*` category. Warp's cannot: it matches commands with
-* regular expressions rather than globs, and writing any denylist **replaces**
-* Warp's built-in default one, so an inert `secrets/**` entry there would trade
-* the tool's own protection for a rule that matches no command. Where the deny
-* cannot be written it withholds the allow rules it covers instead, which
-* restricts in the same direction without touching the denylist.
-*
-* A `bash` deny withholds nothing: it names a command by construction, so the
-* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
-* and a narrow deny keeps carving an exception out of a wider allow (`git *`
-* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
-* even where it is written: a pattern under `*` need not name a command —
-* `secrets/**` there denies a path — so as a denylist entry it may match nothing
-* at all, and leaving an overlapping allow beside it would auto-approve the very
-* commands the author meant to stop. Over-restricting a `*` deny that *was* a
-* command pattern is reported; failing open would not be.
-*
-* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
-* patterns are not globs.
-*/
-function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
-	const deny = [];
-	const unwrittenDenyPatterns = [];
-	const restrictions = [];
-	const writtenAllToolsDenyPatterns = [];
-	const allToolsAskPatterns = [];
-	for (const rule of rules) {
-		const { pattern, action, fromAllToolsCategory } = rule;
-		if (action === "allow") continue;
-		if (action !== "deny") {
-			restrictions.push(rule);
-			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
-			continue;
-		}
-		if (writesAllToolsDeny || !fromAllToolsCategory) {
-			deny.push(pattern);
-			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
-		} else unwrittenDenyPatterns.push(pattern);
-		if (fromAllToolsCategory) restrictions.push(rule);
-	}
-	const budget = createIntersectionBudget();
-	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
-		normalizePattern,
-		budget
-	});
-	const allow = [];
-	const shadowedAllowPatterns = [];
-	const withholdingPatterns = /* @__PURE__ */ new Set();
-	for (const { pattern, action } of rules) {
-		if (action !== "allow") continue;
-		const shadowing = shadowingRestrictions(pattern);
-		if (shadowing.length > 0) {
-			shadowedAllowPatterns.push(pattern);
-			for (const restriction of shadowing) withholdingPatterns.add(restriction);
-			continue;
-		}
-		allow.push(pattern);
-	}
-	return {
-		allow,
-		deny,
-		shadowedAllowPatterns,
-		unwrittenDenyPatterns,
-		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
-			rules,
-			allToolsPatterns: writtenAllToolsDenyPatterns,
-			withholdingPatterns
-		}),
-		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
-			rules,
-			allToolsPatterns: allToolsAskPatterns,
-			withholdingPatterns
-		}),
-		intersectionBudgetExhausted: budget.remaining === 0
-	};
-}
-/**
-* Report, for one command-only tool, every canonical rule its two lists could
-* not carry. Every command-only adapter shares this reporting, so a rule
-* dropped in one is worded the same way in all.
-*/
-function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
-	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
-	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
-	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
-	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
-	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
-	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
-	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
-}
 //#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
@@ -37400,7 +38109,7 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 	return merged;
 }
 function buildCodexBashRulesContent(config) {
-	const bashRules = config.permission.bash ?? {};
+	const bashRules = bashRulesHonoringAllTools(config.permission);
 	const entries = Object.entries(bashRules);
 	const header = ["# Generated by Rulesync from .rulesync/permissions.jsonc (permission.bash)", "# https://developers.openai.com/codex/rules"];
 	if (entries.length === 0) return [...header, "# No bash permission rules were configured."].join("\n");
@@ -38091,7 +38800,7 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 function convertRulesyncToCursorPermissions(config, logger) {
 	const allow = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const cursorType = toCursorType(category);
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildCursorPermissionEntry(cursorType, toCursorPattern(category, pattern));
@@ -38910,7 +39619,7 @@ function convertRulesyncToDevinPermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const scope = toDevinScope(category);
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildDevinPermissionEntry(scope, pattern);
@@ -39198,6 +39907,19 @@ var GoosePermissions = class GoosePermissions extends ToolPermissions {
 	isDeletable() {
 		return false;
 	}
+	/**
+	* `permission.yaml` is Goose's file, not one rulesync owns: rulesync merges
+	* into it when it exists but has no business bringing it into existence to
+	* hold nothing. When no rule maps, the `user` block holds three empty lists,
+	* which would otherwise be written as a fresh permission.yaml that says
+	* nothing — an absent file and empty lists both mean "no user override, so
+	* Goose decides on its own". An existing file is still rewritten as before,
+	* so user content is never dropped — the skip only applies when there is no
+	* file yet.
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
 	static getSettablePaths(_options) {
 		return {
 			relativeDirPath: GOOSE_GLOBAL_DIR,
@@ -39282,7 +40004,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 		never_allow: []
 	};
 	const assigned = /* @__PURE__ */ new Map();
-	const orderedEntries = Object.entries(config.permission).toSorted(([a], [b]) => (a === "edit" ? 1 : 0) - (b === "edit" ? 1 : 0));
+	const orderedEntries = Object.entries(honorAllToolsOnBash(config.permission)).toSorted(([a], [b]) => (a === "edit" ? 1 : 0) - (b === "edit" ? 1 : 0));
 	for (const [category, rules] of orderedEntries) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -39614,7 +40336,7 @@ function unmanagedEntries(existingPermission, key) {
 */
 function buildGrokPermissionArrays(config, existingPermission, logger) {
 	const ranked = /* @__PURE__ */ new Map();
-	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) for (const [pattern, action] of Object.entries(rules)) {
 		const entry = buildGrokEntry(category, pattern);
 		if (entry === null) {
 			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
@@ -39703,6 +40425,8 @@ function deriveGrokPermissionMode(config) {
 function patternsByAction(category, action) {
 	return Object.entries(category ?? {}).filter(([, value]) => value === action).map(([pattern]) => pattern);
 }
+/** The canonical category whose `deny` rules feed `security.website_blocklist`. */
+const WEBFETCH_PERMISSION_CATEGORY = "webfetch";
 function clonePermissionBlock(permission) {
 	return Object.fromEntries(Object.entries(permission).map(([category, rules]) => [category, { ...rules }]));
 }
@@ -39715,18 +40439,39 @@ function ensureCategory(permission, category) {
 function removeEmptyCategories(permission) {
 	for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
 }
+/**
+* Make the native `command_allowlist` authoritative for the `bash` allow rules
+* it can speak for, and for those only. The allowlist is a list of shell-command
+* patterns, so it is generated from `bash` alone (see `fromRulesyncPermissions`);
+* an allow in any other category names something Hermes's allowlist cannot
+* carry, so its absence from the list says nothing about it and it is kept as
+* provenance wrote it. The same holds for a `bash` allow the generator withheld
+* because a stricter `*` or `bash` rule covers it: the allowlist never carried
+* it, so its absence is not a retraction and the rule is kept too.
+*/
 function reconcileCommandAllowlist({ permission, commandAllowlist }) {
-	const nativeAllows = new Set(commandAllowlist);
-	const existingAllowCategories = /* @__PURE__ */ new Map();
-	for (const [category, rules] of Object.entries(permission)) for (const [pattern, action] of Object.entries(rules)) {
-		if (action !== "allow") continue;
-		existingAllowCategories.set(pattern, category);
-		if (!nativeAllows.has(pattern)) delete rules[pattern];
-	}
-	for (const pattern of nativeAllows) {
-		const existingCategory = existingAllowCategories.get(pattern);
-		if (existingCategory) ensureCategory(permission, existingCategory)[pattern] = "allow";
-		else ensureCategory(permission, "bash")[pattern] = "allow";
+	const { rules: commandRules } = collectShellCommandRules(permission);
+	const { shadowedAllowPatterns } = partitionCommandRules({
+		rules: commandRules,
+		writesAllToolsDeny: false
+	});
+	const withheld = new Set(shadowedAllowPatterns);
+	const rules = ensureCategory(permission, SHELL_PERMISSION_CATEGORY);
+	for (const [pattern, action] of Object.entries(rules)) if (action === "allow" && !withheld.has(pattern)) delete rules[pattern];
+	for (const pattern of commandAllowlist) rules[pattern] = "allow";
+}
+/**
+* Report the restricting rules Hermes has no per-pattern primitive for: a
+* `deny` or `ask` in any category other than `bash`, `*`, and `webfetch`, and
+* an `ask` under `webfetch` — the blocklist carries a `webfetch` deny but has
+* no ask tier. (`bash` and `*` are reported by `warnAboutUnwrittenCommandRules`.)
+* Such rules survive only in the round-trip blob.
+*/
+function warnAboutUnexpressedHermesRestrictions({ permissionBlock, foreignRestrictingCategories, logger }) {
+	for (const category of foreignRestrictingCategories) {
+		const isWebfetch = category === WEBFETCH_PERMISSION_CATEGORY;
+		if (isWebfetch && patternsByAction(permissionBlock[category], "ask").length === 0) continue;
+		warnWithFallback(logger, isWebfetch ? "Hermes Agent's security.website_blocklist has no ask tier, so the 'webfetch' ask rule(s) cannot be represented and were skipped; they survive only in the permissions.rulesync round-trip block." : `Hermes Agent has no per-pattern primitive for '${category}' deny and ask rules (it enforces command_allowlist, approvals.deny, and security.website_blocklist), so they were skipped; they survive only in the permissions.rulesync round-trip block.`);
 	}
 }
 function reconcileNativeDenies({ permission, category, patterns }) {
@@ -39838,14 +40583,14 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
-			category: "bash",
+			category: SHELL_PERMISSION_CATEGORY,
 			patterns: isStringArray$2(approvals.deny) ? approvals.deny : []
 		});
 		const security = isRecord$1(config.security) ? config.security : {};
 		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
-			category: "webfetch",
+			category: WEBFETCH_PERMISSION_CATEGORY,
 			patterns: websiteBlocklist.enabled === true && isStringArray$2(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
@@ -39865,12 +40610,32 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			fileContent: JSON.stringify(imported, null, 2)
 		});
 	}
-	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, global = false }) {
+	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, global = false, logger }) {
 		const permissions = rulesyncPermissions.getJson();
 		const permissionBlock = permissions.permission ?? {};
-		const commandAllowlist = Object.entries(permissionBlock).flatMap(([, patterns]) => patternsByAction(patterns, "allow"));
-		const bashDeny = patternsByAction(permissionBlock.bash, "deny");
-		const webfetchDeny = patternsByAction(permissionBlock.webfetch, "deny");
+		const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permissionBlock);
+		const { allow: commandAllowlist, deny: bashDeny, shadowedAllowPatterns, unwrittenDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+			rules,
+			writesAllToolsDeny: false
+		});
+		warnAboutUnexpressedHermesRestrictions({
+			permissionBlock,
+			foreignRestrictingCategories,
+			logger
+		});
+		warnAboutUnwrittenCommandRules({
+			toolLabel: "Hermes Agent",
+			surfaceLabel: "command_allowlist/approvals.deny",
+			foreignRestrictingCategories: [],
+			shadowedAllowPatterns,
+			unwrittenDenyPatterns,
+			unwrittenDenyReason: "approvals.deny is a hard denylist of shell commands, and a pattern written under '*' need not be a command at all.",
+			unenforcedAllToolsAskPatterns,
+			ignoredAllToolsAllowPatterns,
+			intersectionBudgetExhausted,
+			logger
+		});
+		const webfetchDeny = patternsByAction(permissionBlock[WEBFETCH_PERMISSION_CATEGORY], "deny");
 		let config = {};
 		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
 		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
@@ -40137,7 +40902,7 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 */
 function convertRulesyncToJunieRules({ config, logger, existingRules, overrideSecretFile, overrideRuleDefaults }) {
 	const ruleLists = {};
-	for (const [category, patterns] of Object.entries(config.permission)) {
+	for (const [category, patterns] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const group = CANONICAL_TO_JUNIE_GROUP[category];
 		if (!group) {
 			if (Object.keys(patterns).length > 0) logger?.warn(`Junie allowlist only models executables/fileEditing/mcpTools/readOutsideProject (canonical bash/edit/write/read/mcp); '${category}' rules cannot be represented and were skipped.`);
@@ -40387,7 +41152,7 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const kiloOverride = rulesyncJson.kilo;
 		const incomingPermission = {
-			...rulesyncJson.permission,
+			...honorAllToolsOnBash(rulesyncJson.permission),
 			...kiloOverride?.permission
 		};
 		const droppedDenyByKey = {};
@@ -40906,7 +41671,7 @@ function buildKiroPermissionsFromRulesync({ config, logger, existing }) {
 		allowedCommands: [],
 		deniedCommands: []
 	};
-	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) for (const [pattern, action] of Object.entries(rules)) {
 		if (action === "ask") {
 			logger?.warn(`Kiro permissions do not support "ask". Skipping ${category}:${pattern}`);
 			continue;
@@ -41190,7 +41955,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const overridePermission = rulesyncJson.opencode?.permission ?? {};
 		const sharedPermission = {};
-		for (const [category, value] of Object.entries(rulesyncJson.permission ?? {})) sharedPermission[toOpencodePermissionKey(category)] = value;
+		for (const [category, value] of Object.entries(honorAllToolsOnBash(rulesyncJson.permission ?? {}))) sharedPermission[toOpencodePermissionKey(category)] = value;
 		const permission = {};
 		for (const [category, value] of Object.entries({
 			...sharedPermission,
@@ -42319,11 +43084,19 @@ var RooPermissions = class extends ToolPermissions {
 		const paths = this.getSettablePaths();
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const rules = rulesyncPermissions.getJson().permission[COMMAND_CATEGORY];
+		const permission = rulesyncPermissions.getJson().permission;
+		const bashStated = permission[COMMAND_CATEGORY] !== void 0;
 		const patch = {};
-		if (rules !== void 0) {
+		if (bashStated) {
+			const { bash } = resolveShellCommandLists({
+				permission,
+				writesAllToolsDeny: true,
+				toolLabel: this.getToolLabel(),
+				surfaceLabel: `${this.getAllowedCommandsKey()}/${this.getDeniedCommandsKey()}`,
+				logger
+			});
 			const { allowed, denied } = buildVscodeCommandLists({
-				rules,
+				rules: bash,
 				toolLabel: this.getToolLabel(),
 				logger
 			});
@@ -42334,7 +43107,7 @@ var RooPermissions = class extends ToolPermissions {
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			ownsCommandKeys: rules !== void 0,
+			ownsCommandKeys: bashStated,
 			fileContent: applySharedConfigPatch({
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
@@ -42714,7 +43487,7 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 		config,
 		logger
 	});
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		if (category === CATCH_ALL_PATTERN$1) {
 			const toolWideDefault = convertAllToolsRules({
 				rules,
@@ -43724,7 +44497,7 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const config = parseVibeConfig(existingContent);
-		const permission = rulesyncPermissions.getJson().permission;
+		const permission = honorAllToolsOnBash(rulesyncPermissions.getJson().permission);
 		const vibeOverride = rulesyncPermissions.getJson().vibe;
 		const tools = toVibeToolsRecord(config.tools);
 		const diskShellPatterns = new Map([VIBE_SHELL_CATEGORY, ...VIBE_SHELL_ALIAS_TOOL_NAMES].map((vibeToolName) => [vibeToolName, toStringArray(readVibeToolConfig({
@@ -45065,6 +45838,19 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 	isDeletable() {
 		return false;
 	}
+	/**
+	* `settings.toml` is Warp's file, not one rulesync owns: rulesync merges into
+	* it when it exists but has no business bringing it into existence to hold
+	* nothing. When no rule maps, both command lists are dropped and the payload
+	* is a bare `[agents.profiles]` table, which would otherwise be written as a
+	* fresh settings file that says nothing — an absent file and an empty table
+	* both mean "Warp's own defaults". An existing file is still rewritten as
+	* before, so user content is never dropped — the skip only applies when
+	* there is no file yet.
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
 	static getSettablePaths(_options) {
 		return {
 			relativeDirPath: warpSettingsDir(),
@@ -45676,6 +46462,7 @@ function buildZedToolPermissions({ permission, logger }) {
 	for (const [category, rules] of Object.entries(permission)) {
 		if (category === "*") {
 			for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") managedDefault = CANONICAL_TO_ZED_ACTION[action];
+			else if (permission.bash?.[pattern] === "deny" || permission.bash?.[pattern] === "ask") continue;
 			else logger?.warn(`Zed permissions: dropping the "*" category rule for pattern "${pattern}" — Zed's global tool-permission default takes no patterns; scope the rule to a tool category instead.`);
 			continue;
 		}
@@ -45830,7 +46617,7 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		const toolPermissions = asRecord(agent.tool_permissions);
 		const existingTools = asRecord(toolPermissions.tools);
 		const { managedDefault, managedTools, excludedCategories, inertMcpCategories } = buildZedToolPermissions({
-			permission: config.permission,
+			permission: honorAllToolsOnBash(config.permission),
 			logger
 		});
 		if (excludedCategories.length > 0) logger?.warn(`Zed permissions: dropping the ${excludedCategories.map((category) => `"${category}"`).join(", ")} ${excludedCategories.length === 1 ? "category" : "categories"} — Zed does not gate its read-only tools, so the entries would never be consulted. Zed's read-denial surface is \`private_files\`, which the ignore feature writes from \`.rulesync/.aiignore\`.`);
@@ -46339,6 +47126,24 @@ var PermissionsProcessor = class extends FeatureProcessor {
 	}
 };
 //#endregion
+//#region src/constants/codebuddy-paths.ts
+/**
+* CodeBuddy Code configuration-layout conventions.
+*
+* CodeBuddy Code (`@tencent-ai/codebuddy-code`) is Tencent Cloud's terminal
+* coding agent. Its configuration surface mirrors Claude Code closely: a
+* root memory file plus a `.codebuddy/` tree.
+*
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @see https://www.codebuddy.ai/docs/cli/codebuddy-dir
+*/
+/** Root directory for CodeBuddy Code configuration, relative to the scope root. */
+const CODEBUDDY_DIR = ".codebuddy";
+const CODEBUDDY_RULE_FILE_NAME = "CODEBUDDY.md";
+const CODEBUDDY_LOCAL_RULE_FILE_NAME = "CODEBUDDY.local.md";
+/** Modular rules directory name under `.codebuddy/`. */
+const CODEBUDDY_RULES_DIR_NAME = "rules";
+//#endregion
 //#region src/features/skills/simulated-skill.ts
 const SimulatedSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -46877,7 +47682,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 	* This only deletes directories that are no longer in the rulesync source, not directories that will be overwritten.
 	*/
 	async removeOrphanAiDirs(existingDirs, generatedDirs) {
-		const generatedPaths = new Set(generatedDirs.map((d) => d.getDirPath()));
+		const generatedPaths = new Set(generatedDirs.map((d) => caseFoldIdentity(d.getDirPath())));
 		const orphanPaths = /* @__PURE__ */ new Set();
 		const quotedOutputRoot = quoteForLog(this.outputRoot);
 		for (const aiDir of existingDirs) {
@@ -46902,7 +47707,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				this.logger.warn(verdict === "equal" ? `Refusing to delete ${quotedDirPath}: it is the root it was found in, not a directory inside that root` : `Refusing to delete ${quotedDirPath}: it is not inside ${quotedRoot}, the root it was found in`);
 				continue;
 			}
-			if (!generatedPaths.has(dirPath)) orphanPaths.add(dirPath);
+			if (!generatedPaths.has(caseFoldIdentity(dirPath))) orphanPaths.add(dirPath);
 		}
 		return await this.deleteOrphanPaths({
 			paths: orphanPaths,
@@ -47001,7 +47806,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 			const mainFile = aiDir.getMainFile();
 			if (mainFile) generatedNames.add(toPosixPath(mainFile.name));
 			for (const file of aiDir.getOtherFiles()) generatedNames.add(toPosixPath(file.relativeFilePathToDirPath));
-			const generatedNamesFolded = new Set([...generatedNames].map((name) => name.toLowerCase()));
+			const generatedNamesFolded = new Set([...generatedNames].map((name) => caseFoldIdentity(name)));
 			let existingNames;
 			try {
 				existingNames = await listFilePathsRecursively(dirPath, {
@@ -47016,7 +47821,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				const posixName = toPosixPath(existingName);
 				if (generatedNames.has(posixName)) continue;
 				const filePath = (0, node_path.join)(dirPath, existingName);
-				if (generatedNamesFolded.has(posixName.toLowerCase())) {
+				if (generatedNamesFolded.has(caseFoldIdentity(posixName))) {
 					this.logger.warn(`Refusing to delete ${quoteForLog(filePath)}: this run wrote a file whose path differs from it only in case, which on a case-insensitive filesystem is the very file it wrote`);
 					continue;
 				}
@@ -47072,7 +47877,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 			generatedPaths.add(flatFilePath);
 			for (const file of generatedDir.getOtherFiles()) generatedPaths.add((0, node_path.join)(generatedDirPath, file.relativeFilePathToDirPath));
 		}
-		const generatedPathsFolded = new Set([...generatedPaths].map((generatedPath) => generatedPath.toLowerCase()));
+		const generatedPathsFolded = new Set([...generatedPaths].map((generatedPath) => caseFoldIdentity(generatedPath)));
 		const orphanPaths = /* @__PURE__ */ new Set();
 		const quotedOutputRoot = quoteForLog(this.outputRoot);
 		for (const aiDir of existingFlatFiles) {
@@ -47102,7 +47907,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				continue;
 			}
 			if (generatedPaths.has(filePath)) continue;
-			if (generatedPathsFolded.has(filePath.toLowerCase())) {
+			if (generatedPathsFolded.has(caseFoldIdentity(filePath))) {
 				this.logger.warn(`Refusing to delete ${quotedFilePath}: this run wrote a file whose path differs from it only in case, which on a case-insensitive filesystem is the very file it wrote`);
 				continue;
 			}
@@ -48934,6 +49739,191 @@ var CopilotcliSkill = class CopilotcliSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/crush-skill.ts
+const CrushSkillFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.string(),
+	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+	license: zod_mini.z.optional(zod_mini.z.string()),
+	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Represents a Crush Agent Skill directory.
+*
+* Crush auto-discovers Agent Skills (`SKILL.md` per directory) from
+* `.crush/skills/` at project scope and `~/.config/crush/skills/` (or
+* `$CRUSH_SKILLS_DIR`) at global scope. Unless `$CRUSH_SKILLS_DIR` is set,
+* Crush also scans several shared directories it does not own (globally
+* `~/.config/agents/skills/`, `~/.agents/skills/`, `~/.claude/skills/`;
+* per-project `.agents/skills/`, `.claude/skills/`, `.cursor/skills/`, also
+* checked at a git worktree's common root); this class writes only to the
+* Crush-specific path above, leaving those shared roots to their own targets.
+*
+* Crush's `UserInvocable` field is a non-pointer Go `bool`, so an omitted
+* `user-invocable` (at both the root and the `crush:` section) resolves to
+* `false`: the skill stays reachable by the model but is hidden from Crush's
+* command palette. See `FromSkillCatalog` in `internal/commands/commands.go`.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+var CrushSkill = class CrushSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = CRUSH_SKILLS_PROJECT_DIR, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? CRUSH_SKILLS_GLOBAL_DIR : CRUSH_SKILLS_PROJECT_DIR };
+	}
+	getFrontmatter() {
+		return CrushSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = CrushSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const crushSection = {
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.license !== void 0 && { license: frontmatter.license },
+			...frontmatter.compatibility !== void 0 && { compatibility: frontmatter.compatibility },
+			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
+		};
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"],
+			...Object.keys(crushSection).length > 0 && { crush: crushSection }
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+		const settablePaths = CrushSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const crushSection = rulesyncFrontmatter.crush;
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const license = resolveLicense({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const compatibility = resolveCompatibility({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const metadata = resolveMetadata({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const compatibilityString = compatibility === void 0 ? void 0 : toCompatibilityString(compatibility);
+		const crushFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...license !== void 0 && { license },
+			...compatibilityString !== void 0 && compatibilityString.length > 0 && { compatibility: compatibilityString },
+			...metadata !== void 0 && { metadata: toStringMetadata(metadata) }
+		};
+		return new CrushSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName: rulesyncSkill.getDirName(),
+			frontmatter: crushFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("crush");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: CrushSkill.getSettablePaths
+		});
+		const result = CrushSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new CrushSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		const settablePaths = CrushSkill.getSettablePaths({ global });
+		return new CrushSkill({
+			outputRoot,
+			relativeDirPath: relativeDirPath ?? settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/cursor-skill.ts
 const CursorSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -49098,9 +50088,9 @@ const DeepagentsSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
 	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
-	license: zod_mini.z.optional(zod_mini.z.string()),
-	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
-	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+	license: zod_mini.z.optional(zod_mini.z.unknown()),
+	compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+	metadata: zod_mini.z.optional(zod_mini.z.unknown())
 });
 var DeepagentsSkill = class DeepagentsSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = DEEPAGENTS_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -50158,9 +51148,9 @@ var JunieSkill = class JunieSkill extends ToolSkill {
 const KiloSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
-	license: zod_mini.z.optional(zod_mini.z.string()),
-	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
-	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	license: zod_mini.z.optional(zod_mini.z.unknown()),
+	compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+	metadata: zod_mini.z.optional(zod_mini.z.unknown()),
 	"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 var KiloSkill = class KiloSkill extends ToolSkill {
@@ -50597,10 +51587,11 @@ var KiroSkill = class KiroSkill extends ToolSkill {
 			rootFrontmatter: rulesyncFrontmatter,
 			section: kiroSection
 		});
+		const { name: _sectionName, description: _sectionDescription, ...section } = kiroSection ?? {};
 		const kiroFrontmatter = {
-			...kiroSection,
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
+			...section,
 			...license !== void 0 && { license },
 			...compatibility !== void 0 && { compatibility },
 			...metadata !== void 0 && { metadata }
@@ -50832,9 +51823,9 @@ var MusecodeSkill = class MusecodeSkill extends ToolSkill {
 const OpenCodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
-	license: zod_mini.z.optional(zod_mini.z.string()),
-	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
-	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	license: zod_mini.z.optional(zod_mini.z.unknown()),
+	compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
+	metadata: zod_mini.z.optional(zod_mini.z.unknown()),
 	"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 var OpenCodeSkill = class OpenCodeSkill extends ToolSkill {
@@ -52748,6 +53739,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["crush", {
+		class: CrushSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["cursor", {
 		class: CursorSkill,
 		meta: {
@@ -60491,6 +61490,238 @@ var ClineRule = class ClineRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/features/rules/codebuddy-rule.ts
+/**
+* Frontmatter schema for CodeBuddy Code modular rules.
+* @see https://www.codebuddy.ai/docs/cli/memory
+*/
+const CodebuddyRuleFrontmatterSchema = zod_mini.z.object({
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	paths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	alwaysApply: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* A universal glob (matching everything) is redundant on an Always Apply
+* rule and, paired with `alwaysApply: true`, is the same semantic conflict
+* `CursorRule.resolveCursorGlobs` avoids for Cursor: `alwaysApply` already
+* applies the rule everywhere, so also emitting an explicit
+* `paths: ["**\/*"]` is at best redundant and, on a subsequent
+* import/generate round-trip, misleadingly implies the rule is scoped by
+* path rather than always-on.
+*/
+const UNIVERSAL_PATHS = /* @__PURE__ */ new Set(["**/*", "*"]);
+/**
+* Rule generator for CodeBuddy Code, Tencent Cloud's terminal coding agent
+* (`@tencent-ai/codebuddy-code`). Its configuration surface mirrors Claude
+* Code closely.
+*
+* Rules format:
+* - {project}/CODEBUDDY.md (root: true), also read from {project}/.codebuddy/CODEBUDDY.md
+* - {project}/.codebuddy/rules/*.md (root: false, with optional
+*   `description` / `paths` / `alwaysApply` frontmatter)
+* - Global: ~/.codebuddy/CODEBUDDY.md and ~/.codebuddy/rules/*.md
+*
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @see https://www.codebuddy.ai/docs/cli/codebuddy-dir
+*/
+var CodebuddyRule = class CodebuddyRule extends ToolRule {
+	frontmatter;
+	body;
+	static getSettablePaths({ global, excludeToolDir } = {}) {
+		if (global) return {
+			root: {
+				relativeDirPath: buildToolPath(CODEBUDDY_DIR, ".", excludeToolDir),
+				relativeFilePath: CODEBUDDY_RULE_FILE_NAME
+			},
+			nonRoot: { relativeDirPath: buildToolPath(CODEBUDDY_DIR, CODEBUDDY_RULES_DIR_NAME, excludeToolDir) }
+		};
+		return {
+			root: {
+				relativeDirPath: ".",
+				relativeFilePath: CODEBUDDY_RULE_FILE_NAME
+			},
+			alternativeRoots: [{
+				relativeDirPath: CODEBUDDY_DIR,
+				relativeFilePath: CODEBUDDY_RULE_FILE_NAME
+			}],
+			nonRoot: { relativeDirPath: buildToolPath(CODEBUDDY_DIR, CODEBUDDY_RULES_DIR_NAME, excludeToolDir) }
+		};
+	}
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate) {
+			const result = CodebuddyRuleFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: rest.root ? body : CodebuddyRule.generateFileContent(body, frontmatter)
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static generateFileContent(body, frontmatter) {
+		if (frontmatter.description === void 0 && frontmatter.paths === void 0 && frontmatter.alwaysApply === void 0) return body;
+		return stringifyFrontmatter(body, {
+			description: frontmatter.description,
+			alwaysApply: frontmatter.alwaysApply,
+			paths: frontmatter.paths
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false, relativeDirPath: overrideDirPath }) {
+		const paths = this.getSettablePaths({ global });
+		if (relativeFilePath === paths.root.relativeFilePath) {
+			const rootDirPath = overrideDirPath ?? paths.root.relativeDirPath;
+			const fileContent = await readFileContent((0, node_path.join)(outputRoot, rootDirPath, paths.root.relativeFilePath));
+			return new CodebuddyRule({
+				outputRoot,
+				relativeDirPath: rootDirPath,
+				relativeFilePath: paths.root.relativeFilePath,
+				frontmatter: {},
+				body: fileContent.trim(),
+				validate,
+				root: true
+			});
+		}
+		if (!paths.nonRoot) throw new Error(`nonRoot path is not set for ${relativeFilePath}`);
+		const relativePath = (0, node_path.join)(paths.nonRoot.relativeDirPath, relativeFilePath);
+		const filePath = (0, node_path.join)(outputRoot, relativePath);
+		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const result = CodebuddyRuleFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new CodebuddyRule({
+			outputRoot,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: content.trim(),
+			validate,
+			root: false
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		const isRoot = relativeFilePath === this.getSettablePaths({ global }).root.relativeFilePath;
+		return new CodebuddyRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			validate: false,
+			root: isRoot
+		});
+	}
+	static resolveCodebuddyPaths({ paths, alwaysApply }) {
+		if (!paths || paths.length === 0) return;
+		if (alwaysApply && paths.every((path) => UNIVERSAL_PATHS.has(path.trim()))) return;
+		return paths;
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
+		const root = rulesyncFrontmatter.root ?? false;
+		const paths = this.getSettablePaths({ global });
+		const body = rulesyncRule.getBody();
+		if (root) return new CodebuddyRule({
+			outputRoot,
+			frontmatter: {},
+			body,
+			relativeDirPath: paths.root.relativeDirPath,
+			relativeFilePath: paths.root.relativeFilePath,
+			validate,
+			root
+		});
+		if (!paths.nonRoot) throw new Error(`nonRoot path is not set for ${rulesyncRule.getRelativeFilePath()}`);
+		const codebuddyPaths = rulesyncFrontmatter.codebuddy?.paths;
+		const globs = rulesyncFrontmatter.globs;
+		const alwaysApply = rulesyncFrontmatter.codebuddy?.alwaysApply;
+		const pathsValue = CodebuddyRule.resolveCodebuddyPaths({
+			paths: codebuddyPaths ?? (globs?.length ? globs : void 0),
+			alwaysApply: alwaysApply === true
+		});
+		const codebuddyFrontmatter = {
+			description: rulesyncFrontmatter.codebuddy?.description ?? rulesyncFrontmatter.description,
+			paths: pathsValue,
+			alwaysApply
+		};
+		return new CodebuddyRule({
+			outputRoot,
+			frontmatter: codebuddyFrontmatter,
+			body,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath: rulesyncRule.getRelativeFilePath(),
+			validate,
+			root
+		});
+	}
+	toRulesyncRule() {
+		const targets = ["*"];
+		if (this.isRoot()) {
+			const rulesyncFrontmatter = {
+				targets,
+				root: true,
+				description: this.description,
+				globs: ["**/*"]
+			};
+			return new RulesyncRule({
+				outputRoot: this.getOutputRoot(),
+				frontmatter: rulesyncFrontmatter,
+				body: this.body,
+				relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+				relativeFilePath: this.getRelativeFilePath(),
+				validate: true
+			});
+		}
+		const isAlways = this.frontmatter.alwaysApply === true;
+		const sourcePaths = this.frontmatter.paths ?? [];
+		const globs = sourcePaths.length === 0 && isAlways ? ["**/*"] : sourcePaths;
+		const rulesyncFrontmatter = {
+			targets,
+			root: false,
+			description: this.frontmatter.description,
+			globs,
+			...(this.frontmatter.paths !== void 0 || this.frontmatter.alwaysApply !== void 0 || this.frontmatter.description !== void 0) && { codebuddy: {
+				paths: this.frontmatter.paths,
+				alwaysApply: this.frontmatter.alwaysApply,
+				description: this.frontmatter.description
+			} }
+		};
+		return new RulesyncRule({
+			outputRoot: this.getOutputRoot(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.body,
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = CodebuddyRuleFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		else return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "codebuddy"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/codexcli-rule.ts
 var CodexcliRule = class CodexcliRule extends ToolRule {
 	constructor({ fileContent, root, ...rest }) {
@@ -60787,6 +62018,79 @@ var CopilotcliRule = class CopilotcliRule extends CopilotRule {
 	}
 };
 //#endregion
+//#region src/features/rules/crush-rule.ts
+var CrushRule = class CrushRule extends ToolRule {
+	constructor({ fileContent, root, ...rest }) {
+		super({
+			...rest,
+			fileContent,
+			root: root ?? false
+		});
+	}
+	static getSettablePaths({ global = false } = {}) {
+		if (global) return { root: {
+			relativeDirPath: CRUSH_GLOBAL_DIR,
+			relativeFilePath: CRUSH_RULE_FILE_NAME
+		} };
+		return { root: {
+			relativeDirPath: ".",
+			relativeFilePath: CRUSH_RULE_FILE_NAME
+		} };
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const relativePath = (0, node_path.join)(root.relativeDirPath, root.relativeFilePath);
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
+		return new CrushRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = rulesyncRule.getFrontmatter().root ?? false;
+		return new CrushRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		return this.toRulesyncRuleDefault();
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = relativeFilePath === root.relativeFilePath && relativeDirPath === root.relativeDirPath;
+		return new CrushRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: isRoot
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "crush"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/cursor-rule.ts
 const CursorRuleFrontmatterSchema = zod_mini.z.object({
 	description: zod_mini.z.optional(zod_mini.z.string()),
@@ -61394,13 +62698,34 @@ var DevinRule = class DevinRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/factorydroid-rule.ts
+/**
+* Rule generator for Factory Droid.
+*
+* Factory Droid loads the root `AGENTS.md` (project) / `~/.factory/AGENTS.md`
+* (global) as coding guidelines, plus non-root rules referenced from it via
+* `.factory/rules/*.md`.
+*
+* Factory Droid also loads `DESIGN.md` (project only) as a second,
+* independent instruction surface: "Always-on design-system, UX, visual, and
+* interaction guidance", loaded separately from `AGENTS.md`'s coding
+* guidelines. Rulesync emits it from any non-root rule that opts in via a
+* `factorydroid.channel: design` frontmatter block — those rule bodies are
+* routed to `DESIGN.md` instead of `AGENTS.md`/`.factory/rules/*.md`, and
+* multiple opted-in rules concatenate in source order. Factory's docs describe
+* `DESIGN.md` at the repository root and in nested subdirectories, like
+* `AGENTS.md`, but document no personal/global home-directory equivalent, so
+* this channel is project scope only.
+* @see https://docs.factory.ai/cli/configuration/agents-md
+*/
 var FactorydroidRule = class FactorydroidRule extends ToolRule {
-	constructor({ fileContent, root, ...rest }) {
+	design;
+	constructor({ fileContent, root, design = false, ...rest }) {
 		super({
 			...rest,
 			fileContent,
 			root: root ?? false
 		});
+		this.design = design;
 	}
 	static getSettablePaths({ global, excludeToolDir } = {}) {
 		if (global) return { root: {
@@ -61412,11 +62737,47 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 				relativeDirPath: ".",
 				relativeFilePath: FACTORYDROID_RULE_FILE_NAME
 			},
-			nonRoot: { relativeDirPath: buildToolPath(FACTORYDROID_DIR, "rules", excludeToolDir) }
+			nonRoot: { relativeDirPath: buildToolPath(FACTORYDROID_DIR, "rules", excludeToolDir) },
+			design: {
+				relativeDirPath: ".",
+				relativeFilePath: FACTORYDROID_DESIGN_FILE_NAME
+			}
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+	/**
+	* Extra fixed files this tool manages beyond the root/non-root rules. The
+	* RulesProcessor enumerates these for import and deletion so a stale
+	* `DESIGN.md` is cleaned up once no rule opts in anymore. Empty in global
+	* mode: `DESIGN.md` has no documented home-directory equivalent.
+	*/
+	static getExtraFixedFiles({ global = false } = {}) {
+		if (global) return [];
+		return [this.getSettablePaths({ global }).design];
+	}
+	/**
+	* Factory Droid loads `DESIGN.md` itself, so listing it in the root rule's
+	* TOON reference section would double-load the content (and misrepresent it
+	* as a rule the model must remember to open).
+	*/
+	isExcludedFromRootReferences() {
+		return this.design;
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
+		const design = !global ? paths.design : void 0;
+		if (design !== void 0 && relativeDirPath === design.relativeDirPath && relativeFilePath === design.relativeFilePath) {
+			const relativePath = (0, node_path.join)(design.relativeDirPath, design.relativeFilePath);
+			const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
+			return new FactorydroidRule({
+				outputRoot,
+				relativeDirPath: design.relativeDirPath,
+				relativeFilePath: design.relativeFilePath,
+				fileContent,
+				validate,
+				root: false,
+				design: true
+			});
+		}
 		if (relativeFilePath === paths.root.relativeFilePath) {
 			const relativePath = (0, node_path.join)(paths.root.relativeDirPath, paths.root.relativeFilePath);
 			const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
@@ -61443,18 +62804,34 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const isRoot = relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
+		const design = !global ? paths.design : void 0;
+		const isDesign = design !== void 0 && relativeDirPath === design.relativeDirPath && relativeFilePath === design.relativeFilePath;
+		const isRoot = !isDesign && relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
 		return new FactorydroidRule({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
 			validate: false,
-			root: isRoot
+			root: isRoot,
+			design: isDesign
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const frontmatter = rulesyncRule.getFrontmatter();
 		const paths = this.getSettablePaths({ global });
+		if (!global && !frontmatter.root && frontmatter.factorydroid?.channel === "design") {
+			const { design } = paths;
+			return new FactorydroidRule({
+				outputRoot,
+				relativeDirPath: design.relativeDirPath,
+				relativeFilePath: design.relativeFilePath,
+				fileContent: rulesyncRule.getBody(),
+				validate,
+				root: false,
+				design: true
+			});
+		}
 		return new FactorydroidRule(this.buildToolRuleParamsAgentsmd({
 			outputRoot,
 			rulesyncRule,
@@ -61464,6 +62841,17 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 		}));
 	}
 	toRulesyncRule() {
+		if (this.design) return new RulesyncRule({
+			outputRoot: process.cwd(),
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: FACTORYDROID_DESIGN_FILE_NAME,
+			frontmatter: {
+				root: false,
+				targets: ["factorydroid"],
+				factorydroid: { channel: "design" }
+			},
+			body: this.getFileContent()
+		});
 		return this.toRulesyncRuleDefault();
 	}
 	validate() {
@@ -63981,6 +65369,16 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto"
 		}
 	}],
+	["codebuddy", {
+		class: CodebuddyRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			localRootMode: "separate-local-file",
+			localRootFileName: CODEBUDDY_LOCAL_RULE_FILE_NAME
+		}
+	}],
 	["codexcli", {
 		class: CodexcliRule,
 		meta: {
@@ -64006,6 +65404,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto"
 		}
 	}],
+	["crush", {
+		class: CrushRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
+	}],
 	["cursor", {
 		class: CursorRule,
 		meta: {
@@ -64374,6 +65781,10 @@ var RulesProcessor = class extends FeatureProcessor {
 			outputFiles,
 			convertedRules
 		});
+		await this.warnForDeactivatedImportOnlyRoots({
+			toolRules,
+			factory
+		});
 		return outputFiles;
 	}
 	/**
@@ -64595,6 +66006,41 @@ var RulesProcessor = class extends FeatureProcessor {
 		}
 	}
 	/**
+	* Warn when this generate run is about to write a root rule file that will
+	* make the tool stop reading paths it currently reads instead — Junie's
+	* `.junie/rules/*.md` and `.junie/playbook.md` become unreachable the
+	* moment `.junie/AGENTS.md` exists, since Junie reads the root file
+	* exclusively once it is present. `importOnlyRoots` with
+	* `onlyWhenRootAbsent` already models exactly this shape for import; this
+	* reuses the same declaration so the
+	* `generate` path — which never calls `loadToolFiles` and so never reached
+	* the existing import-side warning — surfaces it too. Without this, a repo
+	* that only ever runs `generate` never sees any warning: the deactivated
+	* files stay on disk, untouched and not gitignored, silently unread.
+	*/
+	async warnForDeactivatedImportOnlyRoots({ toolRules, factory }) {
+		const rootRule = toolRules.find((rule) => rule.isRoot());
+		if (!rootRule) return;
+		const settablePaths = factory.class.getSettablePaths({ global: this.global });
+		const importOnlyRoots = "importOnlyRoots" in settablePaths ? settablePaths.importOnlyRoots : void 0;
+		if (!importOnlyRoots || importOnlyRoots.length === 0) return;
+		const existingPaths = [];
+		for (const importOnlyRoot of importOnlyRoots) {
+			if (importOnlyRoot.onlyWhenRootAbsent !== true) continue;
+			const matchedPaths = await findFilesByGlobs(rootRelativeGlob(importOnlyRoot.relativeDirPath, importOnlyRoot.relativeFilePath ?? `*.${factory.meta.extension}`), {
+				cwd: this.outputRoot,
+				type: "file"
+			});
+			existingPaths.push(...matchedPaths);
+		}
+		if (existingPaths.length === 0) return;
+		const rootFileRelativePath = (0, node_path.join)(rootRule.getRelativeDirPath(), rootRule.getRelativeFilePath());
+		const names = existingPaths.map((filePath) => stripControlCharacters((0, node_path.relative)(this.outputRoot, filePath)));
+		const listedNames = names.slice(0, MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS);
+		const remainingCount = names.length - listedNames.length;
+		this.logger.warn(`Writing ${stripControlCharacters(rootFileRelativePath)} for ${this.toolTarget} means ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} will no longer be read. Run \`rulesync import --targets ${this.toolTarget}\` first to carry that content into ${RULESYNC_RULES_RELATIVE_DIR_PATH}, or delete ${listedNames.length === 1 ? "it" : "them"} once you have checked the content is already in the root file.`);
+	}
+	/**
 	* Handle localRoot rule generation based on tool target.
 	* - `separate-local-file`: writes a dedicated `*.local.md` root file
 	*   (claudecode/legacy: `./CLAUDE.local.md`, rovodev: `./AGENTS.local.md`)
@@ -64846,6 +66292,26 @@ As this project's AI coding tool, you must follow the additional conventions bel
 		}));
 	}
 	/**
+	* Load and merge rulesync rule files from every configured input root's
+	* `.rulesync/rules/` directory, by relative path, so that a rule with the
+	* same target path from a later root replaces the earlier root's copy
+	* (case-insensitive, matching the intra-root collision handling).
+	*
+	* This is the side-effect-free half of `loadRulesyncFiles`: it does not
+	* warn about a missing root rule or validate `localRoot` placement, so it
+	* is also safe to call from code paths — like
+	* `warnForFoldImportDuplicationRisk` — that only need the merged rule set
+	* and must not trigger `loadRulesyncFiles`'s generate-time checks.
+	*/
+	async loadMergedRulesyncRules() {
+		return mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (rule) => rule.getRelativeFilePath(),
+			artifactName: "rule",
+			logger: this.logger
+		});
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Load and parse rulesync rule files from every configured input root's
 	* `.rulesync/rules/` directory, merging by relative path so that a rule
@@ -64853,12 +66319,7 @@ As this project's AI coding tool, you must follow the additional conventions bel
 	* copy (case-insensitive, matching the intra-root collision handling).
 	*/
 	async loadRulesyncFiles() {
-		const rulesyncRules = mergeByCaseInsensitiveIdentity({
-			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
-			identity: (rule) => rule.getRelativeFilePath(),
-			artifactName: "rule",
-			logger: this.logger
-		});
+		const rulesyncRules = await this.loadMergedRulesyncRules();
 		const factory = this.getFactory(this.toolTarget);
 		const targetedRootRules = rulesyncRules.filter((rule) => rule.getFrontmatter().root).filter((rule) => factory.class.isTargetedByRulesyncRule(rule));
 		if (targetedRootRules.length === 0 && rulesyncRules.length > 0) this.logger.warn(`No root rulesync rule file found for target '${this.toolTarget}'. Consider adding 'root: true' to one of your rule files in ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
@@ -64915,6 +66376,46 @@ As this project's AI coding tool, you must follow the additional conventions bel
 		});
 	}
 	/**
+	* Warn when importing a `collisionPolicy: "fold"` target's root file while
+	* `.rulesync/rules/` still holds non-root rules targeting it. A fold target
+	* (codexcli, junie, and others) concatenates every targeted non-root rule
+	* into its one root output file on `generate`. Importing that root file
+	* back therefore re-reads the already-folded content as a single new
+	* rulesync rule, while the original non-root rules stay in place
+	* untouched — the next `generate` folds both together, duplicating the
+	* content once per generate/import cycle with nothing to indicate why.
+	*
+	* This does not attempt to detect or drop the specific duplicated content
+	* (the root file has no marker recording which rule contributed what); it
+	* only surfaces that the cycle produces one, per the "at minimum, warn"
+	* option recorded on issue #2743.
+	*
+	* Only the actual `rulesync import` call site invokes this (and only once
+	* it has confirmed there is something to import) — `loadToolFiles` is also
+	* the entry point for `rulesync convert` and `rulesync fetch`, neither of
+	* which writes to `.rulesync/rules/` or carries this duplication risk.
+	*
+	* Reads via `loadMergedRulesyncRules` rather than `loadRulesyncFiles`
+	* deliberately: this runs before the imported root file is written, so
+	* `.rulesync/rules/` never yet has a root rule targeting this tool, and
+	* `loadRulesyncFiles`'s "no root rule found" warning and `localRoot`
+	* validation (which can throw) would fire spuriously on every fold-tool
+	* import — including ones where nothing is actually misconfigured.
+	*
+	* In global mode, a `localRoot: true` rule is excluded from the
+	* duplication check the same way `loadRulesyncFiles`'s global-mode branch
+	* excludes it from `nonRootRules`: `generate` ignores `localRoot` entirely
+	* in global mode, so such a rule is never actually folded into the global
+	* root output and warning about it here would be inaccurate.
+	*/
+	async warnForFoldImportDuplicationRisk() {
+		const factory = this.getFactory(this.toolTarget);
+		if (factory.meta.collisionPolicy !== "fold") return;
+		const nonRootRules = (await this.loadMergedRulesyncRules()).filter((rule) => !rule.getFrontmatter().root && (!this.global || !rule.getFrontmatter().localRoot) && factory.class.isTargetedByRulesyncRule(rule));
+		if (nonRootRules.length === 0) return;
+		this.logger.warn(`Importing ${this.toolTarget}'s root file will re-add content already folded from ${formatRulePaths(nonRootRules)}: ${this.toolTarget} concatenates every non-root rule into its single root output file, so the imported copy duplicates them the next time you run \`rulesync generate --targets ${this.toolTarget}\`. Review the imported rule and remove the duplicated content, or remove the original non-root rule files, before generating again.`);
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Load tool-specific rule configurations and parse them into ToolRule instances
 	*/
@@ -66978,6 +68479,7 @@ async function importRulesCore(params) {
 		logger.warn(`No rule files found for ${tool}. Skipping import.`);
 		return 0;
 	}
+	await rulesProcessor.warnForFoldImportDuplicationRisk();
 	const rulesyncFiles = await rulesProcessor.convertToolFilesToRulesyncFiles(toolFiles);
 	const { count: writtenCount } = await rulesProcessor.writeAiFiles(rulesyncFiles);
 	if (config.getVerbose() && writtenCount > 0) logger.success(`Created ${writtenCount} rule files`);
@@ -67297,6 +68799,18 @@ Object.defineProperty(exports, "CLIError", {
 		return CLIError;
 	}
 });
+Object.defineProperty(exports, "CODEBUDDY_DIR", {
+	enumerable: true,
+	get: function() {
+		return CODEBUDDY_DIR;
+	}
+});
+Object.defineProperty(exports, "CODEBUDDY_LOCAL_RULE_FILE_NAME", {
+	enumerable: true,
+	get: function() {
+		return CODEBUDDY_LOCAL_RULE_FILE_NAME;
+	}
+});
 Object.defineProperty(exports, "CODEXCLI_BASH_RULES_FILE_NAME", {
 	enumerable: true,
 	get: function() {
@@ -67879,6 +69393,12 @@ Object.defineProperty(exports, "hasDeceptiveHiddenCharacters", {
 		return hasDeceptiveHiddenCharacters;
 	}
 });
+Object.defineProperty(exports, "hasEnclosingMarkOutsideKeycap", {
+	enumerable: true,
+	get: function() {
+		return hasEnclosingMarkOutsideKeycap;
+	}
+});
 Object.defineProperty(exports, "importFromTool", {
 	enumerable: true,
 	get: function() {