rulesync 16.21.0 → 16.22.1

package/dist/{import-5_n-Y8N6.js → import-DUE1P1zV.js}

@@ -221,6 +221,35 @@ function hasDeceptiveHiddenCharacters(text) {
 		return !joinsCharacter(characters[index - 1]) || !joinsCharacter(characters[index + 1]);
 	});
 }
+/** A mark that draws around the character before it — a circle, a square, a keycap box. */
+const ENCLOSING_MARK_PATTERN = /\p{Me}/u;
+/**
+* Whether `text` carries an enclosing mark that is not the keycap of an emoji
+* keycap sequence.
+*
+* An enclosing mark (`\p{Me}`: U+20DD COMBINING ENCLOSING CIRCLE, U+20E3
+* COMBINING ENCLOSING KEYCAP, the Cyrillic and Vedic ones) is drawn over the
+* character before it and takes no column of its own, so `pdf` with one after
+* it occupies the three columns of `pdf` and is a fourth directory underneath.
+* Unlike a joiner or a variation selector it is not invisible — the box is
+* drawn — which is why `hasDeceptiveHiddenCharacters` does not refuse it and
+* why it is a question for the confusable-name note instead: the row is drawn,
+* only not the way its name reads. The one place an enclosing mark belongs in
+* a name is the keycap sequence of UTS #51, which `isKeycapSequence` matches
+* whole; every other one is left over.
+*
+* Restricted to `\p{Me}` on purpose: a non-spacing mark (`\p{Mn}`) is how
+* Devanagari, Arabic and Vietnamese write, and folding those would mark
+* ordinary names in every one of them.
+*/
+function hasEnclosingMarkOutsideKeycap(text) {
+	const characters = [...text];
+	return characters.some((character, index) => ENCLOSING_MARK_PATTERN.test(character) && !isKeycapSequence({
+		base: characters[index - 2],
+		selector: characters[index - 1] ?? "",
+		following: character
+	}));
+}
 //#endregion
 //#region src/utils/truncate.ts
 /**
@@ -444,9 +473,11 @@ const rulesProcessorToolTargetTuple = [
 	"claudecode",
 	"claudecode-legacy",
 	"cline",
+	"codebuddy",
 	"codexcli",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -482,6 +513,7 @@ const ignoreProcessorToolTargetTuple = [
 	"claudecode",
 	"claudecode-legacy",
 	"cline",
+	"crush",
 	"cursor",
 	"hermesagent",
 	"junie",
@@ -623,6 +655,7 @@ const skillsProcessorToolTargetTuple = [
 	"codexcli",
 	"copilot",
 	"copilotcli",
+	"crush",
 	"cursor",
 	"deepagents",
 	"factorydroid",
@@ -3327,6 +3360,83 @@ var RulesyncFile = class extends AiFile {
 	}
 };
 //#endregion
+//#region src/utils/bounded-walk.ts
+const ALIAS_HINT = "(a chain of YAML aliases may be amplifying the document)";
+/**
+* Create the bookkeeping for one walk. `subject` names the document kind in
+* every error ("Frontmatter", "Shared config"); `root`, when given, is entered
+* up front so the root object counts as the first nesting level, matching the
+* +1 that `enter` applies to every container nested inside it.
+*/
+function createBoundedWalk({ subject, limits, root }) {
+	const ancestors = /* @__PURE__ */ new WeakSet();
+	let valuesRemaining = limits.maxValues;
+	let stringCharsRemaining = limits.maxStringChars;
+	let depth = 0;
+	const chargeChars = (chars) => {
+		stringCharsRemaining -= chars;
+		if (stringCharsRemaining < 0) throw new Error(`${subject}'s string values expand to more than ${limits.maxStringChars} characters; refusing to process it ${ALIAS_HINT}`);
+	};
+	const chargeValue = (stringChars = 0) => {
+		valuesRemaining -= 1;
+		if (valuesRemaining < 0) throw new Error(`${subject} expands to more than ${limits.maxValues} values; refusing to process it ${ALIAS_HINT}`);
+		chargeChars(stringChars);
+	};
+	const enter = (container) => {
+		depth += 1;
+		if (depth > limits.maxDepth) throw new Error(`${subject} nests more than ${limits.maxDepth} levels deep; refusing to process it ${ALIAS_HINT}`);
+		ancestors.add(container);
+	};
+	const leave = (container) => {
+		ancestors.delete(container);
+		depth -= 1;
+	};
+	if (root !== void 0) enter(root);
+	return {
+		chargeValue,
+		chargeChars,
+		isAncestor: (container) => ancestors.has(container),
+		enter,
+		leave
+	};
+}
+//#endregion
+//#region src/utils/prototype-pollution.ts
+/**
+* Keys that, if walked into when constructing or merging objects from
+* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
+* chain) and propagate state to every other object in the runtime. Any code
+* that copies arbitrary user-supplied keys into a fresh object — frontmatter
+* parsing, MCP config conversion, settings round-trip — should skip these.
+*/
+const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isPrototypePollutionKey(key) {
+	return PROTOTYPE_POLLUTION_KEYS.has(key);
+}
+/**
+* Returns a shallow copy of a record's own entries with every
+* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
+*
+* Use when copying a nested, user-supplied string map — an MCP server's `env`
+* or `headers` table — into freshly generated config. Carrying such a map by
+* reference, or re-assigning its keys via bracket notation, would let a literal
+* `__proto__` key ride along (and re-assigning it would mutate the target's
+* prototype). Walking the entries through this helper severs that path while
+* preserving every legitimate key.
+*/
+function omitPrototypePollutionKeys(record) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(record)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		sanitized[key] = value;
+	}
+	return sanitized;
+}
+//#endregion
 //#region src/utils/type-guards.ts
 /**
 * Type guard to check if a value is a plain object (Record<string, unknown>).
@@ -3391,67 +3501,154 @@ function loadYaml(content) {
 }
 //#endregion
 //#region src/utils/frontmatter.ts
-function deepRemoveNullishValue(value) {
+/**
+* Upper bound on the number of values a frontmatter document may expand to
+* once every YAML alias is written out.
+*
+* A YAML alias makes one parsed container reachable from many keys, and the
+* cleaners below copy each reachable value, so a small file with a few levels
+* of nested aliases (an "alias bomb") can expand into megabytes of output or
+* exhaust the heap. Counting every visited value against this budget turns
+* that into an error instead. Real frontmatter is a handful of keys; even a
+* generous skill manifest stays orders of magnitude below the limit.
+*/
+const MAX_FRONTMATTER_VALUES = 1e5;
+/**
+* Upper bound on the total character count of string leaves a frontmatter
+* document may expand to.
+*
+* {@link MAX_FRONTMATTER_VALUES} bounds how many values are visited, but a
+* single long string aliased thousands of times still fits that budget while
+* the duplicated output balloons: one scalar of a few KB, chained through a
+* handful of aliases within the value budget, can multiply into a document
+* many megabytes larger than it started. Charging every visited string's
+* length against this separate budget bounds that output regardless of how
+* many aliases point at it.
+*/
+const MAX_FRONTMATTER_STRING_CHARS = 4e6;
+/**
+* Upper bound on the raw character length of the `---`-delimited frontmatter
+* block itself, checked before it is ever handed to the YAML parser.
+*
+* The budgets above only bound the *parsed* document — the walk over
+* `matter()`'s output — but a complex YAML key (an array or mapping used as a
+* mapping key) is joined into a string by js-yaml while it parses, and a
+* mapping with many such keys can cost real memory before that walk ever
+* starts, or even before `matter()` returns. Capping the raw block size keeps
+* that parse-time cost bounded regardless of what the block contains. Real
+* frontmatter blocks are a few hundred bytes at most; even a large project
+* manifest stays well under this.
+*/
+const MAX_FRONTMATTER_RAW_CHARS = 65536;
+/**
+* Estimate the serialized character cost of a leaf that is not a string (a
+* string leaf is charged by its own length instead).
+*
+* js-yaml's default schema resolves `!!binary` scalars to a `Uint8Array`, and
+* its dumper writes one back out as base64 — roughly 4 output characters per
+* 3 input bytes. Without this, an aliased binary blob would walk the budget
+* for free even though it can dominate the emitted document's size.
+*/
+function estimateLeafChars(value) {
+	if (value instanceof Uint8Array) return Math.ceil(value.byteLength / 3) * 4;
+	return 0;
+}
+/**
+* Copy one parsed value, dropping nullish leaves and cyclic references.
+*
+* Every alias is still written out as an independent copy, as gray-matter's
+* default YAML engine would otherwise serialize shared references as `&ref_0`
+* anchors that simplified frontmatter parsers cannot read; the expansion is
+* bounded by {@link MAX_FRONTMATTER_VALUES} instead.
+*/
+function deepCleanValue(value, options) {
+	const leafChars = typeof value === "string" ? value.length : estimateLeafChars(value);
+	options.walk.chargeValue(leafChars);
 	if (value === null || value === void 0) return;
-	if (Array.isArray(value)) return value.map((item) => deepRemoveNullishValue(item)).filter((item) => item !== void 0);
+	if (typeof value === "string") return options.transformString ? options.transformString(value) : value;
+	if (Array.isArray(value)) {
+		if (options.walk.isAncestor(value)) return;
+		options.walk.enter(value);
+		const cleanedArray = [];
+		for (const item of value) {
+			const cleaned = deepCleanValue(item, options);
+			if (cleaned !== void 0) cleanedArray.push(cleaned);
+		}
+		options.walk.leave(value);
+		return cleanedArray;
+	}
 	if (isPlainObject$1(value)) {
-		const result = {};
-		for (const [key, val] of Object.entries(value)) {
-			const cleaned = deepRemoveNullishValue(val);
-			if (cleaned !== void 0) result[key] = cleaned;
-		}
+		if (options.walk.isAncestor(value)) return;
+		options.walk.enter(value);
+		const result = cleanOwnEntries(value, options);
+		options.walk.leave(value);
 		return result;
 	}
 	return value;
 }
-function deepRemoveNullishObject(obj) {
-	if (!obj || typeof obj !== "object") return {};
+/**
+* Copy the cleaned own entries of a parsed object into a fresh record.
+*
+* A YAML parser defines a `__proto__:` key as an own property, and assigning
+* it back with bracket notation would instead replace the new record's
+* prototype, whose members zod's loose object schemas then promote to real
+* keys. So a fetched skill could hide `allowed-tools` under an innocuous
+* looking `__proto__:` block. That key, `constructor` and `prototype` are
+* therefore dropped rather than copied, and cannot be used as frontmatter
+* keys.
+*/
+function cleanOwnEntries(obj, options) {
 	const result = {};
 	for (const [key, val] of Object.entries(obj)) {
-		const cleaned = deepRemoveNullishValue(val);
+		options.walk.chargeChars(key.length);
+		const cleaned = deepCleanValue(val, options);
+		if (isPrototypePollutionKey(key)) continue;
 		if (cleaned !== void 0) result[key] = cleaned;
 	}
 	return result;
 }
-function deepFlattenStringsValue(value) {
-	if (value === null || value === void 0) return;
-	if (typeof value === "string") return value.replace(/\n+/g, " ").trim();
-	if (Array.isArray(value)) return value.map((item) => deepFlattenStringsValue(item)).filter((item) => item !== void 0);
-	if (isPlainObject$1(value)) {
-		const result = {};
-		for (const [key, val] of Object.entries(value)) {
-			const cleaned = deepFlattenStringsValue(val);
-			if (cleaned !== void 0) result[key] = cleaned;
-		}
-		return result;
-	}
-	return value;
+function deepCleanObject(obj, options) {
+	if (!obj || typeof obj !== "object") return {};
+	return cleanOwnEntries(obj, {
+		...options,
+		walk: createBoundedWalk({
+			subject: "Frontmatter",
+			limits: {
+				maxValues: MAX_FRONTMATTER_VALUES,
+				maxStringChars: MAX_FRONTMATTER_STRING_CHARS,
+				maxDepth: 64
+			},
+			root: obj
+		})
+	});
+}
+/** Drop null and undefined values, recursively. */
+function deepRemoveNullishObject(obj) {
+	return deepCleanObject(obj, {});
 }
+/** Drop nullish values and collapse every string onto a single line. */
 function deepFlattenStringsObject(obj) {
-	if (!obj || typeof obj !== "object") return {};
-	const result = {};
-	for (const [key, val] of Object.entries(obj)) {
-		const cleaned = deepFlattenStringsValue(val);
-		if (cleaned !== void 0) result[key] = cleaned;
-	}
-	return result;
+	return deepCleanObject(obj, { transformString: (value) => value.replace(/\n+/g, " ").trim() });
 }
 function stringifyFrontmatter(body, frontmatter, options) {
 	const { avoidBlockScalars = false } = options ?? {};
 	const cleanFrontmatter = avoidBlockScalars ? deepFlattenStringsObject(frontmatter) : deepRemoveNullishObject(frontmatter);
-	if (avoidBlockScalars) return matter.stringify(body, cleanFrontmatter, { engines: { yaml: {
+	const file = { content: body };
+	if (avoidBlockScalars) return matter.stringify(file, cleanFrontmatter, { engines: { yaml: {
 		parse: (input) => loadYaml(input) ?? {},
 		stringify: (data) => dump(data, { lineWidth: -1 })
 	} } });
-	return matter.stringify(body, cleanFrontmatter);
+	return matter.stringify(file, cleanFrontmatter);
 }
 function parseFrontmatter(content, filePath) {
 	let frontmatter;
 	let body;
 	let hasFrontmatter;
 	try {
+		const bounds = findFrontmatterBlockBounds(content);
+		if (bounds && bounds.blockEnd - bounds.blockStart > 65536) throw new Error(`Frontmatter block is larger than ${MAX_FRONTMATTER_RAW_CHARS} characters; refusing to parse it (a complex YAML key can cost memory while parsing, before any post-parse budget applies)`);
 		const result = matter(content, {});
-		frontmatter = result.data;
+		frontmatter = deepRemoveNullishObject(result.data);
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
 	} catch (error) {
@@ -3459,7 +3656,7 @@ function parseFrontmatter(content, filePath) {
 		throw error;
 	}
 	return {
-		frontmatter: deepRemoveNullishObject(frontmatter),
+		frontmatter,
 		body,
 		hasFrontmatter
 	};
@@ -3508,17 +3705,34 @@ function repairFrontmatterLine(line) {
 	};
 }
 /**
-* Quote the unquoted scalars that make a frontmatter block unparseable, or
-* return `undefined` when there is nothing to repair. Only the frontmatter
-* block is rewritten; the body is passed through untouched.
+* Locate a raw `---`-delimited frontmatter block's bounds within `content`,
+* without parsing it. Shared by the size guard in {@link parseFrontmatter} and
+* the YAML repair pass below, so both agree on exactly what gray-matter would
+* treat as the block: gray-matter ends it at the first `\n---`, with no
+* requirement that the delimiter be alone on its line, so a stricter pattern
+* here would run past gray-matter's delimiter and act on text that is really
+* the body.
 */
-function repairMalformedFrontmatterYaml(content) {
+function findFrontmatterBlockBounds(content) {
 	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
 	if (!opening) return;
 	const blockStart = opening[0].length;
 	const closing = /\r?\n---/.exec(content.slice(blockStart));
 	if (!closing) return;
-	const blockEnd = blockStart + closing.index;
+	return {
+		blockStart,
+		blockEnd: blockStart + closing.index
+	};
+}
+/**
+* Quote the unquoted scalars that make a frontmatter block unparseable, or
+* return `undefined` when there is nothing to repair. Only the frontmatter
+* block is rewritten; the body is passed through untouched.
+*/
+function repairMalformedFrontmatterYaml(content) {
+	const bounds = findFrontmatterBlockBounds(content);
+	if (!bounds) return;
+	const { blockStart, blockEnd } = bounds;
 	const block = content.slice(blockStart, blockEnd);
 	const repairedLines = block.split("\n").map(repairFrontmatterLine);
 	const repairedBlock = repairedLines.map(({ line }) => line).join("\n");
@@ -5197,42 +5411,6 @@ const CANONICAL_TO_GROKCLI_EVENT_NAMES = {
 */
 const GROKCLI_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_GROKCLI_EVENT_NAMES).map(([k, v]) => [v, k]));
 //#endregion
-//#region src/utils/prototype-pollution.ts
-/**
-* Keys that, if walked into when constructing or merging objects from
-* untrusted input, can mutate `Object.prototype` (or otherwise the prototype
-* chain) and propagate state to every other object in the runtime. Any code
-* that copies arbitrary user-supplied keys into a fresh object — frontmatter
-* parsing, MCP config conversion, settings round-trip — should skip these.
-*/
-const PROTOTYPE_POLLUTION_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isPrototypePollutionKey(key) {
-	return PROTOTYPE_POLLUTION_KEYS.has(key);
-}
-/**
-* Returns a shallow copy of a record's own entries with every
-* prototype-pollution key (`__proto__`, `constructor`, `prototype`) dropped.
-*
-* Use when copying a nested, user-supplied string map — an MCP server's `env`
-* or `headers` table — into freshly generated config. Carrying such a map by
-* reference, or re-assigning its keys via bracket notation, would let a literal
-* `__proto__` key ride along (and re-assigning it would mutate the target's
-* prototype). Walking the entries through this helper severs that path while
-* preserving every legitimate key.
-*/
-function omitPrototypePollutionKeys(record) {
-	const sanitized = {};
-	for (const [key, value] of Object.entries(record)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-		sanitized[key] = value;
-	}
-	return sanitized;
-}
-//#endregion
 //#region src/utils/jsonc.ts
 /**
 * Rebuild the parsed value from its own enumerable entries, dropping
@@ -5983,6 +6161,17 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 		const fallbackDirPath = overrideDirPath ?? paths.recommended.relativeDirPath;
 		throw new RulesyncSourceNotFoundError(`No ${join(outputRoot, fallbackDirPath, paths.recommended.relativeFilePath)} found.`);
 	}
+	/**
+	* Return one server exactly as authored, before `getMcpServers()` strips
+	* rulesync- and tool-specific fields. Keep this lookup here so every target
+	* that re-merges one of those fields shares the same own-property and
+	* prototype-pollution guards.
+	*/
+	getRawMcpServer(name) {
+		if (isPrototypePollutionKey(name)) return void 0;
+		const mcpServers = isRecord$1(this.json) ? this.json.mcpServers : void 0;
+		return isRecord$1(mcpServers) && Object.hasOwn(mcpServers, name) ? mcpServers[name] : void 0;
+	}
 	getMcpServers() {
 		const mcpServers = this.json.mcpServers ?? {};
 		const entries = Object.entries(mcpServers);
@@ -7609,6 +7798,11 @@ const RulesyncRuleFrontmatterSchema = z.object({
 	globs: z.optional(z.array(z.string())),
 	agentsmd: z.optional(z.looseObject({ subprojectPath: z.optional(z.string()) })),
 	claudecode: z.optional(z.looseObject({ paths: z.optional(z.array(z.string())) })),
+	codebuddy: z.optional(z.looseObject({
+		paths: z.optional(z.array(z.string())),
+		alwaysApply: z.optional(z.boolean()),
+		description: z.optional(z.string())
+	})),
 	cursor: z.optional(z.looseObject({
 		alwaysApply: z.optional(z.boolean()),
 		description: z.optional(z.string()),
@@ -7650,7 +7844,8 @@ const RulesyncRuleFrontmatterSchema = z.object({
 		name: z.optional(z.string()),
 		extends: z.optional(z.string()),
 		facet: z.optional(z.enum(["policies", "output-contracts"]))
-	}))
+	})),
+	factorydroid: z.optional(z.looseObject({ channel: z.optional(z.enum(["design"])) }))
 });
 /**
 * The `agentsmd.subprojectPath` every consumer should act on, resolved once so
@@ -8765,15 +8960,15 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	opencode: z.optional(z.looseObject({
 		"allowed-tools": z.optional(z.array(z.string())),
-		license: z.optional(z.string()),
-		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
-		metadata: z.optional(z.looseObject({}))
+		license: z.optional(z.unknown()),
+		compatibility: z.optional(z.unknown()),
+		metadata: z.optional(z.unknown())
 	})),
 	kilo: z.optional(z.looseObject({
 		"allowed-tools": z.optional(z.array(z.string())),
-		license: z.optional(z.string()),
-		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
-		metadata: z.optional(z.looseObject({}))
+		license: z.optional(z.unknown()),
+		compatibility: z.optional(z.unknown()),
+		metadata: z.optional(z.unknown())
 	})),
 	kiro: z.optional(z.looseObject({
 		license: z.optional(z.string()),
@@ -8782,9 +8977,9 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	deepagents: z.optional(z.looseObject({
 		"allowed-tools": z.optional(z.array(z.string())),
-		license: z.optional(z.string()),
-		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
-		metadata: z.optional(z.looseObject({}))
+		license: z.optional(z.unknown()),
+		compatibility: z.optional(z.unknown()),
+		metadata: z.optional(z.unknown())
 	})),
 	copilot: z.optional(z.looseObject({
 		license: z.optional(z.string()),
@@ -8891,6 +9086,13 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	takt: z.optional(z.looseObject({
 		name: z.optional(z.string()),
 		extends: z.optional(z.string())
+	})),
+	crush: z.optional(z.looseObject({
+		"disable-model-invocation": z.optional(z.boolean()),
+		"user-invocable": z.optional(z.boolean()),
+		license: z.optional(z.string()),
+		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
+		metadata: z.optional(z.looseObject({}))
 	}))
 });
 /**
@@ -9116,7 +9318,7 @@ async function getLocalSkillDirNames(sourceTree) {
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
+* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -9135,7 +9337,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, cursor, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
+* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -9600,8 +9802,8 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 	* This only deletes files that are no longer in the rulesync source, not files that will be overwritten.
 	*/
 	async removeOrphanAiFiles(existingFiles, generatedFiles) {
-		const generatedPaths = new Set(generatedFiles.map((f) => f.getFilePath()));
-		const orphanFiles = existingFiles.filter((f) => !generatedPaths.has(f.getFilePath()));
+		const generatedPaths = new Set(generatedFiles.map((f) => caseFoldIdentity(f.getFilePath())));
+		const orphanFiles = existingFiles.filter((f) => !generatedPaths.has(caseFoldIdentity(f.getFilePath())));
 		for (const aiFile of orphanFiles) {
 			const filePath = aiFile.getFilePath();
 			const loggedPath = stripControlCharacters(filePath);
@@ -10728,6 +10930,15 @@ const FACTORYDROID_COMMANDS_DIR_PATH = join(FACTORYDROID_DIR, "commands");
 const FACTORYDROID_SKILLS_DIR_PATH = join(FACTORYDROID_DIR, "skills");
 const FACTORYDROID_DROIDS_DIR_PATH = join(FACTORYDROID_DIR, "droids");
 const FACTORYDROID_RULE_FILE_NAME = "AGENTS.md";
+/**
+* Factory Droid's design-guidelines instruction file: "Always-on design-system,
+* UX, visual, and interaction guidance", loaded separately from `AGENTS.md`'s
+* coding guidelines. Project scope only — Factory's docs describe root and
+* nested `DESIGN.md` files like `AGENTS.md`, but document no personal/global
+* home-directory equivalent.
+* @see https://docs.factory.ai/cli/configuration/agents-md
+*/
+const FACTORYDROID_DESIGN_FILE_NAME = "DESIGN.md";
 const FACTORYDROID_MCP_FILE_NAME = "mcp.json";
 const FACTORYDROID_SETTINGS_FILE_NAME = "settings.json";
 const FACTORYDROID_HOOKS_FILE_NAME = "hooks.json";
@@ -11250,6 +11461,21 @@ function stripStrings(_key, value) {
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
 /**
+* Upper bound on the number of values a shared config document may expand
+* to once every YAML alias is written out. Real config files hold a few
+* hundred values at most; even a large MCP server catalog stays orders of
+* magnitude below the limit.
+*/
+const MAX_SHARED_CONFIG_VALUES = 1e5;
+/**
+* Upper bound on the total character count of the string leaves and keys a
+* shared config document may expand to. The value budget bounds how many
+* values are visited, but one long string aliased thousands of times fits
+* that budget while the duplicated output balloons; charging every visited
+* string's length separately bounds the output regardless of alias count.
+*/
+const MAX_SHARED_CONFIG_STRING_CHARS = 4e6;
+/**
 * Rebuild a parsed document without its prototype-pollution keys.
 *
 * Every object is rebuilt, not just the ones that are already plain: a literal
@@ -11264,15 +11490,61 @@ function stripStrings(_key, value) {
 *
 * Dates are the one object the YAML and TOML parsers produce that is not a
 * mapping, so they are passed through rather than flattened into `{}`.
+*
+* The rebuild is bounded, because a YAML alias makes one parsed container
+* reachable from many keys and every alias is copied out independently (the
+* writers dump with `noRefs: true`, so memoizing here would only move the
+* blowup into serialization). A small "alias bomb" of nested anchors would
+* otherwise cost exponential time and memory, and a self-referencing anchor
+* would recurse until the stack overflowed — both reachable from a config
+* file committed to a cloned repository. The walk therefore charges every
+* value against {@link MAX_SHARED_CONFIG_VALUES}, every string and key
+* against {@link MAX_SHARED_CONFIG_STRING_CHARS}, caps nesting at
+* {@link MAX_SHARED_CONFIG_DEPTH}, and refuses a reference back to an
+* ancestor outright, each with a clear error instead of a hang or a crash.
 */
 function sanitizeSharedConfigValue(value) {
-	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
+	return sanitizeSharedConfigValueBounded(value, createBoundedWalk({
+		subject: "Shared config",
+		limits: {
+			maxValues: MAX_SHARED_CONFIG_VALUES,
+			maxStringChars: MAX_SHARED_CONFIG_STRING_CHARS,
+			maxDepth: 64
+		}
+	}));
+}
+/**
+* Refuse a container that is already on the descent path. Unlike the
+* frontmatter cleaner, which drops such a cycle and keeps the rest of the
+* document, a shared config file is refused outright: silently dropping part
+* of a user's settings file would let a later write-back persist the loss.
+*/
+function enterSharedConfigContainer(walk, container) {
+	if (walk.isAncestor(container)) throw new Error("Shared config contains a value that refers back to itself (a circular YAML alias); refusing to process it");
+	walk.enter(container);
+}
+function sanitizeSharedConfigValueBounded(value, walk) {
+	if (typeof value === "string") {
+		walk.chargeValue(value.length);
+		return value;
+	}
+	walk.chargeValue();
+	if (Array.isArray(value)) {
+		enterSharedConfigContainer(walk, value);
+		const items = value.map((item) => sanitizeSharedConfigValueBounded(item, walk));
+		walk.leave(value);
+		return items;
+	}
 	if (value === null || typeof value !== "object" || value instanceof Date) return value;
+	enterSharedConfigContainer(walk, value);
 	const result = {};
 	for (const [key, nested] of Object.entries(value)) {
+		walk.chargeChars(key.length);
+		const sanitized = sanitizeSharedConfigValueBounded(nested, walk);
 		if (isPrototypePollutionKey(key)) continue;
-		result[key] = sanitizeSharedConfigValue(nested);
+		result[key] = sanitized;
 	}
+	walk.leave(value);
 	return result;
 }
 /**
@@ -11301,7 +11573,12 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (parsed === void 0 || parsed === null) return {};
-	const sanitized = sanitizeSharedConfigValue(parsed);
+	let sanitized;
+	try {
+		sanitized = sanitizeSharedConfigValue(parsed);
+	} catch (error) {
+		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
+	}
 	if (!isPlainObject$1(sanitized)) {
 		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
 		return {};
@@ -15627,6 +15904,10 @@ function toAllowedToolsArray(value) {
 * The spec types `compatibility` as a free-form string. An object from a legacy
 * rulesync input is flattened to `key: value` pairs instead of being emitted as
 * a YAML mapping, which conformant clients reject.
+*
+* Exported for `CrushSkill`, which requires the same bare-string shape (Crush's
+* Go struct types `Compatibility` as a plain `string`) and reuses this
+* implementation rather than maintaining a second, divergent copy.
 */
 function toCompatibilityString(value) {
 	if (typeof value === "string") return value;
@@ -15635,6 +15916,10 @@ function toCompatibilityString(value) {
 /**
 * The spec types `metadata` as "a map from string keys to string values", so
 * non-string values (e.g. a YAML number `version: 1`) are stringified.
+*
+* Exported for `CrushSkill`, which requires the same `map[string]string`
+* shape (Crush's Go struct types `Metadata` that way) and reuses this
+* implementation rather than maintaining a second, divergent copy.
 */
 function toStringMetadata(metadata) {
 	return Object.fromEntries(Object.entries(metadata).map(([key, value]) => [key, stringifyValue(value)]));
@@ -18645,7 +18930,13 @@ var CommandsProcessor = class extends FeatureProcessor {
 				if (!matchByBasename || flatOnly && dirname(key) !== ".") return [key];
 				return [key, basename(key)];
 			};
-			const seen = new Set(toolCommands.flatMap((command) => keysOf(command)));
+			const claimedKeys = new ClaimedIdentities();
+			const primarySource = paths.relativeDirPath;
+			const secondarySource = "a secondary source";
+			for (const command of toolCommands) for (const candidate of keysOf(command)) claimedKeys.claim({
+				identity: candidate,
+				source: primarySource
+			});
 			const additionalCommands = await factory.class.loadAdditionalImportFiles({
 				outputRoot: this.outputRoot,
 				global: this.global,
@@ -18653,11 +18944,26 @@ var CommandsProcessor = class extends FeatureProcessor {
 			});
 			for (const command of additionalCommands) {
 				const key = command.getRelativeFilePath();
-				if (keysOf(command, true).some((candidate) => seen.has(candidate))) {
-					this.logger.warn(`Duplicate ${this.toolTarget} command "${key}" from a secondary source; keeping the one already loaded.`);
+				const collision = [...new Set(keysOf(command, true))].map((candidate) => {
+					const claimed = claimedKeys.claim({
+						identity: candidate,
+						source: secondarySource
+					});
+					return claimed === null ? void 0 : {
+						candidate,
+						claimed
+					};
+				}).find((hit) => hit !== void 0);
+				if (collision) {
+					const { candidate, claimed } = collision;
+					if (claimed.spelling === candidate) this.logger.warn(`Duplicate ${this.toolTarget} command "${stripControlCharacters(key)}" from ${secondarySource}; keeping the one already loaded.`);
+					else this.logger.warn(`Case-insensitive ${this.toolTarget} command collision: "${stripControlCharacters(claimed.spelling)}" and "${stripControlCharacters(candidate)}" resolve to the same command file. Keeping "${stripControlCharacters(claimed.spelling)}" from ${claimed.source === secondarySource ? "earlier in the same source" : `the higher-precedence ${claimed.source}`} and ignoring "${stripControlCharacters(key)}" from ${secondarySource}, which is not imported.`);
 					continue;
 				}
-				for (const candidate of keysOf(command)) seen.add(candidate);
+				for (const candidate of keysOf(command)) claimedKeys.claim({
+					identity: candidate,
+					source: secondarySource
+				});
 				toolCommands.push(command);
 			}
 		}
@@ -18947,6 +19253,21 @@ var AmpHooks = class AmpHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/utils/own-lookup.ts
+/**
+* Read a key from a plain string map without walking its prototype chain.
+*
+* A bracket read on an object literal resolves inherited members too, so a
+* user-supplied key such as `toString` or `constructor` "succeeds" with an
+* `Object.prototype` function instead of falling through to the caller's
+* `?? fallback`. Hook adapters translate native event names this way from
+* `Object.entries()` over a config file, so route the read through here to keep
+* the fallback honest: only a key the map itself defines yields a value.
+*/
+function lookupOwn({ record, key }) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
+//#endregion
 //#region src/utils/object.ts
 /**
 * Return a shallow copy of `obj` keeping only the entries whose value is
@@ -19331,7 +19652,10 @@ function canonicalToToolHooks({ config, toolOverrideHooks, converterConfig, logg
 	const warn = warnOnce(logger);
 	const result = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const toolEventName = converterConfig.canonicalToToolEventNames[eventName] ?? eventName;
+		const toolEventName = lookupOwn({
+			record: converterConfig.canonicalToToolEventNames,
+			key: eventName
+		}) ?? eventName;
 		const byMatcher = groupDefinitionsByMatcher({
 			definitions,
 			converterConfig
@@ -19759,7 +20083,10 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 	const warn = warnOnce(logger);
 	const canonical = {};
 	for (const [toolEventName, matcherEntries] of Object.entries(hooks)) {
-		const eventName = converterConfig.toolToCanonicalEventNames[toolEventName] ?? toolEventName;
+		const eventName = lookupOwn({
+			record: converterConfig.toolToCanonicalEventNames,
+			key: toolEventName
+		}) ?? toolEventName;
 		if (!Array.isArray(matcherEntries)) continue;
 		const defs = [];
 		for (const rawEntry of matcherEntries) {
@@ -19815,7 +20142,10 @@ function flattenAntigravityHooks(parsed) {
 	const flat = {};
 	const addEvent = (event, entries) => {
 		if (isPrototypePollutionKey(event) || !Array.isArray(entries)) return;
-		const existing = Object.hasOwn(flat, event) ? flat[event] : void 0;
+		const existing = lookupOwn({
+			record: flat,
+			key: event
+		});
 		flat[event] = existing ? [...existing, ...entries] : [...entries];
 	};
 	for (const [key, value] of Object.entries(parsed)) if (Array.isArray(value)) addEvent(key, value);
@@ -20202,6 +20532,16 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 		const paths = AugmentcodeHooks.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
+		let existingHooks = {};
+		try {
+			const parsed = JSON.parse(existingContent);
+			const candidate = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.hooks : void 0;
+			if (candidate && typeof candidate === "object" && !Array.isArray(candidate)) existingHooks = candidate;
+		} catch {
+			existingHooks = {};
+		}
+		const nativeEventKeys = new Set(Object.values(CANONICAL_TO_AUGMENTCODE_EVENT_NAMES));
+		const preservedHooks = Object.fromEntries(Object.entries(existingHooks).filter(([key]) => !nativeEventKeys.has(key)));
 		const config = rulesyncHooks.getJson();
 		const augmentHooks = canonicalToToolHooks({
 			config,
@@ -20213,7 +20553,10 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
 			existingContent,
-			patch: { hooks: augmentHooks },
+			patch: { hooks: {
+				...preservedHooks,
+				...augmentHooks
+			} },
 			filePath
 		});
 		return new AugmentcodeHooks({
@@ -20971,7 +21314,10 @@ function canonicalToCopilotHooks(config) {
 	};
 	const copilot = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const copilotEventName = CANONICAL_TO_COPILOT_EVENT_NAMES[eventName] ?? eventName;
+		const copilotEventName = lookupOwn({
+			record: CANONICAL_TO_COPILOT_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const entries = [];
 		for (const def of definitions) {
 			const hookType = def.type ?? "command";
@@ -21048,7 +21394,10 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 	if (copilotHooks === null || copilotHooks === void 0 || typeof copilotHooks !== "object") return {};
 	const canonical = {};
 	for (const [copilotEventName, hookEntries] of Object.entries(copilotHooks)) {
-		const eventName = COPILOT_TO_CANONICAL_EVENT_NAMES[copilotEventName] ?? copilotEventName;
+		const eventName = lookupOwn({
+			record: COPILOT_TO_CANONICAL_EVENT_NAMES,
+			key: copilotEventName
+		}) ?? copilotEventName;
 		if (!Array.isArray(hookEntries)) continue;
 		const defs = [];
 		for (const rawEntry of hookEntries) {
@@ -21318,7 +21667,10 @@ function canonicalToCopilotCliHooks(config, logger) {
 	};
 	const out = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const copilotEventName = CANONICAL_TO_COPILOTCLI_EVENT_NAMES[eventName] ?? eventName;
+		const copilotEventName = lookupOwn({
+			record: CANONICAL_TO_COPILOTCLI_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const entries = buildCopilotCliEntriesForEvent({
 			eventName,
 			definitions,
@@ -21375,7 +21727,10 @@ function copilotCliHooksToCanonical(rawHooks, logger) {
 	if (rawHooks === null || rawHooks === void 0 || typeof rawHooks !== "object") return {};
 	const canonical = {};
 	for (const [copilotEventName, hookEntries] of Object.entries(rawHooks)) {
-		const eventName = COPILOTCLI_TO_CANONICAL_EVENT_NAMES[copilotEventName] ?? copilotEventName;
+		const eventName = lookupOwn({
+			record: COPILOTCLI_TO_CANONICAL_EVENT_NAMES,
+			key: copilotEventName
+		}) ?? copilotEventName;
 		if (!Array.isArray(hookEntries)) continue;
 		const defs = [];
 		for (const rawEntry of hookEntries) {
@@ -21527,7 +21882,10 @@ var CursorHooks = class CursorHooks extends ToolHooks {
 		const mappedHooks = {};
 		const cursorSupportedTypes = /* @__PURE__ */ new Set(["command", "prompt"]);
 		for (const [eventName, defs] of Object.entries(mergedHooks)) {
-			const cursorEventName = CANONICAL_TO_CURSOR_EVENT_NAMES[eventName] ?? eventName;
+			const cursorEventName = lookupOwn({
+				record: CANONICAL_TO_CURSOR_EVENT_NAMES,
+				key: eventName
+			}) ?? eventName;
 			const mappedDefs = defs.filter((def) => cursorSupportedTypes.has(def.type ?? "command")).map((def) => ({
 				...def.type !== void 0 && def.type !== null && { type: def.type },
 				...def.command !== void 0 && def.command !== null && { command: def.command },
@@ -21560,7 +21918,10 @@ var CursorHooks = class CursorHooks extends ToolHooks {
 		const cursorHooks = parsed.hooks ?? {};
 		const canonicalHooks = {};
 		for (const [cursorEventName, defs] of Object.entries(cursorHooks)) {
-			const eventName = CURSOR_TO_CANONICAL_EVENT_NAMES[cursorEventName] ?? cursorEventName;
+			const eventName = lookupOwn({
+				record: CURSOR_TO_CANONICAL_EVENT_NAMES,
+				key: cursorEventName
+			}) ?? cursorEventName;
 			canonicalHooks[eventName] = defs;
 		}
 		const version = parsed.version ?? 1;
@@ -21630,7 +21991,10 @@ function canonicalToDeepagentsHooks(config) {
 	const hooks = {};
 	for (const [canonicalEvent, definitions] of Object.entries(effectiveHooks)) {
 		if (!supported.has(canonicalEvent)) continue;
-		const deepagentsEvent = CANONICAL_TO_DEEPAGENTS_EVENT_NAMES[canonicalEvent];
+		const deepagentsEvent = lookupOwn({
+			record: CANONICAL_TO_DEEPAGENTS_EVENT_NAMES,
+			key: canonicalEvent
+		});
 		if (!deepagentsEvent) continue;
 		for (const def of definitions) {
 			if ((def.type ?? "command") !== "command") continue;
@@ -21659,7 +22023,10 @@ function canonicalToDeepagentsHooks(config) {
 function deepagentsToCanonicalHooks(hooks) {
 	const canonical = {};
 	for (const [deepagentsEvent, groups] of Object.entries(hooks)) {
-		const canonicalEvent = DEEPAGENTS_TO_CANONICAL_EVENT_NAMES[deepagentsEvent];
+		const canonicalEvent = lookupOwn({
+			record: DEEPAGENTS_TO_CANONICAL_EVENT_NAMES,
+			key: deepagentsEvent
+		});
 		if (!canonicalEvent || !Array.isArray(groups)) continue;
 		for (const group of groups) {
 			if (!isRecord(group) || !Array.isArray(group.hooks)) continue;
@@ -21692,7 +22059,10 @@ function deepagentsLegacyToCanonicalHooks(entries) {
 		const command = argv.length === 3 && argv[0] === "bash" && argv[1] === "-c" ? String(argv[2] ?? "") : argv.join(" ");
 		const events = Array.isArray(entry.events) ? entry.events : [];
 		for (const legacyEvent of events) {
-			const canonicalEvent = typeof legacyEvent === "string" ? DEEPAGENTS_LEGACY_TO_CANONICAL_EVENT_NAMES[legacyEvent] : void 0;
+			const canonicalEvent = typeof legacyEvent === "string" ? lookupOwn({
+				record: DEEPAGENTS_LEGACY_TO_CANONICAL_EVENT_NAMES,
+				key: legacyEvent
+			}) : void 0;
 			if (!canonicalEvent) continue;
 			(canonical[canonicalEvent] ??= []).push({
 				type: "command",
@@ -22413,7 +22783,10 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	const result = {};
 	for (const [canonicalEvent, definitions] of Object.entries(config.hooks)) {
 		if (!HERMESAGENT_CANONICAL_EVENTS.has(canonicalEvent)) continue;
-		const nativeEvent = CANONICAL_TO_HERMESAGENT_EVENT_NAMES[canonicalEvent];
+		const nativeEvent = lookupOwn({
+			record: CANONICAL_TO_HERMESAGENT_EVENT_NAMES,
+			key: canonicalEvent
+		});
 		if (nativeEvent) setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -22424,7 +22797,10 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	}
 	for (const [canonicalEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (!HERMESAGENT_CANONICAL_EVENTS.has(canonicalEvent)) continue;
-		const nativeEvent = CANONICAL_TO_HERMESAGENT_EVENT_NAMES[canonicalEvent];
+		const nativeEvent = lookupOwn({
+			record: CANONICAL_TO_HERMESAGENT_EVENT_NAMES,
+			key: canonicalEvent
+		});
 		if (nativeEvent) setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -22490,7 +22866,10 @@ function hermesHooksToCanonical(hooks) {
 	for (const [nativeEvent, entries] of Object.entries(hooks)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(nativeEvent) || !Array.isArray(entries)) continue;
 		if (!isHermesHookEventEntry(nativeEvent, entries)) continue;
-		const rulesyncEvent = HERMESAGENT_TO_CANONICAL_EVENT_NAMES[nativeEvent] ?? nativeEvent;
+		const rulesyncEvent = lookupOwn({
+			record: HERMESAGENT_TO_CANONICAL_EVENT_NAMES,
+			key: nativeEvent
+		}) ?? nativeEvent;
 		const defs = entries.map((raw) => hermesEntryToDefinition({
 			nativeEvent,
 			raw
@@ -23127,7 +23506,10 @@ function canonicalToKimiCodeHooks({ config, toolOverrideHooks, trustedDirectory,
 	const result = [];
 	const nativeEvents = new Set(KIMI_CODE_NATIVE_HOOK_EVENTS);
 	for (const [event, definitions] of Object.entries(buildEffectiveHooks(config, toolOverrideHooks))) {
-		const nativeEvent = CANONICAL_TO_KIMI_CODE_EVENT_NAMES[event] ?? event;
+		const nativeEvent = lookupOwn({
+			record: CANONICAL_TO_KIMI_CODE_EVENT_NAMES,
+			key: event
+		}) ?? event;
 		if (!nativeEvents.has(nativeEvent)) {
 			logger?.warn(`Kimi Code hooks: skipping unsupported event "${event}".`);
 			continue;
@@ -23161,14 +23543,22 @@ function kimiCodeHooksToCanonical(hooks) {
 		if (raw === null || typeof raw !== "object" || Array.isArray(raw)) continue;
 		const entry = raw;
 		if (typeof entry.event !== "string" || typeof entry.command !== "string") continue;
-		const event = KIMI_CODE_TO_CANONICAL_EVENT_NAMES[entry.event] ?? entry.event;
+		const event = lookupOwn({
+			record: KIMI_CODE_TO_CANONICAL_EVENT_NAMES,
+			key: entry.event
+		}) ?? entry.event;
 		const definition = {
 			type: "command",
 			command: stripTrustedDirectoryWrapper(entry.command),
 			...typeof entry.matcher === "string" && { matcher: entry.matcher },
 			...typeof entry.timeout === "number" && { timeout: entry.timeout }
 		};
-		(result[event] ??= []).push(definition);
+		const list = lookupOwn({
+			record: result,
+			key: event
+		}) ?? [];
+		list.push(definition);
+		result[event] = list;
 	}
 	return result;
 }
@@ -23371,7 +23761,13 @@ function canonicalToKiroIdeHooks(config) {
 	};
 	const entries = [];
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const trigger = CANONICAL_TO_KIRO_IDE_EVENT_NAMES[eventName] ?? KIRO_LEGACY_TO_KIRO_IDE_TRIGGER_NAMES[eventName] ?? eventName;
+		const trigger = lookupOwn({
+			record: CANONICAL_TO_KIRO_IDE_EVENT_NAMES,
+			key: eventName
+		}) ?? lookupOwn({
+			record: KIRO_LEGACY_TO_KIRO_IDE_TRIGGER_NAMES,
+			key: eventName
+		}) ?? eventName;
 		entries.push(...buildKiroIdeEntriesForEvent(trigger, definitions));
 	}
 	return entries;
@@ -23380,7 +23776,10 @@ function kiroIdeHooksToCanonical(entries) {
 	const canonical = {};
 	for (const entry of entries) {
 		if (entry.trigger === void 0 || entry.action === void 0) continue;
-		const eventName = KIRO_IDE_TO_CANONICAL_EVENT_NAMES[entry.trigger] ?? entry.trigger;
+		const eventName = lookupOwn({
+			record: KIRO_IDE_TO_CANONICAL_EVENT_NAMES,
+			key: entry.trigger
+		}) ?? entry.trigger;
 		if (isPrototypePollutionKey(eventName)) continue;
 		const def = {};
 		if (entry.action.type === "command") {
@@ -23397,7 +23796,12 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
 		if (entry.enabled === false) def.enabled = false;
-		(canonical[eventName] ??= []).push(def);
+		const list = lookupOwn({
+			record: canonical,
+			key: eventName
+		}) ?? [];
+		list.push(def);
+		canonical[eventName] = list;
 	}
 	return canonical;
 }
@@ -23578,7 +23982,10 @@ function canonicalToKiroHooks({ config, logger }) {
 	};
 	const kiro = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const kiroEventName = CANONICAL_TO_KIRO_EVENT_NAMES[eventName] ?? eventName;
+		const kiroEventName = lookupOwn({
+			record: CANONICAL_TO_KIRO_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const entries = buildKiroEntriesForEvent(definitions);
 		if (entries.length > 0) if (kiro[kiroEventName]) kiro[kiroEventName].push(...entries);
 		else kiro[kiroEventName] = entries;
@@ -23609,7 +24016,10 @@ function kiroHooksToCanonical(kiroHooks) {
 	if (kiroHooks === null || kiroHooks === void 0 || typeof kiroHooks !== "object") return {};
 	const canonical = {};
 	for (const [kiroEventName, entries] of Object.entries(kiroHooks)) {
-		const eventName = KIRO_TO_CANONICAL_EVENT_NAMES[kiroEventName] ?? kiroEventName;
+		const eventName = lookupOwn({
+			record: KIRO_TO_CANONICAL_EVENT_NAMES,
+			key: kiroEventName
+		}) ?? kiroEventName;
 		if (!Array.isArray(entries)) continue;
 		const defs = [];
 		for (const rawEntry of entries) {
@@ -24168,7 +24578,10 @@ function canonicalToQwencodeHooks(config, logger) {
 	]);
 	const qwencode = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const qwencodeEventName = CANONICAL_TO_QWENCODE_EVENT_NAMES[eventName] ?? eventName;
+		const qwencodeEventName = lookupOwn({
+			record: CANONICAL_TO_QWENCODE_EVENT_NAMES,
+			key: eventName
+		}) ?? eventName;
 		const byMatcher = /* @__PURE__ */ new Map();
 		for (const def of definitions) {
 			if (!qwencodeSupportedTypes.has(def.type ?? "command")) continue;
@@ -24273,7 +24686,10 @@ function qwencodeHooksToCanonical(qwencodeHooks) {
 	if (qwencodeHooks === null || qwencodeHooks === void 0 || typeof qwencodeHooks !== "object") return {};
 	const canonical = {};
 	for (const [qwencodeEventName, matcherEntries] of Object.entries(qwencodeHooks)) {
-		const eventName = QWENCODE_TO_CANONICAL_EVENT_NAMES[qwencodeEventName] ?? qwencodeEventName;
+		const eventName = lookupOwn({
+			record: QWENCODE_TO_CANONICAL_EVENT_NAMES,
+			key: qwencodeEventName
+		}) ?? qwencodeEventName;
 		if (!Array.isArray(matcherEntries)) continue;
 		const defs = [];
 		for (const rawEntry of matcherEntries) {
@@ -24388,7 +24804,10 @@ function canonicalToReasonixHooks({ config, toolOverrideHooks, logger }) {
 	const result = {};
 	for (const [event, defs] of Object.entries(effectiveHooks)) {
 		if (!SUPPORTED_REASONIX_EVENTS.has(event)) continue;
-		const reasonixEvent = CANONICAL_TO_REASONIX_EVENT_NAMES[event] ?? event;
+		const reasonixEvent = lookupOwn({
+			record: CANONICAL_TO_REASONIX_EVENT_NAMES,
+			key: event
+		}) ?? event;
 		const isMatcherEvent = REASONIX_MATCHER_EVENTS.has(reasonixEvent);
 		const entries = [];
 		for (const def of defs) {
@@ -24401,7 +24820,10 @@ function canonicalToReasonixHooks({ config, toolOverrideHooks, logger }) {
 			if (typeof def.timeout === "number") entry.timeout = Math.round(def.timeout * 1e3);
 			entries.push(entry);
 		}
-		if (entries.length > 0) result[reasonixEvent] = [...result[reasonixEvent] ?? [], ...entries];
+		if (entries.length > 0) result[reasonixEvent] = [...lookupOwn({
+			record: result,
+			key: reasonixEvent
+		}) ?? [], ...entries];
 	}
 	return result;
 }
@@ -24414,7 +24836,10 @@ function reasonixHooksToCanonical(hooks) {
 	if (hooks === null || hooks === void 0 || typeof hooks !== "object" || Array.isArray(hooks)) return canonical;
 	for (const [reasonixEvent, rawEntries] of Object.entries(hooks)) {
 		if (!Array.isArray(rawEntries)) continue;
-		const canonicalEvent = REASONIX_TO_CANONICAL_EVENT_NAMES[reasonixEvent] ?? reasonixEvent;
+		const canonicalEvent = lookupOwn({
+			record: REASONIX_TO_CANONICAL_EVENT_NAMES,
+			key: reasonixEvent
+		}) ?? reasonixEvent;
 		const defs = [];
 		for (const rawEntry of rawEntries) {
 			if (rawEntry === null || typeof rawEntry !== "object" || Array.isArray(rawEntry)) continue;
@@ -24429,7 +24854,10 @@ function reasonixHooksToCanonical(hooks) {
 			if (typeof entry.timeout === "number") def.timeout = entry.timeout / 1e3;
 			defs.push(def);
 		}
-		if (defs.length > 0) canonical[canonicalEvent] = [...canonical[canonicalEvent] ?? [], ...defs];
+		if (defs.length > 0) canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
 	}
 	return canonical;
 }
@@ -24557,7 +24985,10 @@ function canonicalToVibeHooks(config, toolOverride) {
 	const hooks = [];
 	for (const [event, defs] of Object.entries(effective)) {
 		if (!SUPPORTED_VIBE_EVENTS.has(event)) continue;
-		const vibeEvent = CANONICAL_TO_VIBE_EVENT_NAMES[event] ?? event;
+		const vibeEvent = lookupOwn({
+			record: CANONICAL_TO_VIBE_EVENT_NAMES,
+			key: event
+		}) ?? event;
 		let index = 0;
 		for (const def of defs) {
 			if ((def.type ?? "command") !== "command") continue;
@@ -24587,7 +25018,10 @@ function vibeEntryToCanonicalDef(raw) {
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
 	if (isPrototypePollutionKey(vibeEvent)) return null;
-	const canonicalEvent = VIBE_TO_CANONICAL_EVENT_NAMES[vibeEvent] ?? vibeEvent;
+	const canonicalEvent = lookupOwn({
+		record: VIBE_TO_CANONICAL_EVENT_NAMES,
+		key: vibeEvent
+	}) ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
 	if (typeof entry.match === "string" && entry.match !== "" && entry.match !== "*") def.matcher = entry.match;
@@ -24612,7 +25046,10 @@ function vibeHooksToCanonical(parsed) {
 	for (const raw of rawHooks) {
 		const result = vibeEntryToCanonicalDef(raw);
 		if (result === null) continue;
-		const list = canonical[result.canonicalEvent] ?? [];
+		const list = lookupOwn({
+			record: canonical,
+			key: result.canonicalEvent
+		}) ?? [];
 		list.push(result.def);
 		canonical[result.canonicalEvent] = list;
 	}
@@ -25691,6 +26128,68 @@ var ClineIgnore = class ClineIgnore extends ToolIgnore {
 	}
 };
 //#endregion
+//#region src/constants/crush-paths.ts
+const CRUSH_RULE_FILE_NAME = "CRUSH.md";
+const CRUSH_GLOBAL_DIR = join(".config", "crush");
+const CRUSH_IGNORE_FILE_NAME = ".crushignore";
+const CRUSH_SKILLS_PROJECT_DIR = join(".crush", "skills");
+const CRUSH_SKILLS_GLOBAL_DIR = join(CRUSH_GLOBAL_DIR, "skills");
+//#endregion
+//#region src/features/ignore/crush-ignore.ts
+/**
+* Ignore generator for Crush.
+*
+* Crush excludes files from tool access via a `.crushignore` file, read
+* hierarchically (root and any subdirectory, the same way it walks
+* `.gitignore`) using gitignore syntax. Crush documents no global/user-scope
+* ignore file, so this is project-only.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/fsext/fileutil.go
+*/
+var CrushIgnore = class CrushIgnore extends ToolIgnore {
+	static getSettablePaths() {
+		return {
+			relativeDirPath: ".",
+			relativeFilePath: CRUSH_IGNORE_FILE_NAME
+		};
+	}
+	toRulesyncIgnore() {
+		return new RulesyncIgnore({
+			outputRoot: ".",
+			relativeDirPath: ".",
+			relativeFilePath: RULESYNC_AIIGNORE_RELATIVE_FILE_PATH,
+			fileContent: this.fileContent
+		});
+	}
+	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore }) {
+		const body = rulesyncIgnore.getFileContent();
+		return new CrushIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent: body
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+		const fileContent = await readFileContent(join(outputRoot, this.getSettablePaths().relativeDirPath, this.getSettablePaths().relativeFilePath));
+		return new CrushIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new CrushIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/ignore/cursor-ignore.ts
 /**
 * Cursor ignore adapter.
@@ -26687,6 +27186,7 @@ const toolIgnoreFactories = /* @__PURE__ */ new Map([
 	["claudecode", { class: ClaudecodeIgnore }],
 	["claudecode-legacy", { class: ClaudecodeIgnore }],
 	["cline", { class: ClineIgnore }],
+	["crush", { class: CrushIgnore }],
 	["cursor", { class: CursorIgnore }],
 	["hermesagent", { class: HermesagentIgnore }],
 	["junie", { class: JunieIgnore }],
@@ -27991,9 +28491,8 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 			throw new Error(`Failed to parse existing Codex CLI config at ${configTomlFilePath}: ${formatError(error)}`, { cause: error });
 		}
 		const strippedMcpServers = rulesyncMcp.getMcpServers();
-		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const converted = convertToCodexFormat(Object.fromEntries(Object.entries(strippedMcpServers).map(([serverName, serverConfig]) => {
-			const rawServer = isRecord$1(rawMcpServers) ? rawMcpServers[serverName] : void 0;
+			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
 			return [serverName, {
 				...serverConfig,
 				...isRecord$1(rawServer) && isEnvVarEntryArray(rawServer.envVars) ? { envVars: rawServer.envVars } : {},
@@ -30956,9 +31455,8 @@ var MusecodeMcp = class MusecodeMcp extends ToolMcp {
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const existing = parseMusecodeSettings(existingContent, filePath);
-		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const converted = convertToMusecodeFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => {
-			const rawServer = isRecord$1(rawMcpServers) ? rawMcpServers[serverName] : void 0;
+			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
 			const mode = asMusecodeMode(isRecord$1(rawServer) ? rawServer.musecodeMode : void 0);
 			return [serverName, {
 				...serverConfig,
@@ -31907,6 +32405,66 @@ async function readRovodevConfigYaml({ outputRoot }) {
 		filePath: join(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)
 	});
 }
+/**
+* Decide the absolute path a configured `mcpConfigPath` would name in the
+* given scope, without yet checking whether that path stays inside it. Split
+* out of resolveRovodevMcpImportPath so each function's branching stays
+* within the project's complexity budget.
+*/
+function resolveMcpConfigCandidatePath({ outputRoot, global, normalizedPath, configuredPath }) {
+	if (global && normalizedPath.startsWith("~/")) return { path: resolve(outputRoot, normalizedPath.slice(2)) };
+	if (!global && normalizedPath.startsWith("~/")) return { rejectionMessage: `Rovo Dev MCP: mcp.mcpConfigPath is ${quoteValueForWarning(configuredPath)} in project scope. A home-anchored path cannot be imported as part of a project, so importing ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.` };
+	if (isAbsolute(normalizedPath)) return { path: resolve(normalizedPath) };
+	if (!global) return { path: resolve(outputRoot, normalizedPath) };
+	return { rejectionMessage: `Rovo Dev MCP: mcp.mcpConfigPath is ${quoteValueForWarning(configuredPath)} in global scope. Only home-anchored or absolute paths can be imported safely, so importing ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.` };
+}
+/**
+* Resolve the active Rovo Dev MCP config without following a pointer outside
+* the import scope. The implementation is deliberately separate from
+* fromFile: it keeps path-policy decisions testable without changing the
+* public ToolMcp contract.
+*/
+async function resolveRovodevMcpImportPath({ outputRoot, global, config, logger }) {
+	const fallback = {
+		filePath: join(outputRoot, ROVODEV_DIR, ROVODEV_MCP_FILE_NAME),
+		relativeDirPath: ROVODEV_DIR,
+		relativeFilePath: ROVODEV_MCP_FILE_NAME
+	};
+	const configuredPath = (config && isRecord$1(config.mcp) ? config.mcp : {}).mcpConfigPath;
+	if (configuredPath === void 0) {
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath is unset in ${join(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)}. Importing ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)}, which may not be the file Rovo Dev reads.`);
+		return fallback;
+	}
+	if (typeof configuredPath !== "string" || configuredPath.trim() === "") {
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${join(ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)} must be a non-empty string. Importing ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.`);
+		return fallback;
+	}
+	const normalizedPath = normalizeMcpConfigPathValue(configuredPath.trim());
+	const candidateResult = resolveMcpConfigCandidatePath({
+		outputRoot,
+		global,
+		normalizedPath,
+		configuredPath
+	});
+	if ("rejectionMessage" in candidateResult) {
+		logger?.warn(candidateResult.rejectionMessage);
+		return fallback;
+	}
+	const candidatePath = candidateResult.path;
+	const relativePath = relative(resolve(outputRoot), candidatePath);
+	if (relativePath === "" || splitPathSegments(normalizedPath).includes("..") || pathEscapesRoot(relativePath) || await resolvedPathEscapesRoot({
+		rootPath: outputRoot,
+		targetPath: candidatePath
+	})) {
+		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath is ${quoteValueForWarning(configuredPath)}, which is outside the import scope or traverses a symbolic link. Importing ${join(ROVODEV_DIR, ROVODEV_MCP_FILE_NAME)} instead.`);
+		return fallback;
+	}
+	return {
+		filePath: candidatePath,
+		relativeDirPath: dirname(relativePath),
+		relativeFilePath: basename(relativePath)
+	};
+}
 function disabledNamesOf(config) {
 	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
 	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
@@ -32012,6 +32570,25 @@ function envVarMcpFileSpellings({ fileName }) {
 	return [`$HOME/${tail}`, `\${HOME}/${tail}`];
 }
 /**
+* Classify the existing `mcpConfigPath` without deciding how to report it.
+* Keep the known-file checks in this order: the generated file is valid in
+* either scope, while the documented default and environment-variable
+* spellings are global-only alternatives that need their own warnings.
+*/
+function classifyExistingPointer({ existing, global, outputRoot }) {
+	if (existing === void 0) return { kind: "unset" };
+	const normalized = typeof existing === "string" ? normalizeMcpConfigPathValue(existing) : void 0;
+	const namesFile = (fileName) => normalized !== void 0 && mcpFileSpellings({
+		fileName,
+		global,
+		outputRoot
+	}).includes(normalized);
+	if (namesFile("mcp.json")) return { kind: "already-generated" };
+	if (global && namesFile(ROVODEV_ALTERNATE_MCP_FILE_NAME)) return { kind: "documented-default" };
+	if (global && normalized !== void 0 && envVarMcpFileSpellings({ fileName: "mcp.json" }).includes(normalized)) return { kind: "env-var-spelling" };
+	return { kind: "unrelated" };
+}
+/**
 * Point `mcp.mcpConfigPath` at the `mcp.json` rulesync writes for this scope,
 * and report whether the block gained a value it did not already carry.
 *
@@ -32122,45 +32699,44 @@ function announcePointer({ global, logger }) {
 async function applyMcpConfigPointer({ existingMcp, global, hasLiveServers, outputRoot, logger }) {
 	const { pointer, configLabel, mcpLabel } = pointerLabels(global);
 	const existing = existingMcp.mcpConfigPath;
-	const normalizedExisting = typeof existing === "string" ? normalizeMcpConfigPathValue(existing) : void 0;
-	const namesFile = (fileName) => normalizedExisting !== void 0 && mcpFileSpellings({
-		fileName,
+	const classification = classifyExistingPointer({
+		existing,
 		global,
 		outputRoot
-	}).includes(normalizedExisting);
-	const pointsAtGeneratedFile = namesFile(ROVODEV_MCP_FILE_NAME);
+	});
 	if (!hasLiveServers) {
-		if (pointsAtGeneratedFile) logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} points at ${mcpLabel}, which now has no enabled server. Rovo Dev reads MCP servers from that file and nowhere else, so ${global ? "Rovo Dev has" : "this project has"} no MCP servers at all until one targeting rovodev is added back — remove the mcp.mcpConfigPath line to fall back to ${global ? "Rovo Dev's own default" : "the global config"}.`);
+		if (classification.kind === "already-generated") logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} points at ${mcpLabel}, which now has no enabled server. Rovo Dev reads MCP servers from that file and nowhere else, so ${global ? "Rovo Dev has" : "this project has"} no MCP servers at all until one targeting rovodev is added back — remove the mcp.mcpConfigPath line to fall back to ${global ? "Rovo Dev's own default" : "the global config"}.`);
 		return false;
 	}
-	if (existing === void 0) {
-		const displaced = global ? await describeDisplacedGlobalServers({ outputRoot }) : null;
-		if (displaced !== null) {
-			logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath unset in ${configLabel}, because ${displaced}. Atlassian documents that path and ${mcpLabel} as two different defaults for the setting, and mcpConfigPath names one config rather than merging, so pointing it at ${mcpLabel} would stop those servers being read on every project. Move the ones you want to keep into .rulesync/mcp.jsonc — or none at all, if it turns out to hold nothing you need — then set mcp.mcpConfigPath to "${pointer}" yourself, which rulesync will not overwrite.`);
-			return false;
+	switch (classification.kind) {
+		case "unset": {
+			const displaced = global ? await describeDisplacedGlobalServers({ outputRoot }) : null;
+			if (displaced !== null) {
+				logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath unset in ${configLabel}, because ${displaced}. Atlassian documents that path and ${mcpLabel} as two different defaults for the setting, and mcpConfigPath names one config rather than merging, so pointing it at ${mcpLabel} would stop those servers being read on every project. Move the ones you want to keep into .rulesync/mcp.jsonc — or none at all, if it turns out to hold nothing you need — then set mcp.mcpConfigPath to "${pointer}" yourself, which rulesync will not overwrite.`);
+				return false;
+			}
+			existingMcp.mcpConfigPath = pointer;
+			announcePointer({
+				global,
+				logger
+			});
+			return true;
 		}
-		existingMcp.mcpConfigPath = pointer;
-		announcePointer({
-			global,
-			logger
-		});
-		return true;
-	}
-	if (pointsAtGeneratedFile) return false;
-	if (global && namesFile(ROVODEV_ALTERNATE_MCP_FILE_NAME)) {
-		await warnAtDocumentedDefault({
-			existing,
-			outputRoot,
-			logger
-		});
-		return false;
-	}
-	if (global && normalizedExisting !== void 0 && envVarMcpFileSpellings({ fileName: "mcp.json" }).includes(normalizedExisting)) {
-		logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${quoteValueForWarning(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
-		return false;
+		case "already-generated": return false;
+		case "documented-default":
+			await warnAtDocumentedDefault({
+				existing,
+				outputRoot,
+				logger
+			});
+			return false;
+		case "env-var-spelling":
+			logger?.warn(`Rovo Dev MCP: mcp.mcpConfigPath in ${configLabel} is ${quoteValueForWarning(existing)}. That names ${mcpLabel} only if Rovo Dev expands environment variables in this setting, which Atlassian does not document — if it does not, the path resolves literally and Rovo Dev reads no MCP servers at all. Write "${pointer}" instead, the form its own documented default uses.`);
+			return false;
+		case "unrelated":
+			logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
+			return false;
 	}
-	logger?.warn(`Rovo Dev MCP: leaving mcp.mcpConfigPath as ${quoteValueForWarning(existing)} in ${configLabel}. Rovo Dev reads MCP servers from that path, so the generated ${mcpLabel} is unused until it is set to "${pointer}".`);
-	return false;
 }
 /**
 * Auxiliary writer for the `mcp:` block of `.rovodev/config.yml` (project) /
@@ -32202,14 +32778,20 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			relativeFilePath: ROVODEV_MCP_FILE_NAME
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = this.getSettablePaths({ global });
-		const json = parseRovodevMcpJson(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}", paths.relativeDirPath, paths.relativeFilePath);
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
+		const rovodevConfig = await readRovodevConfigYaml({ outputRoot });
+		const paths = await resolveRovodevMcpImportPath({
+			outputRoot,
+			global,
+			config: rovodevConfig,
+			logger
+		});
+		const json = parseRovodevMcpJson(await readFileContentOrNull(paths.filePath) ?? "{\"mcpServers\":{}}", paths.relativeDirPath, paths.relativeFilePath);
 		const newJson = {
 			...json,
 			mcpServers: json.mcpServers ?? {}
 		};
-		const disabledNames = disabledNamesOf(await readRovodevConfigYaml({ outputRoot }));
+		const disabledNames = disabledNamesOf(rovodevConfig);
 		if (disabledNames.length > 0 && isMcpServers(newJson.mcpServers)) {
 			const servers = newJson.mcpServers;
 			for (const name of disabledNames) {
@@ -32239,9 +32821,8 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 		} catch {
 			canWriteDisableToggle = false;
 		}
-		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const mcpServers = Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => {
-			const rawServer = isRecord$1(rawMcpServers) && Object.hasOwn(rawMcpServers, name) ? rawMcpServers[name] : void 0;
+			const rawServer = rulesyncMcp.getRawMcpServer(name);
 			const record = {
 				...server,
 				...readEnableInstructions(rawServer) && { rovodevEnableInstructions: true }
@@ -34229,6 +34810,518 @@ function convertAmpToRulesync({ disable, permissions }) {
 	return { permission };
 }
 //#endregion
+//#region src/utils/glob.ts
+/**
+* Convert a glob-like pattern into an anchored regex source string.
+*
+* Only `*` (any run of characters) and `?` (one character) carry meaning;
+* every other regex metacharacter is escaped so it matches literally. The
+* result is anchored at both ends, because the callers ask "is this the whole
+* name?" rather than "does this appear somewhere in it?".
+*
+* Note that `[` and `]` are escaped along with everything else, so a bracket
+* class is a literal here while `matchesGlob` below reads it as a class. The
+* one caller wants exactly that: AugmentCode writes this source into its own
+* config as the tool's own shell-command regex, and never executes it, so it
+* has to say what the tool would read rather than what a glob means. Use
+* `matchesGlob` for an actual comparison.
+*/
+function globToAnchoredRegexSource(glob) {
+	let source = "";
+	for (const char of glob) if (char === "*") source += ".*";
+	else if (char === "?") source += ".";
+	else if (/[\\^$.|+(){}[\]]/.test(char)) source += `\\${char}`;
+	else source += char;
+	return `^${source}$`;
+}
+/**
+* Read a `[...]` class body starting just past the `[`, or `undefined` when the
+* bracket is never closed — in which case it is an ordinary character.
+*/
+function parseGlobClass(characters, start) {
+	let index = start;
+	const negated = characters[index] === "!" || characters[index] === "^";
+	if (negated) index += 1;
+	const members = /* @__PURE__ */ new Set();
+	const ranges = [];
+	let first = true;
+	while (index < characters.length) {
+		const character = characters[index] ?? "";
+		if (character === "]" && !first) return {
+			step: {
+				kind: "class",
+				negated,
+				members,
+				ranges
+			},
+			next: index + 1
+		};
+		first = false;
+		const high = characters[index + 2];
+		if (characters[index + 1] === "-" && high !== void 0 && high !== "]") {
+			ranges.push([character.codePointAt(0) ?? 0, high.codePointAt(0) ?? 0]);
+			index += 3;
+			continue;
+		}
+		members.add(character);
+		index += 1;
+	}
+}
+/** Split a glob into the steps `matchesGlob` walks. */
+function parseGlob(glob) {
+	const characters = [...glob];
+	const steps = [];
+	let index = 0;
+	let bracketsAreClosed = true;
+	while (index < characters.length) {
+		const character = characters[index] ?? "";
+		index += 1;
+		if (character === "*") {
+			if (steps.at(-1)?.kind !== "star") steps.push({ kind: "star" });
+			continue;
+		}
+		if (character === "?") {
+			steps.push({ kind: "any" });
+			continue;
+		}
+		if (character === "[" && bracketsAreClosed) {
+			const parsed = parseGlobClass(characters, index);
+			if (parsed === void 0) bracketsAreClosed = false;
+			else {
+				steps.push(parsed.step);
+				index = parsed.next;
+				continue;
+			}
+		}
+		steps.push({
+			kind: "literal",
+			character
+		});
+	}
+	return steps;
+}
+function matchesGlobStep(step, character) {
+	if (step.kind === "star") return false;
+	if (step.kind === "any") return true;
+	if (step.kind === "literal") return step.character === character;
+	const code = character.codePointAt(0) ?? 0;
+	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
+	return step.negated ? !admitted : admitted;
+}
+/** Whether two single-character steps can both match one same character. */
+function stepsShareACharacter(left, right) {
+	if (left.kind === "any" || right.kind === "any") return true;
+	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
+	if (left.kind === "literal") return matchesGlobStep(right, left.character);
+	if (right.kind === "literal") return matchesGlobStep(left, right.character);
+	return true;
+}
+/** Whether every step from `index` on can match the empty string. */
+function isAllStars(steps, index) {
+	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
+	return true;
+}
+/**
+* The most work one intersection walk will do, counted in cells times the cost
+* of one. Past it the two patterns are reported as intersecting without being
+* walked: the product of two lengths grows quadratically, and a pattern long
+* enough to reach this is pathological rather than a command anybody typed.
+* Answering `true` withholds an `allow`, which is the direction that fails
+* closed.
+*/
+const MAX_INTERSECTION_CELLS = 1e6;
+/**
+* The most work a whole run of comparisons will do. A caller holding R
+* restrictions and A allow rules asks R x A times, and a per-pair cap alone
+* bounds none of that: a hundred restrictions against a hundred allow rules,
+* each pattern just under the per-pair cap, is ten thousand affordable walks
+* that together take minutes. The shared budget is spent down across the run
+* and, once it is gone, every remaining pair is reported as intersecting —
+* again the direction that withholds an `allow` rather than writing one.
+*/
+const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
+/**
+* What a pair costs on top of the cells it walks: the call itself, sizing and
+* filling the two rows the table is held in, and collecting the answer.
+* Charging only cells would leave the *number* of pairs unbounded — a pair of
+* one-step patterns walks a single cell, so n short restrictions against n
+* short allow rules is n squared comparisons that never spend the budget down
+* however many of them there are. Charging a floor per pair puts pair count and
+* walk length on the same exhaustible resource.
+*
+* For the short patterns of an ordinary config the floor is the whole charge,
+* which lowers how many pairs a run compares from around a million to about
+* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
+* that line withholds every allow it has not yet compared, the same fail-closed
+* answer exhaustion gives everywhere else.
+*/
+const INTERSECTION_PAIR_COST = 64;
+/**
+* A budget for one caller's run of comparisons. Hand the same one to every
+* `parsedGlobsIntersect` call that belongs together — one adapter reading one
+* config — so the run as a whole stays bounded rather than only each pair in
+* it.
+*/
+function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
+	return { remaining };
+}
+/**
+* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
+* the same pattern against a whole list parses it once and reuses the result.
+*/
+function parseGlobPattern(glob) {
+	const steps = parseGlob(glob);
+	return {
+		steps,
+		maxRanges: maxRangeCount(steps)
+	};
+}
+/**
+* What one cell can cost, as a multiplier on the cell count. A literal met by a
+* `[a-z...]` class walks that class's ranges, so a single class carrying
+* thousands of them turns a walk that looks affordable by cell count alone into
+* a quadratic one — which is why the budget is spent on cells times this rather
+* than on cells.
+*/
+function maxRangeCount(steps) {
+	let most = 0;
+	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
+	return most;
+}
+/**
+* `globsIntersect` for two globs already parsed, optionally spending a budget
+* shared with the rest of the caller's run — see `createIntersectionBudget`.
+* Once that budget is exhausted every further pair answers `true` without being
+* walked, so a caller reading the answer as a reason to restrict stays on the
+* safe side.
+*/
+function parsedGlobsIntersect(left, right, budget) {
+	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
+	const cellCost = 1 + left.maxRanges + right.maxRanges;
+	const cost = rows.length * columns.length * cellCost;
+	if (cost > MAX_INTERSECTION_CELLS) return true;
+	if (budget !== void 0) {
+		const charge = cost + INTERSECTION_PAIR_COST;
+		if (charge > budget.remaining) {
+			budget.remaining = 0;
+			return true;
+		}
+		budget.remaining -= charge;
+	}
+	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
+	for (let i = rows.length - 1; i >= 0; i--) {
+		const row = Array.from({ length: columns.length + 1 }, () => false);
+		row[columns.length] = isAllStars(rows, i);
+		for (let j = columns.length - 1; j >= 0; j--) {
+			const rowStep = rows[i];
+			const columnStep = columns[j];
+			if (rowStep === void 0 || columnStep === void 0) continue;
+			if (rowStep.kind === "star" || columnStep.kind === "star") {
+				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
+				continue;
+			}
+			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
+		}
+		next = row;
+	}
+	return next[0] ?? false;
+}
+//#endregion
+//#region src/features/permissions/shell-command-categories.ts
+/** The canonical category that names a shell command's permissions. */
+const SHELL_PERMISSION_CATEGORY = "bash";
+/**
+* Collect the canonical rules that govern shell commands, for the adapters
+* whose tool models commands and nothing else.
+*
+* The `bash` category contributes every rule. The all-tools `*` category
+* contributes its **restricting** rules — `deny` and `ask` — because a rule
+* written there covers shell commands too, and dropping it inverts the
+* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
+* an adapter that reads only `bash` auto-approves the very command the file
+* denies.
+*
+* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
+* need not be a command at all — `secrets/**` under `*` denies a path — and
+* carrying it in the restricting direction only over-restricts, while carrying
+* it in the permissive direction would grant something the author never said
+* about commands. Both directions therefore fail closed.
+*/
+function collectShellCommandRules(permission) {
+	const rules = [];
+	const foreignRestrictingCategories = [];
+	const ignoredAllToolsAllowPatterns = [];
+	for (const [category, categoryRules] of Object.entries(permission)) {
+		if (category === "bash") {
+			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
+				pattern,
+				action,
+				fromAllToolsCategory: false
+			});
+			continue;
+		}
+		if (category === "*") {
+			for (const [pattern, action] of Object.entries(categoryRules)) {
+				if (action === "allow") {
+					ignoredAllToolsAllowPatterns.push(pattern);
+					continue;
+				}
+				rules.push({
+					pattern,
+					action,
+					fromAllToolsCategory: true
+				});
+			}
+			continue;
+		}
+		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
+	}
+	return {
+		rules,
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns
+	};
+}
+/**
+* Build the test an adapter applies to an `allow` pattern before writing it:
+* which restrictions it cannot write name some of the same commands? The
+* answer is the list of those restrictions — empty when the `allow` may be
+* written — so a caller can report both the allow rules it withheld and the
+* restrictions that withheld nothing.
+*
+* Canonically the stricter rule wins **whatever its width** — rulesync collapses
+* colliding rules as `deny > ask > allow` — so the two patterns are compared by
+* asking whether any one command matches both. Width does not enter into it: an
+* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
+* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
+* on every `git ... --force` command even though neither pattern covers the
+* other's spelling. Comparing only identical spellings would let the most
+* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
+*
+* Identical spellings are still compared as strings first, as a shortcut past
+* the walk for the commonest case.
+*
+* `normalizePattern` rewrites a pattern written in the tool's own language into
+* the widest glob it could stand for, for a tool whose patterns are not globs.
+* It reaches the `bash` rules and the `allow` rules, which is where such a
+* pattern is written; an all-tools `*` pattern is canonical — it is read by
+* every tool, so it is a glob already — and is compared as it stands. The
+* rewrite must only ever widen what a pattern covers, so an inexact reading
+* withholds an allow rather than writing one the config restricts — see
+* `warpCommandPatternToGlob`.
+*/
+function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
+	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
+		pattern,
+		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
+	}));
+	return (allowPattern) => {
+		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
+		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
+		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
+	};
+}
+/**
+* Which of the given all-tools `*` restrictions look like they may not name a
+* command at all — the question a `deny` and an `ask` written there both raise.
+*
+* "Withheld no allow rule" alone does not answer it: a config with no `allow`
+* rules has nothing to withhold, and a pattern the author also wrote under
+* `bash` is a command on their own word. Both are excluded, so what remains is
+* a `*` pattern that had allow rules to overlap, overlapped none of them, and
+* is claimed as a command nowhere else — the shape `secrets/**` has.
+*
+* A `bash` restriction never belongs here: it names a command by construction,
+* so overlapping no allow rule says nothing is wrong with it.
+*/
+function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
+	if (!rules.some(({ action }) => action === "allow")) return [];
+	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
+	return uniq(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
+}
+/**
+* Split shell-command rules into the allow and deny lists of a tool that models
+* commands with those two tiers and nothing else.
+*
+* `ask` has no list of its own — such a tool already prompts for whatever it
+* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
+* still has to *withhold* the `allow` rules it covers, though: the canonical
+* order is `deny > ask > allow`, so auto-approving a command the file also asks
+* about would answer the prompt the author wanted.
+*
+* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
+* from the all-tools `*` category. Warp's cannot: it matches commands with
+* regular expressions rather than globs, and writing any denylist **replaces**
+* Warp's built-in default one, so an inert `secrets/**` entry there would trade
+* the tool's own protection for a rule that matches no command. Where the deny
+* cannot be written it withholds the allow rules it covers instead, which
+* restricts in the same direction without touching the denylist.
+*
+* A `bash` deny withholds nothing: it names a command by construction, so the
+* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
+* and a narrow deny keeps carving an exception out of a wider allow (`git *`
+* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
+* even where it is written: a pattern under `*` need not name a command —
+* `secrets/**` there denies a path — so as a denylist entry it may match nothing
+* at all, and leaving an overlapping allow beside it would auto-approve the very
+* commands the author meant to stop. Over-restricting a `*` deny that *was* a
+* command pattern is reported; failing open would not be.
+*
+* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
+* patterns are not globs.
+*/
+function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
+	const deny = [];
+	const unwrittenDenyPatterns = [];
+	const restrictions = [];
+	const writtenAllToolsDenyPatterns = [];
+	const allToolsAskPatterns = [];
+	for (const rule of rules) {
+		const { pattern, action, fromAllToolsCategory } = rule;
+		if (action === "allow") continue;
+		if (action !== "deny") {
+			restrictions.push(rule);
+			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
+			continue;
+		}
+		if (writesAllToolsDeny || !fromAllToolsCategory) {
+			deny.push(pattern);
+			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
+		} else unwrittenDenyPatterns.push(pattern);
+		if (fromAllToolsCategory) restrictions.push(rule);
+	}
+	const budget = createIntersectionBudget();
+	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
+		normalizePattern,
+		budget
+	});
+	const allow = [];
+	const shadowedAllowPatterns = [];
+	const withholdingPatterns = /* @__PURE__ */ new Set();
+	for (const { pattern, action } of rules) {
+		if (action !== "allow") continue;
+		const shadowing = shadowingRestrictions(pattern);
+		if (shadowing.length > 0) {
+			shadowedAllowPatterns.push(pattern);
+			for (const restriction of shadowing) withholdingPatterns.add(restriction);
+			continue;
+		}
+		allow.push(pattern);
+	}
+	return {
+		allow,
+		deny,
+		shadowedAllowPatterns,
+		unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: writtenAllToolsDenyPatterns,
+			withholdingPatterns
+		}),
+		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
+			rules,
+			allToolsPatterns: allToolsAskPatterns,
+			withholdingPatterns
+		}),
+		intersectionBudgetExhausted: budget.remaining === 0
+	};
+}
+/**
+* Report, for one command-only tool, every canonical rule its two lists could
+* not carry. Every command-only adapter shares this reporting, so a rule
+* dropped in one is worded the same way in all.
+*/
+function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
+	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
+	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
+	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
+	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
+	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
+	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
+	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
+}
+function resolveShellCommandState(permission, writesAllToolsDeny) {
+	const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permission);
+	const partitioned = partitionCommandRules({
+		rules,
+		writesAllToolsDeny
+	});
+	return {
+		allow: partitioned.allow,
+		deny: partitioned.deny,
+		bash: bashRulesHonoringAllTools(permission),
+		foreignRestrictingCategories,
+		ignoredAllToolsAllowPatterns,
+		shadowedAllowPatterns: partitioned.shadowedAllowPatterns,
+		unwrittenDenyPatterns: partitioned.unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: partitioned.unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns: partitioned.unenforcedAllToolsAskPatterns,
+		intersectionBudgetExhausted: partitioned.intersectionBudgetExhausted
+	};
+}
+/**
+* Collect shell-command allow/deny lists the way the command-only adapters do,
+* and report every restriction the surface cannot carry.
+*/
+function resolveShellCommandLists({ permission, writesAllToolsDeny, toolLabel, surfaceLabel, logger }) {
+	const resolved = resolveShellCommandState(permission, writesAllToolsDeny);
+	warnAboutUnwrittenCommandRules({
+		toolLabel,
+		surfaceLabel,
+		foreignRestrictingCategories: resolved.foreignRestrictingCategories,
+		shadowedAllowPatterns: resolved.shadowedAllowPatterns,
+		unwrittenDenyPatterns: resolved.unwrittenDenyPatterns,
+		unenforcedAllToolsDenyPatterns: resolved.unenforcedAllToolsDenyPatterns,
+		unenforcedAllToolsAskPatterns: resolved.unenforcedAllToolsAskPatterns,
+		ignoredAllToolsAllowPatterns: resolved.ignoredAllToolsAllowPatterns,
+		intersectionBudgetExhausted: resolved.intersectionBudgetExhausted,
+		logger
+	});
+	return {
+		allow: resolved.allow,
+		deny: resolved.deny,
+		bash: resolved.bash
+	};
+}
+/**
+* The `bash` category after all-tools `*` restrictions have been applied. A
+* `deny`/`ask` written under `*` covers shell commands too, so a bash `allow`
+* it overlaps is withheld, a `*` deny is copied in, and a `*` ask is copied in
+* wherever `bash` says nothing about that exact pattern yet — otherwise it
+* would vanish from the resolved category entirely rather than falling back to
+* a tier that still prompts. An existing `bash` entry for the same pattern is
+* never downgraded by a `*` ask (a bash `allow` was already dropped above, and
+* a bash `deny`/`ask` there is at least as strict already).
+*/
+function bashRulesHonoringAllTools(permission) {
+	const { rules } = collectShellCommandRules(permission);
+	const allToolsRestrictions = rules.filter(({ fromAllToolsCategory }) => fromAllToolsCategory);
+	const shadowingRestrictions = createShadowingRestrictionsTest(allToolsRestrictions);
+	const bash = { ...permission.bash };
+	for (const [pattern, action] of Object.entries(bash)) if (action === "allow" && shadowingRestrictions(pattern).length > 0) delete bash[pattern];
+	for (const { pattern, action } of allToolsRestrictions) {
+		if (isPrototypePollutionKey(pattern)) continue;
+		if (action === "deny") {
+			if (bash[pattern] !== "ask") bash[pattern] = "deny";
+			continue;
+		}
+		if (bash[pattern] === void 0) bash[pattern] = "ask";
+	}
+	return bash;
+}
+/**
+* Return a permission block whose `bash` category honors all-tools `*`
+* restrictions. Other categories are unchanged, so adapters that already model
+* `*` keep doing so.
+*/
+function honorAllToolsOnBash(permission) {
+	if (permission.bash === void 0) return permission;
+	return {
+		...permission,
+		bash: bashRulesHonoringAllTools(permission)
+	};
+}
+//#endregion
 //#region src/features/permissions/antigravity-cli-permissions.ts
 /**
 * Top-level `~/.gemini/antigravity-cli/settings.json` keys the `antigravity-cli`
@@ -34476,7 +35569,7 @@ function convertRulesyncToAntigravityCliPermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const cliToolName = toAntigravityCliToolName(category);
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildPermissionEntry$1(cliToolName, pattern);
@@ -34687,7 +35780,7 @@ function convertRulesyncToAntigravityIdePermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const action = toIdeAction(category);
 		for (const [pattern, permissionAction] of Object.entries(rules)) {
 			const entry = buildPermissionEntry(action, pattern);
@@ -34727,223 +35820,6 @@ function convertAntigravityIdeToRulesyncPermissions(params) {
 	return { permission };
 }
 //#endregion
-//#region src/utils/glob.ts
-/**
-* Convert a glob-like pattern into an anchored regex source string.
-*
-* Only `*` (any run of characters) and `?` (one character) carry meaning;
-* every other regex metacharacter is escaped so it matches literally. The
-* result is anchored at both ends, because the callers ask "is this the whole
-* name?" rather than "does this appear somewhere in it?".
-*
-* Note that `[` and `]` are escaped along with everything else, so a bracket
-* class is a literal here while `matchesGlob` below reads it as a class. The
-* one caller wants exactly that: AugmentCode writes this source into its own
-* config as the tool's own shell-command regex, and never executes it, so it
-* has to say what the tool would read rather than what a glob means. Use
-* `matchesGlob` for an actual comparison.
-*/
-function globToAnchoredRegexSource(glob) {
-	let source = "";
-	for (const char of glob) if (char === "*") source += ".*";
-	else if (char === "?") source += ".";
-	else if (/[\\^$.|+(){}[\]]/.test(char)) source += `\\${char}`;
-	else source += char;
-	return `^${source}$`;
-}
-/**
-* Read a `[...]` class body starting just past the `[`, or `undefined` when the
-* bracket is never closed — in which case it is an ordinary character.
-*/
-function parseGlobClass(characters, start) {
-	let index = start;
-	const negated = characters[index] === "!" || characters[index] === "^";
-	if (negated) index += 1;
-	const members = /* @__PURE__ */ new Set();
-	const ranges = [];
-	let first = true;
-	while (index < characters.length) {
-		const character = characters[index] ?? "";
-		if (character === "]" && !first) return {
-			step: {
-				kind: "class",
-				negated,
-				members,
-				ranges
-			},
-			next: index + 1
-		};
-		first = false;
-		const high = characters[index + 2];
-		if (characters[index + 1] === "-" && high !== void 0 && high !== "]") {
-			ranges.push([character.codePointAt(0) ?? 0, high.codePointAt(0) ?? 0]);
-			index += 3;
-			continue;
-		}
-		members.add(character);
-		index += 1;
-	}
-}
-/** Split a glob into the steps `matchesGlob` walks. */
-function parseGlob(glob) {
-	const characters = [...glob];
-	const steps = [];
-	let index = 0;
-	let bracketsAreClosed = true;
-	while (index < characters.length) {
-		const character = characters[index] ?? "";
-		index += 1;
-		if (character === "*") {
-			if (steps.at(-1)?.kind !== "star") steps.push({ kind: "star" });
-			continue;
-		}
-		if (character === "?") {
-			steps.push({ kind: "any" });
-			continue;
-		}
-		if (character === "[" && bracketsAreClosed) {
-			const parsed = parseGlobClass(characters, index);
-			if (parsed === void 0) bracketsAreClosed = false;
-			else {
-				steps.push(parsed.step);
-				index = parsed.next;
-				continue;
-			}
-		}
-		steps.push({
-			kind: "literal",
-			character
-		});
-	}
-	return steps;
-}
-function matchesGlobStep(step, character) {
-	if (step.kind === "star") return false;
-	if (step.kind === "any") return true;
-	if (step.kind === "literal") return step.character === character;
-	const code = character.codePointAt(0) ?? 0;
-	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
-	return step.negated ? !admitted : admitted;
-}
-/** Whether two single-character steps can both match one same character. */
-function stepsShareACharacter(left, right) {
-	if (left.kind === "any" || right.kind === "any") return true;
-	if (left.kind === "literal" && right.kind === "literal") return left.character === right.character;
-	if (left.kind === "literal") return matchesGlobStep(right, left.character);
-	if (right.kind === "literal") return matchesGlobStep(left, right.character);
-	return true;
-}
-/** Whether every step from `index` on can match the empty string. */
-function isAllStars(steps, index) {
-	for (let step = index; step < steps.length; step++) if (steps[step]?.kind !== "star") return false;
-	return true;
-}
-/**
-* The most work one intersection walk will do, counted in cells times the cost
-* of one. Past it the two patterns are reported as intersecting without being
-* walked: the product of two lengths grows quadratically, and a pattern long
-* enough to reach this is pathological rather than a command anybody typed.
-* Answering `true` withholds an `allow`, which is the direction that fails
-* closed.
-*/
-const MAX_INTERSECTION_CELLS = 1e6;
-/**
-* The most work a whole run of comparisons will do. A caller holding R
-* restrictions and A allow rules asks R x A times, and a per-pair cap alone
-* bounds none of that: a hundred restrictions against a hundred allow rules,
-* each pattern just under the per-pair cap, is ten thousand affordable walks
-* that together take minutes. The shared budget is spent down across the run
-* and, once it is gone, every remaining pair is reported as intersecting —
-* again the direction that withholds an `allow` rather than writing one.
-*/
-const MAX_TOTAL_INTERSECTION_CELLS = 1e7;
-/**
-* What a pair costs on top of the cells it walks: the call itself, sizing and
-* filling the two rows the table is held in, and collecting the answer.
-* Charging only cells would leave the *number* of pairs unbounded — a pair of
-* one-step patterns walks a single cell, so n short restrictions against n
-* short allow rules is n squared comparisons that never spend the budget down
-* however many of them there are. Charging a floor per pair puts pair count and
-* walk length on the same exhaustible resource.
-*
-* For the short patterns of an ordinary config the floor is the whole charge,
-* which lowers how many pairs a run compares from around a million to about
-* 150,000 — roughly 400 restrictions against 400 allow rules. A config past
-* that line withholds every allow it has not yet compared, the same fail-closed
-* answer exhaustion gives everywhere else.
-*/
-const INTERSECTION_PAIR_COST = 64;
-/**
-* A budget for one caller's run of comparisons. Hand the same one to every
-* `parsedGlobsIntersect` call that belongs together — one adapter reading one
-* config — so the run as a whole stays bounded rather than only each pair in
-* it.
-*/
-function createIntersectionBudget(remaining = MAX_TOTAL_INTERSECTION_CELLS) {
-	return { remaining };
-}
-/**
-* Parse `glob` into the form `parsedGlobsIntersect` walks. A caller comparing
-* the same pattern against a whole list parses it once and reuses the result.
-*/
-function parseGlobPattern(glob) {
-	const steps = parseGlob(glob);
-	return {
-		steps,
-		maxRanges: maxRangeCount(steps)
-	};
-}
-/**
-* What one cell can cost, as a multiplier on the cell count. A literal met by a
-* `[a-z...]` class walks that class's ranges, so a single class carrying
-* thousands of them turns a walk that looks affordable by cell count alone into
-* a quadratic one — which is why the budget is spent on cells times this rather
-* than on cells.
-*/
-function maxRangeCount(steps) {
-	let most = 0;
-	for (const step of steps) if (step.kind === "class" && step.ranges.length > most) most = step.ranges.length;
-	return most;
-}
-/**
-* `globsIntersect` for two globs already parsed, optionally spending a budget
-* shared with the rest of the caller's run — see `createIntersectionBudget`.
-* Once that budget is exhausted every further pair answers `true` without being
-* walked, so a caller reading the answer as a reason to restrict stays on the
-* safe side.
-*/
-function parsedGlobsIntersect(left, right, budget) {
-	const [rows, columns] = left.steps.length >= right.steps.length ? [left.steps, right.steps] : [right.steps, left.steps];
-	const cellCost = 1 + left.maxRanges + right.maxRanges;
-	const cost = rows.length * columns.length * cellCost;
-	if (cost > MAX_INTERSECTION_CELLS) return true;
-	if (budget !== void 0) {
-		const charge = cost + INTERSECTION_PAIR_COST;
-		if (charge > budget.remaining) {
-			budget.remaining = 0;
-			return true;
-		}
-		budget.remaining -= charge;
-	}
-	let next = Array.from({ length: columns.length + 1 }, (_, j) => isAllStars(columns, j));
-	for (let i = rows.length - 1; i >= 0; i--) {
-		const row = Array.from({ length: columns.length + 1 }, () => false);
-		row[columns.length] = isAllStars(rows, i);
-		for (let j = columns.length - 1; j >= 0; j--) {
-			const rowStep = rows[i];
-			const columnStep = columns[j];
-			if (rowStep === void 0 || columnStep === void 0) continue;
-			if (rowStep.kind === "star" || columnStep.kind === "star") {
-				row[j] = (next[j] ?? false) || (row[j + 1] ?? false);
-				continue;
-			}
-			row[j] = stepsShareACharacter(rowStep, columnStep) && (next[j + 1] ?? false);
-		}
-		next = row;
-	}
-	return next[0] ?? false;
-}
-//#endregion
 //#region src/features/permissions/augmentcode-permissions.ts
 const moduleLogger$2 = fallbackLogger;
 z.enum([
@@ -35195,6 +36071,7 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 		const basicExistingEntries = existingEntries.filter((entry) => !isSpecialEntry(entry));
 		const generatedKeys = new Set(generated.map((e) => `${e.toolName}|${e.shellInputRegex ?? ""}|${e.permission.type}`));
 		const preservedBasicEntries = basicExistingEntries.filter((entry) => {
+			if (entry.toolName === "*") return false;
 			if (!MANAGED_AUGMENT_TOOL_NAMES.has(entry.toolName)) return true;
 			if (entry.permission.type === "deny") {
 				const key = `${entry.toolName}|${entry.shellInputRegex ?? ""}|${entry.permission.type}`;
@@ -35272,7 +36149,18 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 };
 function convertRulesyncToAugmentEntries({ config, logger }) {
 	const entries = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	const resolvedBashRules = bashRulesHonoringAllTools(config.permission);
+	const permission = config.permission.bash !== void 0 || Object.keys(resolvedBashRules).length > 0 ? {
+		...config.permission,
+		bash: resolvedBashRules
+	} : config.permission;
+	const allToolsFailClosedType = computeAllToolsFailClosedType(config.permission["*"]);
+	const categoriesWithOwnEntries = /* @__PURE__ */ new Set();
+	for (const [category, rules] of Object.entries(permission)) {
+		if (category === "*") {
+			logger?.warn("AugmentCode permissions: the all-tools '*' category cannot be emitted as a single entry because AugmentCode has no wildcard toolName. Deny/ask rules are folded into 'launch-process' and, for any other managed tool that has no explicit rules of its own, applied as a blanket deny/ask; all-tools allow rules and tools that already define their own rules are left untouched.");
+			continue;
+		}
 		const augmentToolName = toAugmentToolName(category);
 		if (!MANAGED_AUGMENT_TOOL_NAMES.has(augmentToolName) && augmentToolName === category) logger?.warn(`AugmentCode permissions: passing through unknown tool category '${category}' as toolName.`);
 		if (augmentToolName === "launch-process") {
@@ -35297,19 +36185,50 @@ function convertRulesyncToAugmentEntries({ config, logger }) {
 				toolName: augmentToolName,
 				permission: { type: "deny" }
 			});
+			categoriesWithOwnEntries.add(category);
 			continue;
 		}
 		const droppedPatterns = [];
-		for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") entries.push({
-			toolName: augmentToolName,
-			permission: { type: actionToAugmentType(action) }
-		});
-		else droppedPatterns.push(pattern);
+		for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") {
+			entries.push({
+				toolName: augmentToolName,
+				permission: { type: actionToAugmentType(action) }
+			});
+			categoriesWithOwnEntries.add(category);
+		} else droppedPatterns.push(pattern);
 		if (droppedPatterns.length > 0) logger?.warn(`AugmentCode permissions: dropping non-wildcard patterns for category '${category}' (${droppedPatterns.join(", ")}); AugmentCode does not document a per-input matcher for this tool. Use a 'deny' rule with pattern '*' if you need to block this tool entirely.`);
 	}
+	entries.push(...synthesizeManagedToolFallbackEntries(categoriesWithOwnEntries, allToolsFailClosedType));
 	return entries;
 }
 /**
+* The strictest action the all-tools `*` category imposes, for tools with no per-input matcher to
+* narrow it onto (see {@link synthesizeManagedToolFallbackEntries}). `deny` wins over `ask`,
+* and an all-tools `allow` never forces an entry — there is nothing to fail closed on.
+*/
+function computeAllToolsFailClosedType(allToolsRules) {
+	if (!allToolsRules) return void 0;
+	const actions = Object.values(allToolsRules);
+	if (actions.some((action) => action === "deny")) return "deny";
+	if (actions.some((action) => action === "ask")) return "ask-user";
+}
+/**
+* Extend the same fail-closed treatment `bash` gets (via {@link bashRulesHonoringAllTools}) to the
+* other managed tools: one that produced no entries of its own above must not fall back to
+* AugmentCode's own default just because it has no per-input matcher to narrow the all-tools
+* restriction onto. A category can be stated yet still emit nothing (e.g. only non-`*` allow/ask
+* patterns, dropped with a warning), so this checks emitted entries rather than whether the
+* category was merely present in the source config. A tool whose own rules did emit entries is
+* left untouched here.
+*/
+function synthesizeManagedToolFallbackEntries(categoriesWithOwnEntries, allToolsFailClosedType) {
+	if (allToolsFailClosedType === void 0) return [];
+	return Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).filter(([canonicalName]) => canonicalName !== "bash" && !categoriesWithOwnEntries.has(canonicalName)).map(([, augmentToolName]) => ({
+		toolName: augmentToolName,
+		permission: { type: allToolsFailClosedType }
+	}));
+}
+/**
 * Sort AugmentCode tool-permission entries to make the `first-match-wins` semantics safe and predictable.
 *
 * Augment evaluates `toolPermissions` top-to-bottom and stops at the first match. To prevent a
@@ -35404,216 +36323,6 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	}
 	return { permission };
 }
-/**
-* Collect the canonical rules that govern shell commands, for the adapters
-* whose tool models commands and nothing else.
-*
-* The `bash` category contributes every rule. The all-tools `*` category
-* contributes its **restricting** rules — `deny` and `ask` — because a rule
-* written there covers shell commands too, and dropping it inverts the
-* author's intent: with `{"*": {"rm *": "deny"}, "bash": {"rm *": "allow"}}`,
-* an adapter that reads only `bash` auto-approves the very command the file
-* denies.
-*
-* Its `allow` rules are deliberately **not** contributed. A pattern under `*`
-* need not be a command at all — `secrets/**` under `*` denies a path — and
-* carrying it in the restricting direction only over-restricts, while carrying
-* it in the permissive direction would grant something the author never said
-* about commands. Both directions therefore fail closed.
-*/
-function collectShellCommandRules(permission) {
-	const rules = [];
-	const foreignRestrictingCategories = [];
-	const ignoredAllToolsAllowPatterns = [];
-	for (const [category, categoryRules] of Object.entries(permission)) {
-		if (category === "bash") {
-			for (const [pattern, action] of Object.entries(categoryRules)) rules.push({
-				pattern,
-				action,
-				fromAllToolsCategory: false
-			});
-			continue;
-		}
-		if (category === "*") {
-			for (const [pattern, action] of Object.entries(categoryRules)) {
-				if (action === "allow") {
-					ignoredAllToolsAllowPatterns.push(pattern);
-					continue;
-				}
-				rules.push({
-					pattern,
-					action,
-					fromAllToolsCategory: true
-				});
-			}
-			continue;
-		}
-		if (Object.values(categoryRules).some((action) => action === "deny" || action === "ask")) foreignRestrictingCategories.push(category);
-	}
-	return {
-		rules,
-		foreignRestrictingCategories,
-		ignoredAllToolsAllowPatterns
-	};
-}
-/**
-* Build the test an adapter applies to an `allow` pattern before writing it:
-* which restrictions it cannot write name some of the same commands? The
-* answer is the list of those restrictions — empty when the `allow` may be
-* written — so a caller can report both the allow rules it withheld and the
-* restrictions that withheld nothing.
-*
-* Canonically the stricter rule wins **whatever its width** — rulesync collapses
-* colliding rules as `deny > ask > allow` — so the two patterns are compared by
-* asking whether any one command matches both. Width does not enter into it: an
-* `ask` on `*` overlaps an allowed `git *`, an `ask` on `npm publish` overlaps
-* an allowed `npm *`, and an `ask` on `* --force` overlaps an allowed `git *`
-* on every `git ... --force` command even though neither pattern covers the
-* other's spelling. Comparing only identical spellings would let the most
-* ordinary catch-all (`{"*": {"*": "ask"}}`) disappear without a word.
-*
-* Identical spellings are still compared as strings first, as a shortcut past
-* the walk for the commonest case.
-*
-* `normalizePattern` rewrites a pattern written in the tool's own language into
-* the widest glob it could stand for, for a tool whose patterns are not globs.
-* It reaches the `bash` rules and the `allow` rules, which is where such a
-* pattern is written; an all-tools `*` pattern is canonical — it is read by
-* every tool, so it is a glob already — and is compared as it stands. The
-* rewrite must only ever widen what a pattern covers, so an inexact reading
-* withholds an allow rather than writing one the config restricts — see
-* `warpCommandPatternToGlob`.
-*/
-function createShadowingRestrictionsTest(restrictions, { normalizePattern = (pattern) => pattern, budget = createIntersectionBudget() } = {}) {
-	const normalized = restrictions.map(({ pattern, fromAllToolsCategory }) => ({
-		pattern,
-		glob: parseGlobPattern(fromAllToolsCategory ? pattern : normalizePattern(pattern))
-	}));
-	return (allowPattern) => {
-		if (budget.remaining === 0) return normalized.map(({ pattern }) => pattern);
-		const allowGlob = parseGlobPattern(normalizePattern(allowPattern));
-		return normalized.filter(({ pattern, glob }) => pattern === allowPattern || parsedGlobsIntersect(glob, allowGlob, budget)).map(({ pattern }) => pattern);
-	};
-}
-/**
-* Which of the given all-tools `*` restrictions look like they may not name a
-* command at all — the question a `deny` and an `ask` written there both raise.
-*
-* "Withheld no allow rule" alone does not answer it: a config with no `allow`
-* rules has nothing to withhold, and a pattern the author also wrote under
-* `bash` is a command on their own word. Both are excluded, so what remains is
-* a `*` pattern that had allow rules to overlap, overlapped none of them, and
-* is claimed as a command nowhere else — the shape `secrets/**` has.
-*
-* A `bash` restriction never belongs here: it names a command by construction,
-* so overlapping no allow rule says nothing is wrong with it.
-*/
-function collectUnenforcedAllToolsPatterns({ rules, allToolsPatterns, withholdingPatterns }) {
-	if (!rules.some(({ action }) => action === "allow")) return [];
-	const shellPatterns = new Set(rules.filter(({ fromAllToolsCategory }) => !fromAllToolsCategory).map(({ pattern }) => pattern));
-	return uniq(allToolsPatterns).filter((pattern) => !withholdingPatterns.has(pattern) && !shellPatterns.has(pattern));
-}
-/**
-* Split shell-command rules into the allow and deny lists of a tool that models
-* commands with those two tiers and nothing else.
-*
-* `ask` has no list of its own — such a tool already prompts for whatever it
-* does not auto-approve, so an `ask` rule is satisfied by writing nothing. It
-* still has to *withhold* the `allow` rules it covers, though: the canonical
-* order is `deny > ask > allow`, so auto-approving a command the file also asks
-* about would answer the prompt the author wanted.
-*
-* `writesAllToolsDeny` says whether the tool's denylist can carry a pattern
-* from the all-tools `*` category. Warp's cannot: it matches commands with
-* regular expressions rather than globs, and writing any denylist **replaces**
-* Warp's built-in default one, so an inert `secrets/**` entry there would trade
-* the tool's own protection for a rule that matches no command. Where the deny
-* cannot be written it withholds the allow rules it covers instead, which
-* restricts in the same direction without touching the denylist.
-*
-* A `bash` deny withholds nothing: it names a command by construction, so the
-* denylist entry enforces it wherever the tool's deny-beats-allow order applies,
-* and a narrow deny keeps carving an exception out of a wider allow (`git *`
-* allowed, `git push *` denied). An all-tools `*` deny withholds all the same,
-* even where it is written: a pattern under `*` need not name a command —
-* `secrets/**` there denies a path — so as a denylist entry it may match nothing
-* at all, and leaving an overlapping allow beside it would auto-approve the very
-* commands the author meant to stop. Over-restricting a `*` deny that *was* a
-* command pattern is reported; failing open would not be.
-*
-* `normalizePattern` is handed to `createShadowingRestrictionsTest` for a tool whose
-* patterns are not globs.
-*/
-function partitionCommandRules({ rules, writesAllToolsDeny, normalizePattern }) {
-	const deny = [];
-	const unwrittenDenyPatterns = [];
-	const restrictions = [];
-	const writtenAllToolsDenyPatterns = [];
-	const allToolsAskPatterns = [];
-	for (const rule of rules) {
-		const { pattern, action, fromAllToolsCategory } = rule;
-		if (action === "allow") continue;
-		if (action !== "deny") {
-			restrictions.push(rule);
-			if (fromAllToolsCategory) allToolsAskPatterns.push(pattern);
-			continue;
-		}
-		if (writesAllToolsDeny || !fromAllToolsCategory) {
-			deny.push(pattern);
-			if (fromAllToolsCategory) writtenAllToolsDenyPatterns.push(pattern);
-		} else unwrittenDenyPatterns.push(pattern);
-		if (fromAllToolsCategory) restrictions.push(rule);
-	}
-	const budget = createIntersectionBudget();
-	const shadowingRestrictions = createShadowingRestrictionsTest(restrictions, {
-		normalizePattern,
-		budget
-	});
-	const allow = [];
-	const shadowedAllowPatterns = [];
-	const withholdingPatterns = /* @__PURE__ */ new Set();
-	for (const { pattern, action } of rules) {
-		if (action !== "allow") continue;
-		const shadowing = shadowingRestrictions(pattern);
-		if (shadowing.length > 0) {
-			shadowedAllowPatterns.push(pattern);
-			for (const restriction of shadowing) withholdingPatterns.add(restriction);
-			continue;
-		}
-		allow.push(pattern);
-	}
-	return {
-		allow,
-		deny,
-		shadowedAllowPatterns,
-		unwrittenDenyPatterns,
-		unenforcedAllToolsDenyPatterns: collectUnenforcedAllToolsPatterns({
-			rules,
-			allToolsPatterns: writtenAllToolsDenyPatterns,
-			withholdingPatterns
-		}),
-		unenforcedAllToolsAskPatterns: collectUnenforcedAllToolsPatterns({
-			rules,
-			allToolsPatterns: allToolsAskPatterns,
-			withholdingPatterns
-		}),
-		intersectionBudgetExhausted: budget.remaining === 0
-	};
-}
-/**
-* Report, for one command-only tool, every canonical rule its two lists could
-* not carry. Every command-only adapter shares this reporting, so a rule
-* dropped in one is worded the same way in all.
-*/
-function warnAboutUnwrittenCommandRules({ toolLabel, surfaceLabel, foreignRestrictingCategories, shadowedAllowPatterns, unwrittenDenyPatterns = [], unwrittenDenyReason, unenforcedAllToolsDenyPatterns = [], unenforcedAllToolsAskPatterns = [], ignoredAllToolsAllowPatterns = [], intersectionBudgetExhausted = false, logger }) {
-	if (intersectionBudgetExhausted) warnWithFallback(logger, `${toolLabel} reached the limit on how much work one generation may spend comparing .rulesync/permissions.jsonc's allow rules against its deny and ask rules, so the allow rules left over were withheld rather than compared — the safe answer, but a wider one than the file asks for. Write fewer or shorter command patterns to have them all compared.`);
-	for (const category of foreignRestrictingCategories) warnWithFallback(logger, `${toolLabel} only models shell-command permissions (${surfaceLabel}); '${category}' deny and ask rules cannot be represented and were skipped.`);
-	if (unwrittenDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} did not write the all-tools '*' deny rule(s) for ${unwrittenDenyPatterns.join(", ")} into its denylist.${unwrittenDenyReason === void 0 ? "" : ` ${unwrittenDenyReason}`} They restrict only by withholding the allow rules they cover; write them under 'bash' to have them enforced as commands.`);
-	if (unenforcedAllToolsDenyPatterns.length > 0) warnWithFallback(logger, `${toolLabel} wrote the all-tools '*' deny rule(s) for ${unenforcedAllToolsDenyPatterns.join(", ")} into its denylist as they stand, but they withheld none of the allow rules beside them. A pattern written under '*' need not name a command — 'secrets/**' there denies a path — and a denylist entry that names none blocks nothing; write it under 'bash' too if it is a command pattern.`);
-	if (unenforcedAllToolsAskPatterns.length > 0) warnWithFallback(logger, `${toolLabel} has no ask tier (${surfaceLabel}), so the all-tools '*' ask rule(s) for ${unenforcedAllToolsAskPatterns.join(", ")} restrict only by withholding the allow rules they cover — and they covered none. A pattern written under '*' need not name a command, so nothing observed says these ones do; write them under 'bash' if they are command patterns.`);
-	if (ignoredAllToolsAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} reads the all-tools '*' category for its deny and ask rules only, so the allow rule(s) for ${ignoredAllToolsAllowPatterns.join(", ")} were skipped — a pattern written under '*' need not be a command. Write them under 'bash' to auto-approve them as commands.`);
-	if (shadowedAllowPatterns.length > 0) warnWithFallback(logger, `${toolLabel} was not given the allow rule(s) for ${shadowedAllowPatterns.join(", ")} because .rulesync/permissions.jsonc restricts the same commands elsewhere, and the stricter rule wins whatever its width.`);
-}
 //#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
@@ -37375,7 +38084,7 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 	return merged;
 }
 function buildCodexBashRulesContent(config) {
-	const bashRules = config.permission.bash ?? {};
+	const bashRules = bashRulesHonoringAllTools(config.permission);
 	const entries = Object.entries(bashRules);
 	const header = ["# Generated by Rulesync from .rulesync/permissions.jsonc (permission.bash)", "# https://developers.openai.com/codex/rules"];
 	if (entries.length === 0) return [...header, "# No bash permission rules were configured."].join("\n");
@@ -38066,7 +38775,7 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 function convertRulesyncToCursorPermissions(config, logger) {
 	const allow = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const cursorType = toCursorType(category);
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildCursorPermissionEntry(cursorType, toCursorPattern(category, pattern));
@@ -38885,7 +39594,7 @@ function convertRulesyncToDevinPermissions(config) {
 	const allow = [];
 	const ask = [];
 	const deny = [];
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const scope = toDevinScope(category);
 		for (const [pattern, action] of Object.entries(rules)) {
 			const entry = buildDevinPermissionEntry(scope, pattern);
@@ -39173,6 +39882,19 @@ var GoosePermissions = class GoosePermissions extends ToolPermissions {
 	isDeletable() {
 		return false;
 	}
+	/**
+	* `permission.yaml` is Goose's file, not one rulesync owns: rulesync merges
+	* into it when it exists but has no business bringing it into existence to
+	* hold nothing. When no rule maps, the `user` block holds three empty lists,
+	* which would otherwise be written as a fresh permission.yaml that says
+	* nothing — an absent file and empty lists both mean "no user override, so
+	* Goose decides on its own". An existing file is still rewritten as before,
+	* so user content is never dropped — the skip only applies when there is no
+	* file yet.
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
 	static getSettablePaths(_options) {
 		return {
 			relativeDirPath: GOOSE_GLOBAL_DIR,
@@ -39257,7 +39979,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 		never_allow: []
 	};
 	const assigned = /* @__PURE__ */ new Map();
-	const orderedEntries = Object.entries(config.permission).toSorted(([a], [b]) => (a === "edit" ? 1 : 0) - (b === "edit" ? 1 : 0));
+	const orderedEntries = Object.entries(honorAllToolsOnBash(config.permission)).toSorted(([a], [b]) => (a === "edit" ? 1 : 0) - (b === "edit" ? 1 : 0));
 	for (const [category, rules] of orderedEntries) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -39589,7 +40311,7 @@ function unmanagedEntries(existingPermission, key) {
 */
 function buildGrokPermissionArrays(config, existingPermission, logger) {
 	const ranked = /* @__PURE__ */ new Map();
-	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) for (const [pattern, action] of Object.entries(rules)) {
 		const entry = buildGrokEntry(category, pattern);
 		if (entry === null) {
 			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
@@ -39678,6 +40400,8 @@ function deriveGrokPermissionMode(config) {
 function patternsByAction(category, action) {
 	return Object.entries(category ?? {}).filter(([, value]) => value === action).map(([pattern]) => pattern);
 }
+/** The canonical category whose `deny` rules feed `security.website_blocklist`. */
+const WEBFETCH_PERMISSION_CATEGORY = "webfetch";
 function clonePermissionBlock(permission) {
 	return Object.fromEntries(Object.entries(permission).map(([category, rules]) => [category, { ...rules }]));
 }
@@ -39690,18 +40414,39 @@ function ensureCategory(permission, category) {
 function removeEmptyCategories(permission) {
 	for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
 }
+/**
+* Make the native `command_allowlist` authoritative for the `bash` allow rules
+* it can speak for, and for those only. The allowlist is a list of shell-command
+* patterns, so it is generated from `bash` alone (see `fromRulesyncPermissions`);
+* an allow in any other category names something Hermes's allowlist cannot
+* carry, so its absence from the list says nothing about it and it is kept as
+* provenance wrote it. The same holds for a `bash` allow the generator withheld
+* because a stricter `*` or `bash` rule covers it: the allowlist never carried
+* it, so its absence is not a retraction and the rule is kept too.
+*/
 function reconcileCommandAllowlist({ permission, commandAllowlist }) {
-	const nativeAllows = new Set(commandAllowlist);
-	const existingAllowCategories = /* @__PURE__ */ new Map();
-	for (const [category, rules] of Object.entries(permission)) for (const [pattern, action] of Object.entries(rules)) {
-		if (action !== "allow") continue;
-		existingAllowCategories.set(pattern, category);
-		if (!nativeAllows.has(pattern)) delete rules[pattern];
-	}
-	for (const pattern of nativeAllows) {
-		const existingCategory = existingAllowCategories.get(pattern);
-		if (existingCategory) ensureCategory(permission, existingCategory)[pattern] = "allow";
-		else ensureCategory(permission, "bash")[pattern] = "allow";
+	const { rules: commandRules } = collectShellCommandRules(permission);
+	const { shadowedAllowPatterns } = partitionCommandRules({
+		rules: commandRules,
+		writesAllToolsDeny: false
+	});
+	const withheld = new Set(shadowedAllowPatterns);
+	const rules = ensureCategory(permission, SHELL_PERMISSION_CATEGORY);
+	for (const [pattern, action] of Object.entries(rules)) if (action === "allow" && !withheld.has(pattern)) delete rules[pattern];
+	for (const pattern of commandAllowlist) rules[pattern] = "allow";
+}
+/**
+* Report the restricting rules Hermes has no per-pattern primitive for: a
+* `deny` or `ask` in any category other than `bash`, `*`, and `webfetch`, and
+* an `ask` under `webfetch` — the blocklist carries a `webfetch` deny but has
+* no ask tier. (`bash` and `*` are reported by `warnAboutUnwrittenCommandRules`.)
+* Such rules survive only in the round-trip blob.
+*/
+function warnAboutUnexpressedHermesRestrictions({ permissionBlock, foreignRestrictingCategories, logger }) {
+	for (const category of foreignRestrictingCategories) {
+		const isWebfetch = category === WEBFETCH_PERMISSION_CATEGORY;
+		if (isWebfetch && patternsByAction(permissionBlock[category], "ask").length === 0) continue;
+		warnWithFallback(logger, isWebfetch ? "Hermes Agent's security.website_blocklist has no ask tier, so the 'webfetch' ask rule(s) cannot be represented and were skipped; they survive only in the permissions.rulesync round-trip block." : `Hermes Agent has no per-pattern primitive for '${category}' deny and ask rules (it enforces command_allowlist, approvals.deny, and security.website_blocklist), so they were skipped; they survive only in the permissions.rulesync round-trip block.`);
 	}
 }
 function reconcileNativeDenies({ permission, category, patterns }) {
@@ -39813,14 +40558,14 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
-			category: "bash",
+			category: SHELL_PERMISSION_CATEGORY,
 			patterns: isStringArray$2(approvals.deny) ? approvals.deny : []
 		});
 		const security = isRecord$1(config.security) ? config.security : {};
 		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
-			category: "webfetch",
+			category: WEBFETCH_PERMISSION_CATEGORY,
 			patterns: websiteBlocklist.enabled === true && isStringArray$2(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
@@ -39840,12 +40585,32 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			fileContent: JSON.stringify(imported, null, 2)
 		});
 	}
-	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, global = false }) {
+	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, global = false, logger }) {
 		const permissions = rulesyncPermissions.getJson();
 		const permissionBlock = permissions.permission ?? {};
-		const commandAllowlist = Object.entries(permissionBlock).flatMap(([, patterns]) => patternsByAction(patterns, "allow"));
-		const bashDeny = patternsByAction(permissionBlock.bash, "deny");
-		const webfetchDeny = patternsByAction(permissionBlock.webfetch, "deny");
+		const { rules, foreignRestrictingCategories, ignoredAllToolsAllowPatterns } = collectShellCommandRules(permissionBlock);
+		const { allow: commandAllowlist, deny: bashDeny, shadowedAllowPatterns, unwrittenDenyPatterns, unenforcedAllToolsAskPatterns, intersectionBudgetExhausted } = partitionCommandRules({
+			rules,
+			writesAllToolsDeny: false
+		});
+		warnAboutUnexpressedHermesRestrictions({
+			permissionBlock,
+			foreignRestrictingCategories,
+			logger
+		});
+		warnAboutUnwrittenCommandRules({
+			toolLabel: "Hermes Agent",
+			surfaceLabel: "command_allowlist/approvals.deny",
+			foreignRestrictingCategories: [],
+			shadowedAllowPatterns,
+			unwrittenDenyPatterns,
+			unwrittenDenyReason: "approvals.deny is a hard denylist of shell commands, and a pattern written under '*' need not be a command at all.",
+			unenforcedAllToolsAskPatterns,
+			ignoredAllToolsAllowPatterns,
+			intersectionBudgetExhausted,
+			logger
+		});
+		const webfetchDeny = patternsByAction(permissionBlock[WEBFETCH_PERMISSION_CATEGORY], "deny");
 		let config = {};
 		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
 		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
@@ -40112,7 +40877,7 @@ var JuniePermissions = class JuniePermissions extends ToolPermissions {
 */
 function convertRulesyncToJunieRules({ config, logger, existingRules, overrideSecretFile, overrideRuleDefaults }) {
 	const ruleLists = {};
-	for (const [category, patterns] of Object.entries(config.permission)) {
+	for (const [category, patterns] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const group = CANONICAL_TO_JUNIE_GROUP[category];
 		if (!group) {
 			if (Object.keys(patterns).length > 0) logger?.warn(`Junie allowlist only models executables/fileEditing/mcpTools/readOutsideProject (canonical bash/edit/write/read/mcp); '${category}' rules cannot be represented and were skipped.`);
@@ -40362,7 +41127,7 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const kiloOverride = rulesyncJson.kilo;
 		const incomingPermission = {
-			...rulesyncJson.permission,
+			...honorAllToolsOnBash(rulesyncJson.permission),
 			...kiloOverride?.permission
 		};
 		const droppedDenyByKey = {};
@@ -40881,7 +41646,7 @@ function buildKiroPermissionsFromRulesync({ config, logger, existing }) {
 		allowedCommands: [],
 		deniedCommands: []
 	};
-	for (const [category, rules] of Object.entries(config.permission)) for (const [pattern, action] of Object.entries(rules)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) for (const [pattern, action] of Object.entries(rules)) {
 		if (action === "ask") {
 			logger?.warn(`Kiro permissions do not support "ask". Skipping ${category}:${pattern}`);
 			continue;
@@ -41165,7 +41930,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const overridePermission = rulesyncJson.opencode?.permission ?? {};
 		const sharedPermission = {};
-		for (const [category, value] of Object.entries(rulesyncJson.permission ?? {})) sharedPermission[toOpencodePermissionKey(category)] = value;
+		for (const [category, value] of Object.entries(honorAllToolsOnBash(rulesyncJson.permission ?? {}))) sharedPermission[toOpencodePermissionKey(category)] = value;
 		const permission = {};
 		for (const [category, value] of Object.entries({
 			...sharedPermission,
@@ -42294,11 +43059,19 @@ var RooPermissions = class extends ToolPermissions {
 		const paths = this.getSettablePaths();
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const rules = rulesyncPermissions.getJson().permission[COMMAND_CATEGORY];
+		const permission = rulesyncPermissions.getJson().permission;
+		const bashStated = permission[COMMAND_CATEGORY] !== void 0;
 		const patch = {};
-		if (rules !== void 0) {
+		if (bashStated) {
+			const { bash } = resolveShellCommandLists({
+				permission,
+				writesAllToolsDeny: true,
+				toolLabel: this.getToolLabel(),
+				surfaceLabel: `${this.getAllowedCommandsKey()}/${this.getDeniedCommandsKey()}`,
+				logger
+			});
 			const { allowed, denied } = buildVscodeCommandLists({
-				rules,
+				rules: bash,
 				toolLabel: this.getToolLabel(),
 				logger
 			});
@@ -42309,7 +43082,7 @@ var RooPermissions = class extends ToolPermissions {
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			ownsCommandKeys: rules !== void 0,
+			ownsCommandKeys: bashStated,
 			fileContent: applySharedConfigPatch({
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
@@ -42689,7 +43462,7 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 		config,
 		logger
 	});
-	for (const [category, rules] of Object.entries(config.permission)) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		if (category === CATCH_ALL_PATTERN$1) {
 			const toolWideDefault = convertAllToolsRules({
 				rules,
@@ -43699,7 +44472,7 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const config = parseVibeConfig(existingContent);
-		const permission = rulesyncPermissions.getJson().permission;
+		const permission = honorAllToolsOnBash(rulesyncPermissions.getJson().permission);
 		const vibeOverride = rulesyncPermissions.getJson().vibe;
 		const tools = toVibeToolsRecord(config.tools);
 		const diskShellPatterns = new Map([VIBE_SHELL_CATEGORY, ...VIBE_SHELL_ALIAS_TOOL_NAMES].map((vibeToolName) => [vibeToolName, toStringArray(readVibeToolConfig({
@@ -45040,6 +45813,19 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 	isDeletable() {
 		return false;
 	}
+	/**
+	* `settings.toml` is Warp's file, not one rulesync owns: rulesync merges into
+	* it when it exists but has no business bringing it into existence to hold
+	* nothing. When no rule maps, both command lists are dropped and the payload
+	* is a bare `[agents.profiles]` table, which would otherwise be written as a
+	* fresh settings file that says nothing — an absent file and an empty table
+	* both mean "Warp's own defaults". An existing file is still rewritten as
+	* before, so user content is never dropped — the skip only applies when
+	* there is no file yet.
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
 	static getSettablePaths(_options) {
 		return {
 			relativeDirPath: warpSettingsDir(),
@@ -45651,6 +46437,7 @@ function buildZedToolPermissions({ permission, logger }) {
 	for (const [category, rules] of Object.entries(permission)) {
 		if (category === "*") {
 			for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") managedDefault = CANONICAL_TO_ZED_ACTION[action];
+			else if (permission.bash?.[pattern] === "deny" || permission.bash?.[pattern] === "ask") continue;
 			else logger?.warn(`Zed permissions: dropping the "*" category rule for pattern "${pattern}" — Zed's global tool-permission default takes no patterns; scope the rule to a tool category instead.`);
 			continue;
 		}
@@ -45805,7 +46592,7 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		const toolPermissions = asRecord(agent.tool_permissions);
 		const existingTools = asRecord(toolPermissions.tools);
 		const { managedDefault, managedTools, excludedCategories, inertMcpCategories } = buildZedToolPermissions({
-			permission: config.permission,
+			permission: honorAllToolsOnBash(config.permission),
 			logger
 		});
 		if (excludedCategories.length > 0) logger?.warn(`Zed permissions: dropping the ${excludedCategories.map((category) => `"${category}"`).join(", ")} ${excludedCategories.length === 1 ? "category" : "categories"} — Zed does not gate its read-only tools, so the entries would never be consulted. Zed's read-denial surface is \`private_files\`, which the ignore feature writes from \`.rulesync/.aiignore\`.`);
@@ -46314,6 +47101,24 @@ var PermissionsProcessor = class extends FeatureProcessor {
 	}
 };
 //#endregion
+//#region src/constants/codebuddy-paths.ts
+/**
+* CodeBuddy Code configuration-layout conventions.
+*
+* CodeBuddy Code (`@tencent-ai/codebuddy-code`) is Tencent Cloud's terminal
+* coding agent. Its configuration surface mirrors Claude Code closely: a
+* root memory file plus a `.codebuddy/` tree.
+*
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @see https://www.codebuddy.ai/docs/cli/codebuddy-dir
+*/
+/** Root directory for CodeBuddy Code configuration, relative to the scope root. */
+const CODEBUDDY_DIR = ".codebuddy";
+const CODEBUDDY_RULE_FILE_NAME = "CODEBUDDY.md";
+const CODEBUDDY_LOCAL_RULE_FILE_NAME = "CODEBUDDY.local.md";
+/** Modular rules directory name under `.codebuddy/`. */
+const CODEBUDDY_RULES_DIR_NAME = "rules";
+//#endregion
 //#region src/features/skills/simulated-skill.ts
 const SimulatedSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -46852,7 +47657,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 	* This only deletes directories that are no longer in the rulesync source, not directories that will be overwritten.
 	*/
 	async removeOrphanAiDirs(existingDirs, generatedDirs) {
-		const generatedPaths = new Set(generatedDirs.map((d) => d.getDirPath()));
+		const generatedPaths = new Set(generatedDirs.map((d) => caseFoldIdentity(d.getDirPath())));
 		const orphanPaths = /* @__PURE__ */ new Set();
 		const quotedOutputRoot = quoteForLog(this.outputRoot);
 		for (const aiDir of existingDirs) {
@@ -46877,7 +47682,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				this.logger.warn(verdict === "equal" ? `Refusing to delete ${quotedDirPath}: it is the root it was found in, not a directory inside that root` : `Refusing to delete ${quotedDirPath}: it is not inside ${quotedRoot}, the root it was found in`);
 				continue;
 			}
-			if (!generatedPaths.has(dirPath)) orphanPaths.add(dirPath);
+			if (!generatedPaths.has(caseFoldIdentity(dirPath))) orphanPaths.add(dirPath);
 		}
 		return await this.deleteOrphanPaths({
 			paths: orphanPaths,
@@ -46976,7 +47781,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 			const mainFile = aiDir.getMainFile();
 			if (mainFile) generatedNames.add(toPosixPath(mainFile.name));
 			for (const file of aiDir.getOtherFiles()) generatedNames.add(toPosixPath(file.relativeFilePathToDirPath));
-			const generatedNamesFolded = new Set([...generatedNames].map((name) => name.toLowerCase()));
+			const generatedNamesFolded = new Set([...generatedNames].map((name) => caseFoldIdentity(name)));
 			let existingNames;
 			try {
 				existingNames = await listFilePathsRecursively(dirPath, {
@@ -46991,7 +47796,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				const posixName = toPosixPath(existingName);
 				if (generatedNames.has(posixName)) continue;
 				const filePath = join(dirPath, existingName);
-				if (generatedNamesFolded.has(posixName.toLowerCase())) {
+				if (generatedNamesFolded.has(caseFoldIdentity(posixName))) {
 					this.logger.warn(`Refusing to delete ${quoteForLog(filePath)}: this run wrote a file whose path differs from it only in case, which on a case-insensitive filesystem is the very file it wrote`);
 					continue;
 				}
@@ -47047,7 +47852,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 			generatedPaths.add(flatFilePath);
 			for (const file of generatedDir.getOtherFiles()) generatedPaths.add(join(generatedDirPath, file.relativeFilePathToDirPath));
 		}
-		const generatedPathsFolded = new Set([...generatedPaths].map((generatedPath) => generatedPath.toLowerCase()));
+		const generatedPathsFolded = new Set([...generatedPaths].map((generatedPath) => caseFoldIdentity(generatedPath)));
 		const orphanPaths = /* @__PURE__ */ new Set();
 		const quotedOutputRoot = quoteForLog(this.outputRoot);
 		for (const aiDir of existingFlatFiles) {
@@ -47077,7 +47882,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				continue;
 			}
 			if (generatedPaths.has(filePath)) continue;
-			if (generatedPathsFolded.has(filePath.toLowerCase())) {
+			if (generatedPathsFolded.has(caseFoldIdentity(filePath))) {
 				this.logger.warn(`Refusing to delete ${quotedFilePath}: this run wrote a file whose path differs from it only in case, which on a case-insensitive filesystem is the very file it wrote`);
 				continue;
 			}
@@ -48909,6 +49714,191 @@ var CopilotcliSkill = class CopilotcliSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/crush-skill.ts
+const CrushSkillFrontmatterSchema = z.looseObject({
+	name: z.string(),
+	description: z.string(),
+	"user-invocable": z.optional(z.boolean()),
+	"disable-model-invocation": z.optional(z.boolean()),
+	license: z.optional(z.string()),
+	compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
+	metadata: z.optional(z.looseObject({}))
+});
+/**
+* Represents a Crush Agent Skill directory.
+*
+* Crush auto-discovers Agent Skills (`SKILL.md` per directory) from
+* `.crush/skills/` at project scope and `~/.config/crush/skills/` (or
+* `$CRUSH_SKILLS_DIR`) at global scope. Unless `$CRUSH_SKILLS_DIR` is set,
+* Crush also scans several shared directories it does not own (globally
+* `~/.config/agents/skills/`, `~/.agents/skills/`, `~/.claude/skills/`;
+* per-project `.agents/skills/`, `.claude/skills/`, `.cursor/skills/`, also
+* checked at a git worktree's common root); this class writes only to the
+* Crush-specific path above, leaving those shared roots to their own targets.
+*
+* Crush's `UserInvocable` field is a non-pointer Go `bool`, so an omitted
+* `user-invocable` (at both the root and the `crush:` section) resolves to
+* `false`: the skill stays reachable by the model but is hidden from Crush's
+* command palette. See `FromSkillCatalog` in `internal/commands/commands.go`.
+* @see https://github.com/charmbracelet/crush/blob/main/internal/config/load.go
+*/
+var CrushSkill = class CrushSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = CRUSH_SKILLS_PROJECT_DIR, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? CRUSH_SKILLS_GLOBAL_DIR : CRUSH_SKILLS_PROJECT_DIR };
+	}
+	getFrontmatter() {
+		return CrushSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = CrushSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const crushSection = {
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.license !== void 0 && { license: frontmatter.license },
+			...frontmatter.compatibility !== void 0 && { compatibility: frontmatter.compatibility },
+			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
+		};
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"],
+			...Object.keys(crushSection).length > 0 && { crush: crushSection }
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+		const settablePaths = CrushSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const crushSection = rulesyncFrontmatter.crush;
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const license = resolveLicense({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const compatibility = resolveCompatibility({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const metadata = resolveMetadata({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: crushSection
+		});
+		const compatibilityString = compatibility === void 0 ? void 0 : toCompatibilityString(compatibility);
+		const crushFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...license !== void 0 && { license },
+			...compatibilityString !== void 0 && compatibilityString.length > 0 && { compatibility: compatibilityString },
+			...metadata !== void 0 && { metadata: toStringMetadata(metadata) }
+		};
+		return new CrushSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName: rulesyncSkill.getDirName(),
+			frontmatter: crushFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("crush");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: CrushSkill.getSettablePaths
+		});
+		const result = CrushSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = join(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${join(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new CrushSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		const settablePaths = CrushSkill.getSettablePaths({ global });
+		return new CrushSkill({
+			outputRoot,
+			relativeDirPath: relativeDirPath ?? settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/cursor-skill.ts
 const CursorSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -49073,9 +50063,9 @@ const DeepagentsSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
-	license: z.optional(z.string()),
-	compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
-	metadata: z.optional(z.looseObject({}))
+	license: z.optional(z.unknown()),
+	compatibility: z.optional(z.unknown()),
+	metadata: z.optional(z.unknown())
 });
 var DeepagentsSkill = class DeepagentsSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = DEEPAGENTS_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -50133,9 +51123,9 @@ var JunieSkill = class JunieSkill extends ToolSkill {
 const KiloSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
-	license: z.optional(z.string()),
-	compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
-	metadata: z.optional(z.looseObject({})),
+	license: z.optional(z.unknown()),
+	compatibility: z.optional(z.unknown()),
+	metadata: z.optional(z.unknown()),
 	"allowed-tools": z.optional(z.array(z.string()))
 });
 var KiloSkill = class KiloSkill extends ToolSkill {
@@ -50572,10 +51562,11 @@ var KiroSkill = class KiroSkill extends ToolSkill {
 			rootFrontmatter: rulesyncFrontmatter,
 			section: kiroSection
 		});
+		const { name: _sectionName, description: _sectionDescription, ...section } = kiroSection ?? {};
 		const kiroFrontmatter = {
-			...kiroSection,
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
+			...section,
 			...license !== void 0 && { license },
 			...compatibility !== void 0 && { compatibility },
 			...metadata !== void 0 && { metadata }
@@ -50807,9 +51798,9 @@ var MusecodeSkill = class MusecodeSkill extends ToolSkill {
 const OpenCodeSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
-	license: z.optional(z.string()),
-	compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
-	metadata: z.optional(z.looseObject({})),
+	license: z.optional(z.unknown()),
+	compatibility: z.optional(z.unknown()),
+	metadata: z.optional(z.unknown()),
 	"allowed-tools": z.optional(z.array(z.string()))
 });
 var OpenCodeSkill = class OpenCodeSkill extends ToolSkill {
@@ -52723,6 +53714,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["crush", {
+		class: CrushSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["cursor", {
 		class: CursorSkill,
 		meta: {
@@ -60466,6 +61465,238 @@ var ClineRule = class ClineRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/features/rules/codebuddy-rule.ts
+/**
+* Frontmatter schema for CodeBuddy Code modular rules.
+* @see https://www.codebuddy.ai/docs/cli/memory
+*/
+const CodebuddyRuleFrontmatterSchema = z.object({
+	description: z.optional(z.string()),
+	paths: z.optional(z.array(z.string())),
+	alwaysApply: z.optional(z.boolean())
+});
+/**
+* A universal glob (matching everything) is redundant on an Always Apply
+* rule and, paired with `alwaysApply: true`, is the same semantic conflict
+* `CursorRule.resolveCursorGlobs` avoids for Cursor: `alwaysApply` already
+* applies the rule everywhere, so also emitting an explicit
+* `paths: ["**\/*"]` is at best redundant and, on a subsequent
+* import/generate round-trip, misleadingly implies the rule is scoped by
+* path rather than always-on.
+*/
+const UNIVERSAL_PATHS = /* @__PURE__ */ new Set(["**/*", "*"]);
+/**
+* Rule generator for CodeBuddy Code, Tencent Cloud's terminal coding agent
+* (`@tencent-ai/codebuddy-code`). Its configuration surface mirrors Claude
+* Code closely.
+*
+* Rules format:
+* - {project}/CODEBUDDY.md (root: true), also read from {project}/.codebuddy/CODEBUDDY.md
+* - {project}/.codebuddy/rules/*.md (root: false, with optional
+*   `description` / `paths` / `alwaysApply` frontmatter)
+* - Global: ~/.codebuddy/CODEBUDDY.md and ~/.codebuddy/rules/*.md
+*
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @see https://www.codebuddy.ai/docs/cli/codebuddy-dir
+*/
+var CodebuddyRule = class CodebuddyRule extends ToolRule {
+	frontmatter;
+	body;
+	static getSettablePaths({ global, excludeToolDir } = {}) {
+		if (global) return {
+			root: {
+				relativeDirPath: buildToolPath(CODEBUDDY_DIR, ".", excludeToolDir),
+				relativeFilePath: CODEBUDDY_RULE_FILE_NAME
+			},
+			nonRoot: { relativeDirPath: buildToolPath(CODEBUDDY_DIR, CODEBUDDY_RULES_DIR_NAME, excludeToolDir) }
+		};
+		return {
+			root: {
+				relativeDirPath: ".",
+				relativeFilePath: CODEBUDDY_RULE_FILE_NAME
+			},
+			alternativeRoots: [{
+				relativeDirPath: CODEBUDDY_DIR,
+				relativeFilePath: CODEBUDDY_RULE_FILE_NAME
+			}],
+			nonRoot: { relativeDirPath: buildToolPath(CODEBUDDY_DIR, CODEBUDDY_RULES_DIR_NAME, excludeToolDir) }
+		};
+	}
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate) {
+			const result = CodebuddyRuleFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: rest.root ? body : CodebuddyRule.generateFileContent(body, frontmatter)
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static generateFileContent(body, frontmatter) {
+		if (frontmatter.description === void 0 && frontmatter.paths === void 0 && frontmatter.alwaysApply === void 0) return body;
+		return stringifyFrontmatter(body, {
+			description: frontmatter.description,
+			alwaysApply: frontmatter.alwaysApply,
+			paths: frontmatter.paths
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false, relativeDirPath: overrideDirPath }) {
+		const paths = this.getSettablePaths({ global });
+		if (relativeFilePath === paths.root.relativeFilePath) {
+			const rootDirPath = overrideDirPath ?? paths.root.relativeDirPath;
+			const fileContent = await readFileContent(join(outputRoot, rootDirPath, paths.root.relativeFilePath));
+			return new CodebuddyRule({
+				outputRoot,
+				relativeDirPath: rootDirPath,
+				relativeFilePath: paths.root.relativeFilePath,
+				frontmatter: {},
+				body: fileContent.trim(),
+				validate,
+				root: true
+			});
+		}
+		if (!paths.nonRoot) throw new Error(`nonRoot path is not set for ${relativeFilePath}`);
+		const relativePath = join(paths.nonRoot.relativeDirPath, relativeFilePath);
+		const filePath = join(outputRoot, relativePath);
+		const { frontmatter, body: content } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const result = CodebuddyRuleFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new CodebuddyRule({
+			outputRoot,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: content.trim(),
+			validate,
+			root: false
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		const isRoot = relativeFilePath === this.getSettablePaths({ global }).root.relativeFilePath;
+		return new CodebuddyRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			validate: false,
+			root: isRoot
+		});
+	}
+	static resolveCodebuddyPaths({ paths, alwaysApply }) {
+		if (!paths || paths.length === 0) return;
+		if (alwaysApply && paths.every((path) => UNIVERSAL_PATHS.has(path.trim()))) return;
+		return paths;
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
+		const root = rulesyncFrontmatter.root ?? false;
+		const paths = this.getSettablePaths({ global });
+		const body = rulesyncRule.getBody();
+		if (root) return new CodebuddyRule({
+			outputRoot,
+			frontmatter: {},
+			body,
+			relativeDirPath: paths.root.relativeDirPath,
+			relativeFilePath: paths.root.relativeFilePath,
+			validate,
+			root
+		});
+		if (!paths.nonRoot) throw new Error(`nonRoot path is not set for ${rulesyncRule.getRelativeFilePath()}`);
+		const codebuddyPaths = rulesyncFrontmatter.codebuddy?.paths;
+		const globs = rulesyncFrontmatter.globs;
+		const alwaysApply = rulesyncFrontmatter.codebuddy?.alwaysApply;
+		const pathsValue = CodebuddyRule.resolveCodebuddyPaths({
+			paths: codebuddyPaths ?? (globs?.length ? globs : void 0),
+			alwaysApply: alwaysApply === true
+		});
+		const codebuddyFrontmatter = {
+			description: rulesyncFrontmatter.codebuddy?.description ?? rulesyncFrontmatter.description,
+			paths: pathsValue,
+			alwaysApply
+		};
+		return new CodebuddyRule({
+			outputRoot,
+			frontmatter: codebuddyFrontmatter,
+			body,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath: rulesyncRule.getRelativeFilePath(),
+			validate,
+			root
+		});
+	}
+	toRulesyncRule() {
+		const targets = ["*"];
+		if (this.isRoot()) {
+			const rulesyncFrontmatter = {
+				targets,
+				root: true,
+				description: this.description,
+				globs: ["**/*"]
+			};
+			return new RulesyncRule({
+				outputRoot: this.getOutputRoot(),
+				frontmatter: rulesyncFrontmatter,
+				body: this.body,
+				relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+				relativeFilePath: this.getRelativeFilePath(),
+				validate: true
+			});
+		}
+		const isAlways = this.frontmatter.alwaysApply === true;
+		const sourcePaths = this.frontmatter.paths ?? [];
+		const globs = sourcePaths.length === 0 && isAlways ? ["**/*"] : sourcePaths;
+		const rulesyncFrontmatter = {
+			targets,
+			root: false,
+			description: this.frontmatter.description,
+			globs,
+			...(this.frontmatter.paths !== void 0 || this.frontmatter.alwaysApply !== void 0 || this.frontmatter.description !== void 0) && { codebuddy: {
+				paths: this.frontmatter.paths,
+				alwaysApply: this.frontmatter.alwaysApply,
+				description: this.frontmatter.description
+			} }
+		};
+		return new RulesyncRule({
+			outputRoot: this.getOutputRoot(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.body,
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = CodebuddyRuleFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		else return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "codebuddy"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/codexcli-rule.ts
 var CodexcliRule = class CodexcliRule extends ToolRule {
 	constructor({ fileContent, root, ...rest }) {
@@ -60762,6 +61993,79 @@ var CopilotcliRule = class CopilotcliRule extends CopilotRule {
 	}
 };
 //#endregion
+//#region src/features/rules/crush-rule.ts
+var CrushRule = class CrushRule extends ToolRule {
+	constructor({ fileContent, root, ...rest }) {
+		super({
+			...rest,
+			fileContent,
+			root: root ?? false
+		});
+	}
+	static getSettablePaths({ global = false } = {}) {
+		if (global) return { root: {
+			relativeDirPath: CRUSH_GLOBAL_DIR,
+			relativeFilePath: CRUSH_RULE_FILE_NAME
+		} };
+		return { root: {
+			relativeDirPath: ".",
+			relativeFilePath: CRUSH_RULE_FILE_NAME
+		} };
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const relativePath = join(root.relativeDirPath, root.relativeFilePath);
+		const fileContent = await readFileContent(join(outputRoot, relativePath));
+		return new CrushRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = rulesyncRule.getFrontmatter().root ?? false;
+		return new CrushRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		return this.toRulesyncRuleDefault();
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = relativeFilePath === root.relativeFilePath && relativeDirPath === root.relativeDirPath;
+		return new CrushRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: isRoot
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "crush"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/cursor-rule.ts
 const CursorRuleFrontmatterSchema = z.object({
 	description: z.optional(z.string()),
@@ -61369,13 +62673,34 @@ var DevinRule = class DevinRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/factorydroid-rule.ts
+/**
+* Rule generator for Factory Droid.
+*
+* Factory Droid loads the root `AGENTS.md` (project) / `~/.factory/AGENTS.md`
+* (global) as coding guidelines, plus non-root rules referenced from it via
+* `.factory/rules/*.md`.
+*
+* Factory Droid also loads `DESIGN.md` (project only) as a second,
+* independent instruction surface: "Always-on design-system, UX, visual, and
+* interaction guidance", loaded separately from `AGENTS.md`'s coding
+* guidelines. Rulesync emits it from any non-root rule that opts in via a
+* `factorydroid.channel: design` frontmatter block — those rule bodies are
+* routed to `DESIGN.md` instead of `AGENTS.md`/`.factory/rules/*.md`, and
+* multiple opted-in rules concatenate in source order. Factory's docs describe
+* `DESIGN.md` at the repository root and in nested subdirectories, like
+* `AGENTS.md`, but document no personal/global home-directory equivalent, so
+* this channel is project scope only.
+* @see https://docs.factory.ai/cli/configuration/agents-md
+*/
 var FactorydroidRule = class FactorydroidRule extends ToolRule {
-	constructor({ fileContent, root, ...rest }) {
+	design;
+	constructor({ fileContent, root, design = false, ...rest }) {
 		super({
 			...rest,
 			fileContent,
 			root: root ?? false
 		});
+		this.design = design;
 	}
 	static getSettablePaths({ global, excludeToolDir } = {}) {
 		if (global) return { root: {
@@ -61387,11 +62712,47 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 				relativeDirPath: ".",
 				relativeFilePath: FACTORYDROID_RULE_FILE_NAME
 			},
-			nonRoot: { relativeDirPath: buildToolPath(FACTORYDROID_DIR, "rules", excludeToolDir) }
+			nonRoot: { relativeDirPath: buildToolPath(FACTORYDROID_DIR, "rules", excludeToolDir) },
+			design: {
+				relativeDirPath: ".",
+				relativeFilePath: FACTORYDROID_DESIGN_FILE_NAME
+			}
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+	/**
+	* Extra fixed files this tool manages beyond the root/non-root rules. The
+	* RulesProcessor enumerates these for import and deletion so a stale
+	* `DESIGN.md` is cleaned up once no rule opts in anymore. Empty in global
+	* mode: `DESIGN.md` has no documented home-directory equivalent.
+	*/
+	static getExtraFixedFiles({ global = false } = {}) {
+		if (global) return [];
+		return [this.getSettablePaths({ global }).design];
+	}
+	/**
+	* Factory Droid loads `DESIGN.md` itself, so listing it in the root rule's
+	* TOON reference section would double-load the content (and misrepresent it
+	* as a rule the model must remember to open).
+	*/
+	isExcludedFromRootReferences() {
+		return this.design;
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
+		const design = !global ? paths.design : void 0;
+		if (design !== void 0 && relativeDirPath === design.relativeDirPath && relativeFilePath === design.relativeFilePath) {
+			const relativePath = join(design.relativeDirPath, design.relativeFilePath);
+			const fileContent = await readFileContent(join(outputRoot, relativePath));
+			return new FactorydroidRule({
+				outputRoot,
+				relativeDirPath: design.relativeDirPath,
+				relativeFilePath: design.relativeFilePath,
+				fileContent,
+				validate,
+				root: false,
+				design: true
+			});
+		}
 		if (relativeFilePath === paths.root.relativeFilePath) {
 			const relativePath = join(paths.root.relativeDirPath, paths.root.relativeFilePath);
 			const fileContent = await readFileContent(join(outputRoot, relativePath));
@@ -61418,18 +62779,34 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const isRoot = relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
+		const design = !global ? paths.design : void 0;
+		const isDesign = design !== void 0 && relativeDirPath === design.relativeDirPath && relativeFilePath === design.relativeFilePath;
+		const isRoot = !isDesign && relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
 		return new FactorydroidRule({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
 			validate: false,
-			root: isRoot
+			root: isRoot,
+			design: isDesign
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const frontmatter = rulesyncRule.getFrontmatter();
 		const paths = this.getSettablePaths({ global });
+		if (!global && !frontmatter.root && frontmatter.factorydroid?.channel === "design") {
+			const { design } = paths;
+			return new FactorydroidRule({
+				outputRoot,
+				relativeDirPath: design.relativeDirPath,
+				relativeFilePath: design.relativeFilePath,
+				fileContent: rulesyncRule.getBody(),
+				validate,
+				root: false,
+				design: true
+			});
+		}
 		return new FactorydroidRule(this.buildToolRuleParamsAgentsmd({
 			outputRoot,
 			rulesyncRule,
@@ -61439,6 +62816,17 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 		}));
 	}
 	toRulesyncRule() {
+		if (this.design) return new RulesyncRule({
+			outputRoot: process.cwd(),
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: FACTORYDROID_DESIGN_FILE_NAME,
+			frontmatter: {
+				root: false,
+				targets: ["factorydroid"],
+				factorydroid: { channel: "design" }
+			},
+			body: this.getFileContent()
+		});
 		return this.toRulesyncRuleDefault();
 	}
 	validate() {
@@ -63956,6 +65344,16 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto"
 		}
 	}],
+	["codebuddy", {
+		class: CodebuddyRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			localRootMode: "separate-local-file",
+			localRootFileName: CODEBUDDY_LOCAL_RULE_FILE_NAME
+		}
+	}],
 	["codexcli", {
 		class: CodexcliRule,
 		meta: {
@@ -63981,6 +65379,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto"
 		}
 	}],
+	["crush", {
+		class: CrushRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
+	}],
 	["cursor", {
 		class: CursorRule,
 		meta: {
@@ -64349,6 +65756,10 @@ var RulesProcessor = class extends FeatureProcessor {
 			outputFiles,
 			convertedRules
 		});
+		await this.warnForDeactivatedImportOnlyRoots({
+			toolRules,
+			factory
+		});
 		return outputFiles;
 	}
 	/**
@@ -64570,6 +65981,41 @@ var RulesProcessor = class extends FeatureProcessor {
 		}
 	}
 	/**
+	* Warn when this generate run is about to write a root rule file that will
+	* make the tool stop reading paths it currently reads instead — Junie's
+	* `.junie/rules/*.md` and `.junie/playbook.md` become unreachable the
+	* moment `.junie/AGENTS.md` exists, since Junie reads the root file
+	* exclusively once it is present. `importOnlyRoots` with
+	* `onlyWhenRootAbsent` already models exactly this shape for import; this
+	* reuses the same declaration so the
+	* `generate` path — which never calls `loadToolFiles` and so never reached
+	* the existing import-side warning — surfaces it too. Without this, a repo
+	* that only ever runs `generate` never sees any warning: the deactivated
+	* files stay on disk, untouched and not gitignored, silently unread.
+	*/
+	async warnForDeactivatedImportOnlyRoots({ toolRules, factory }) {
+		const rootRule = toolRules.find((rule) => rule.isRoot());
+		if (!rootRule) return;
+		const settablePaths = factory.class.getSettablePaths({ global: this.global });
+		const importOnlyRoots = "importOnlyRoots" in settablePaths ? settablePaths.importOnlyRoots : void 0;
+		if (!importOnlyRoots || importOnlyRoots.length === 0) return;
+		const existingPaths = [];
+		for (const importOnlyRoot of importOnlyRoots) {
+			if (importOnlyRoot.onlyWhenRootAbsent !== true) continue;
+			const matchedPaths = await findFilesByGlobs(rootRelativeGlob(importOnlyRoot.relativeDirPath, importOnlyRoot.relativeFilePath ?? `*.${factory.meta.extension}`), {
+				cwd: this.outputRoot,
+				type: "file"
+			});
+			existingPaths.push(...matchedPaths);
+		}
+		if (existingPaths.length === 0) return;
+		const rootFileRelativePath = join(rootRule.getRelativeDirPath(), rootRule.getRelativeFilePath());
+		const names = existingPaths.map((filePath) => stripControlCharacters(relative(this.outputRoot, filePath)));
+		const listedNames = names.slice(0, MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS);
+		const remainingCount = names.length - listedNames.length;
+		this.logger.warn(`Writing ${stripControlCharacters(rootFileRelativePath)} for ${this.toolTarget} means ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} will no longer be read. Run \`rulesync import --targets ${this.toolTarget}\` first to carry that content into ${RULESYNC_RULES_RELATIVE_DIR_PATH}, or delete ${listedNames.length === 1 ? "it" : "them"} once you have checked the content is already in the root file.`);
+	}
+	/**
 	* Handle localRoot rule generation based on tool target.
 	* - `separate-local-file`: writes a dedicated `*.local.md` root file
 	*   (claudecode/legacy: `./CLAUDE.local.md`, rovodev: `./AGENTS.local.md`)
@@ -64821,6 +66267,26 @@ As this project's AI coding tool, you must follow the additional conventions bel
 		}));
 	}
 	/**
+	* Load and merge rulesync rule files from every configured input root's
+	* `.rulesync/rules/` directory, by relative path, so that a rule with the
+	* same target path from a later root replaces the earlier root's copy
+	* (case-insensitive, matching the intra-root collision handling).
+	*
+	* This is the side-effect-free half of `loadRulesyncFiles`: it does not
+	* warn about a missing root rule or validate `localRoot` placement, so it
+	* is also safe to call from code paths — like
+	* `warnForFoldImportDuplicationRisk` — that only need the merged rule set
+	* and must not trigger `loadRulesyncFiles`'s generate-time checks.
+	*/
+	async loadMergedRulesyncRules() {
+		return mergeByCaseInsensitiveIdentity({
+			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
+			identity: (rule) => rule.getRelativeFilePath(),
+			artifactName: "rule",
+			logger: this.logger
+		});
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Load and parse rulesync rule files from every configured input root's
 	* `.rulesync/rules/` directory, merging by relative path so that a rule
@@ -64828,12 +66294,7 @@ As this project's AI coding tool, you must follow the additional conventions bel
 	* copy (case-insensitive, matching the intra-root collision handling).
 	*/
 	async loadRulesyncFiles() {
-		const rulesyncRules = mergeByCaseInsensitiveIdentity({
-			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
-			identity: (rule) => rule.getRelativeFilePath(),
-			artifactName: "rule",
-			logger: this.logger
-		});
+		const rulesyncRules = await this.loadMergedRulesyncRules();
 		const factory = this.getFactory(this.toolTarget);
 		const targetedRootRules = rulesyncRules.filter((rule) => rule.getFrontmatter().root).filter((rule) => factory.class.isTargetedByRulesyncRule(rule));
 		if (targetedRootRules.length === 0 && rulesyncRules.length > 0) this.logger.warn(`No root rulesync rule file found for target '${this.toolTarget}'. Consider adding 'root: true' to one of your rule files in ${RULESYNC_RULES_RELATIVE_DIR_PATH}.`);
@@ -64890,6 +66351,46 @@ As this project's AI coding tool, you must follow the additional conventions bel
 		});
 	}
 	/**
+	* Warn when importing a `collisionPolicy: "fold"` target's root file while
+	* `.rulesync/rules/` still holds non-root rules targeting it. A fold target
+	* (codexcli, junie, and others) concatenates every targeted non-root rule
+	* into its one root output file on `generate`. Importing that root file
+	* back therefore re-reads the already-folded content as a single new
+	* rulesync rule, while the original non-root rules stay in place
+	* untouched — the next `generate` folds both together, duplicating the
+	* content once per generate/import cycle with nothing to indicate why.
+	*
+	* This does not attempt to detect or drop the specific duplicated content
+	* (the root file has no marker recording which rule contributed what); it
+	* only surfaces that the cycle produces one, per the "at minimum, warn"
+	* option recorded on issue #2743.
+	*
+	* Only the actual `rulesync import` call site invokes this (and only once
+	* it has confirmed there is something to import) — `loadToolFiles` is also
+	* the entry point for `rulesync convert` and `rulesync fetch`, neither of
+	* which writes to `.rulesync/rules/` or carries this duplication risk.
+	*
+	* Reads via `loadMergedRulesyncRules` rather than `loadRulesyncFiles`
+	* deliberately: this runs before the imported root file is written, so
+	* `.rulesync/rules/` never yet has a root rule targeting this tool, and
+	* `loadRulesyncFiles`'s "no root rule found" warning and `localRoot`
+	* validation (which can throw) would fire spuriously on every fold-tool
+	* import — including ones where nothing is actually misconfigured.
+	*
+	* In global mode, a `localRoot: true` rule is excluded from the
+	* duplication check the same way `loadRulesyncFiles`'s global-mode branch
+	* excludes it from `nonRootRules`: `generate` ignores `localRoot` entirely
+	* in global mode, so such a rule is never actually folded into the global
+	* root output and warning about it here would be inaccurate.
+	*/
+	async warnForFoldImportDuplicationRisk() {
+		const factory = this.getFactory(this.toolTarget);
+		if (factory.meta.collisionPolicy !== "fold") return;
+		const nonRootRules = (await this.loadMergedRulesyncRules()).filter((rule) => !rule.getFrontmatter().root && (!this.global || !rule.getFrontmatter().localRoot) && factory.class.isTargetedByRulesyncRule(rule));
+		if (nonRootRules.length === 0) return;
+		this.logger.warn(`Importing ${this.toolTarget}'s root file will re-add content already folded from ${formatRulePaths(nonRootRules)}: ${this.toolTarget} concatenates every non-root rule into its single root output file, so the imported copy duplicates them the next time you run \`rulesync generate --targets ${this.toolTarget}\`. Review the imported rule and remove the duplicated content, or remove the original non-root rule files, before generating again.`);
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Load tool-specific rule configurations and parse them into ToolRule instances
 	*/
@@ -66953,6 +68454,7 @@ async function importRulesCore(params) {
 		logger.warn(`No rule files found for ${tool}. Skipping import.`);
 		return 0;
 	}
+	await rulesProcessor.warnForFoldImportDuplicationRisk();
 	const rulesyncFiles = await rulesProcessor.convertToolFilesToRulesyncFiles(toolFiles);
 	const { count: writtenCount } = await rulesProcessor.writeAiFiles(rulesyncFiles);
 	if (config.getVerbose() && writtenCount > 0) logger.success(`Created ${writtenCount} rule files`);
@@ -67200,6 +68702,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { loadYaml as $, ToolTargetSchema as $t, caseFoldIdentity as A, ALL_FEATURES as An, getHomeDirectory as At, RulesyncRuleFrontmatterSchema as B, removeDirectory as Bt, CLAUDECODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, assertWritablePathInsideRoot as Ct, CLAUDECODE_SKILLS_DIR_PATH as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, ensureDir as Dt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, directoryExists as Et, RulesyncSubagent as F, hasDeceptiveHiddenCharacters as Fn, listFilePathsRecursively as Ft, getRulesyncSourceCandidates as G, resolvePath as Gt, RulesyncMcp as H, removeFile as Ht, RulesyncSubagentFrontmatterSchema as I, quoteForLog as In, listSubdirectoryNames as It, RulesyncCommand as J, writeFileBuffer as Jt, resolveRulesyncSourceWritePath as K, runWithDirectoryRollback as Kt, RulesyncSkill as L, stripControlCharacters as Ln, pathEscapesRoot as Lt, AUGMENTCODE_DIR as M, DEPRECATED_FEATURE_REPLACEMENTS as Mn, isFileSystemError as Mt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as N, formatError as Nn, isSymlink as Nt, FACTORYDROID_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, fileExists as Ot, getLocalSkillDirNames as P, truncateText as Pn, listDirectoryEntryNames as Pt, stringifyFrontmatter as Q, PACKAGING_TOOL_TARGETS as Qt, RulesyncSkillFrontmatterSchema as R, stripControlCharactersKeepingLineFeeds as Rn, readFileContent as Rt, CODEXCLI_DIR as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, assertTreeContainsNoSymlinks as St, CLAUDECODE_MEMORIES_DIR_NAME as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, createTempDirectory as Tt, RulesyncIgnore as U, removeFileStrict as Ut, RulesyncPermissions as V, removeDirectoryStrict as Vt, RulesyncHooks as W, removeTempDirectory as Wt, RulesyncCheck as X, ALL_TOOL_TARGETS as Xt, RulesyncCommandFrontmatterSchema as Y, writeFileContent as Yt, RulesyncCheckFrontmatterSchema as Z, ALL_TOOL_TARGETS_WITH_WILDCARD as Zt, CommandsProcessor as _, RULESYNC_MCP_RELATIVE_FILE_PATH as _n, withWarnOnceScope as _t, getProcessorRegistryEntry as a, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as an, CONFLICTING_TARGET_PAIRS as at, ChecksProcessor as b, RULESYNC_PERMISSIONS_FILE_NAME as bn, applyFileMode as bt, RulesProcessor as c, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as cn, SourceEntrySchema as ct, ELLIPSIS_WIDTH as d, RULESYNC_HOOKS_LEGACY_FILE_NAME as dn, JsonLogger as dt, CURATED_RULES_FEATURE_SUBDIR as en, SHARED_USER_MANAGED_CONFIG_PATHS as et, displayWidthOf as f, RULESYNC_HOOKS_RELATIVE_FILE_PATH as fn, WarningCollectingLogger as ft, HooksProcessor as g, RULESYNC_MCP_LEGACY_FILE_NAME as gn, resetRunWarningState as gt, IgnoreProcessor as h, RULESYNC_MCP_FILE_NAME as hn, withFallbackLoggerTarget as ht, inspectInputRoots as i, RULESYNC_CHECKS_RELATIVE_DIR_PATH as in, resolveEffectiveInputRoots as it, groupSpellingsByCaseFoldedIdentity as j, ALL_FEATURES_WITH_WILDCARD as jn, isFileNotFoundError as jt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as k, parseCommaSeparatedList as kn, getFileSize as kt, SubagentsProcessor as l, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as ln, findControlCharacter as lt, McpProcessor as m, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as mn, warnOnConflictingFlags as mt, formatSourceLoadFailure as n, RULESYNC_AIIGNORE_FILE_NAME as nn, ConfigResolver as nt, convertFromTool as o, RULESYNC_CONFIG_RELATIVE_FILE_PATH as on, ConfigFileSchema as ot, shortenToWidth as p, RULESYNC_IGNORE_RELATIVE_FILE_PATH as pn, fallbackLogger as pt, parseJsonc as q, toPosixPath as qt, generate as r, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as rn, mergeInputRootConfigs as rt, isPackagingToolTarget as s, RULESYNC_CONFIG_SCHEMA_URL as sn, GITIGNORE_DESTINATION_KEY as st, importFromTool as t, MAX_FILE_SIZE as tn, SKILL_FILE_NAME as tt, SkillsProcessor as u, RULESYNC_HOOKS_FILE_NAME as un, ConsoleLogger as ut, QWENCODE_DIR as v, RULESYNC_MCP_SCHEMA_URL as vn, CLIError as vt, CLAUDECODE_LOCAL_RULE_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, checkPathTraversal as wt, CODEXCLI_BASH_RULES_FILE_NAME as x, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as xn, assertDirectoryIfExists as xt, QWENCODE_LOCAL_RULE_FILE_NAME as y, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as yn, ErrorCodes as yt, RulesyncRule as z, stripHiddenCharacters as zn, readFileContentOrNull as zt };
+export { RulesyncCheckFrontmatterSchema as $, ALL_TOOL_TARGETS_WITH_WILDCARD as $t, FACTORYDROID_DIR as A, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as An, fileExists as At, RulesyncSkillFrontmatterSchema as B, stripControlCharacters as Bn, readFileContent as Bt, CODEXCLI_BASH_RULES_FILE_NAME as C, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as Cn, assertDirectoryIfExists as Ct, CLAUDECODE_MEMORIES_DIR_NAME as D, RULESYNC_RULES_RELATIVE_DIR_PATH as Dn, createTempDirectory as Dt, CLAUDECODE_LOCAL_RULE_FILE_NAME as E, RULESYNC_RELATIVE_DIR_PATH as En, checkPathTraversal as Et, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as F, formatError as Fn, isSymlink as Ft, RulesyncIgnore as G, removeFileStrict as Gt, RulesyncRuleFrontmatterSchema as H, stripHiddenCharacters as Hn, removeDirectory as Ht, getLocalSkillDirNames as I, truncateText as In, listDirectoryEntryNames as It, resolveRulesyncSourceWritePath as J, runWithDirectoryRollback as Jt, RulesyncHooks as K, removeTempDirectory as Kt, RulesyncSubagent as L, hasDeceptiveHiddenCharacters as Ln, listFilePathsRecursively as Lt, caseFoldIdentity as M, ALL_FEATURES as Mn, getHomeDirectory as Mt, groupSpellingsByCaseFoldedIdentity as N, ALL_FEATURES_WITH_WILDCARD as Nn, isFileNotFoundError as Nt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_SKILLS_RELATIVE_DIR_PATH as On, directoryExists as Ot, AUGMENTCODE_DIR as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, isFileSystemError as Pt, RulesyncCheck as Q, ALL_TOOL_TARGETS as Qt, RulesyncSubagentFrontmatterSchema as R, hasEnclosingMarkOutsideKeycap as Rn, listSubdirectoryNames as Rt, ChecksProcessor as S, RULESYNC_PERMISSIONS_FILE_NAME as Sn, applyFileMode as St, CLAUDECODE_DIR as T, RULESYNC_PERMISSIONS_SCHEMA_URL as Tn, assertWritablePathInsideRoot as Tt, RulesyncPermissions as U, removeDirectoryStrict as Ut, RulesyncRule as V, stripControlCharactersKeepingLineFeeds as Vn, readFileContentOrNull as Vt, RulesyncMcp as W, removeFile as Wt, RulesyncCommand as X, writeFileBuffer as Xt, parseJsonc as Y, toPosixPath as Yt, RulesyncCommandFrontmatterSchema as Z, writeFileContent as Zt, IgnoreProcessor as _, RULESYNC_MCP_FILE_NAME as _n, withFallbackLoggerTarget as _t, getProcessorRegistryEntry as a, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as an, mergeInputRootConfigs as at, QWENCODE_DIR as b, RULESYNC_MCP_SCHEMA_URL as bn, CLIError as bt, RulesProcessor as c, RULESYNC_CONFIG_RELATIVE_FILE_PATH as cn, ConfigFileSchema as ct, CODEBUDDY_DIR as d, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as dn, findControlCharacter as dt, PACKAGING_TOOL_TARGETS as en, stringifyFrontmatter as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_HOOKS_FILE_NAME as fn, ConsoleLogger as ft, McpProcessor as g, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as gn, warnOnConflictingFlags as gt, shortenToWidth as h, RULESYNC_IGNORE_RELATIVE_FILE_PATH as hn, fallbackLogger as ht, inspectInputRoots as i, RULESYNC_AIIGNORE_FILE_NAME as in, ConfigResolver as it, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, getFileSize as jt, CLAUDECODE_SKILLS_DIR_PATH as k, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as kn, ensureDir as kt, SubagentsProcessor as l, RULESYNC_CONFIG_SCHEMA_URL as ln, GITIGNORE_DESTINATION_KEY as lt, displayWidthOf as m, RULESYNC_HOOKS_RELATIVE_FILE_PATH as mn, WarningCollectingLogger as mt, formatSourceLoadFailure as n, CURATED_RULES_FEATURE_SUBDIR as nn, SHARED_USER_MANAGED_CONFIG_PATHS as nt, convertFromTool as o, RULESYNC_CHECKS_RELATIVE_DIR_PATH as on, resolveEffectiveInputRoots as ot, ELLIPSIS_WIDTH as p, RULESYNC_HOOKS_LEGACY_FILE_NAME as pn, JsonLogger as pt, getRulesyncSourceCandidates as q, resolvePath as qt, generate as r, MAX_FILE_SIZE as rn, SKILL_FILE_NAME as rt, isPackagingToolTarget as s, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as sn, CONFLICTING_TARGET_PAIRS as st, importFromTool as t, ToolTargetSchema as tn, loadYaml as tt, SkillsProcessor as u, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as un, SourceEntrySchema as ut, HooksProcessor as v, RULESYNC_MCP_LEGACY_FILE_NAME as vn, resetRunWarningState as vt, CODEXCLI_DIR as w, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as wn, assertTreeContainsNoSymlinks as wt, QWENCODE_LOCAL_RULE_FILE_NAME as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, ErrorCodes as xt, CommandsProcessor as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, withWarnOnceScope as yt, RulesyncSkill as z, quoteForLog as zn, pathEscapesRoot as zt };
 
-//# sourceMappingURL=import-5_n-Y8N6.js.map
+//# sourceMappingURL=import-DUE1P1zV.js.map