rulesync 16.22.1 → 16.24.0

package/dist/{import-B7o8So93.cjs → import-C0WSCbU9.cjs}

@@ -6658,10 +6658,25 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
-* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`,
-* `allowedHttpHookUrls`, `allowPrivateNetworkHooks` — the latter is honored by
-* Qwen Code only in user/system settings, so generate skips it in project scope).
-* It also
+* `sandbox`, `sandboxImage`, `disabled`, `visible`, `listDirectory`,
+* `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
+* `allowPrivateNetworkHooks`, `allowedInsecureVoiceBaseUrls`). Qwen Code strips
+* `tools.workflowsEnabled`, `security.allowPrivateNetworkHooks` and
+* `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
+* skips those three in project scope and announces a granting value in global
+* scope. `security.allowedHttpHookUrls` (honored in a workspace only while no
+* higher scope sets it) and `security.folderTrust` (the initial trust decision
+* is made from user/system settings alone, before the workspace merge) are
+* written in both scopes, with a note in project scope and an announcement of
+* any global change. Every other key is honored in either scope, so a write that
+* changes what the file said is reported in either scope, naming what that key
+* decides there — the autonomy and containment
+* controls (`approvalMode`, `autoAccept`, `sandbox`, `sandboxImage`), the
+* registry controls (`disabled`, `visible`, `listDirectory`), the Auto Mode
+* classifier config, and, because these groups are loose objects, any key
+* rulesync does not model. Import flags a scope-dependent key only when it read
+* the project file, since that is the value a `--global` regenerate would
+* promote. It also
 * exposes `permissions.autoMode` (the Auto Mode classifier config:
 * `hints.{allow,softDeny,hardDeny}`, `environment`, `classifyAllShell` — see
 * https://qwenlm.github.io/qwen-code-docs/en/users/features/auto-mode/), which
@@ -6699,6 +6714,8 @@ const QwencodePermissionsOverrideSchema = zod_mini.z.looseObject({
 *
 * @example
 * { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
+* @example
+* { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 */
 const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -6706,7 +6723,8 @@ const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 	agent: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	rawAllow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	rawAsk: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
-	rawDeny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	rawDeny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	allowDynamicBash: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
 * Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
@@ -7350,6 +7368,32 @@ const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
 	})))
 });
 /**
+* Tool-scoped override block for Devin Local. `sandbox` is the sibling
+* top-level `config.json` block that governs the sandbox Devin runs commands
+* in: `allowed_domains` / `denied_domains` (proxy domain patterns, deny beating
+* allow), `network_mode` (`full`, the upstream default, allows every HTTP
+* method; `limited` only GET/HEAD/OPTIONS) and `excluded` (`allow` / `ask` /
+* `deny` lists of `Exec(...)` matchers deciding which commands run *outside* the
+* sandbox — `deny` pins them inside it). It constrains how
+* a permitted command runs rather than which commands are permitted, so it has
+* no canonical category and is authored here.
+*
+* Upstream lists `sandbox` as a **User Config Only** key, so it is emitted at
+* global scope only; at project scope it is dropped with a warning rather than
+* written into a file Devin would ignore.
+*
+* @example
+* { "sandbox": { "allowed_domains": ["github.com"], "network_mode": "limited" } }
+* @example
+* { "sandbox": { "excluded": { "allow": ["Exec(git status *)"], "deny": ["Exec(git tag *)"] } } }
+* @see https://docs.devin.ai/cli/sandbox
+* @see https://docs.devin.ai/cli/reference/configuration/config-file
+*/
+const DevinPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
@@ -7399,10 +7443,10 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	kiro: zod_mini.z.optional(KiroPermissionsOverrideSchema),
 	codexcli: zod_mini.z.optional(CodexcliPermissionsOverrideSchema),
 	zed: zod_mini.z.optional(ZedPermissionsOverrideSchema),
+	devin: zod_mini.z.optional(DevinPermissionsOverrideSchema),
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
-	devin: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
@@ -12628,7 +12672,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions"]
+				ownedKeys: ["permissions", "sandbox"]
 			}
 		}
 	},
@@ -36349,6 +36393,180 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 	return { permission };
 }
 //#endregion
+//#region src/features/permissions/sandbox-trust.ts
+/** A key whose quiet value is an explicit `false`. */
+const isNotFalse = (value) => value !== false;
+/** A key whose quiet value is an explicit `true`. */
+const isNotTrue = (value) => value !== true;
+/** A list-valued key whose quiet value is the empty list. */
+const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
+/** The map-valued counterpart of {@link isNonEmptyList}. */
+const isNonEmptyMap = (value) => !isRecord$1(value) || Object.keys(value).length > 0;
+/**
+* What {@link readSandboxPath} returns when a container on the way to the leaf
+* is present but is not an object, so the leaf cannot be read at all. It is not
+* `undefined`, because the two mean opposite things to a caller: `undefined` is
+* "this path is not being written", while this is "something is being written
+* here and its shape hides what". The same fail-safe rule the predicates follow
+* applies to the walk — silence must mean "this cannot loosen anything", not
+* "this is not the shape the table expected".
+*/
+const UNREADABLE_SANDBOX_PATH = Symbol("unreadable-sandbox-path");
+/**
+* Reads `sandbox` at `path`. Returns `undefined` when a segment is absent, and
+* {@link UNREADABLE_SANDBOX_PATH} when one is present but is not an object.
+* Shared by everything that addresses a `sandbox` path so a nested path added to
+* one of the tables is actually traversed rather than silently skipped, and so a
+* hostile shape (an array, a string, `null`) is reported rather than throwing.
+*/
+function readSandboxPath({ sandbox, path }) {
+	let cursor = sandbox;
+	for (const segment of path) {
+		if (cursor === void 0) return void 0;
+		if (!isRecord$1(cursor)) return UNREADABLE_SANDBOX_PATH;
+		cursor = cursor[segment];
+	}
+	return cursor;
+}
+/**
+* Every path in `paths` whose value in `sandbox` loosens the policy. Nothing is
+* removed — the values are written, just not silently. Call it on the block this
+* generate authored, after any scope filter has run: a value the file already
+* held is the user's own, not something rulesync opened, and a path a filter
+* dropped is not being written at all.
+*/
+function collectTrustAffectingSandboxPaths({ sandbox, paths }) {
+	const entries = [];
+	const reportedContainers = /* @__PURE__ */ new Set();
+	for (const { path, reason, widens } of paths) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0) continue;
+		if (value === UNREADABLE_SANDBOX_PATH) {
+			const label = findUnreadableContainer({
+				sandbox,
+				path
+			});
+			if (label === void 0 || reportedContainers.has(label)) continue;
+			reportedContainers.add(label);
+			entries.push({
+				label,
+				reason: UNREADABLE_CONTAINER_REASON
+			});
+			continue;
+		}
+		if (!widens(value)) continue;
+		entries.push({
+			label: `sandbox.${path.join(".")}`,
+			reason
+		});
+	}
+	return entries;
+}
+/** The reason printed for a container that hides the settings underneath it. */
+const UNREADABLE_CONTAINER_REASON = "is not the object it has to be, so nothing under it can be checked for what it opens";
+/**
+* The prefix of `path` that {@link readSandboxPath} could not walk past, as a
+* label. `undefined` when the walk was not blocked at all. Callers that report
+* an unreadable path name the container rather than the leaf, because the leaf
+* is not what the file actually holds.
+*/
+function findUnreadableContainer({ sandbox, path }) {
+	let cursor = sandbox;
+	const walked = [];
+	for (const segment of path) {
+		if (cursor === void 0) return void 0;
+		if (!isRecord$1(cursor)) return walked.length === 0 ? "sandbox" : `sandbox.${walked.join(".")}`;
+		walked.push(segment);
+		cursor = cursor[segment];
+	}
+}
+/**
+* The reason printed for a value the file held in a shape that cannot be read,
+* which this generate is about to replace. `shape` names what the tool documents
+* there, so the message says which expectation the file's value missed.
+*/
+const replacedUnreadableReason = ({ shape, toolLabel }) => `replaces a value already in the file that is not the ${shape} ${toolLabel} documents, so what it restricted cannot be read`;
+/**
+* The restrictions this generate would weaken, compared between the `sandbox`
+* already in the file and the one about to replace it. A `before` that is
+* present but not a list is reported outright: a shape the tool may still honor
+* is not something to go quiet about just because it cannot be diffed. Shared by
+* every tool whose override replaces a restricting list whole rather than
+* merging into it — Claude Code needs no equivalent, because it merges its lists
+* across settings scopes, so a file can only ever add to them.
+*/
+function collectRestrictionLosingSandboxEntries({ existing, merged, paths, toolLabel }) {
+	const entries = [];
+	const reportedContainers = /* @__PURE__ */ new Set();
+	for (const { path, reason, loosens } of paths) {
+		const before = readSandboxPath({
+			sandbox: existing,
+			path
+		});
+		if (before === void 0) continue;
+		const [rootKey] = path;
+		if (rootKey !== void 0 && existing[rootKey] === merged[rootKey]) continue;
+		const after = readSandboxPath({
+			sandbox: merged,
+			path
+		});
+		const label = `sandbox.${path.join(".")}`;
+		if (before === UNREADABLE_SANDBOX_PATH) {
+			const container = findUnreadableContainer({
+				sandbox: existing,
+				path
+			});
+			if (container === void 0 || reportedContainers.has(container)) continue;
+			reportedContainers.add(container);
+			entries.push({
+				label: container,
+				reason: replacedUnreadableReason({
+					shape: "object",
+					toolLabel
+				})
+			});
+			continue;
+		}
+		if (!Array.isArray(before)) {
+			entries.push({
+				label,
+				reason: replacedUnreadableReason({
+					shape: "list",
+					toolLabel
+				})
+			});
+			continue;
+		}
+		if (before.length === 0) continue;
+		if (!loosens({
+			before,
+			after: Array.isArray(after) ? after : []
+		})) continue;
+		entries.push({
+			label,
+			reason
+		});
+	}
+	return entries;
+}
+/**
+* The one warning that names every trust-affecting setting this generate wrote
+* to `relativeFilePath`. Emitted once per file: the individual reasons are what
+* matter, but the "review this as you would a hook" framing only needs saying
+* once, and repeating it per key buries the reasons in boilerplate. `noun` lets
+* a tool whose entries are not all additions call them something more accurate
+* than "setting".
+*/
+function warnOnTrustAffectingEntries({ toolLabel, noun = "setting", entries, relativeFilePath, logger }) {
+	if (entries.length === 0) return;
+	const one = entries.length === 1;
+	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
+	logger?.warn(`${toolLabel} permissions: writing ${entries.length} trust-affecting ${noun}${one ? "" : "s"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
+}
+//#endregion
 //#region src/features/permissions/claudecode-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Claude Code tool names (PascalCase).
@@ -36397,19 +36615,6 @@ function parseClaudePermissionEntry(entry) {
 	};
 }
 /**
-* Claude Code's file permission checks match only `Edit(path)` and `Read(path)`
-* rules. A `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rule "is accepted
-* but never matched by those checks, so Claude Code warns at startup for each
-* allow, deny, or ask rule in one of these unmatched forms" — so a canonical
-* `write`/`notebookedit`/`glob` rule with a pattern is emitted in the form the
-* docs prescribe instead. A tool-name rule with no path is unaffected: it
-* matches the tool everywhere and produces no warning.
-* @see https://code.claude.com/docs/en/permissions
-*/
-function isPlainRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
 * Merge `patch` into `base`, recursing into plain objects so a sibling key at
 * any depth survives. Arrays and scalars are replaced, since a list the author
 * states is the list they mean.
@@ -36419,7 +36624,7 @@ function deepMergeRecords(base, patch) {
 	for (const [key, value] of Object.entries(patch)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 		const existing = merged[key];
-		merged[key] = isPlainRecord(existing) && isPlainRecord(value) ? deepMergeRecords(existing, value) : value;
+		merged[key] = isRecord$1(existing) && isRecord$1(value) ? deepMergeRecords(existing, value) : value;
 	}
 	return merged;
 }
@@ -36484,13 +36689,11 @@ const CLAUDECODE_MANAGED_ONLY_SANDBOX_PATHS = [["filesystem", "allowManagedReadP
 * traversed rather than silently skipped.
 */
 function resolveSandboxParent({ root, segments }) {
-	let parent = root;
-	for (const segment of segments) {
-		const next = parent[segment];
-		if (!isPlainRecord(next)) return void 0;
-		parent = next;
-	}
-	return parent;
+	const resolved = readSandboxPath({
+		sandbox: root,
+		path: segments
+	});
+	return isRecord$1(resolved) ? resolved : void 0;
 }
 /**
 * Deletes `path` from `target` in place and reports whether anything was there,
@@ -36524,18 +36727,6 @@ function deleteSandboxPath({ target, path }) {
 	return true;
 }
 /**
-* The one warning that names every trust-affecting setting this generate wrote
-* to `relativeFilePath`. Emitted once per file: the individual reasons are what
-* matter, but the "review this as you would a hook" framing only needs saying
-* once, and repeating it per key buries the reasons in boilerplate.
-*/
-function warnOnTrustAffectingEntries({ entries, relativeFilePath, logger }) {
-	if (entries.length === 0) return;
-	const one = entries.length === 1;
-	const details = entries.map(({ label, reason }) => `'${label}' — ${reason}`).join("; ");
-	logger?.warn(`Claude Code permissions: writing ${entries.length} trust-affecting ${one ? "setting" : "settings"} to ${relativeFilePath}; review ${one ? "it" : "them"} as you would a hook, especially if this permissions file came from 'rulesync fetch'. ${details}.`);
-}
-/**
 * The `permissions.defaultMode` values that start a session with fewer prompts
 * than the default. `plan` and `default` are absent because they do not widen
 * anything.
@@ -36580,18 +36771,6 @@ const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS = [
 	["socatPath"]
 ];
 /**
-* The predicates the "which value actually widens?" tables are built from.
-* Each names the value that does *not* widen and reports everything else, never
-* the reverse: the override is authored JSONC, so a key can carry any value at
-* all, and one Claude Code coerces is still honored. Reporting an off-type value
-* keeps the warning fail-safe — silence has to mean "this cannot loosen
-* anything", not "this is not the type the table expected".
-*/
-const isNotFalse = (value) => value !== false;
-const isNotTrue = (value) => value !== true;
-const isNonEmptyList = (value) => !Array.isArray(value) || value.length > 0;
-const isNonEmptyMap = (value) => !isPlainRecord(value) || Object.keys(value).length > 0;
-/**
 * `sandbox` paths that loosen the sandbox rather than naming something to run:
 * they let commands out of it, weaken the isolation it provides, or redirect
 * where its traffic goes. They are written like `env` is — the ordinary uses are
@@ -36694,30 +36873,6 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		widens: () => true
 	}
 ];
-/**
-* Every authored `sandbox` path that loosens the sandbox. Nothing is removed —
-* the values are written, just not silently. Called on the filtered `sandbox`
-* so it never claims to be writing a path the scope filters dropped.
-*/
-function collectTrustAffectingSandboxPaths({ sandbox }) {
-	const entries = [];
-	for (const { path, reason, widens } of CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS) {
-		const leaf = path.at(-1);
-		if (leaf === void 0) continue;
-		const parent = resolveSandboxParent({
-			root: sandbox,
-			segments: path.slice(0, -1)
-		});
-		if (parent === void 0) continue;
-		const value = parent[leaf];
-		if (value === void 0 || !widens(value)) continue;
-		entries.push({
-			label: `sandbox.${path.join(".")}`,
-			reason
-		});
-	}
-	return entries;
-}
 /** Paths that name an executable Claude Code runs. Refused in both scopes. */
 const CLAUDECODE_COMMAND_EXECUTING_SANDBOX_REFUSAL = {
 	paths: CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS,
@@ -36788,13 +36943,13 @@ const CLAUDECODE_MASKABLE_CREDENTIAL_LISTS = ["envVars", "files"];
 */
 function stripProjectIgnoredMaskEntries({ sandbox, relativeFilePath, logger }) {
 	const credentials = sandbox.credentials;
-	if (!isPlainRecord(credentials)) return sandbox;
+	if (!isRecord$1(credentials)) return sandbox;
 	const filteredCredentials = { ...credentials };
 	let changed = false;
 	for (const listKey of CLAUDECODE_MASKABLE_CREDENTIAL_LISTS) {
 		const list = filteredCredentials[listKey];
 		if (!Array.isArray(list)) continue;
-		const kept = list.filter((entry) => !(isPlainRecord(entry) && entry.mode === "mask"));
+		const kept = list.filter((entry) => !(isRecord$1(entry) && entry.mode === "mask"));
 		if (kept.length === list.length) continue;
 		changed = true;
 		const dropped = list.length - kept.length;
@@ -37073,6 +37228,16 @@ function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logge
 		trustAffecting
 	};
 }
+/**
+* Claude Code's file permission checks match only `Edit(path)` and `Read(path)`
+* rules. A `Write(path)`, `NotebookEdit(path)` or `Glob(path)` rule "is accepted
+* but never matched by those checks, so Claude Code warns at startup for each
+* allow, deny, or ask rule in one of these unmatched forms" — so a canonical
+* `write`/`notebookedit`/`glob` rule with a pattern is emitted in the form the
+* docs prescribe instead. A tool-name rule with no path is unaffected: it
+* matches the tool everywhere and produces no warning.
+* @see https://code.claude.com/docs/en/permissions
+*/
 const CLAUDE_PATH_RULE_ALIASES = {
 	Write: "Edit",
 	NotebookEdit: "Edit",
@@ -37153,7 +37318,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			};
 		}
 		const overrideSandbox = config.claudecode?.sandbox;
-		if (isPlainRecord(overrideSandbox)) {
+		if (isRecord$1(overrideSandbox)) {
 			const honorableSandbox = stripSandboxPaths({
 				sandbox: overrideSandbox,
 				refusals: [
@@ -37169,8 +37334,11 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 				relativeFilePath: paths.relativeFilePath,
 				logger
 			});
-			trustAffecting.push(...collectTrustAffectingSandboxPaths({ sandbox: scopedSandbox }));
-			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isPlainRecord(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
+			trustAffecting.push(...collectTrustAffectingSandboxPaths({
+				sandbox: scopedSandbox,
+				paths: CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS
+			}));
+			if (Object.keys(scopedSandbox).length > 0) settings.sandbox = deepMergeRecords(isRecord$1(settings.sandbox) ? settings.sandbox : {}, scopedSandbox);
 		}
 		const overrideTopLevel = {};
 		for (const [key, value] of Object.entries(config.claudecode ?? {})) {
@@ -37188,8 +37356,9 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		trustAffecting.push(...trustAffectingTopLevel);
 		if (Object.keys(scopedTopLevel).length > 0) settings = deepMergeRecords(settings, scopedTopLevel);
 		warnOnTrustAffectingEntries({
+			toolLabel: "Claude Code",
 			entries: trustAffecting,
-			relativeFilePath: paths.relativeFilePath,
+			relativeFilePath: toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)),
 			logger
 		});
 		const managedToolNames = managedClaudeToolNames(config);
@@ -37232,7 +37401,7 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 		const nonListFields = Object.fromEntries(Object.entries(permissionsRest).filter(([key]) => !PROTOTYPE_POLLUTION_KEYS.has(key)));
 		if (Object.keys(nonListFields).length > 0) config.claudecode = { permissions: nonListFields };
 		const { sandbox } = settings;
-		if (isPlainRecord(sandbox)) {
+		if (isRecord$1(sandbox)) {
 			const importedSandbox = structuredClone(sandbox);
 			for (const path of CLAUDECODE_COMMAND_EXECUTING_SANDBOX_PATHS) deleteSandboxPath({
 				target: importedSandbox,
@@ -39485,6 +39654,80 @@ function buildDevinPermissionEntry(scope, pattern) {
 	if (pattern === "*") return scope;
 	return `${scope}(${pattern})`;
 }
+function asDevinRecord(value) {
+	return isRecord$1(value) ? { ...value } : {};
+}
+/**
+* `sandbox` paths whose authored value loosens the sandbox on its own: they let
+* a command out of it, or widen what a command left inside it may reach. They
+* are written — the ordinary uses are far too common to refuse — but never
+* silently, because a permissions file is shareable (`rulesync fetch` copies one
+* into a project) and should not be able to open the sandbox without saying so.
+* This is the same stance `CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS` takes for
+* the equivalent Claude Code keys, and `widens` follows the same convention of
+* naming the restrictive value rather than the permissive ones, so a spelling
+* Devin does not recognize is reported rather than waved through.
+*
+* The three keys that restrict — `allowed_domains` (an allowlist only while it
+* has entries), `denied_domains` and `excluded.deny` — are not here: they loosen
+* by losing entries, which `DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS` covers.
+*
+* @see https://docs.devin.ai/cli/sandbox
+*/
+const DEVIN_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["network_mode"],
+		reason: "anything but 'limited' lets sandboxed requests use every HTTP method, not just GET/HEAD/OPTIONS",
+		widens: (value) => value !== "limited"
+	},
+	{
+		path: ["excluded", "allow"],
+		reason: "names commands that run outside the sandbox with no prompt and no sandbox policy",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["excluded", "ask"],
+		reason: "names commands that run outside the sandbox once confirmed, with no sandbox policy",
+		widens: isNonEmptyList
+	}
+];
+/** How Devin is named in the warnings this file emits. */
+const DEVIN_TOOL_LABEL = "Devin";
+/**
+* `sandbox` paths that restrict, and that therefore loosen the policy by losing
+* entries rather than by holding a value. Devin's config is one file rather than
+* a stack of settings scopes, and the override is shallow-merged over the
+* existing `sandbox` at its top level: each of these lists is replaced whole,
+* and `excluded.deny` vanishes as soon as the override states any other
+* `excluded` key. Losing an entry has the same effect as adding one to the
+* permissive keys above, so it is announced the same way. Claude Code needs no
+* equivalent — it merges its lists across settings scopes, so a file can only
+* ever add to them.
+*
+* `loosens` is asked only about a `before` that actually restricted something,
+* and the two directions are not symmetric: `allowed_domains` restricts by
+* listing what is reachable, so it loosens by gaining entries or by emptying
+* out altogether, while the deny lists loosen by losing entries.
+*
+* @see https://docs.devin.ai/cli/sandbox
+*/
+const DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS = [
+	{
+		path: ["allowed_domains"],
+		reason: "adds to the proxy allowlist already in the file, or empties it so every domain becomes reachable again",
+		loosens: ({ before, after }) => after.length === 0 || after.some((entry) => !before.includes(entry))
+	},
+	{
+		path: ["denied_domains"],
+		reason: "drops domains the deny list already in the file kept out of reach",
+		loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+	},
+	{
+		path: ["excluded", "deny"],
+		reason: "drops commands the list already in the file pinned inside the sandbox",
+		loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+	}
+];
 /**
 * Permissions generator for Devin Local (native `.devin/` configuration).
 *
@@ -39500,10 +39743,18 @@ function buildDevinPermissionEntry(scope, pattern) {
 *
 * In global mode the config file is shared with the hooks (`hooks`) feature
 * (MCP moved to the dedicated mcp_config.json in v3000.3), so reads and writes
-* merge into the existing JSON and the file is never deleted; only the managed
-* `permissions` key is rewritten.
+* merge into the existing JSON and the file is never deleted; only the keys
+* this feature manages are rewritten — `permissions`, plus `sandbox` in global
+* mode when the `devin` override authors it.
+*
+* The sibling `sandbox` block — which decides what a permitted command may
+* reach rather than which commands are permitted — has no canonical category
+* and is authored through the `devin` override in `.rulesync/permissions.jsonc`.
+* Devin documents it as a user-config-only key, so it is written at global
+* scope only.
 *
 * @see https://docs.devin.ai/cli/reference/permissions
+* @see https://docs.devin.ai/cli/sandbox
 */
 var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	constructor(params) {
@@ -39514,7 +39765,8 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 	/**
 	* config.json may carry the MCP/hooks features' keys, so it is never deleted;
-	* only the managed `permissions` key is rewritten.
+	* only the keys this feature manages are rewritten — `permissions`, plus
+	* `sandbox` in global mode when the `devin` override authors it.
 	*/
 	isDeletable() {
 		return false;
@@ -39540,7 +39792,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			validate
 		});
 	}
-	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, validate = true }) {
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, validate = true, logger }) {
 		const paths = DevinPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
@@ -39566,6 +39818,46 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 		else delete mergedPermissions.ask;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
+		const patch = { permissions: mergedPermissions };
+		const authoredSandbox = config.devin?.sandbox;
+		if (authoredSandbox !== void 0) {
+			const authoredSandboxRecord = asDevinRecord(authoredSandbox);
+			if (global) {
+				const existingSandbox = asDevinRecord(settings.sandbox);
+				const mergedSandbox = {
+					...existingSandbox,
+					...authoredSandboxRecord
+				};
+				const writesSandbox = Object.keys(mergedSandbox).length > 0;
+				if (writesSandbox) patch.sandbox = mergedSandbox;
+				const replacesUnreadableSandbox = writesSandbox && settings.sandbox !== void 0 && !isRecord$1(settings.sandbox);
+				warnOnTrustAffectingEntries({
+					toolLabel: DEVIN_TOOL_LABEL,
+					noun: "sandbox change",
+					entries: [
+						...replacesUnreadableSandbox ? [{
+							label: "sandbox",
+							reason: replacedUnreadableReason({
+								shape: "object",
+								toolLabel: DEVIN_TOOL_LABEL
+							})
+						}] : [],
+						...collectTrustAffectingSandboxPaths({
+							sandbox: authoredSandboxRecord,
+							paths: DEVIN_TRUST_AFFECTING_SANDBOX_PATHS
+						}),
+						...collectRestrictionLosingSandboxEntries({
+							existing: existingSandbox,
+							merged: mergedSandbox,
+							paths: DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS,
+							toolLabel: DEVIN_TOOL_LABEL
+						})
+					],
+					relativeFilePath: toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)),
+					logger
+				});
+			} else if (Object.keys(authoredSandboxRecord).length > 0) logger?.warn("Devin reads 'sandbox' from the user config only, so the 'devin.sandbox' override was dropped from the project config. Generate with --global to author it.");
+		}
 		return new DevinPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -39574,7 +39866,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
 				existingContent,
-				patch: { permissions: mergedPermissions },
+				patch,
 				filePath
 			}),
 			validate
@@ -39594,7 +39886,10 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			ask: Array.isArray(permissions.ask) ? permissions.ask : [],
 			deny: Array.isArray(permissions.deny) ? permissions.deny : []
 		});
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(config, null, 2) });
+		const sandbox = asDevinRecord(settings.sandbox);
+		const result = { ...config };
+		if (Object.keys(sandbox).length > 0) result.devin = { sandbox };
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -42224,15 +42519,129 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"sandbox",
 	"sandboxImage",
 	"disabled",
-	"visible"
+	"visible",
+	"listDirectory",
+	"workflowsEnabled"
 ];
 const QWEN_OVERRIDE_SECURITY_KEYS = [
 	"folderTrust",
 	"allowedHttpHookUrls",
-	"allowPrivateNetworkHooks"
+	"allowPrivateNetworkHooks",
+	"allowedInsecureVoiceBaseUrls"
 ];
-const QWEN_GLOBAL_ONLY_SECURITY_KEYS = ["allowPrivateNetworkHooks"];
+/**
+* What each rule means for the two directions, so a key's behavior is declared
+* once beside its rule rather than spelled out at every branch.
+*
+* `stripInProjectScope` separates the keys a project file cannot use at all from
+* the ones whose project value still does something, just not unconditionally —
+* only the former are dropped. `announceOnlyGrants` marks the rule whose risk is
+* a value that turns something on; for the others the dangerous value is often
+* the falsy one (an empty allow-all list, folder trust switched off, a sandbox
+* turned off), so every change is announced instead. `announceOnImport` marks
+* the keys whose meaning depends on the scope they are written in — importing
+* one and regenerating globally turns a value a workspace could not decide for
+* itself into one Qwen Code enforces everywhere. `global-machine-wide` keys are
+* honored identically in either scope, so import neither promotes nor weakens
+* them and the announcement on the generate side is the control point.
+* `projectNote` is `null` for a rule that has nothing to say about the project
+* scope. A `globalNote` here is the rule's default; a key whose meaning the
+* default does not describe carries its own.
+*/
+const QWEN_SCOPE_RULES = {
+	"workspace-stripped": {
+		stripInProjectScope: true,
+		announceOnlyGrants: true,
+		announceOnImport: true,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} is only honored in user/system settings, so it is skipped for the project-scoped ${filePath} (a value already in that file is left as it is). Check it if the override arrived with a repository you cloned, and author it in the global scope only if that is a value you want every project on this machine to run under.`,
+		globalNote: "Qwen Code ignores this key in workspace settings so a repository cannot grant it per project; in the global scope it applies to every project on this machine."
+	},
+	"workspace-non-overriding": {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: true,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, but Qwen Code honors a workspace value for it only while no user, system, or system-defaults scope sets the key — a repository cannot replace the list a user configured in a higher scope. It does replace one written by hand in this same file, and an empty list is Qwen Code's allow-all, so check what it now says. Author it in the global scope if it has to apply unconditionally.`,
+		globalNote: "A global value outranks every repository's own list for this key, and an empty list means allow-all, so this decides where HTTP hooks may send data for every project on this machine."
+	},
+	"user-scope-trust-check": {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: true,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, but Qwen Code makes the initial trust decision from user and system settings alone, before a workspace file is merged, so a project value cannot decide whether this workspace is trusted (it still drives folder trust once the workspace is trusted). Check it if the override arrived with a repository you cloned, and author it in the global scope only if that is a value you want every project on this machine to run under.`,
+		globalNote: "Qwen Code reads this key from the global scope when it decides whether a workspace is trusted, so this changes which projects on this machine it trusts."
+	},
+	"global-machine-wide": {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: false,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code honors this key in a workspace file, so it takes effect while you work in this repository. Check it if the override arrived with a repository you cloned.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope it settles how much the agent may do unattended — how far approvals are skipped, and whether tool calls are contained at all — for every project on this machine."
+	},
+	unmodeled: {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: false,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. This is not a key rulesync models, so it cannot say what Qwen Code does with it — and some settings in these groups are potent (\`tools.discoveryCommand\` and \`tools.callCommand\` are spawned as commands when Qwen Code starts). Check it if the override arrived with a repository you cloned.`,
+		globalNote: "This is not a key rulesync models, so it cannot say what Qwen Code does with it — and some settings in these groups are potent (`tools.discoveryCommand` and `tools.callCommand` are spawned as commands when Qwen Code starts). Check what it now says for every project on this machine."
+	}
+};
+const QWEN_OVERRIDE_GROUPS = [{
+	groupName: "tools",
+	overrideKeys: QWEN_OVERRIDE_TOOLS_KEYS,
+	scopedKeys: {
+		workflowsEnabled: { rule: "workspace-stripped" },
+		approvalMode: {
+			rule: "global-machine-wide",
+			projectNote: autonomyProjectNote
+		},
+		autoAccept: {
+			rule: "global-machine-wide",
+			projectNote: autonomyProjectNote
+		},
+		sandbox: {
+			rule: "global-machine-wide",
+			projectNote: autonomyProjectNote
+		},
+		sandboxImage: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so a sandboxed run in this repository executes inside the named image — check that it is one you trust to run your code.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope every sandboxed run on this machine executes inside the named image — check that it is one you trust to run your code."
+		},
+		disabled: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so a name that is gone is a tool the model can call again in this repository unless another scope still disables it.`,
+			globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the list in this file rather than adding to it, so in the global scope this decides which tools stay out of the registry for every project on this machine — dropping a name hands that tool back to the model unless another scope still disables it."
+		},
+		visible: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides which deferred tools are visible at startup in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides which deferred tools are visible at startup for every project on this machine."
+		},
+		listDirectory: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
+		}
+	}
+}, {
+	groupName: "security",
+	overrideKeys: QWEN_OVERRIDE_SECURITY_KEYS,
+	scopedKeys: {
+		allowPrivateNetworkHooks: { rule: "workspace-stripped" },
+		allowedInsecureVoiceBaseUrls: {
+			rule: "workspace-stripped",
+			grants: isNonEmptyArray
+		},
+		allowedHttpHookUrls: { rule: "workspace-non-overriding" },
+		folderTrust: { rule: "user-scope-trust-check" }
+	}
+}];
 const QWEN_OVERRIDE_PERMISSIONS_KEYS = ["autoMode"];
+const QWEN_SCOPED_PERMISSIONS_KEYS = { autoMode: {
+	rule: "global-machine-wide",
+	projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the whole block rather than merging into it, so it rewrites the instructions Auto Mode's classifier follows in this repository — including any deny hint you had configured.`,
+	globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the whole block rather than merging into it, so in the global scope this rewrites the instructions Auto Mode's classifier follows — including any deny hint you had configured — for every project on this machine."
+} };
 function asPlainRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -42244,20 +42653,172 @@ function pickQwenOverrideKeys(group, keys) {
 	return picked;
 }
 /**
-* Drop the global-only `security` keys from the override when generating project
-* settings, warning once per dropped key. Only the override copy is filtered, so
-* a value the user already wrote into the project file stays untouched.
+* Whether a value written for a scoped key actually grants something. Qwen Code
+* reads the boolean ones with a plain truthiness check, so anything truthy turns
+* the capability on — `1` and the string `"false"` included, which is why this is
+* not a `=== true` test. Not all of them are booleans either:
+* `security.allowedInsecureVoiceBaseUrls` is a list of base URLs, and an empty
+* list grants nothing.
+*
+* Only the rules whose `announceOnlyGrants` is set consult this, because "empty"
+* does not mean the same thing for every list: an empty
+* `security.allowedHttpHookUrls` is Qwen Code's allow-all, the widest value there
+* is, so that key is announced whatever it says.
 */
-function scopeOverrideSecurity(overrideSecurity, { global, relativeFilePath, logger }) {
-	const scoped = { ...asPlainRecord(overrideSecurity) };
-	if (global) return scoped;
-	for (const key of QWEN_GLOBAL_ONLY_SECURITY_KEYS) {
-		if (scoped[key] === void 0) continue;
-		delete scoped[key];
-		logger?.warn(`Qwen permissions: 'security.${key}' is only honored in user/system settings, so it is skipped for the project-scoped ${relativeFilePath}. Author it in the global scope instead.`);
+function isNonEmptyArray(value) {
+	return Array.isArray(value) && value.length > 0;
+}
+/**
+* Whether a value turns something on, read the way Qwen Code reads it.
+*
+* Plain truthiness by default, because that is what Qwen Code applies to these
+* settings: `1` and the string `"false"` enable them, and so does an empty array
+* — which is why an empty list cannot be treated as harmless everywhere. A key
+* whose list Qwen Code matches against, rather than tests for truth, carries its
+* own `grants` instead.
+*/
+function grantsSomething(value, scopedKey) {
+	return (scopedKey?.grants ?? Boolean)(value);
+}
+/**
+* The autonomy and containment controls say the same thing in project scope, so
+* they share one note rather than repeating it three times.
+*/
+function autonomyProjectNote({ qualifiedKey, quotedValue, filePath }) {
+	return `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code honors this key in a workspace file, so it settles how far approvals are skipped and whether tool calls are contained while you work in this repository. Check it if the override arrived with a repository you cloned.`;
+}
+/**
+* Quote a `group.key` pair for a warning. The key goes through the same quoting
+* a value does, because it is one: the override's groups are `z.looseObject`s,
+* so a key the scope gate names may have been written by whoever authored the
+* `.rulesync/permissions.jsonc` rather than chosen from a list rulesync knows.
+* Serializing it — rather than wrapping it in quotes of our own — is what keeps
+* a key that contains a quote from closing it and continuing the sentence.
+*/
+function quoteQualifiedKey({ groupName, key }) {
+	return quoteValueForWarning(`${groupName}.${key}`);
+}
+/**
+* Compare two settings values without letting key order decide the answer, so
+* re-emitting `{ enabled: true, note: "x" }` as `{ note: "x", enabled: true }`
+* is not announced as a change.
+*/
+function stableStringify(value) {
+	return JSON.stringify(value, (_key, nested) => nested !== null && typeof nested === "object" && !Array.isArray(nested) ? Object.fromEntries(Object.entries(nested).toSorted(([left], [right]) => left.localeCompare(right))) : nested) ?? "undefined";
+}
+function sameSettingsValue(a, b) {
+	return stableStringify(a) === stableStringify(b);
+}
+/**
+* Apply the scope rules for a settings group's scoped keys.
+*
+* Generating project settings drops the keys Qwen Code strips from a workspace
+* file before the merge — writing one there would be dead configuration — and
+* explains the keys whose project value is honored only conditionally rather
+* than dropping those. Either way only the override copy is touched, so a value
+* the user already wrote into the project file stays where it is.
+*
+* Generating global settings keeps every key, and announces the write: the
+* `.rulesync/permissions.jsonc` carrying it may have arrived with a cloned or
+* fetched repository, and the global file applies to every project on this
+* machine. So the new value is named alongside the one it replaces, exactly as
+* the deepagents startup override announces its own relaxations. Every key the
+* override writes is announced, not only the ones with a scope rule — the
+* groups are `z.looseObject`s, so an unmodeled key falls back to the
+* `unmodeled` rule rather than slipping past the gate that the modeled ones
+* pass through.
+*/
+function scopeOverrideGroup(overrideGroup, { groupName, scopedKeys, existingGroup, global, filePath, logger }) {
+	const scoped = { ...asPlainRecord(overrideGroup) };
+	const previous = asPlainRecord(existingGroup);
+	const rulesByKey = new Map(Object.entries(scopedKeys));
+	for (const key of Object.keys(scoped)) {
+		const value = scoped[key];
+		if (value === void 0) continue;
+		const scopedKey = rulesByKey.get(key);
+		const rule = scopedKey?.rule ?? "unmodeled";
+		const { stripInProjectScope, announceOnlyGrants } = QWEN_SCOPE_RULES[rule];
+		const projectNote = scopedKey?.projectNote ?? QWEN_SCOPE_RULES[rule].projectNote;
+		const globalNote = scopedKey?.globalNote ?? QWEN_SCOPE_RULES[rule].globalNote;
+		const previousValue = Object.hasOwn(previous, key) ? previous[key] : void 0;
+		const unchanged = sameSettingsValue(previousValue, value);
+		if (!global) {
+			if (stripInProjectScope) delete scoped[key];
+			else if (unchanged) continue;
+			if (projectNote) warnWithFallback(logger, `Qwen permissions: ${projectNote({
+				qualifiedKey: quoteQualifiedKey({
+					groupName,
+					key
+				}),
+				quotedValue: quoteValueForWarning(value),
+				filePath
+			})}`);
+			continue;
+		}
+		if (unchanged) continue;
+		if (announceOnlyGrants && !grantsSomething(value, scopedKey)) continue;
+		const replaced = previousValue === void 0 ? "" : ` (was ${quoteValueForWarning(previousValue)})`;
+		warnWithFallback(logger, `Qwen permissions: the qwencode override wrote ${quoteQualifiedKey({
+			groupName,
+			key
+		})} = ${quoteValueForWarning(value)}${replaced} into ${filePath}, your global Qwen Code settings. ${globalNote}`);
 	}
 	return scoped;
 }
+/**
+* Build the `tools`/`security` patch groups contributed by the `qwencode`
+* override. Each group is shallow-merged over what `settings.json` already has,
+* after the scope gate has handled the keys Qwen Code honors in one scope only.
+*/
+function buildOverrideGroupsPatch({ settings, override, global, filePath, logger }) {
+	const patch = {};
+	for (const { groupName, scopedKeys } of QWEN_OVERRIDE_GROUPS) {
+		const overrideGroup = override?.[groupName];
+		if (overrideGroup === void 0) continue;
+		const existingGroup = settings[groupName];
+		const scoped = scopeOverrideGroup(overrideGroup, {
+			groupName,
+			scopedKeys,
+			existingGroup,
+			global,
+			filePath,
+			logger
+		});
+		const merged = {
+			...asPlainRecord(existingGroup),
+			...scoped
+		};
+		if (Object.keys(merged).length > 0) patch[groupName] = merged;
+	}
+	return patch;
+}
+/**
+* Warn about a scoped key lifted out of a *project* settings file being
+* imported. The file carries no scope marker, so import keeps the key either
+* way — but regenerating in the global scope would turn a value a workspace
+* could not decide for itself into one Qwen Code enforces everywhere, and a
+* settings file read out of a cloned repository is exactly where such a value
+* comes from. Importing the global file is the case this has nothing to say
+* about: the value is already in the scope the warning would send it to.
+*/
+function warnAboutImportedScopedKeys(groups) {
+	for (const { groupName, scopedKeys } of QWEN_OVERRIDE_GROUPS) {
+		const group = groups[groupName];
+		for (const [key, scopedKey] of Object.entries(scopedKeys)) {
+			const { rule } = scopedKey;
+			const value = group[key];
+			if (value === void 0) continue;
+			const { announceOnlyGrants, announceOnImport } = QWEN_SCOPE_RULES[rule];
+			if (!announceOnImport) continue;
+			if (announceOnlyGrants && !grantsSomething(value, scopedKey)) continue;
+			const globalNote = scopedKey.globalNote ?? QWEN_SCOPE_RULES[rule].globalNote;
+			moduleLogger$1.warn(`Qwen permissions: imported ${quoteQualifiedKey({
+				groupName,
+				key
+			})} = ${quoteValueForWarning(value)}. ${globalNote} Review it before generating with the global scope.`);
+		}
+	}
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -42286,7 +42847,8 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
-			validate
+			validate,
+			global
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
@@ -42302,6 +42864,7 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Qwen settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const displayPath = toPosixPath((0, node_path.join)(global ? "~" : ".", paths.relativeDirPath, paths.relativeFilePath));
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToQwenPermissions(config);
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toQwenToolName(category)));
@@ -42320,24 +42883,25 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
 		const override = config.qwencode;
-		if (override?.autoMode !== void 0) mergedPermissions.autoMode = override.autoMode;
-		const patch = { permissions: mergedPermissions };
-		if (override?.tools !== void 0) patch.tools = {
-			...asPlainRecord(settings.tools),
-			...asPlainRecord(override.tools)
-		};
-		if (override?.security !== void 0) {
-			const scopedSecurity = scopeOverrideSecurity(override.security, {
+		if (override?.autoMode !== void 0) {
+			const scopedAutoMode = scopeOverrideGroup({ autoMode: override.autoMode }, {
+				groupName: "permissions",
+				scopedKeys: QWEN_SCOPED_PERMISSIONS_KEYS,
+				existingGroup: existingPermissions,
 				global,
-				relativeFilePath: paths.relativeFilePath,
+				filePath: displayPath,
 				logger
 			});
-			const mergedSecurity = {
-				...asPlainRecord(settings.security),
-				...scopedSecurity
-			};
-			if (Object.keys(mergedSecurity).length > 0) patch.security = mergedSecurity;
+			if (scopedAutoMode.autoMode !== void 0) mergedPermissions.autoMode = scopedAutoMode.autoMode;
 		}
+		const patch = { permissions: mergedPermissions };
+		Object.assign(patch, buildOverrideGroupsPatch({
+			settings,
+			override,
+			global,
+			filePath: displayPath,
+			logger
+		}));
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "permissions",
@@ -42369,16 +42933,17 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
-		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
-		for (const key of QWEN_GLOBAL_ONLY_SECURITY_KEYS) {
-			if (overrideSecurity[key] === void 0) continue;
-			moduleLogger$1.warn(`Qwen permissions: imported 'security.${key}'. Qwen Code ignores it in workspace settings but enforces it in user/system settings, so review it before generating with the global scope.`);
-		}
+		const overrideGroups = {
+			tools: pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS),
+			security: pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS)
+		};
+		if (!this.global) warnAboutImportedScopedKeys(overrideGroups);
 		const overridePermissions = pickQwenOverrideKeys(settings.permissions, QWEN_OVERRIDE_PERMISSIONS_KEYS);
 		const qwencodeOverride = {};
-		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
-		if (Object.keys(overrideSecurity).length > 0) qwencodeOverride.security = overrideSecurity;
+		for (const { groupName } of QWEN_OVERRIDE_GROUPS) {
+			const group = overrideGroups[groupName];
+			if (Object.keys(group).length > 0) qwencodeOverride[groupName] = group;
+		}
 		if (overridePermissions.autoMode !== void 0) qwencodeOverride.autoMode = overridePermissions.autoMode;
 		const result = { ...config };
 		if (Object.keys(qwencodeOverride).length > 0) result.qwencode = qwencodeOverride;
@@ -42542,6 +43107,137 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 	if (pattern === "*") return toolName;
 	return `${toolName}(${pattern})`;
 }
+/** How Reasonix is named in the warnings this file emits. */
+const REASONIX_TOOL_LABEL = "Reasonix";
+/** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
+const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/**
+* `[sandbox]` keys whose authored value loosens the enforcement layer beneath
+* the permission policy: they take Bash out of its OS jail, open that jail to
+* the network, or widen where the file-writing built-ins may write. Written —
+* the ordinary uses are far too common to refuse — but never silently, the same
+* stance `DEVIN_TRUST_AFFECTING_SANDBOX_PATHS` takes, and `widens` likewise
+* names the restrictive value so a spelling Reasonix does not recognize is
+* reported rather than waved through.
+*
+* `forbid_read` is not here: it restricts, so it loosens by losing entries
+* rather than by holding one, which needs the before/after comparison
+* {@link REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS} below does instead.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+const REASONIX_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["bash"],
+		reason: "anything but 'enforce' takes Bash out of the OS sandbox, so a command may write and read wherever the user can",
+		widens: (value) => value !== "enforce"
+	},
+	{
+		path: ["network"],
+		reason: "lets sandboxed Bash reach the network",
+		widens: isNotFalse
+	},
+	{
+		path: ["allow_write"],
+		reason: "adds directories the file-writing tools may modify outside the workspace root, which a headless run would otherwise refuse",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["workspace_root"],
+		reason: "moves the root the file-writing tools and sandboxed Bash are confined to, so what they may reach is decided by this path rather than by the project directory",
+		widens: escapesTheProject
+	}
+];
+/**
+* Whether a `workspace_root` points somewhere other than inside the project the
+* generate runs in. The key moves the write confinement rather than adding to
+* it, so the ordinary value — the project directory, spelled relatively — would
+* otherwise be announced on every generate; anything else is the case worth
+* naming, since it is how a fetched permissions file would put `~/.ssh` or
+* `C:\\Users\\<user>` inside the jail: an absolute path in either flavour, one
+* carrying a drive letter, a home-relative one, a shell or environment
+* expansion, and any path holding a `..` segment — even one that would land back
+* inside, since resolving it here would only be a guess at what Reasonix does.
+* Both path flavours are asked because the file is authored on one machine and
+* generated on another, so a Windows-shaped root reaching a POSIX check must not
+* read as relative. Anything that is not a string is reported, per the fail-safe
+* rule the predicates in `sandbox-trust.ts` follow.
+*/
+function escapesTheProject(value) {
+	if (typeof value !== "string") return true;
+	const trimmed = value.trim();
+	if (trimmed === "") return false;
+	if (trimmed.startsWith("~")) return true;
+	if (node_path.posix.isAbsolute(trimmed) || node_path.win32.isAbsolute(trimmed)) return true;
+	if (/^[A-Za-z]:/.test(trimmed)) return true;
+	if (trimmed.includes("$") || /%[^%]+%/.test(trimmed)) return true;
+	return trimmed.split(/[\\/]/).includes("..");
+}
+/**
+* The `[sandbox]` key that restricts, and so loosens by losing entries rather
+* than by holding a value. The override is shallow-merged over the existing
+* `[sandbox]` at its top level, so an authored `forbid_read` replaces the list
+* the file had whole — emptying it, or dropping the `${HOME}/.ssh` entry
+* Reasonix's own example recommends, opens exactly what the list kept closed.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+const REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS = [{
+	path: ["forbid_read"],
+	reason: "drops paths the list already in the file kept out of read, list and search",
+	loosens: ({ before, after }) => before.some((entry) => !after.includes(entry))
+}];
+/**
+* Everything worth naming about the `[sandbox]` table this generate is about to
+* write: the authored values that loosen enforcement, the restrictions the
+* shallow merge would drop, and a `[sandbox]` the file holds in some shape other
+* than a table, which the write replaces wholesale. The widening check reads the
+* authored block alone — a loosening value the file already held is the user's
+* own, and re-announcing it on every generate would bury the values rulesync
+* actually wrote — while a loss can only be seen from both sides.
+*/
+function collectSandboxOverlayEntries({ existing, authored, merged }) {
+	return [
+		...existing !== void 0 && !isRecord$1(existing) ? [{
+			label: "sandbox",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}] : [],
+		...collectTrustAffectingSandboxPaths({
+			sandbox: asReasonixRecord(authored),
+			paths: REASONIX_TRUST_AFFECTING_SANDBOX_PATHS
+		}),
+		...collectRestrictionLosingSandboxEntries({
+			existing: asReasonixRecord(existing),
+			merged,
+			paths: REASONIX_RESTRICTION_LOSING_SANDBOX_PATHS,
+			toolLabel: REASONIX_TOOL_LABEL
+		})
+	];
+}
+/**
+* Writes the override's `allow_dynamic_bash` into `[permissions]`, where it sits
+* beside allow/ask/deny rather than in a table of its own, and reports it when
+* it is being turned on: it widens what a shareable permissions file lets run
+* with no human in the loop. Only an authored value is written — leaving the key
+* out of the override keeps whatever the file already had — and turning it off
+* narrows, so that stays quiet. Only a literal `false` is quiet, not everything
+* falsy: `getJson()` casts rather than parses, so a `--no-validate` run can put
+* a value the schema forbids here, and a value Reasonix might still coerce is
+* not something to write in silence. The entries are returned rather than logged so
+* one generate still produces one warning naming everything it wrote.
+*/
+function applyAllowDynamicBash({ permissions, authored }) {
+	if (authored === void 0) return [];
+	permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY] = authored;
+	if (!isNotFalse(authored)) return [];
+	return [{
+		label: `permissions.${REASONIX_ALLOW_DYNAMIC_BASH_KEY}`,
+		reason: "lets an Allow fallback, Auto included, run the nested and indirect Bash that otherwise needs a human or an exact-literal grant — command and process substitution, a dynamic command name, 'eval', 'source', 'sh -c' and their kind"
+	}];
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -42598,6 +43294,7 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const relativeFilePathForLog = toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath));
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const parsed = parseReasonixConfig(existingContent);
 		const config = rulesyncPermissions.getJson();
@@ -42642,11 +43339,23 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			...deny,
 			...rawDeny
 		]);
+		const trustAffecting = applyAllowDynamicBash({
+			permissions: mergedPermissions,
+			authored: override?.allowDynamicBash
+		});
 		const patch = { permissions: mergedPermissions };
-		if (override?.sandbox !== void 0) patch.sandbox = {
-			...asReasonixRecord(parsed.sandbox),
-			...asReasonixRecord(override.sandbox)
-		};
+		if (override?.sandbox !== void 0) {
+			const mergedSandbox = {
+				...asReasonixRecord(parsed.sandbox),
+				...asReasonixRecord(override.sandbox)
+			};
+			patch.sandbox = mergedSandbox;
+			trustAffecting.push(...collectSandboxOverlayEntries({
+				existing: parsed.sandbox,
+				authored: override.sandbox,
+				merged: mergedSandbox
+			}));
+		}
 		if (override?.agent !== void 0) {
 			const mergedAgent = {
 				...asReasonixRecord(parsed.agent),
@@ -42654,9 +43363,16 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			};
 			const retired = REASONIX_RETIRED_AGENT_KEYS.filter((key) => mergedAgent[key] !== void 0);
 			for (const key of retired) delete mergedAgent[key];
-			if (retired.length > 0) logger?.warn(`Reasonix permissions: removing ${retired.map((key) => `"${key}"`).join(", ")} from [agent] in ${filePath}; Reasonix took the key off its config surface in v1.17.18, so what it used to express now belongs in the shared \`permission\` block.`);
+			if (retired.length > 0) logger?.warn(`Reasonix permissions: removing ${retired.map((key) => `"${key}"`).join(", ")} from [agent] in ${relativeFilePathForLog}; Reasonix took the key off its config surface in v1.17.18, so what it used to express now belongs in the shared \`permission\` block.`);
 			patch.agent = mergedAgent;
 		}
+		warnOnTrustAffectingEntries({
+			toolLabel: REASONIX_TOOL_LABEL,
+			noun: "change",
+			entries: trustAffecting,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		});
 		return new ReasonixPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -42691,6 +43407,8 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const sandbox = asReasonixRecord(this.toml.sandbox);
 		const agentPlanMode = pickReasonixKeys(this.toml.agent, [...REASONIX_OVERRIDE_AGENT_KEYS, ...REASONIX_RETIRED_AGENT_KEYS]);
 		const reasonixOverride = {};
+		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
+		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;