rulesync 16.23.0 → 16.24.1

package/dist/{import-D420jbVB.cjs → import-CI0pN6s5.cjs}

@@ -6658,10 +6658,25 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
-* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`,
-* `allowedHttpHookUrls`, `allowPrivateNetworkHooks` — the latter is honored by
-* Qwen Code only in user/system settings, so generate skips it in project scope).
-* It also
+* `sandbox`, `sandboxImage`, `disabled`, `visible`, `listDirectory`,
+* `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
+* `allowPrivateNetworkHooks`, `allowedInsecureVoiceBaseUrls`). Qwen Code strips
+* `tools.workflowsEnabled`, `security.allowPrivateNetworkHooks` and
+* `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
+* skips those three in project scope and announces a granting value in global
+* scope. `security.allowedHttpHookUrls` (honored in a workspace only while no
+* higher scope sets it) and `security.folderTrust` (the initial trust decision
+* is made from user/system settings alone, before the workspace merge) are
+* written in both scopes, with a note in project scope and an announcement of
+* any global change. Every other key is honored in either scope, so a write that
+* changes what the file said is reported in either scope, naming what that key
+* decides there — the autonomy and containment
+* controls (`approvalMode`, `autoAccept`, `sandbox`, `sandboxImage`), the
+* registry controls (`disabled`, `visible`, `listDirectory`), the Auto Mode
+* classifier config, and, because these groups are loose objects, any key
+* rulesync does not model. Import flags a scope-dependent key only when it read
+* the project file, since that is the value a `--global` regenerate would
+* promote. It also
 * exposes `permissions.autoMode` (the Auto Mode classifier config:
 * `hints.{allow,softDeny,hardDeny}`, `environment`, `classifyAllShell` — see
 * https://qwenlm.github.io/qwen-code-docs/en/users/features/auto-mode/), which
@@ -22812,8 +22827,10 @@ function definitionsToHermesEntries({ event, sourceEvent = event, definitions, l
 	for (const definition of definitions) {
 		if ((definition.type ?? "command") !== "command" || typeof definition.command !== "string" || definition.command === "") continue;
 		const entry = { command: definition.command };
-		if (typeof definition.matcher === "string" && definition.matcher !== "") if (supportsMatcher) entry.matcher = definition.matcher;
-		else logger?.warn(`matcher "${definition.matcher}" on "${sourceEvent}" hook will be ignored — Hermes Agent only supports matchers on pre_tool_call/post_tool_call`);
+		if (typeof definition.matcher === "string" && definition.matcher !== "") {
+			if (supportsMatcher) entry.matcher = definition.matcher;
+			else logger?.warn(`matcher "${definition.matcher}" on "${sourceEvent}" hook will be ignored — Hermes Agent only supports matchers on pre_tool_call/post_tool_call`);
+		}
 		if (typeof definition.timeout === "number") entry.timeout = definition.timeout;
 		if (typeof definition.failClosed === "boolean") {
 			if (event === HERMESAGENT_FAIL_CLOSED_EVENT) entry.fail_closed = definition.failClosed;
@@ -24041,8 +24058,10 @@ function canonicalToKiroHooks({ config, logger }) {
 			key: eventName
 		}) ?? eventName;
 		const entries = buildKiroEntriesForEvent(definitions);
-		if (entries.length > 0) if (kiro[kiroEventName]) kiro[kiroEventName].push(...entries);
-		else kiro[kiroEventName] = entries;
+		if (entries.length > 0) {
+			if (kiro[kiroEventName]) kiro[kiroEventName].push(...entries);
+			else kiro[kiroEventName] = entries;
+		}
 	}
 	return kiro;
 }
@@ -24868,8 +24887,10 @@ function canonicalToReasonixHooks({ config, toolOverrideHooks, logger }) {
 			if ((def.type ?? "command") !== "command") continue;
 			if (typeof def.command !== "string") continue;
 			const entry = { command: def.command };
-			if (typeof def.matcher === "string" && def.matcher !== "") if (isMatcherEvent) entry.match = def.matcher;
-			else logger?.warn(`matcher "${def.matcher}" on "${event}" hook will be ignored — Reasonix's "${reasonixEvent}" event does not support matchers`);
+			if (typeof def.matcher === "string" && def.matcher !== "") {
+				if (isMatcherEvent) entry.match = def.matcher;
+				else logger?.warn(`matcher "${def.matcher}" on "${event}" hook will be ignored — Reasonix's "${reasonixEvent}" event does not support matchers`);
+			}
 			if (typeof def.description === "string" && def.description !== "") entry.description = def.description;
 			if (typeof def.timeout === "number") entry.timeout = Math.round(def.timeout * 1e3);
 			entries.push(entry);
@@ -28437,12 +28458,16 @@ function convertFromCodexFormat(codexMcp) {
 			} else if (key === "oauth" && isRecord$1(value)) converted[key] = mapOauthFromCodex(value);
 			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_FIELD_MAP[key];
-				if (mappedKey) if (isValidRenamedArray(key, value)) converted[mappedKey] = value;
-				else warnWithFallback(void 0, `Ignored malformed array for ${key} in MCP server ${name}`);
+				if (mappedKey) {
+					if (isValidRenamedArray(key, value)) converted[mappedKey] = value;
+					else warnWithFallback(void 0, `Ignored malformed array for ${key} in MCP server ${name}`);
+				}
 			} else if (Object.hasOwn(CODEX_TO_RULESYNC_SCALAR_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_SCALAR_FIELD_MAP[key];
-				if (mappedKey) if (typeof value === "string") converted[mappedKey] = value;
-				else warnWithFallback(void 0, `Ignored malformed value for ${key} in MCP server ${name}: expected a string`);
+				if (mappedKey) {
+					if (typeof value === "string") converted[mappedKey] = value;
+					else warnWithFallback(void 0, `Ignored malformed value for ${key} in MCP server ${name}: expected a string`);
+				}
 			} else converted[key] = value;
 		}
 		restateCanonicalTransport(converted);
@@ -28474,12 +28499,16 @@ function convertToCodexFormat(mcpServers) {
 			} else if (key === "oauth" && isRecord$1(value)) converted[key] = mapOauthToCodex(value);
 			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_FIELD_MAP[key];
-				if (mappedKey) if (isValidRenamedArray(key, value)) converted[mappedKey] = value;
-				else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string array, got ${typeof value}`);
+				if (mappedKey) {
+					if (isValidRenamedArray(key, value)) converted[mappedKey] = value;
+					else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string array, got ${typeof value}`);
+				}
 			} else if (Object.hasOwn(RULESYNC_TO_CODEX_SCALAR_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_SCALAR_FIELD_MAP[key];
-				if (mappedKey) if (typeof value === "string") converted[mappedKey] = value;
-				else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string, got ${typeof value}`);
+				if (mappedKey) {
+					if (typeof value === "string") converted[mappedKey] = value;
+					else warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected string, got ${typeof value}`);
+				}
 			} else converted[key] = value;
 		}
 		const previousName = originalNames.get(codexName);
@@ -28723,8 +28752,10 @@ function resolveRemoteMcpUrl(serverConfig) {
 /** The `command` array a `local` server is spawned with, `args` merged in. */
 function resolveLocalMcpCommand(serverConfig) {
 	const commandArray = [];
-	if (serverConfig.command) if (Array.isArray(serverConfig.command)) commandArray.push(...serverConfig.command);
-	else commandArray.push(serverConfig.command);
+	if (serverConfig.command) {
+		if (Array.isArray(serverConfig.command)) commandArray.push(...serverConfig.command);
+		else commandArray.push(serverConfig.command);
+	}
 	if (serverConfig.args) commandArray.push(...serverConfig.args);
 	return commandArray;
 }
@@ -29261,8 +29292,10 @@ function toDeepagentsServer({ name, server, logger }) {
 	const { enabledTools, disabledTools, type: _type, transport, ...rest } = server;
 	const converted = { ...rest };
 	const normalized = normalizeDeepagentsTransport(rawTransport);
-	if (normalized !== void 0) if (transport !== void 0) converted.transport = normalized;
-	else converted.type = normalized;
+	if (normalized !== void 0) {
+		if (transport !== void 0) converted.transport = normalized;
+		else converted.type = normalized;
+	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
 		toolName: TOOL_NAME,
 		serverName: name,
@@ -29277,8 +29310,10 @@ function toDeepagentsServer({ name, server, logger }) {
 			logger
 		});
 		converted.allowedTools = enabledTools;
-	} else if (disabledTools !== void 0) if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
-	else converted.disabledTools = disabledTools;
+	} else if (disabledTools !== void 0) {
+		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
+		else converted.disabledTools = disabledTools;
+	}
 	return converted;
 }
 /** Lift dcode's spellings back into the canonical model. */
@@ -32215,14 +32250,16 @@ function rulesyncMcpServerToReasonix(name, server, logger) {
 		name,
 		...type !== void 0 && { type }
 	};
-	if (server.command !== void 0) if (Array.isArray(server.command)) {
-		const [command, ...commandArgs] = server.command;
-		if (command !== void 0) plugin.command = command;
-		const args = [...commandArgs, ...server.args ?? []];
-		if (args.length > 0) plugin.args = args;
-	} else {
-		plugin.command = server.command;
-		if (server.args !== void 0) plugin.args = server.args;
+	if (server.command !== void 0) {
+		if (Array.isArray(server.command)) {
+			const [command, ...commandArgs] = server.command;
+			if (command !== void 0) plugin.command = command;
+			const args = [...commandArgs, ...server.args ?? []];
+			if (args.length > 0) plugin.args = args;
+		} else {
+			plugin.command = server.command;
+			if (server.args !== void 0) plugin.args = server.args;
+		}
 	}
 	for (const field of REASONIX_PLUGIN_FIELDS) {
 		if (field === "type" || field === "command" || field === "args") continue;
@@ -33290,14 +33327,16 @@ function rulesyncMcpServerToVibe(name, server, existing) {
 		name,
 		...transport !== void 0 && { transport }
 	};
-	if (server.command !== void 0) if (Array.isArray(server.command)) {
-		const [command, ...commandArgs] = server.command;
-		if (command !== void 0) vibeServer.command = command;
-		const args = [...commandArgs, ...server.args ?? []];
-		if (args.length > 0) vibeServer.args = args;
-	} else {
-		vibeServer.command = server.command;
-		if (server.args !== void 0) vibeServer.args = server.args;
+	if (server.command !== void 0) {
+		if (Array.isArray(server.command)) {
+			const [command, ...commandArgs] = server.command;
+			if (command !== void 0) vibeServer.command = command;
+			const args = [...commandArgs, ...server.args ?? []];
+			if (args.length > 0) vibeServer.args = args;
+		} else {
+			vibeServer.command = server.command;
+			if (server.args !== void 0) vibeServer.args = server.args;
+		}
 	}
 	const hasStructuredAuth = serverRecord.auth !== void 0;
 	for (const field of VIBE_MCP_SERVER_FIELDS) {
@@ -42504,15 +42543,129 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"sandbox",
 	"sandboxImage",
 	"disabled",
-	"visible"
+	"visible",
+	"listDirectory",
+	"workflowsEnabled"
 ];
 const QWEN_OVERRIDE_SECURITY_KEYS = [
 	"folderTrust",
 	"allowedHttpHookUrls",
-	"allowPrivateNetworkHooks"
+	"allowPrivateNetworkHooks",
+	"allowedInsecureVoiceBaseUrls"
 ];
-const QWEN_GLOBAL_ONLY_SECURITY_KEYS = ["allowPrivateNetworkHooks"];
+/**
+* What each rule means for the two directions, so a key's behavior is declared
+* once beside its rule rather than spelled out at every branch.
+*
+* `stripInProjectScope` separates the keys a project file cannot use at all from
+* the ones whose project value still does something, just not unconditionally —
+* only the former are dropped. `announceOnlyGrants` marks the rule whose risk is
+* a value that turns something on; for the others the dangerous value is often
+* the falsy one (an empty allow-all list, folder trust switched off, a sandbox
+* turned off), so every change is announced instead. `announceOnImport` marks
+* the keys whose meaning depends on the scope they are written in — importing
+* one and regenerating globally turns a value a workspace could not decide for
+* itself into one Qwen Code enforces everywhere. `global-machine-wide` keys are
+* honored identically in either scope, so import neither promotes nor weakens
+* them and the announcement on the generate side is the control point.
+* `projectNote` is `null` for a rule that has nothing to say about the project
+* scope. A `globalNote` here is the rule's default; a key whose meaning the
+* default does not describe carries its own.
+*/
+const QWEN_SCOPE_RULES = {
+	"workspace-stripped": {
+		stripInProjectScope: true,
+		announceOnlyGrants: true,
+		announceOnImport: true,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} is only honored in user/system settings, so it is skipped for the project-scoped ${filePath} (a value already in that file is left as it is). Check it if the override arrived with a repository you cloned, and author it in the global scope only if that is a value you want every project on this machine to run under.`,
+		globalNote: "Qwen Code ignores this key in workspace settings so a repository cannot grant it per project; in the global scope it applies to every project on this machine."
+	},
+	"workspace-non-overriding": {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: true,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, but Qwen Code honors a workspace value for it only while no user, system, or system-defaults scope sets the key — a repository cannot replace the list a user configured in a higher scope. It does replace one written by hand in this same file, and an empty list is Qwen Code's allow-all, so check what it now says. Author it in the global scope if it has to apply unconditionally.`,
+		globalNote: "A global value outranks every repository's own list for this key, and an empty list means allow-all, so this decides where HTTP hooks may send data for every project on this machine."
+	},
+	"user-scope-trust-check": {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: true,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, but Qwen Code makes the initial trust decision from user and system settings alone, before a workspace file is merged, so a project value cannot decide whether this workspace is trusted (it still drives folder trust once the workspace is trusted). Check it if the override arrived with a repository you cloned, and author it in the global scope only if that is a value you want every project on this machine to run under.`,
+		globalNote: "Qwen Code reads this key from the global scope when it decides whether a workspace is trusted, so this changes which projects on this machine it trusts."
+	},
+	"global-machine-wide": {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: false,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code honors this key in a workspace file, so it takes effect while you work in this repository. Check it if the override arrived with a repository you cloned.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope it settles how much the agent may do unattended — how far approvals are skipped, and whether tool calls are contained at all — for every project on this machine."
+	},
+	unmodeled: {
+		stripInProjectScope: false,
+		announceOnlyGrants: false,
+		announceOnImport: false,
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. This is not a key rulesync models, so it cannot say what Qwen Code does with it — and some settings in these groups are potent (\`tools.discoveryCommand\` and \`tools.callCommand\` are spawned as commands when Qwen Code starts). Check it if the override arrived with a repository you cloned.`,
+		globalNote: "This is not a key rulesync models, so it cannot say what Qwen Code does with it — and some settings in these groups are potent (`tools.discoveryCommand` and `tools.callCommand` are spawned as commands when Qwen Code starts). Check what it now says for every project on this machine."
+	}
+};
+const QWEN_OVERRIDE_GROUPS = [{
+	groupName: "tools",
+	overrideKeys: QWEN_OVERRIDE_TOOLS_KEYS,
+	scopedKeys: {
+		workflowsEnabled: { rule: "workspace-stripped" },
+		approvalMode: {
+			rule: "global-machine-wide",
+			projectNote: autonomyProjectNote
+		},
+		autoAccept: {
+			rule: "global-machine-wide",
+			projectNote: autonomyProjectNote
+		},
+		sandbox: {
+			rule: "global-machine-wide",
+			projectNote: autonomyProjectNote
+		},
+		sandboxImage: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so a sandboxed run in this repository executes inside the named image — check that it is one you trust to run your code.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope every sandboxed run on this machine executes inside the named image — check that it is one you trust to run your code."
+		},
+		disabled: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so a name that is gone is a tool the model can call again in this repository unless another scope still disables it.`,
+			globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the list in this file rather than adding to it, so in the global scope this decides which tools stay out of the registry for every project on this machine — dropping a name hands that tool back to the model unless another scope still disables it."
+		},
+		visible: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides which deferred tools are visible at startup in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides which deferred tools are visible at startup for every project on this machine."
+		},
+		listDirectory: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
+		}
+	}
+}, {
+	groupName: "security",
+	overrideKeys: QWEN_OVERRIDE_SECURITY_KEYS,
+	scopedKeys: {
+		allowPrivateNetworkHooks: { rule: "workspace-stripped" },
+		allowedInsecureVoiceBaseUrls: {
+			rule: "workspace-stripped",
+			grants: isNonEmptyArray
+		},
+		allowedHttpHookUrls: { rule: "workspace-non-overriding" },
+		folderTrust: { rule: "user-scope-trust-check" }
+	}
+}];
 const QWEN_OVERRIDE_PERMISSIONS_KEYS = ["autoMode"];
+const QWEN_SCOPED_PERMISSIONS_KEYS = { autoMode: {
+	rule: "global-machine-wide",
+	projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the whole block rather than merging into it, so it rewrites the instructions Auto Mode's classifier follows in this repository — including any deny hint you had configured.`,
+	globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the whole block rather than merging into it, so in the global scope this rewrites the instructions Auto Mode's classifier follows — including any deny hint you had configured — for every project on this machine."
+} };
 function asPlainRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -42524,20 +42677,172 @@ function pickQwenOverrideKeys(group, keys) {
 	return picked;
 }
 /**
-* Drop the global-only `security` keys from the override when generating project
-* settings, warning once per dropped key. Only the override copy is filtered, so
-* a value the user already wrote into the project file stays untouched.
+* Whether a value written for a scoped key actually grants something. Qwen Code
+* reads the boolean ones with a plain truthiness check, so anything truthy turns
+* the capability on — `1` and the string `"false"` included, which is why this is
+* not a `=== true` test. Not all of them are booleans either:
+* `security.allowedInsecureVoiceBaseUrls` is a list of base URLs, and an empty
+* list grants nothing.
+*
+* Only the rules whose `announceOnlyGrants` is set consult this, because "empty"
+* does not mean the same thing for every list: an empty
+* `security.allowedHttpHookUrls` is Qwen Code's allow-all, the widest value there
+* is, so that key is announced whatever it says.
+*/
+function isNonEmptyArray(value) {
+	return Array.isArray(value) && value.length > 0;
+}
+/**
+* Whether a value turns something on, read the way Qwen Code reads it.
+*
+* Plain truthiness by default, because that is what Qwen Code applies to these
+* settings: `1` and the string `"false"` enable them, and so does an empty array
+* — which is why an empty list cannot be treated as harmless everywhere. A key
+* whose list Qwen Code matches against, rather than tests for truth, carries its
+* own `grants` instead.
+*/
+function grantsSomething(value, scopedKey) {
+	return (scopedKey?.grants ?? Boolean)(value);
+}
+/**
+* The autonomy and containment controls say the same thing in project scope, so
+* they share one note rather than repeating it three times.
+*/
+function autonomyProjectNote({ qualifiedKey, quotedValue, filePath }) {
+	return `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code honors this key in a workspace file, so it settles how far approvals are skipped and whether tool calls are contained while you work in this repository. Check it if the override arrived with a repository you cloned.`;
+}
+/**
+* Quote a `group.key` pair for a warning. The key goes through the same quoting
+* a value does, because it is one: the override's groups are `z.looseObject`s,
+* so a key the scope gate names may have been written by whoever authored the
+* `.rulesync/permissions.jsonc` rather than chosen from a list rulesync knows.
+* Serializing it — rather than wrapping it in quotes of our own — is what keeps
+* a key that contains a quote from closing it and continuing the sentence.
+*/
+function quoteQualifiedKey({ groupName, key }) {
+	return quoteValueForWarning(`${groupName}.${key}`);
+}
+/**
+* Compare two settings values without letting key order decide the answer, so
+* re-emitting `{ enabled: true, note: "x" }` as `{ note: "x", enabled: true }`
+* is not announced as a change.
 */
-function scopeOverrideSecurity(overrideSecurity, { global, relativeFilePath, logger }) {
-	const scoped = { ...asPlainRecord(overrideSecurity) };
-	if (global) return scoped;
-	for (const key of QWEN_GLOBAL_ONLY_SECURITY_KEYS) {
-		if (scoped[key] === void 0) continue;
-		delete scoped[key];
-		logger?.warn(`Qwen permissions: 'security.${key}' is only honored in user/system settings, so it is skipped for the project-scoped ${relativeFilePath}. Author it in the global scope instead.`);
+function stableStringify(value) {
+	return JSON.stringify(value, (_key, nested) => nested !== null && typeof nested === "object" && !Array.isArray(nested) ? Object.fromEntries(Object.entries(nested).toSorted(([left], [right]) => left.localeCompare(right))) : nested) ?? "undefined";
+}
+function sameSettingsValue(a, b) {
+	return stableStringify(a) === stableStringify(b);
+}
+/**
+* Apply the scope rules for a settings group's scoped keys.
+*
+* Generating project settings drops the keys Qwen Code strips from a workspace
+* file before the merge — writing one there would be dead configuration — and
+* explains the keys whose project value is honored only conditionally rather
+* than dropping those. Either way only the override copy is touched, so a value
+* the user already wrote into the project file stays where it is.
+*
+* Generating global settings keeps every key, and announces the write: the
+* `.rulesync/permissions.jsonc` carrying it may have arrived with a cloned or
+* fetched repository, and the global file applies to every project on this
+* machine. So the new value is named alongside the one it replaces, exactly as
+* the deepagents startup override announces its own relaxations. Every key the
+* override writes is announced, not only the ones with a scope rule — the
+* groups are `z.looseObject`s, so an unmodeled key falls back to the
+* `unmodeled` rule rather than slipping past the gate that the modeled ones
+* pass through.
+*/
+function scopeOverrideGroup(overrideGroup, { groupName, scopedKeys, existingGroup, global, filePath, logger }) {
+	const scoped = { ...asPlainRecord(overrideGroup) };
+	const previous = asPlainRecord(existingGroup);
+	const rulesByKey = new Map(Object.entries(scopedKeys));
+	for (const key of Object.keys(scoped)) {
+		const value = scoped[key];
+		if (value === void 0) continue;
+		const scopedKey = rulesByKey.get(key);
+		const rule = scopedKey?.rule ?? "unmodeled";
+		const { stripInProjectScope, announceOnlyGrants } = QWEN_SCOPE_RULES[rule];
+		const projectNote = scopedKey?.projectNote ?? QWEN_SCOPE_RULES[rule].projectNote;
+		const globalNote = scopedKey?.globalNote ?? QWEN_SCOPE_RULES[rule].globalNote;
+		const previousValue = Object.hasOwn(previous, key) ? previous[key] : void 0;
+		const unchanged = sameSettingsValue(previousValue, value);
+		if (!global) {
+			if (stripInProjectScope) delete scoped[key];
+			else if (unchanged) continue;
+			if (projectNote) warnWithFallback(logger, `Qwen permissions: ${projectNote({
+				qualifiedKey: quoteQualifiedKey({
+					groupName,
+					key
+				}),
+				quotedValue: quoteValueForWarning(value),
+				filePath
+			})}`);
+			continue;
+		}
+		if (unchanged) continue;
+		if (announceOnlyGrants && !grantsSomething(value, scopedKey)) continue;
+		const replaced = previousValue === void 0 ? "" : ` (was ${quoteValueForWarning(previousValue)})`;
+		warnWithFallback(logger, `Qwen permissions: the qwencode override wrote ${quoteQualifiedKey({
+			groupName,
+			key
+		})} = ${quoteValueForWarning(value)}${replaced} into ${filePath}, your global Qwen Code settings. ${globalNote}`);
 	}
 	return scoped;
 }
+/**
+* Build the `tools`/`security` patch groups contributed by the `qwencode`
+* override. Each group is shallow-merged over what `settings.json` already has,
+* after the scope gate has handled the keys Qwen Code honors in one scope only.
+*/
+function buildOverrideGroupsPatch({ settings, override, global, filePath, logger }) {
+	const patch = {};
+	for (const { groupName, scopedKeys } of QWEN_OVERRIDE_GROUPS) {
+		const overrideGroup = override?.[groupName];
+		if (overrideGroup === void 0) continue;
+		const existingGroup = settings[groupName];
+		const scoped = scopeOverrideGroup(overrideGroup, {
+			groupName,
+			scopedKeys,
+			existingGroup,
+			global,
+			filePath,
+			logger
+		});
+		const merged = {
+			...asPlainRecord(existingGroup),
+			...scoped
+		};
+		if (Object.keys(merged).length > 0) patch[groupName] = merged;
+	}
+	return patch;
+}
+/**
+* Warn about a scoped key lifted out of a *project* settings file being
+* imported. The file carries no scope marker, so import keeps the key either
+* way — but regenerating in the global scope would turn a value a workspace
+* could not decide for itself into one Qwen Code enforces everywhere, and a
+* settings file read out of a cloned repository is exactly where such a value
+* comes from. Importing the global file is the case this has nothing to say
+* about: the value is already in the scope the warning would send it to.
+*/
+function warnAboutImportedScopedKeys(groups) {
+	for (const { groupName, scopedKeys } of QWEN_OVERRIDE_GROUPS) {
+		const group = groups[groupName];
+		for (const [key, scopedKey] of Object.entries(scopedKeys)) {
+			const { rule } = scopedKey;
+			const value = group[key];
+			if (value === void 0) continue;
+			const { announceOnlyGrants, announceOnImport } = QWEN_SCOPE_RULES[rule];
+			if (!announceOnImport) continue;
+			if (announceOnlyGrants && !grantsSomething(value, scopedKey)) continue;
+			const globalNote = scopedKey.globalNote ?? QWEN_SCOPE_RULES[rule].globalNote;
+			moduleLogger$1.warn(`Qwen permissions: imported ${quoteQualifiedKey({
+				groupName,
+				key
+			})} = ${quoteValueForWarning(value)}. ${globalNote} Review it before generating with the global scope.`);
+		}
+	}
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -42566,7 +42871,8 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
-			validate
+			validate,
+			global
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
@@ -42582,6 +42888,7 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Qwen settings at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
+		const displayPath = toPosixPath((0, node_path.join)(global ? "~" : ".", paths.relativeDirPath, paths.relativeFilePath));
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToQwenPermissions(config);
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toQwenToolName(category)));
@@ -42600,24 +42907,25 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
 		const override = config.qwencode;
-		if (override?.autoMode !== void 0) mergedPermissions.autoMode = override.autoMode;
-		const patch = { permissions: mergedPermissions };
-		if (override?.tools !== void 0) patch.tools = {
-			...asPlainRecord(settings.tools),
-			...asPlainRecord(override.tools)
-		};
-		if (override?.security !== void 0) {
-			const scopedSecurity = scopeOverrideSecurity(override.security, {
+		if (override?.autoMode !== void 0) {
+			const scopedAutoMode = scopeOverrideGroup({ autoMode: override.autoMode }, {
+				groupName: "permissions",
+				scopedKeys: QWEN_SCOPED_PERMISSIONS_KEYS,
+				existingGroup: existingPermissions,
 				global,
-				relativeFilePath: paths.relativeFilePath,
+				filePath: displayPath,
 				logger
 			});
-			const mergedSecurity = {
-				...asPlainRecord(settings.security),
-				...scopedSecurity
-			};
-			if (Object.keys(mergedSecurity).length > 0) patch.security = mergedSecurity;
+			if (scopedAutoMode.autoMode !== void 0) mergedPermissions.autoMode = scopedAutoMode.autoMode;
 		}
+		const patch = { permissions: mergedPermissions };
+		Object.assign(patch, buildOverrideGroupsPatch({
+			settings,
+			override,
+			global,
+			filePath: displayPath,
+			logger
+		}));
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "permissions",
@@ -42649,16 +42957,17 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			ask: permissions.ask ?? [],
 			deny: permissions.deny ?? []
 		});
-		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
-		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
-		for (const key of QWEN_GLOBAL_ONLY_SECURITY_KEYS) {
-			if (overrideSecurity[key] === void 0) continue;
-			moduleLogger$1.warn(`Qwen permissions: imported 'security.${key}'. Qwen Code ignores it in workspace settings but enforces it in user/system settings, so review it before generating with the global scope.`);
-		}
+		const overrideGroups = {
+			tools: pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS),
+			security: pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS)
+		};
+		if (!this.global) warnAboutImportedScopedKeys(overrideGroups);
 		const overridePermissions = pickQwenOverrideKeys(settings.permissions, QWEN_OVERRIDE_PERMISSIONS_KEYS);
 		const qwencodeOverride = {};
-		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
-		if (Object.keys(overrideSecurity).length > 0) qwencodeOverride.security = overrideSecurity;
+		for (const { groupName } of QWEN_OVERRIDE_GROUPS) {
+			const group = overrideGroups[groupName];
+			if (Object.keys(group).length > 0) qwencodeOverride[groupName] = group;
+		}
 		if (overridePermissions.autoMode !== void 0) qwencodeOverride.autoMode = overridePermissions.autoMode;
 		const result = { ...config };
 		if (Object.keys(qwencodeOverride).length > 0) result.qwencode = qwencodeOverride;
@@ -64925,8 +65234,10 @@ var RooRule = class RooRule extends ToolRule {
 			nonRootPath: this.getSettablePaths().nonRoot
 		});
 		const mode = rulesyncRule.getFrontmatter().roo?.mode;
-		if (!params.root && mode !== void 0 && mode !== "") if (!ROO_MODE_SLUG_PATTERN.test(mode)) warnWithFallback(void 0, `Ignoring roo.mode "${mode}" on ${rulesyncRule.getRelativeFilePath()}: a mode slug may contain only letters, digits and hyphens. Writing the rule to ${params.relativeDirPath} instead.`);
-		else params.relativeDirPath = (0, node_path.join)((0, node_path.dirname)(params.relativeDirPath), rooModeRulesDirName(mode));
+		if (!params.root && mode !== void 0 && mode !== "") {
+			if (!ROO_MODE_SLUG_PATTERN.test(mode)) warnWithFallback(void 0, `Ignoring roo.mode "${mode}" on ${rulesyncRule.getRelativeFilePath()}: a mode slug may contain only letters, digits and hyphens. Writing the rule to ${params.relativeDirPath} instead.`);
+			else params.relativeDirPath = (0, node_path.join)((0, node_path.dirname)(params.relativeDirPath), rooModeRulesDirName(mode));
+		}
 		return new RooRule(params);
 	}
 	/**