rulesync 16.22.0 → 16.23.0

package/dist/{import-CUyeYGxZ.cjs → import-D420jbVB.cjs}

@@ -3385,6 +3385,47 @@ var RulesyncFile = class extends AiFile {
 	}
 };
 //#endregion
+//#region src/utils/bounded-walk.ts
+const ALIAS_HINT = "(a chain of YAML aliases may be amplifying the document)";
+/**
+* Create the bookkeeping for one walk. `subject` names the document kind in
+* every error ("Frontmatter", "Shared config"); `root`, when given, is entered
+* up front so the root object counts as the first nesting level, matching the
+* +1 that `enter` applies to every container nested inside it.
+*/
+function createBoundedWalk({ subject, limits, root }) {
+	const ancestors = /* @__PURE__ */ new WeakSet();
+	let valuesRemaining = limits.maxValues;
+	let stringCharsRemaining = limits.maxStringChars;
+	let depth = 0;
+	const chargeChars = (chars) => {
+		stringCharsRemaining -= chars;
+		if (stringCharsRemaining < 0) throw new Error(`${subject}'s string values expand to more than ${limits.maxStringChars} characters; refusing to process it ${ALIAS_HINT}`);
+	};
+	const chargeValue = (stringChars = 0) => {
+		valuesRemaining -= 1;
+		if (valuesRemaining < 0) throw new Error(`${subject} expands to more than ${limits.maxValues} values; refusing to process it ${ALIAS_HINT}`);
+		chargeChars(stringChars);
+	};
+	const enter = (container) => {
+		depth += 1;
+		if (depth > limits.maxDepth) throw new Error(`${subject} nests more than ${limits.maxDepth} levels deep; refusing to process it ${ALIAS_HINT}`);
+		ancestors.add(container);
+	};
+	const leave = (container) => {
+		ancestors.delete(container);
+		depth -= 1;
+	};
+	if (root !== void 0) enter(root);
+	return {
+		chargeValue,
+		chargeChars,
+		isAncestor: (container) => ancestors.has(container),
+		enter,
+		leave
+	};
+}
+//#endregion
 //#region src/utils/prototype-pollution.ts
 /**
 * Keys that, if walked into when constructing or merging objects from
@@ -3524,30 +3565,6 @@ const MAX_FRONTMATTER_STRING_CHARS = 4e6;
 * manifest stays well under this.
 */
 const MAX_FRONTMATTER_RAW_CHARS = 65536;
-/** Charge string content (a string leaf or an object key) against the character budget. */
-function chargeStringChars({ options, chars }) {
-	options.budget.stringCharsRemaining -= chars;
-	if (options.budget.stringCharsRemaining < 0) throw new Error(`Frontmatter's string values expand to more than ${MAX_FRONTMATTER_STRING_CHARS} characters; refusing to process it (a chain of YAML aliases may be amplifying the document)`);
-}
-function consumeBudget({ options, stringChars = 0 }) {
-	options.budget.remaining -= 1;
-	if (options.budget.remaining < 0) throw new Error(`Frontmatter expands to more than ${MAX_FRONTMATTER_VALUES} values; refusing to process it (a chain of YAML aliases may be amplifying the document)`);
-	chargeStringChars({
-		options,
-		chars: stringChars
-	});
-}
-/** Enter one more container level, throwing if the depth cap is exceeded. */
-function enterContainer({ options, container }) {
-	options.depth += 1;
-	if (options.depth > 64) throw new Error(`Frontmatter nests more than 64 levels deep; refusing to process it (a chain of YAML aliases may be amplifying the document)`);
-	options.ancestors.add(container);
-}
-/** Leave a container level entered via {@link enterContainer}. */
-function leaveContainer({ options, container }) {
-	options.ancestors.delete(container);
-	options.depth -= 1;
-}
 /**
 * Estimate the serialized character cost of a leaf that is not a string (a
 * string leaf is charged by its own length instead).
@@ -3570,40 +3587,26 @@ function estimateLeafChars(value) {
 * bounded by {@link MAX_FRONTMATTER_VALUES} instead.
 */
 function deepCleanValue(value, options) {
-	consumeBudget({
-		options,
-		stringChars: typeof value === "string" ? value.length : estimateLeafChars(value)
-	});
+	const leafChars = typeof value === "string" ? value.length : estimateLeafChars(value);
+	options.walk.chargeValue(leafChars);
 	if (value === null || value === void 0) return;
 	if (typeof value === "string") return options.transformString ? options.transformString(value) : value;
 	if (Array.isArray(value)) {
-		if (options.ancestors.has(value)) return;
-		enterContainer({
-			options,
-			container: value
-		});
+		if (options.walk.isAncestor(value)) return;
+		options.walk.enter(value);
 		const cleanedArray = [];
 		for (const item of value) {
 			const cleaned = deepCleanValue(item, options);
 			if (cleaned !== void 0) cleanedArray.push(cleaned);
 		}
-		leaveContainer({
-			options,
-			container: value
-		});
+		options.walk.leave(value);
 		return cleanedArray;
 	}
 	if (isPlainObject$1(value)) {
-		if (options.ancestors.has(value)) return;
-		enterContainer({
-			options,
-			container: value
-		});
+		if (options.walk.isAncestor(value)) return;
+		options.walk.enter(value);
 		const result = cleanOwnEntries(value, options);
-		leaveContainer({
-			options,
-			container: value
-		});
+		options.walk.leave(value);
 		return result;
 	}
 	return value;
@@ -3622,10 +3625,7 @@ function deepCleanValue(value, options) {
 function cleanOwnEntries(obj, options) {
 	const result = {};
 	for (const [key, val] of Object.entries(obj)) {
-		chargeStringChars({
-			options,
-			chars: key.length
-		});
+		options.walk.chargeChars(key.length);
 		const cleaned = deepCleanValue(val, options);
 		if (isPrototypePollutionKey(key)) continue;
 		if (cleaned !== void 0) result[key] = cleaned;
@@ -3636,12 +3636,15 @@ function deepCleanObject(obj, options) {
 	if (!obj || typeof obj !== "object") return {};
 	return cleanOwnEntries(obj, {
 		...options,
-		ancestors: new WeakSet([obj]),
-		budget: {
-			remaining: MAX_FRONTMATTER_VALUES,
-			stringCharsRemaining: MAX_FRONTMATTER_STRING_CHARS
-		},
-		depth: 1
+		walk: createBoundedWalk({
+			subject: "Frontmatter",
+			limits: {
+				maxValues: MAX_FRONTMATTER_VALUES,
+				maxStringChars: MAX_FRONTMATTER_STRING_CHARS,
+				maxDepth: 64
+			},
+			root: obj
+		})
 	});
 }
 /** Drop null and undefined values, recursively. */
@@ -6696,6 +6699,8 @@ const QwencodePermissionsOverrideSchema = zod_mini.z.looseObject({
 *
 * @example
 * { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+* @example
+* { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 */
 const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -6703,7 +6708,8 @@ const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 	agent: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	rawAllow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	rawAsk: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
-	rawDeny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	rawDeny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	allowDynamicBash: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
 * Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
@@ -7347,6 +7353,32 @@ const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
 	})))
 });
 /**
+* Tool-scoped override block for Devin Local. `sandbox` is the sibling
+* top-level `config.json` block that governs the sandbox Devin runs commands
+* in: `allowed_domains` / `denied_domains` (proxy domain patterns, deny beating
+* allow), `network_mode` (`full`, the upstream default, allows every HTTP
+* method; `limited` only GET/HEAD/OPTIONS) and `excluded` (`allow` / `ask` /
+* `deny` lists of `Exec(...)` matchers deciding which commands run *outside* the
+* sandbox — `deny` pins them inside it). It constrains how
+* a permitted command runs rather than which commands are permitted, so it has
+* no canonical category and is authored here.
+*
+* Upstream lists `sandbox` as a **User Config Only** key, so it is emitted at
+* global scope only; at project scope it is dropped with a warning rather than
+* written into a file Devin would ignore.
+*
+* @example
+* { "sandbox": { "allowed_domains": ["github.com"], "network_mode": "limited" } }
+* @example
+* { "sandbox": { "excluded": { "allow": ["Exec(git status *)"], "deny": ["Exec(git tag *)"] } } }
+* @see https://docs.devin.ai/cli/sandbox
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+const DevinPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
@@ -7396,10 +7428,10 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	kiro: zod_mini.z.optional(KiroPermissionsOverrideSchema),
 	codexcli: zod_mini.z.optional(CodexcliPermissionsOverrideSchema),
 	zed: zod_mini.z.optional(ZedPermissionsOverrideSchema),
+	devin: zod_mini.z.optional(DevinPermissionsOverrideSchema),
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
-	devin: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
@@ -11483,6 +11515,21 @@ function stripStrings(_key, value) {
 //#endregion
 //#region src/features/shared/shared-config-gateway.ts
 /**
+* Upper bound on the number of values a shared config document may expand
+* to once every YAML alias is written out. Real config files hold a few
+* hundred values at most; even a large MCP server catalog stays orders of
+* magnitude below the limit.
+*/
+const MAX_SHARED_CONFIG_VALUES = 1e5;
+/**
+* Upper bound on the total character count of the string leaves and keys a
+* shared config document may expand to. The value budget bounds how many
+* values are visited, but one long string aliased thousands of times fits
+* that budget while the duplicated output balloons; charging every visited
+* string's length separately bounds the output regardless of alias count.
+*/
+const MAX_SHARED_CONFIG_STRING_CHARS = 4e6;
+/**
 * Rebuild a parsed document without its prototype-pollution keys.
 *
 * Every object is rebuilt, not just the ones that are already plain: a literal
@@ -11497,15 +11544,61 @@ function stripStrings(_key, value) {
 *
 * Dates are the one object the YAML and TOML parsers produce that is not a
 * mapping, so they are passed through rather than flattened into `{}`.
+*
+* The rebuild is bounded, because a YAML alias makes one parsed container
+* reachable from many keys and every alias is copied out independently (the
+* writers dump with `noRefs: true`, so memoizing here would only move the
+* blowup into serialization). A small "alias bomb" of nested anchors would
+* otherwise cost exponential time and memory, and a self-referencing anchor
+* would recurse until the stack overflowed — both reachable from a config
+* file committed to a cloned repository. The walk therefore charges every
+* value against {@link MAX_SHARED_CONFIG_VALUES}, every string and key
+* against {@link MAX_SHARED_CONFIG_STRING_CHARS}, caps nesting at
+* {@link MAX_SHARED_CONFIG_DEPTH}, and refuses a reference back to an
+* ancestor outright, each with a clear error instead of a hang or a crash.
 */
 function sanitizeSharedConfigValue(value) {
-	if (Array.isArray(value)) return value.map(sanitizeSharedConfigValue);
+	return sanitizeSharedConfigValueBounded(value, createBoundedWalk({
+		subject: "Shared config",
+		limits: {
+			maxValues: MAX_SHARED_CONFIG_VALUES,
+			maxStringChars: MAX_SHARED_CONFIG_STRING_CHARS,
+			maxDepth: 64
+		}
+	}));
+}
+/**
+* Refuse a container that is already on the descent path. Unlike the
+* frontmatter cleaner, which drops such a cycle and keeps the rest of the
+* document, a shared config file is refused outright: silently dropping part
+* of a user's settings file would let a later write-back persist the loss.
+*/
+function enterSharedConfigContainer(walk, container) {
+	if (walk.isAncestor(container)) throw new Error("Shared config contains a value that refers back to itself (a circular YAML alias); refusing to process it");
+	walk.enter(container);
+}
+function sanitizeSharedConfigValueBounded(value, walk) {
+	if (typeof value === "string") {
+		walk.chargeValue(value.length);
+		return value;
+	}
+	walk.chargeValue();
+	if (Array.isArray(value)) {
+		enterSharedConfigContainer(walk, value);
+		const items = value.map((item) => sanitizeSharedConfigValueBounded(item, walk));
+		walk.leave(value);
+		return items;
+	}
 	if (value === null || typeof value !== "object" || value instanceof Date) return value;
+	enterSharedConfigContainer(walk, value);
 	const result = {};
 	for (const [key, nested] of Object.entries(value)) {
+		walk.chargeChars(key.length);
+		const sanitized = sanitizeSharedConfigValueBounded(nested, walk);
 		if (isPrototypePollutionKey(key)) continue;
-		result[key] = sanitizeSharedConfigValue(nested);
+		result[key] = sanitized;
 	}
+	walk.leave(value);
 	return result;
 }
 /**
@@ -11534,7 +11627,12 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (parsed === void 0 || parsed === null) return {};
-	const sanitized = sanitizeSharedConfigValue(parsed);
+	let sanitized;
+	try {
+		sanitized = sanitizeSharedConfigValue(parsed);
+	} catch (error) {
+		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
+	}
 	if (!isPlainObject$1(sanitized)) {
 		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
 		return {};
@@ -12559,7 +12657,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions"]
+				ownedKeys: ["permissions", "sandbox"]
 			}
 		}
 	},
@@ -36280,6 +36378,180 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	return { permission };
 }
 //#endregion
+//#region src/features/permissions/sandbox-trust.ts
+/** A key whose quiet value is an explicit `false`. */
+const isNotFalse = (value) => value !== false;
+/** A key whose quiet value is an explicit `true`. */
+const isNotTrue = (value) => value !== true;
+/** A list-valued key whose quiet value is the empty list. */
+const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
+/** The map-valued counterpart of {@link isNonEmptyList}. */
+const isNonEmptyMap = (value) => !isRecord$1(value) || Object.keys(value).length > 0;
+/**
+* What {@link readSandboxPath} returns when a container on the way to the leaf
+* is present but is not an object, so the leaf cannot be read at all. It is not
+* `undefined`, because the two mean opposite things to a caller: `undefined` is
+* "this path is not being written", while this is "something is being written
+* here and its shape hides what". The same fail-safe rule the predicates follow
+* applies to the walk — silence must mean "this cannot loosen anything", not
+* "this is not the shape the table expected".
+*/
+const UNREADABLE_SANDBOX_PATH = Symbol("unreadable-sandbox-path");
+/**
+* Reads `sandbox` at `path`. Returns `undefined` when a segment is absent, and
+* {@link UNREADABLE_SANDBOX_PATH} when one is present but is not an object.
+* Shared by everything that addresses a `sandbox` path so a nested path added to
+* one of the tables is actually traversed rather than silently skipped, and so a
+* hostile shape (an array, a string, `null`) is reported rather than throwing.
+*/
+function readSandboxPath({ sandbox, path }) {
+	let cursor = sandbox;
+	for (const segment of path) {
+		if (cursor === void 0) return void 0;
+		if (!isRecord$1(cursor)) return UNREADABLE_SANDBOX_PATH;
+		cursor = cursor[segment];
+	}
+	return cursor;
+}
+/**
+* Every path in `paths` whose value in `sandbox` loosens the policy. Nothing is
+* removed — the values are written, just not silently. Call it on the block this
+* generate authored, after any scope filter has run: a value the file already
+* held is the user's own, not something rulesync opened, and a path a filter
+* dropped is not being written at all.
+*/
+function collectTrustAffectingSandboxPaths({ sandbox, paths }) {
+	const entries = [];
+	const reportedContainers = /* @__PURE__ */ new Set();
+	for (const { path, reason, widens } of paths) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0) continue;
+		if (value === UNREADABLE_SANDBOX_PATH) {
+			const label = findUnreadableContainer({
+				sandbox,
+				path
+			});
+			if (label === void 0 || reportedContainers.has(label)) continue;
+			reportedContainers.add(label);
+			entries.push({
+				label,
+				reason: UNREADABLE_CONTAINER_REASON
+			});
+			continue;
+		}
+		if (!widens(value)) continue;
+		entries.push({
+			label: `sandbox.${path.join(".")}`,
+			reason
+		});
+	}
+	return entries;
+}
+/** The reason printed for a container that hides the settings underneath it. */
+const UNREADABLE_CONTAINER_REASON = "is not the object it has to be, so nothing under it can be checked for what it opens";
+/**
+* The prefix of `path` that {@link readSandboxPath} could not walk past, as a
+* label. `undefined` when the walk was not blocked at all. Callers that report
+* an unreadable path name the container rather than the leaf, because the leaf
+* is not what the file actually holds.
+*/
+function findUnreadableContainer({ sandbox, path }) {
+	let cursor = sandbox;
+	const walked = [];
+	for (const segment of path) {
+		if (cursor === void 0) return void 0;
+		if (!isRecord$1(cursor)) return walked.length === 0 ? "sandbox" : `sandbox.${walked.join(".")}`;
+		walked.push(segment);
+		cursor = cursor[segment];
+	}
+}
+/**
+* The reason printed for a value the file held in a shape that cannot be read,
+* which this generate is about to replace. `shape` names what the tool documents
+* there, so the message says which expectation the file's value missed.
+*/
+const replacedUnreadableReason = ({ shape, toolLabel }) => `replaces a value already in the file that is not the ${shape} ${toolLabel} documents, so what it restricted cannot be read`;
+/**
+* The restrictions this generate would weaken, compared between the `sandbox`
+* already in the file and the one about to replace it. A `before` that is
+* present but not a list is reported outright: a shape the tool may still honor
+* is not something to go quiet about just because it cannot be diffed. Shared by
+* every tool whose override replaces a restricting list whole rather than
+* merging into it — Claude Code needs no equivalent, because it merges its lists
+* across settings scopes, so a file can only ever add to them.
+*/
+function collectRestrictionLosingSandboxEntries({ existing, merged, paths, toolLabel }) {
+	const entries = [];
+	const reportedContainers = /* @__PURE__ */ new Set();
+	for (const { path, reason, loosens } of paths) {
+		const before = readSandboxPath({
+			sandbox: existing,
+			path
+		});
+		if (before === void 0) continue;
+		const [rootKey] = path;
+		if (rootKey !== void 0 && existing[rootKey] === merged[rootKey]) continue;
+		const after = readSandboxPath({
+			sandbox: merged,
+			path
+		});
+		const label = `sandbox.${path.join(".")}`;
+		if (before === UNREADABLE_SANDBOX_PATH) {
+			const container = findUnreadableContainer({
+				sandbox: existing,
+				path
+			});
+			if (container === void 0 || reportedContainers.has(container)) continue;
+			reportedContainers.add(container);
+			entries.push({
+				label: container,
+				reason: replacedUnreadableReason({
+					shape: "object",
+					toolLabel
+				})
+			});
+			continue;
+		}
+		if (!Array.isArray(before)) {
+			entries.push({
+				label,
+				reason: replacedUnreadableReason({
+					shape: "list",
+					toolLabel
+				})
+			});
+			continue;
+		}
+		if (before.length === 0) continue;
+		if (!loosens({
+			before,
+			after: Array.isArray(after) ? after : []
+		})) continue;
+		entries.push({
+			label,
+			reason
+		});
+	}
+	return entries;
+}
+/**
+* The one warning that names every trust-affecting setting this generate wrote
+* to `relativeFilePath`. Emitted once per file: the individual reasons are what
+* matter, but the "review this as you would a hook" framing only needs saying
+* once, and repeating it per key buries the reasons in boilerplate. `noun` lets
+* a tool whose entries are not all additions call them something more accurate
+* than "setting".
+*/
+function warnOnTrustAffectingEntries({ toolLabel, noun = "setting", entries, relativeFilePath, logger }) {
+	if (entries.length === 0) return;
+	const one = entries.length === 1;
+	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
+	logger?.warn(`${toolLabel} permissions: writing ${entries.length} trust-affecting ${noun}${one ? "" : "s"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
+}
+//#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Claude Code tool names (PascalCase).
@@ -36328,19 +36600,6 @@ function parseClaudePermissionEntry(entry) {
 	};
 }
 /**
-* Claude Code's file permission checks match only `Edit(path)` and `Read(path)`
-* rules. A `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rule "is accepted
-* but never matched by those checks, so Claude Code warns at startup for each
-* allow, deny, or ask rule in one of these unmatched forms" — so a canonical
-* `write`/`notebookedit`/`glob` rule with a pattern is emitted in the form the
-* docs prescribe instead. A tool-name rule with no path is unaffected: it
-* matches the tool everywhere and produces no warning.
-* @see https://code.claude.com/docs/en/permissions
-*/
-function isPlainRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
 * Merge `patch` into `base`, recursing into plain objects so a sibling key at
 * any depth survives. Arrays and scalars are replaced, since a list the author
 * states is the list they mean.
@@ -36350,7 +36609,7 @@ function deepMergeRecords(base, patch) {
 	for (const [key, value] of Object.entries(patch)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 		const existing = merged[key];
-		merged[key] = isPlainRecord(existing) && isPlainRecord(value) ? deepMergeRecords(existing, value) : value;
+		merged[key] = isRecord$1(existing) && isRecord$1(value) ? deepMergeRecords(existing, value) : value;
 	}
 	return merged;
 }
@@ -36415,13 +36674,11 @@ const CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS = [["filesystem", "allowManagedReadP
 * traversed rather than silently skipped.
 */
 function resolveSandboxParent({ root, segments }) {
-	let parent = root;
-	for (const segment of segments) {
-		const next = parent[segment];
-		if (!isPlainRecord(next)) return void 0;
-		parent = next;
-	}
-	return parent;
+	const resolved = readSandboxPath({
+		sandbox: root,
+		path: segments
+	});
+	return isRecord$1(resolved) ? resolved : void 0;
 }
 /**
 * Deletes `path` from `target` in place and reports whether anything was there,
@@ -36455,18 +36712,6 @@ function deleteSandboxPath({ target, path }) {
 	return true;
 }
 /**
-* The one warning that names every trust-affecting setting this generate wrote
-* to `relativeFilePath`. Emitted once per file: the individual reasons are what
-* matter, but the "review this as you would a hook" framing only needs saying
-* once, and repeating it per key buries the reasons in boilerplate.
-*/
-function warnOnTrustAffectingEntries({ entries, relativeFilePath, logger }) {
-	if (entries.length === 0) return;
-	const one = entries.length === 1;
-	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
-	logger?.warn(`Claude Code permissions: writing ${entries.length} trust-affecting ${one ? "setting" : "settings"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
-}
-/**
 * The `permissions.defaultMode` values that start a session with fewer prompts
 * than the default. `plan` and `default` are absent because they do not widen
 * anything.
@@ -36511,18 +36756,6 @@ const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
 	["socatPath"]
 ];
 /**
-* The predicates the "which value actually widens?" tables are built from.
-* Each names the value that does *not* widen and reports everything else, never
-* the reverse: the override is authored JSONC, so a key can carry any value at
-* all, and one Claude Code coerces is still honored. Reporting an off-type value
-* keeps the warning fail-safe — silence has to mean "this cannot loosen
-* anything", not "this is not the type the table expected".
-*/
-const isNotFalse = (value) => value !== false;
-const isNotTrue = (value) => value !== true;
-const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
-const isNonEmptyMap = (value) => !isPlainRecord(value) || Object.keys(value).length > 0;
-/**
 * `sandbox` paths that loosen the sandbox rather than naming something to run:
 * they let commands out of it, weaken the isolation it provides, or redirect
 * where its traffic goes. They are written like `env` is — the ordinary uses are
@@ -36625,30 +36858,6 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		widens: () => true
 	}
 ];
-/**
-* Every authored `sandbox` path that loosens the sandbox. Nothing is removed —
-* the values are written, just not silently. Called on the filtered `sandbox`
-* so it never claims to be writing a path the scope filters dropped.
-*/
-function collectTrustAffectingSandboxPaths({ sandbox }) {
-	const entries = [];
-	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
-		const leaf = path.at(-1);
-		if (leaf === void 0) continue;
-		const parent = resolveSandboxParent({
-			root: sandbox,
-			segments: path.slice(0, -1)
-		});
-		if (parent === void 0) continue;
-		const value = parent[leaf];
-		if (value === void 0 || !widens(value)) continue;
-		entries.push({
-			label: `sandbox.${path.join(".")}`,
-			reason
-		});
-	}
-	return entries;
-}
 /** Paths that name an executable Claude Code runs. Refused in both scopes. */
 const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL = {
 	paths: CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS,
@@ -36719,13 +36928,13 @@ const CLAUDECODE_MASKABLE_CREDENTIAL_LISTS = ["envVars", "files"];
 */
 function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
 	const credentials = sandbox.credentials;
-	if (!isPlainRecord(credentials)) return sandbox;
+	if (!isRecord$1(credentials)) return sandbox;
 	const filteredCredentials = { ...credentials };
 	let changed = false;
 	for (const listKey of CLAUDECODE_MASKABLE_CREDENTIAL_LISTS) {
 		const list = filteredCredentials[listKey];
 		if (!Array.isArray(list)) continue;
-		const kept = list.filter((entry) => !(isPlainRecord(entry) && entry.mode === "mask"));
+		const kept = list.filter((entry) => !(isRecord$1(entry) && entry.mode === "mask"));
 		if (kept.length === list.length) continue;
 		changed = true;
 		const dropped = list.length - kept.length;
@@ -37004,6 +37213,16 @@ function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logge
 		trustAffecting
 	};
 }
+/**
+* Claude Code's file permission checks match only `Edit(path)` and `Read(path)`
+* rules. A `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rule "is accepted
+* but never matched by those checks, so Claude Code warns at startup for each
+* allow, deny, or ask rule in one of these unmatched forms" — so a canonical
+* `write`/`notebookedit`/`glob` rule with a pattern is emitted in the form the
+* docs prescribe instead. A tool-name rule with no path is unaffected: it
+* matches the tool everywhere and produces no warning.
+* @see https://code.claude.com/docs/en/permissions
+*/
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -37084,7 +37303,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			};
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
-		if (isPlainRecord(overrideSandbox)) {
+		if (isRecord$1(overrideSandbox)) {
 			const honorableSandbox = stripSandboxPaths({
 				sandbox: overrideSandbox,
 				refusals: [
@@ -37100,8 +37319,11 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
-			trustAffecting.push(...collectTrustAffectingSandboxPaths({ sandbox: scopedSandbox }));
-			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
+			trustAffecting.push(...collectTrustAffectingSandboxPaths({
+				sandbox: scopedSandbox,
+				paths: CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS
+			}));
+			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isRecord$1(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
 		const overrideTopLevel = {};
 		for (const [key, value] of Object.entries(config.claudecode ?? {})) {
@@ -37119,8 +37341,9 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		trustAffecting.push(...trustAffectingTopLevel);
 		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
 		warnOnTrustAffectingEntries({
+			toolLabel: "Claude Code",
 			entries: trustAffecting,
-			relativeFilePath: paths.relativeFilePath,
+			relativeFilePath: toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)),
 			logger
 		});
 		const managedToolNames = managedClaudeToolNames(config);
@@ -37163,7 +37386,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		const nonListFields = Object.fromEntries(Object.entries(permissionsRest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
 		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		const { sandbox } = settings;
-		if (isPlainRecord(sandbox)) {
+		if (isRecord$1(sandbox)) {
 			const importedSandbox = structuredClone(sandbox);
 			for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) deleteSandboxPath({
 				target: importedSandbox,
@@ -39416,6 +39639,80 @@ function buildDevinPermissionEntry(scope, pattern) {
 	if (pattern === "*") return scope;
 	return `${scope}(${pattern})`;
 }
+function asDevinRecord(value) {
+	return isRecord$1(value) ? { ...value } : {};
+}
+/**
+* `sandbox` paths whose authored value loosens the sandbox on its own: they let
+* a command out of it, or widen what a command left inside it may reach. They
+* are written — the ordinary uses are far too common to refuse — but never
+* silently, because a permissions file is shareable (`rulesync fetch` copies one
+* into a project) and should not be able to open the sandbox without saying so.
+* This is the same stance `CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS` takes for
+* the equivalent Claude Code keys, and `widens` follows the same convention of
+* naming the restrictive value rather than the permissive ones, so a spelling
+* Devin does not recognize is reported rather than waved through.
+*
+* The three keys that restrict — `allowed_domains` (an allowlist only while it
+* has entries), `denied_domains` and `excluded.deny` — are not here: they loosen
+* by losing entries, which `DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS` covers.
+*
+* @see https://docs.devin.ai/cli/sandbox
+*/
+const DEVIN_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["network_mode"],
+		reason: "anything but 'limited' lets sandboxed requests use every HTTP method, not just GET/HEAD/OPTIONS",
+		widens: (value) => value !== "limited"
+	},
+	{
+		path: ["excluded", "allow"],
+		reason: "names commands that run outside the sandbox with no prompt and no sandbox policy",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["excluded", "ask"],
+		reason: "names commands that run outside the sandbox once confirmed, with no sandbox policy",
+		widens: isNonEmptyList
+	}
+];
+/** How Devin is named in the warnings this file emits. */
+const DEVIN_TOOL_LABEL = "Devin";
+/**
+* `sandbox` paths that restrict, and that therefore loosen the policy by losing
+* entries rather than by holding a value. Devin's config is one file rather than
+* a stack of settings scopes, and the override is shallow-merged over the
+* existing `sandbox` at its top level: each of these lists is replaced whole,
+* and `excluded.deny` vanishes as soon as the override states any other
+* `excluded` key. Losing an entry has the same effect as adding one to the
+* permissive keys above, so it is announced the same way. Claude Code needs no
+* equivalent — it merges its lists across settings scopes, so a file can only
+* ever add to them.
+*
+* `loosens` is asked only about a `before` that actually restricted something,
+* and the two directions are not symmetric: `allowed_domains` restricts by
+* listing what is reachable, so it loosens by gaining entries or by emptying
+* out altogether, while the deny lists loosen by losing entries.
+*
+* @see https://docs.devin.ai/cli/sandbox
+*/
+const DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS = [
+	{
+		path: ["allowed_domains"],
+		reason: "adds to the proxy allowlist already in the file, or empties it so every domain becomes reachable again",
+		loosens: ({ before, after }) => after.length === 0 || after.some((entry) => !before.includes(entry))
+	},
+	{
+		path: ["denied_domains"],
+		reason: "drops domains the deny list already in the file kept out of reach",
+		loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+	},
+	{
+		path: ["excluded", "deny"],
+		reason: "drops commands the list already in the file pinned inside the sandbox",
+		loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+	}
+];
 /**
 * Permissions generator for Devin Local (native `.devin/` configuration).
 *
@@ -39431,10 +39728,18 @@ function buildDevinPermissionEntry(scope, pattern) {
 *
 * In global mode the config file is shared with the hooks (`hooks`) feature
 * (MCP moved to the dedicated mcp_config.json in v3000.3), so reads and writes
-* merge into the existing JSON and the file is never deleted; only the managed
-* `permissions` key is rewritten.
+* merge into the existing JSON and the file is never deleted; only the keys
+* this feature manages are rewritten — `permissions`, plus `sandbox` in global
+* mode when the `devin` override authors it.
+*
+* The sibling `sandbox` block — which decides what a permitted command may
+* reach rather than which commands are permitted — has no canonical category
+* and is authored through the `devin` override in `.rulesync/permissions.jsonc`.
+* Devin documents it as a user-config-only key, so it is written at global
+* scope only.
 *
 * @see https://docs.devin.ai/cli/reference/permissions
+* @see https://docs.devin.ai/cli/sandbox
 */
 var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	constructor(params) {
@@ -39445,7 +39750,8 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 	/**
 	* config.json may carry the MCP/hooks features' keys, so it is never deleted;
-	* only the managed `permissions` key is rewritten.
+	* only the keys this feature manages are rewritten — `permissions`, plus
+	* `sandbox` in global mode when the `devin` override authors it.
 	*/
 	isDeletable() {
 		return false;
@@ -39471,7 +39777,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			validate
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, validate = true }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, validate = true, logger }) {
 		const paths = DevinPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
@@ -39497,6 +39803,46 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 		else delete mergedPermissions.ask;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const patch = { permissions: mergedPermissions };
+		const authoredSandbox = config.devin?.sandbox;
+		if (authoredSandbox !== void 0) {
+			const authoredSandboxRecord = asDevinRecord(authoredSandbox);
+			if (global) {
+				const existingSandbox = asDevinRecord(settings.sandbox);
+				const mergedSandbox = {
+					...existingSandbox,
+					...authoredSandboxRecord
+				};
+				const writesSandbox = Object.keys(mergedSandbox).length > 0;
+				if (writesSandbox) patch.sandbox = mergedSandbox;
+				const replacesUnreadableSandbox = writesSandbox && settings.sandbox !== void 0 && !isRecord$1(settings.sandbox);
+				warnOnTrustAffectingEntries({
+					toolLabel: DEVIN_TOOL_LABEL,
+					noun: "sandbox change",
+					entries: [
+						...replacesUnreadableSandbox ? [{
+							label: "sandbox",
+							reason: replacedUnreadableReason({
+								shape: "object",
+								toolLabel: DEVIN_TOOL_LABEL
+							})
+						}] : [],
+						...collectTrustAffectingSandboxPaths({
+							sandbox: authoredSandboxRecord,
+							paths: DEVIN_TRUST_AFFECTING_SANDBOX_PATHS
+						}),
+						...collectRestrictionLosingSandboxEntries({
+							existing: existingSandbox,
+							merged: mergedSandbox,
+							paths: DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS,
+							toolLabel: DEVIN_TOOL_LABEL
+						})
+					],
+					relativeFilePath: toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)),
+					logger
+				});
+			} else if (Object.keys(authoredSandboxRecord).length > 0) logger?.warn("Devin reads 'sandbox' from the user config only, so the 'devin.sandbox' override was dropped from the project config. Generate with --global to author it.");
+		}
 		return new DevinPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -39505,7 +39851,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
 				existingContent,
-				patch: { permissions: mergedPermissions },
+				patch,
 				filePath
 			}),
 			validate
@@ -39525,7 +39871,10 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			ask: Array.isArray(permissions.ask) ? permissions.ask : [],
 			deny: Array.isArray(permissions.deny) ? permissions.deny : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asDevinRecord(settings.sandbox);
+		const result = { ...config };
+		if (Object.keys(sandbox).length > 0) result.devin = { sandbox };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -42473,6 +42822,137 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+/** How Reasonix is named in the warnings this file emits. */
+const REASONIX_TOOL_LABEL = "Reasonix";
+/** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
+const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/**
+* `[sandbox]` keys whose authored value loosens the enforcement layer beneath
+* the permission policy: they take Bash out of its OS jail, open that jail to
+* the network, or widen where the file-writing built-ins may write. Written —
+* the ordinary uses are far too common to refuse — but never silently, the same
+* stance `DEVIN_TRUST_AFFECTING_SANDBOX_PATHS` takes, and `widens` likewise
+* names the restrictive value so a spelling Reasonix does not recognize is
+* reported rather than waved through.
+*
+* `forbid_read` is not here: it restricts, so it loosens by losing entries
+* rather than by holding one, which needs the before/after comparison
+* {@link REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS} below does instead.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+const REASONIX_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["bash"],
+		reason: "anything but 'enforce' takes Bash out of the OS sandbox, so a command may write and read wherever the user can",
+		widens: (value) => value !== "enforce"
+	},
+	{
+		path: ["network"],
+		reason: "lets sandboxed Bash reach the network",
+		widens: isNotFalse
+	},
+	{
+		path: ["allow_write"],
+		reason: "adds directories the file-writing tools may modify outside the workspace root, which a headless run would otherwise refuse",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["workspace_root"],
+		reason: "moves the root the file-writing tools and sandboxed Bash are confined to, so what they may reach is decided by this path rather than by the project directory",
+		widens: escapesTheProject
+	}
+];
+/**
+* Whether a `workspace_root` points somewhere other than inside the project the
+* generate runs in. The key moves the write confinement rather than adding to
+* it, so the ordinary value — the project directory, spelled relatively — would
+* otherwise be announced on every generate; anything else is the case worth
+* naming, since it is how a fetched permissions file would put `~/.ssh` or
+* `C:\\Users\\<user>` inside the jail: an absolute path in either flavour, one
+* carrying a drive letter, a home-relative one, a shell or environment
+* expansion, and any path holding a `..` segment — even one that would land back
+* inside, since resolving it here would only be a guess at what Reasonix does.
+* Both path flavours are asked because the file is authored on one machine and
+* generated on another, so a Windows-shaped root reaching a POSIX check must not
+* read as relative. Anything that is not a string is reported, per the fail-safe
+* rule the predicates in `sandbox-trust.ts` follow.
+*/
+function escapesTheProject(value) {
+	if (typeof value !== "string") return true;
+	const trimmed = value.trim();
+	if (trimmed === "") return false;
+	if (trimmed.startsWith("~")) return true;
+	if (node_path.posix.isAbsolute(trimmed) || node_path.win32.isAbsolute(trimmed)) return true;
+	if (/^[A-Za-z]:/.test(trimmed)) return true;
+	if (trimmed.includes("$") || /%[^%]+%/.test(trimmed)) return true;
+	return trimmed.split(/[\\/]/).includes("..");
+}
+/**
+* The `[sandbox]` key that restricts, and so loosens by losing entries rather
+* than by holding a value. The override is shallow-merged over the existing
+* `[sandbox]` at its top level, so an authored `forbid_read` replaces the list
+* the file had whole — emptying it, or dropping the `${HOME}/.ssh` entry
+* Reasonix's own example recommends, opens exactly what the list kept closed.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+const REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS = [{
+	path: ["forbid_read"],
+	reason: "drops paths the list already in the file kept out of read, list and search",
+	loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+}];
+/**
+* Everything worth naming about the `[sandbox]` table this generate is about to
+* write: the authored values that loosen enforcement, the restrictions the
+* shallow merge would drop, and a `[sandbox]` the file holds in some shape other
+* than a table, which the write replaces wholesale. The widening check reads the
+* authored block alone — a loosening value the file already held is the user's
+* own, and re-announcing it on every generate would bury the values rulesync
+* actually wrote — while a loss can only be seen from both sides.
+*/
+function collectSandboxOverlayEntries({ existing, authored, merged }) {
+	return [
+		...existing !== void 0 && !isRecord$1(existing) ? [{
+			label: "sandbox",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}] : [],
+		...collectTrustAffectingSandboxPaths({
+			sandbox: asReasonixRecord(authored),
+			paths: REASONIX_TRUST_AFFECTING_SANDBOX_PATHS
+		}),
+		...collectRestrictionLosingSandboxEntries({
+			existing: asReasonixRecord(existing),
+			merged,
+			paths: REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS,
+			toolLabel: REASONIX_TOOL_LABEL
+		})
+	];
+}
+/**
+* Writes the override's `allow_dynamic_bash` into `[permissions]`, where it sits
+* beside allow/ask/deny rather than in a table of its own, and reports it when
+* it is being turned on: it widens what a shareable permissions file lets run
+* with no human in the loop. Only an authored value is written — leaving the key
+* out of the override keeps whatever the file already had — and turning it off
+* narrows, so that stays quiet. Only a literal `false` is quiet, not everything
+* falsy: `getJson()` casts rather than parses, so a `--no-validate` run can put
+* a value the schema forbids here, and a value Reasonix might still coerce is
+* not something to write in silence. The entries are returned rather than logged so
+* one generate still produces one warning naming everything it wrote.
+*/
+function applyAllowDynamicBash({ permissions, authored }) {
+	if (authored === void 0) return [];
+	permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY] = authored;
+	if (!isNotFalse(authored)) return [];
+	return [{
+		label: `permissions.${REASONIX_ALLOW_DYNAMIC_BASH_KEY}`,
+		reason: "lets an Allow fallback, Auto included, run the nested and indirect Bash that otherwise needs a human or an exact-literal grant — command and process substitution, a dynamic command name, 'eval', 'source', 'sh -c' and their kind"
+	}];
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -42529,6 +43009,7 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const relativeFilePathForLog = toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath));
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const parsed = parseReasonixConfig(existingContent);
 		const config = rulesyncPermissions.getJson();
@@ -42573,11 +43054,23 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...deny,
 			...rawDeny
 		]);
+		const trustAffecting = applyAllowDynamicBash({
+			permissions: mergedPermissions,
+			authored: override?.allowDynamicBash
+		});
 		const patch = { permissions: mergedPermissions };
-		if (override?.sandbox !== void 0) patch.sandbox = {
-			...asReasonixRecord(parsed.sandbox),
-			...asReasonixRecord(override.sandbox)
-		};
+		if (override?.sandbox !== void 0) {
+			const mergedSandbox = {
+				...asReasonixRecord(parsed.sandbox),
+				...asReasonixRecord(override.sandbox)
+			};
+			patch.sandbox = mergedSandbox;
+			trustAffecting.push(...collectSandboxOverlayEntries({
+				existing: parsed.sandbox,
+				authored: override.sandbox,
+				merged: mergedSandbox
+			}));
+		}
 		if (override?.agent !== void 0) {
 			const mergedAgent = {
 				...asReasonixRecord(parsed.agent),
@@ -42585,9 +43078,16 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			};
 			const retired = REASONIX_RETIRED_AGENT_KEYS.filter((key) => mergedAgent[key] !== void 0);
 			for (const key of retired) delete mergedAgent[key];
-			if (retired.length > 0) logger?.warn(`Reasonix permissions: removing ${retired.map((key) => `"${key}"`).join(", ")} from [agent] in ${filePath}; Reasonix took the key off its config surface in v1.17.18, so what it used to express now belongs in the shared \`permission\` block.`);
+			if (retired.length > 0) logger?.warn(`Reasonix permissions: removing ${retired.map((key) => `"${key}"`).join(", ")} from [agent] in ${relativeFilePathForLog}; Reasonix took the key off its config surface in v1.17.18, so what it used to express now belongs in the shared \`permission\` block.`);
 			patch.agent = mergedAgent;
 		}
+		warnOnTrustAffectingEntries({
+			toolLabel: REASONIX_TOOL_LABEL,
+			noun: "change",
+			entries: trustAffecting,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		});
 		return new ReasonixPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -42622,6 +43122,8 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const sandbox = asReasonixRecord(this.toml.sandbox);
 		const agentPlanMode = pickReasonixKeys(this.toml.agent, [...REASONIX_OVERRIDE_AGENT_KEYS, ...REASONIX_RETIRED_AGENT_KEYS]);
 		const reasonixOverride = {};
+		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
+		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;