rulesync 16.22.1 → 16.23.0

package/dist/{import-DUE1P1zV.js → import-DIDEUv63.js}

@@ -6674,6 +6674,8 @@ const QwencodePermissionsOverrideSchema = z.looseObject({
 *
 * @example
 * { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+* @example
+* { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 */
 const ReasonixPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
@@ -6681,7 +6683,8 @@ const ReasonixPermissionsOverrideSchema = z.looseObject({
 	agent: z.optional(z.looseObject({})),
 	rawAllow: z.optional(z.array(z.string())),
 	rawAsk: z.optional(z.array(z.string())),
-	rawDeny: z.optional(z.array(z.string()))
+	rawDeny: z.optional(z.array(z.string())),
+	allowDynamicBash: z.optional(z.boolean())
 });
 /**
 * Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
@@ -7325,6 +7328,32 @@ const ZedPermissionsOverrideSchema = z.looseObject({
 	})))
 });
 /**
+* Tool-scoped override block for Devin Local. `sandbox` is the sibling
+* top-level `config.json` block that governs the sandbox Devin runs commands
+* in: `allowed_domains` / `denied_domains` (proxy domain patterns, deny beating
+* allow), `network_mode` (`full`, the upstream default, allows every HTTP
+* method; `limited` only GET/HEAD/OPTIONS) and `excluded` (`allow` / `ask` /
+* `deny` lists of `Exec(...)` matchers deciding which commands run *outside* the
+* sandbox — `deny` pins them inside it). It constrains how
+* a permitted command runs rather than which commands are permitted, so it has
+* no canonical category and is authored here.
+*
+* Upstream lists `sandbox` as a **User Config Only** key, so it is emitted at
+* global scope only; at project scope it is dropped with a warning rather than
+* written into a file Devin would ignore.
+*
+* @example
+* { "sandbox": { "allowed_domains": ["github.com"], "network_mode": "limited" } }
+* @example
+* { "sandbox": { "excluded": { "allow": ["Exec(git status *)"], "deny": ["Exec(git tag *)"] } } }
+* @see https://docs.devin.ai/cli/sandbox
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+const DevinPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	sandbox: z.optional(z.looseObject({}))
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
@@ -7374,10 +7403,10 @@ const PermissionsConfigSchema = z.looseObject({
 	kiro: z.optional(KiroPermissionsOverrideSchema),
 	codexcli: z.optional(CodexcliPermissionsOverrideSchema),
 	zed: z.optional(ZedPermissionsOverrideSchema),
+	devin: z.optional(DevinPermissionsOverrideSchema),
 	"antigravity-ide": z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: z.optional(CanonicalPermissionsOverrideSchema),
 	copilotcli: z.optional(CanonicalPermissionsOverrideSchema),
-	devin: z.optional(CanonicalPermissionsOverrideSchema),
 	goose: z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": z.optional(KimiCodePermissionsOverrideSchema),
@@ -12603,7 +12632,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions"]
+				ownedKeys: ["permissions", "sandbox"]
 			}
 		}
 	},
@@ -36324,6 +36353,180 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	return { permission };
 }
 //#endregion
+//#region src/features/permissions/sandbox-trust.ts
+/** A key whose quiet value is an explicit `false`. */
+const isNotFalse = (value) => value !== false;
+/** A key whose quiet value is an explicit `true`. */
+const isNotTrue = (value) => value !== true;
+/** A list-valued key whose quiet value is the empty list. */
+const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
+/** The map-valued counterpart of {@link isNonEmptyList}. */
+const isNonEmptyMap = (value) => !isRecord$1(value) || Object.keys(value).length > 0;
+/**
+* What {@link readSandboxPath} returns when a container on the way to the leaf
+* is present but is not an object, so the leaf cannot be read at all. It is not
+* `undefined`, because the two mean opposite things to a caller: `undefined` is
+* "this path is not being written", while this is "something is being written
+* here and its shape hides what". The same fail-safe rule the predicates follow
+* applies to the walk — silence must mean "this cannot loosen anything", not
+* "this is not the shape the table expected".
+*/
+const UNREADABLE_SANDBOX_PATH = Symbol("unreadable-sandbox-path");
+/**
+* Reads `sandbox` at `path`. Returns `undefined` when a segment is absent, and
+* {@link UNREADABLE_SANDBOX_PATH} when one is present but is not an object.
+* Shared by everything that addresses a `sandbox` path so a nested path added to
+* one of the tables is actually traversed rather than silently skipped, and so a
+* hostile shape (an array, a string, `null`) is reported rather than throwing.
+*/
+function readSandboxPath({ sandbox, path }) {
+	let cursor = sandbox;
+	for (const segment of path) {
+		if (cursor === void 0) return void 0;
+		if (!isRecord$1(cursor)) return UNREADABLE_SANDBOX_PATH;
+		cursor = cursor[segment];
+	}
+	return cursor;
+}
+/**
+* Every path in `paths` whose value in `sandbox` loosens the policy. Nothing is
+* removed — the values are written, just not silently. Call it on the block this
+* generate authored, after any scope filter has run: a value the file already
+* held is the user's own, not something rulesync opened, and a path a filter
+* dropped is not being written at all.
+*/
+function collectTrustAffectingSandboxPaths({ sandbox, paths }) {
+	const entries = [];
+	const reportedContainers = /* @__PURE__ */ new Set();
+	for (const { path, reason, widens } of paths) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0) continue;
+		if (value === UNREADABLE_SANDBOX_PATH) {
+			const label = findUnreadableContainer({
+				sandbox,
+				path
+			});
+			if (label === void 0 || reportedContainers.has(label)) continue;
+			reportedContainers.add(label);
+			entries.push({
+				label,
+				reason: UNREADABLE_CONTAINER_REASON
+			});
+			continue;
+		}
+		if (!widens(value)) continue;
+		entries.push({
+			label: `sandbox.${path.join(".")}`,
+			reason
+		});
+	}
+	return entries;
+}
+/** The reason printed for a container that hides the settings underneath it. */
+const UNREADABLE_CONTAINER_REASON = "is not the object it has to be, so nothing under it can be checked for what it opens";
+/**
+* The prefix of `path` that {@link readSandboxPath} could not walk past, as a
+* label. `undefined` when the walk was not blocked at all. Callers that report
+* an unreadable path name the container rather than the leaf, because the leaf
+* is not what the file actually holds.
+*/
+function findUnreadableContainer({ sandbox, path }) {
+	let cursor = sandbox;
+	const walked = [];
+	for (const segment of path) {
+		if (cursor === void 0) return void 0;
+		if (!isRecord$1(cursor)) return walked.length === 0 ? "sandbox" : `sandbox.${walked.join(".")}`;
+		walked.push(segment);
+		cursor = cursor[segment];
+	}
+}
+/**
+* The reason printed for a value the file held in a shape that cannot be read,
+* which this generate is about to replace. `shape` names what the tool documents
+* there, so the message says which expectation the file's value missed.
+*/
+const replacedUnreadableReason = ({ shape, toolLabel }) => `replaces a value already in the file that is not the ${shape} ${toolLabel} documents, so what it restricted cannot be read`;
+/**
+* The restrictions this generate would weaken, compared between the `sandbox`
+* already in the file and the one about to replace it. A `before` that is
+* present but not a list is reported outright: a shape the tool may still honor
+* is not something to go quiet about just because it cannot be diffed. Shared by
+* every tool whose override replaces a restricting list whole rather than
+* merging into it — Claude Code needs no equivalent, because it merges its lists
+* across settings scopes, so a file can only ever add to them.
+*/
+function collectRestrictionLosingSandboxEntries({ existing, merged, paths, toolLabel }) {
+	const entries = [];
+	const reportedContainers = /* @__PURE__ */ new Set();
+	for (const { path, reason, loosens } of paths) {
+		const before = readSandboxPath({
+			sandbox: existing,
+			path
+		});
+		if (before === void 0) continue;
+		const [rootKey] = path;
+		if (rootKey !== void 0 && existing[rootKey] === merged[rootKey]) continue;
+		const after = readSandboxPath({
+			sandbox: merged,
+			path
+		});
+		const label = `sandbox.${path.join(".")}`;
+		if (before === UNREADABLE_SANDBOX_PATH) {
+			const container = findUnreadableContainer({
+				sandbox: existing,
+				path
+			});
+			if (container === void 0 || reportedContainers.has(container)) continue;
+			reportedContainers.add(container);
+			entries.push({
+				label: container,
+				reason: replacedUnreadableReason({
+					shape: "object",
+					toolLabel
+				})
+			});
+			continue;
+		}
+		if (!Array.isArray(before)) {
+			entries.push({
+				label,
+				reason: replacedUnreadableReason({
+					shape: "list",
+					toolLabel
+				})
+			});
+			continue;
+		}
+		if (before.length === 0) continue;
+		if (!loosens({
+			before,
+			after: Array.isArray(after) ? after : []
+		})) continue;
+		entries.push({
+			label,
+			reason
+		});
+	}
+	return entries;
+}
+/**
+* The one warning that names every trust-affecting setting this generate wrote
+* to `relativeFilePath`. Emitted once per file: the individual reasons are what
+* matter, but the "review this as you would a hook" framing only needs saying
+* once, and repeating it per key buries the reasons in boilerplate. `noun` lets
+* a tool whose entries are not all additions call them something more accurate
+* than "setting".
+*/
+function warnOnTrustAffectingEntries({ toolLabel, noun = "setting", entries, relativeFilePath, logger }) {
+	if (entries.length === 0) return;
+	const one = entries.length === 1;
+	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
+	logger?.warn(`${toolLabel} permissions: writing ${entries.length} trust-affecting ${noun}${one ? "" : "s"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
+}
+//#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Claude Code tool names (PascalCase).
@@ -36372,19 +36575,6 @@ function parseClaudePermissionEntry(entry) {
 	};
 }
 /**
-* Claude Code's file permission checks match only `Edit(path)` and `Read(path)`
-* rules. A `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rule "is accepted
-* but never matched by those checks, so Claude Code warns at startup for each
-* allow, deny, or ask rule in one of these unmatched forms" — so a canonical
-* `write`/`notebookedit`/`glob` rule with a pattern is emitted in the form the
-* docs prescribe instead. A tool-name rule with no path is unaffected: it
-* matches the tool everywhere and produces no warning.
-* @see https://code.claude.com/docs/en/permissions
-*/
-function isPlainRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
 * Merge `patch` into `base`, recursing into plain objects so a sibling key at
 * any depth survives. Arrays and scalars are replaced, since a list the author
 * states is the list they mean.
@@ -36394,7 +36584,7 @@ function deepMergeRecords(base, patch) {
 	for (const [key, value] of Object.entries(patch)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 		const existing = merged[key];
-		merged[key] = isPlainRecord(existing) && isPlainRecord(value) ? deepMergeRecords(existing, value) : value;
+		merged[key] = isRecord$1(existing) && isRecord$1(value) ? deepMergeRecords(existing, value) : value;
 	}
 	return merged;
 }
@@ -36459,13 +36649,11 @@ const CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS = [["filesystem", "allowManagedReadP
 * traversed rather than silently skipped.
 */
 function resolveSandboxParent({ root, segments }) {
-	let parent = root;
-	for (const segment of segments) {
-		const next = parent[segment];
-		if (!isPlainRecord(next)) return void 0;
-		parent = next;
-	}
-	return parent;
+	const resolved = readSandboxPath({
+		sandbox: root,
+		path: segments
+	});
+	return isRecord$1(resolved) ? resolved : void 0;
 }
 /**
 * Deletes `path` from `target` in place and reports whether anything was there,
@@ -36499,18 +36687,6 @@ function deleteSandboxPath({ target, path }) {
 	return true;
 }
 /**
-* The one warning that names every trust-affecting setting this generate wrote
-* to `relativeFilePath`. Emitted once per file: the individual reasons are what
-* matter, but the "review this as you would a hook" framing only needs saying
-* once, and repeating it per key buries the reasons in boilerplate.
-*/
-function warnOnTrustAffectingEntries({ entries, relativeFilePath, logger }) {
-	if (entries.length === 0) return;
-	const one = entries.length === 1;
-	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
-	logger?.warn(`Claude Code permissions: writing ${entries.length} trust-affecting ${one ? "setting" : "settings"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
-}
-/**
 * The `permissions.defaultMode` values that start a session with fewer prompts
 * than the default. `plan` and `default` are absent because they do not widen
 * anything.
@@ -36555,18 +36731,6 @@ const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
 	["socatPath"]
 ];
 /**
-* The predicates the "which value actually widens?" tables are built from.
-* Each names the value that does *not* widen and reports everything else, never
-* the reverse: the override is authored JSONC, so a key can carry any value at
-* all, and one Claude Code coerces is still honored. Reporting an off-type value
-* keeps the warning fail-safe — silence has to mean "this cannot loosen
-* anything", not "this is not the type the table expected".
-*/
-const isNotFalse = (value) => value !== false;
-const isNotTrue = (value) => value !== true;
-const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
-const isNonEmptyMap = (value) => !isPlainRecord(value) || Object.keys(value).length > 0;
-/**
 * `sandbox` paths that loosen the sandbox rather than naming something to run:
 * they let commands out of it, weaken the isolation it provides, or redirect
 * where its traffic goes. They are written like `env` is — the ordinary uses are
@@ -36669,30 +36833,6 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		widens: () => true
 	}
 ];
-/**
-* Every authored `sandbox` path that loosens the sandbox. Nothing is removed —
-* the values are written, just not silently. Called on the filtered `sandbox`
-* so it never claims to be writing a path the scope filters dropped.
-*/
-function collectTrustAffectingSandboxPaths({ sandbox }) {
-	const entries = [];
-	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
-		const leaf = path.at(-1);
-		if (leaf === void 0) continue;
-		const parent = resolveSandboxParent({
-			root: sandbox,
-			segments: path.slice(0, -1)
-		});
-		if (parent === void 0) continue;
-		const value = parent[leaf];
-		if (value === void 0 || !widens(value)) continue;
-		entries.push({
-			label: `sandbox.${path.join(".")}`,
-			reason
-		});
-	}
-	return entries;
-}
 /** Paths that name an executable Claude Code runs. Refused in both scopes. */
 const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL = {
 	paths: CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS,
@@ -36763,13 +36903,13 @@ const CLAUDECODE_MASKABLE_CREDENTIAL_LISTS = ["envVars", "files"];
 */
 function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
 	const credentials = sandbox.credentials;
-	if (!isPlainRecord(credentials)) return sandbox;
+	if (!isRecord$1(credentials)) return sandbox;
 	const filteredCredentials = { ...credentials };
 	let changed = false;
 	for (const listKey of CLAUDECODE_MASKABLE_CREDENTIAL_LISTS) {
 		const list = filteredCredentials[listKey];
 		if (!Array.isArray(list)) continue;
-		const kept = list.filter((entry) => !(isPlainRecord(entry) && entry.mode === "mask"));
+		const kept = list.filter((entry) => !(isRecord$1(entry) && entry.mode === "mask"));
 		if (kept.length === list.length) continue;
 		changed = true;
 		const dropped = list.length - kept.length;
@@ -37048,6 +37188,16 @@ function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logge
 		trustAffecting
 	};
 }
+/**
+* Claude Code's file permission checks match only `Edit(path)` and `Read(path)`
+* rules. A `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rule "is accepted
+* but never matched by those checks, so Claude Code warns at startup for each
+* allow, deny, or ask rule in one of these unmatched forms" — so a canonical
+* `write`/`notebookedit`/`glob` rule with a pattern is emitted in the form the
+* docs prescribe instead. A tool-name rule with no path is unaffected: it
+* matches the tool everywhere and produces no warning.
+* @see https://code.claude.com/docs/en/permissions
+*/
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -37128,7 +37278,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			};
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
-		if (isPlainRecord(overrideSandbox)) {
+		if (isRecord$1(overrideSandbox)) {
 			const honorableSandbox = stripSandboxPaths({
 				sandbox: overrideSandbox,
 				refusals: [
@@ -37144,8 +37294,11 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
-			trustAffecting.push(...collectTrustAffectingSandboxPaths({ sandbox: scopedSandbox }));
-			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
+			trustAffecting.push(...collectTrustAffectingSandboxPaths({
+				sandbox: scopedSandbox,
+				paths: CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS
+			}));
+			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isRecord$1(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
 		const overrideTopLevel = {};
 		for (const [key, value] of Object.entries(config.claudecode ?? {})) {
@@ -37163,8 +37316,9 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		trustAffecting.push(...trustAffectingTopLevel);
 		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
 		warnOnTrustAffectingEntries({
+			toolLabel: "Claude Code",
 			entries: trustAffecting,
-			relativeFilePath: paths.relativeFilePath,
+			relativeFilePath: toPosixPath(join(paths.relativeDirPath, paths.relativeFilePath)),
 			logger
 		});
 		const managedToolNames = managedClaudeToolNames(config);
@@ -37207,7 +37361,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		const nonListFields = Object.fromEntries(Object.entries(permissionsRest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
 		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		const { sandbox } = settings;
-		if (isPlainRecord(sandbox)) {
+		if (isRecord$1(sandbox)) {
 			const importedSandbox = structuredClone(sandbox);
 			for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) deleteSandboxPath({
 				target: importedSandbox,
@@ -39460,6 +39614,80 @@ function buildDevinPermissionEntry(scope, pattern) {
 	if (pattern === "*") return scope;
 	return `${scope}(${pattern})`;
 }
+function asDevinRecord(value) {
+	return isRecord$1(value) ? { ...value } : {};
+}
+/**
+* `sandbox` paths whose authored value loosens the sandbox on its own: they let
+* a command out of it, or widen what a command left inside it may reach. They
+* are written — the ordinary uses are far too common to refuse — but never
+* silently, because a permissions file is shareable (`rulesync fetch` copies one
+* into a project) and should not be able to open the sandbox without saying so.
+* This is the same stance `CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS` takes for
+* the equivalent Claude Code keys, and `widens` follows the same convention of
+* naming the restrictive value rather than the permissive ones, so a spelling
+* Devin does not recognize is reported rather than waved through.
+*
+* The three keys that restrict — `allowed_domains` (an allowlist only while it
+* has entries), `denied_domains` and `excluded.deny` — are not here: they loosen
+* by losing entries, which `DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS` covers.
+*
+* @see https://docs.devin.ai/cli/sandbox
+*/
+const DEVIN_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["network_mode"],
+		reason: "anything but 'limited' lets sandboxed requests use every HTTP method, not just GET/HEAD/OPTIONS",
+		widens: (value) => value !== "limited"
+	},
+	{
+		path: ["excluded", "allow"],
+		reason: "names commands that run outside the sandbox with no prompt and no sandbox policy",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["excluded", "ask"],
+		reason: "names commands that run outside the sandbox once confirmed, with no sandbox policy",
+		widens: isNonEmptyList
+	}
+];
+/** How Devin is named in the warnings this file emits. */
+const DEVIN_TOOL_LABEL = "Devin";
+/**
+* `sandbox` paths that restrict, and that therefore loosen the policy by losing
+* entries rather than by holding a value. Devin's config is one file rather than
+* a stack of settings scopes, and the override is shallow-merged over the
+* existing `sandbox` at its top level: each of these lists is replaced whole,
+* and `excluded.deny` vanishes as soon as the override states any other
+* `excluded` key. Losing an entry has the same effect as adding one to the
+* permissive keys above, so it is announced the same way. Claude Code needs no
+* equivalent — it merges its lists across settings scopes, so a file can only
+* ever add to them.
+*
+* `loosens` is asked only about a `before` that actually restricted something,
+* and the two directions are not symmetric: `allowed_domains` restricts by
+* listing what is reachable, so it loosens by gaining entries or by emptying
+* out altogether, while the deny lists loosen by losing entries.
+*
+* @see https://docs.devin.ai/cli/sandbox
+*/
+const DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS = [
+	{
+		path: ["allowed_domains"],
+		reason: "adds to the proxy allowlist already in the file, or empties it so every domain becomes reachable again",
+		loosens: ({ before, after }) => after.length === 0 || after.some((entry) => !before.includes(entry))
+	},
+	{
+		path: ["denied_domains"],
+		reason: "drops domains the deny list already in the file kept out of reach",
+		loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+	},
+	{
+		path: ["excluded", "deny"],
+		reason: "drops commands the list already in the file pinned inside the sandbox",
+		loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+	}
+];
 /**
 * Permissions generator for Devin Local (native `.devin/` configuration).
 *
@@ -39475,10 +39703,18 @@ function buildDevinPermissionEntry(scope, pattern) {
 *
 * In global mode the config file is shared with the hooks (`hooks`) feature
 * (MCP moved to the dedicated mcp_config.json in v3000.3), so reads and writes
-* merge into the existing JSON and the file is never deleted; only the managed
-* `permissions` key is rewritten.
+* merge into the existing JSON and the file is never deleted; only the keys
+* this feature manages are rewritten — `permissions`, plus `sandbox` in global
+* mode when the `devin` override authors it.
+*
+* The sibling `sandbox` block — which decides what a permitted command may
+* reach rather than which commands are permitted — has no canonical category
+* and is authored through the `devin` override in `.rulesync/permissions.jsonc`.
+* Devin documents it as a user-config-only key, so it is written at global
+* scope only.
 *
 * @see https://docs.devin.ai/cli/reference/permissions
+* @see https://docs.devin.ai/cli/sandbox
 */
 var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	constructor(params) {
@@ -39489,7 +39725,8 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 	/**
 	* config.json may carry the MCP/hooks features' keys, so it is never deleted;
-	* only the managed `permissions` key is rewritten.
+	* only the keys this feature manages are rewritten — `permissions`, plus
+	* `sandbox` in global mode when the `devin` override authors it.
 	*/
 	isDeletable() {
 		return false;
@@ -39515,7 +39752,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			validate
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, validate = true }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, validate = true, logger }) {
 		const paths = DevinPermissions.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
@@ -39541,6 +39778,46 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 		else delete mergedPermissions.ask;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const patch = { permissions: mergedPermissions };
+		const authoredSandbox = config.devin?.sandbox;
+		if (authoredSandbox !== void 0) {
+			const authoredSandboxRecord = asDevinRecord(authoredSandbox);
+			if (global) {
+				const existingSandbox = asDevinRecord(settings.sandbox);
+				const mergedSandbox = {
+					...existingSandbox,
+					...authoredSandboxRecord
+				};
+				const writesSandbox = Object.keys(mergedSandbox).length > 0;
+				if (writesSandbox) patch.sandbox = mergedSandbox;
+				const replacesUnreadableSandbox = writesSandbox && settings.sandbox !== void 0 && !isRecord$1(settings.sandbox);
+				warnOnTrustAffectingEntries({
+					toolLabel: DEVIN_TOOL_LABEL,
+					noun: "sandbox change",
+					entries: [
+						...replacesUnreadableSandbox ? [{
+							label: "sandbox",
+							reason: replacedUnreadableReason({
+								shape: "object",
+								toolLabel: DEVIN_TOOL_LABEL
+							})
+						}] : [],
+						...collectTrustAffectingSandboxPaths({
+							sandbox: authoredSandboxRecord,
+							paths: DEVIN_TRUST_AFFECTING_SANDBOX_PATHS
+						}),
+						...collectRestrictionLosingSandboxEntries({
+							existing: existingSandbox,
+							merged: mergedSandbox,
+							paths: DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS,
+							toolLabel: DEVIN_TOOL_LABEL
+						})
+					],
+					relativeFilePath: toPosixPath(join(paths.relativeDirPath, paths.relativeFilePath)),
+					logger
+				});
+			} else if (Object.keys(authoredSandboxRecord).length > 0) logger?.warn("Devin reads 'sandbox' from the user config only, so the 'devin.sandbox' override was dropped from the project config. Generate with --global to author it.");
+		}
 		return new DevinPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -39549,7 +39826,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
 				existingContent,
-				patch: { permissions: mergedPermissions },
+				patch,
 				filePath
 			}),
 			validate
@@ -39569,7 +39846,10 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			ask: Array.isArray(permissions.ask) ? permissions.ask : [],
 			deny: Array.isArray(permissions.deny) ? permissions.deny : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asDevinRecord(settings.sandbox);
+		const result = { ...config };
+		if (Object.keys(sandbox).length > 0) result.devin = { sandbox };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -42517,6 +42797,137 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+/** How Reasonix is named in the warnings this file emits. */
+const REASONIX_TOOL_LABEL = "Reasonix";
+/** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
+const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/**
+* `[sandbox]` keys whose authored value loosens the enforcement layer beneath
+* the permission policy: they take Bash out of its OS jail, open that jail to
+* the network, or widen where the file-writing built-ins may write. Written —
+* the ordinary uses are far too common to refuse — but never silently, the same
+* stance `DEVIN_TRUST_AFFECTING_SANDBOX_PATHS` takes, and `widens` likewise
+* names the restrictive value so a spelling Reasonix does not recognize is
+* reported rather than waved through.
+*
+* `forbid_read` is not here: it restricts, so it loosens by losing entries
+* rather than by holding one, which needs the before/after comparison
+* {@link REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS} below does instead.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+const REASONIX_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["bash"],
+		reason: "anything but 'enforce' takes Bash out of the OS sandbox, so a command may write and read wherever the user can",
+		widens: (value) => value !== "enforce"
+	},
+	{
+		path: ["network"],
+		reason: "lets sandboxed Bash reach the network",
+		widens: isNotFalse
+	},
+	{
+		path: ["allow_write"],
+		reason: "adds directories the file-writing tools may modify outside the workspace root, which a headless run would otherwise refuse",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["workspace_root"],
+		reason: "moves the root the file-writing tools and sandboxed Bash are confined to, so what they may reach is decided by this path rather than by the project directory",
+		widens: escapesTheProject
+	}
+];
+/**
+* Whether a `workspace_root` points somewhere other than inside the project the
+* generate runs in. The key moves the write confinement rather than adding to
+* it, so the ordinary value — the project directory, spelled relatively — would
+* otherwise be announced on every generate; anything else is the case worth
+* naming, since it is how a fetched permissions file would put `~/.ssh` or
+* `C:\\Users\\<user>` inside the jail: an absolute path in either flavour, one
+* carrying a drive letter, a home-relative one, a shell or environment
+* expansion, and any path holding a `..` segment — even one that would land back
+* inside, since resolving it here would only be a guess at what Reasonix does.
+* Both path flavours are asked because the file is authored on one machine and
+* generated on another, so a Windows-shaped root reaching a POSIX check must not
+* read as relative. Anything that is not a string is reported, per the fail-safe
+* rule the predicates in `sandbox-trust.ts` follow.
+*/
+function escapesTheProject(value) {
+	if (typeof value !== "string") return true;
+	const trimmed = value.trim();
+	if (trimmed === "") return false;
+	if (trimmed.startsWith("~")) return true;
+	if (posix.isAbsolute(trimmed) || win32.isAbsolute(trimmed)) return true;
+	if (/^[A-Za-z]:/.test(trimmed)) return true;
+	if (trimmed.includes("$") || /%[^%]+%/.test(trimmed)) return true;
+	return trimmed.split(/[\\/]/).includes("..");
+}
+/**
+* The `[sandbox]` key that restricts, and so loosens by losing entries rather
+* than by holding a value. The override is shallow-merged over the existing
+* `[sandbox]` at its top level, so an authored `forbid_read` replaces the list
+* the file had whole — emptying it, or dropping the `${HOME}/.ssh` entry
+* Reasonix's own example recommends, opens exactly what the list kept closed.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+const REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS = [{
+	path: ["forbid_read"],
+	reason: "drops paths the list already in the file kept out of read, list and search",
+	loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+}];
+/**
+* Everything worth naming about the `[sandbox]` table this generate is about to
+* write: the authored values that loosen enforcement, the restrictions the
+* shallow merge would drop, and a `[sandbox]` the file holds in some shape other
+* than a table, which the write replaces wholesale. The widening check reads the
+* authored block alone — a loosening value the file already held is the user's
+* own, and re-announcing it on every generate would bury the values rulesync
+* actually wrote — while a loss can only be seen from both sides.
+*/
+function collectSandboxOverlayEntries({ existing, authored, merged }) {
+	return [
+		...existing !== void 0 && !isRecord$1(existing) ? [{
+			label: "sandbox",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}] : [],
+		...collectTrustAffectingSandboxPaths({
+			sandbox: asReasonixRecord(authored),
+			paths: REASONIX_TRUST_AFFECTING_SANDBOX_PATHS
+		}),
+		...collectRestrictionLosingSandboxEntries({
+			existing: asReasonixRecord(existing),
+			merged,
+			paths: REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS,
+			toolLabel: REASONIX_TOOL_LABEL
+		})
+	];
+}
+/**
+* Writes the override's `allow_dynamic_bash` into `[permissions]`, where it sits
+* beside allow/ask/deny rather than in a table of its own, and reports it when
+* it is being turned on: it widens what a shareable permissions file lets run
+* with no human in the loop. Only an authored value is written — leaving the key
+* out of the override keeps whatever the file already had — and turning it off
+* narrows, so that stays quiet. Only a literal `false` is quiet, not everything
+* falsy: `getJson()` casts rather than parses, so a `--no-validate` run can put
+* a value the schema forbids here, and a value Reasonix might still coerce is
+* not something to write in silence. The entries are returned rather than logged so
+* one generate still produces one warning naming everything it wrote.
+*/
+function applyAllowDynamicBash({ permissions, authored }) {
+	if (authored === void 0) return [];
+	permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY] = authored;
+	if (!isNotFalse(authored)) return [];
+	return [{
+		label: `permissions.${REASONIX_ALLOW_DYNAMIC_BASH_KEY}`,
+		reason: "lets an Allow fallback, Auto included, run the nested and indirect Bash that otherwise needs a human or an exact-literal grant — command and process substitution, a dynamic command name, 'eval', 'source', 'sh -c' and their kind"
+	}];
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -42573,6 +42984,7 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const relativeFilePathForLog = toPosixPath(join(paths.relativeDirPath, paths.relativeFilePath));
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const parsed = parseReasonixConfig(existingContent);
 		const config = rulesyncPermissions.getJson();
@@ -42617,11 +43029,23 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...deny,
 			...rawDeny
 		]);
+		const trustAffecting = applyAllowDynamicBash({
+			permissions: mergedPermissions,
+			authored: override?.allowDynamicBash
+		});
 		const patch = { permissions: mergedPermissions };
-		if (override?.sandbox !== void 0) patch.sandbox = {
-			...asReasonixRecord(parsed.sandbox),
-			...asReasonixRecord(override.sandbox)
-		};
+		if (override?.sandbox !== void 0) {
+			const mergedSandbox = {
+				...asReasonixRecord(parsed.sandbox),
+				...asReasonixRecord(override.sandbox)
+			};
+			patch.sandbox = mergedSandbox;
+			trustAffecting.push(...collectSandboxOverlayEntries({
+				existing: parsed.sandbox,
+				authored: override.sandbox,
+				merged: mergedSandbox
+			}));
+		}
 		if (override?.agent !== void 0) {
 			const mergedAgent = {
 				...asReasonixRecord(parsed.agent),
@@ -42629,9 +43053,16 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			};
 			const retired = REASONIX_RETIRED_AGENT_KEYS.filter((key) => mergedAgent[key] !== void 0);
 			for (const key of retired) delete mergedAgent[key];
-			if (retired.length > 0) logger?.warn(`Reasonix permissions: removing ${retired.map((key) => `"${key}"`).join(", ")} from [agent] in ${filePath}; Reasonix took the key off its config surface in v1.17.18, so what it used to express now belongs in the shared \`permission\` block.`);
+			if (retired.length > 0) logger?.warn(`Reasonix permissions: removing ${retired.map((key) => `"${key}"`).join(", ")} from [agent] in ${relativeFilePathForLog}; Reasonix took the key off its config surface in v1.17.18, so what it used to express now belongs in the shared \`permission\` block.`);
 			patch.agent = mergedAgent;
 		}
+		warnOnTrustAffectingEntries({
+			toolLabel: REASONIX_TOOL_LABEL,
+			noun: "change",
+			entries: trustAffecting,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		});
 		return new ReasonixPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -42666,6 +43097,8 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const sandbox = asReasonixRecord(this.toml.sandbox);
 		const agentPlanMode = pickReasonixKeys(this.toml.agent, [...REASONIX_OVERRIDE_AGENT_KEYS, ...REASONIX_RETIRED_AGENT_KEYS]);
 		const reasonixOverride = {};
+		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
+		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;
@@ -68704,4 +69137,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCheckFrontmatterSchema as $, ALL_TOOL_TARGETS_WITH_WILDCARD as $t, FACTORYDROID_DIR as A, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as An, fileExists as At, RulesyncSkillFrontmatterSchema as B, stripControlCharacters as Bn, readFileContent as Bt, CODEXCLI_BASH_RULES_FILE_NAME as C, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as Cn, assertDirectoryIfExists as Ct, CLAUDECODE_MEMORIES_DIR_NAME as D, RULESYNC_RULES_RELATIVE_DIR_PATH as Dn, createTempDirectory as Dt, CLAUDECODE_LOCAL_RULE_FILE_NAME as E, RULESYNC_RELATIVE_DIR_PATH as En, checkPathTraversal as Et, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as F, formatError as Fn, isSymlink as Ft, RulesyncIgnore as G, removeFileStrict as Gt, RulesyncRuleFrontmatterSchema as H, stripHiddenCharacters as Hn, removeDirectory as Ht, getLocalSkillDirNames as I, truncateText as In, listDirectoryEntryNames as It, resolveRulesyncSourceWritePath as J, runWithDirectoryRollback as Jt, RulesyncHooks as K, removeTempDirectory as Kt, RulesyncSubagent as L, hasDeceptiveHiddenCharacters as Ln, listFilePathsRecursively as Lt, caseFoldIdentity as M, ALL_FEATURES as Mn, getHomeDirectory as Mt, groupSpellingsByCaseFoldedIdentity as N, ALL_FEATURES_WITH_WILDCARD as Nn, isFileNotFoundError as Nt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_SKILLS_RELATIVE_DIR_PATH as On, directoryExists as Ot, AUGMENTCODE_DIR as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, isFileSystemError as Pt, RulesyncCheck as Q, ALL_TOOL_TARGETS as Qt, RulesyncSubagentFrontmatterSchema as R, hasEnclosingMarkOutsideKeycap as Rn, listSubdirectoryNames as Rt, ChecksProcessor as S, RULESYNC_PERMISSIONS_FILE_NAME as Sn, applyFileMode as St, CLAUDECODE_DIR as T, RULESYNC_PERMISSIONS_SCHEMA_URL as Tn, assertWritablePathInsideRoot as Tt, RulesyncPermissions as U, removeDirectoryStrict as Ut, RulesyncRule as V, stripControlCharactersKeepingLineFeeds as Vn, readFileContentOrNull as Vt, RulesyncMcp as W, removeFile as Wt, RulesyncCommand as X, writeFileBuffer as Xt, parseJsonc as Y, toPosixPath as Yt, RulesyncCommandFrontmatterSchema as Z, writeFileContent as Zt, IgnoreProcessor as _, RULESYNC_MCP_FILE_NAME as _n, withFallbackLoggerTarget as _t, getProcessorRegistryEntry as a, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as an, mergeInputRootConfigs as at, QWENCODE_DIR as b, RULESYNC_MCP_SCHEMA_URL as bn, CLIError as bt, RulesProcessor as c, RULESYNC_CONFIG_RELATIVE_FILE_PATH as cn, ConfigFileSchema as ct, CODEBUDDY_DIR as d, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as dn, findControlCharacter as dt, PACKAGING_TOOL_TARGETS as en, stringifyFrontmatter as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_HOOKS_FILE_NAME as fn, ConsoleLogger as ft, McpProcessor as g, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as gn, warnOnConflictingFlags as gt, shortenToWidth as h, RULESYNC_IGNORE_RELATIVE_FILE_PATH as hn, fallbackLogger as ht, inspectInputRoots as i, RULESYNC_AIIGNORE_FILE_NAME as in, ConfigResolver as it, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, getFileSize as jt, CLAUDECODE_SKILLS_DIR_PATH as k, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as kn, ensureDir as kt, SubagentsProcessor as l, RULESYNC_CONFIG_SCHEMA_URL as ln, GITIGNORE_DESTINATION_KEY as lt, displayWidthOf as m, RULESYNC_HOOKS_RELATIVE_FILE_PATH as mn, WarningCollectingLogger as mt, formatSourceLoadFailure as n, CURATED_RULES_FEATURE_SUBDIR as nn, SHARED_USER_MANAGED_CONFIG_PATHS as nt, convertFromTool as o, RULESYNC_CHECKS_RELATIVE_DIR_PATH as on, resolveEffectiveInputRoots as ot, ELLIPSIS_WIDTH as p, RULESYNC_HOOKS_LEGACY_FILE_NAME as pn, JsonLogger as pt, getRulesyncSourceCandidates as q, resolvePath as qt, generate as r, MAX_FILE_SIZE as rn, SKILL_FILE_NAME as rt, isPackagingToolTarget as s, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as sn, CONFLICTING_TARGET_PAIRS as st, importFromTool as t, ToolTargetSchema as tn, loadYaml as tt, SkillsProcessor as u, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as un, SourceEntrySchema as ut, HooksProcessor as v, RULESYNC_MCP_LEGACY_FILE_NAME as vn, resetRunWarningState as vt, CODEXCLI_DIR as w, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as wn, assertTreeContainsNoSymlinks as wt, QWENCODE_LOCAL_RULE_FILE_NAME as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, ErrorCodes as xt, CommandsProcessor as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, withWarnOnceScope as yt, RulesyncSkill as z, quoteForLog as zn, pathEscapesRoot as zt };
 
-//# sourceMappingURL=import-DUE1P1zV.js.map
+//# sourceMappingURL=import-DIDEUv63.js.map