rulesync 16.25.0 → 16.26.0

package/dist/{import-DwtzMiDG.cjs → import-BAnifHej.cjs}

@@ -4730,9 +4730,14 @@ const KIMI_CODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CAN
 * ZCode's configuration-file hooks expose exactly seven PascalCase events, all
 * of which have a clean canonical equivalent: `SessionStart`, `PreToolUse`,
 * `PostToolUse`, `PostToolUseFailure`, `PermissionRequest`, `Stop`, and
-* `UserPromptSubmit` ← `beforeSubmitPrompt`. An optional matcher (a
-* case-sensitive regular expression) is honored on all of them except
-* `UserPromptSubmit` and `Stop`, which expose no value to match against.
+* `UserPromptSubmit` ← `beforeSubmitPrompt`. An optional matcher is honored on
+* all of them except `UserPromptSubmit` and `Stop`, which expose no value to
+* match against. ZCode reads the matcher in one of two ways: a value made up
+* solely of letters, digits, underscores and `|` is an exact name list
+* (`Write|Edit` matches those two tool names, not the regex alternation), and
+* any other character makes the whole value a case-sensitive JavaScript regex.
+* Rulesync passes matchers through verbatim, so an authored value keeps
+* whichever reading ZCode gives it — worth knowing before escaping one.
 * Configuration hooks are read only from the user config
 * `~/.zcode/cli/config.json` (workspace config hooks are never executed) and
 * additionally require `hooks.enabled: true` to run.
@@ -6904,12 +6909,37 @@ const DeepagentsStartupOverrideSchema = zod_mini.z.looseObject({
 	read_project_dotenv: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
+* deepagents-cli's Python extension gate under `[extensions]` in
+* `~/.deepagents/config.toml`. `discover_extensions` auto-loads `*.py` from the
+* user's `~/.deepagents/extensions/` and from the checked-out project's
+* `<root>/.deepagents/extensions/`, so these two keys decide whether
+* repository-authored Python is imported into the agent process at all —
+* the same class of knob as `[startup].mode`, and one that ships defaulting to
+* a prompt a user can accept. Loose so a key added upstream passes through
+* verbatim.
+*
+* `extensions.extra_paths` is deliberately absent: it names machine-local files
+* and directories, which do not belong in a committed
+* `.rulesync/permissions.jsonc`, and it only ever widens what loads.
+*
+* @see https://docs.langchain.com/oss/deepagents/code/configuration
+*/
+const DeepagentsExtensionsOverrideSchema = zod_mini.z.looseObject({
+	enabled: zod_mini.z.optional(zod_mini.z.boolean()),
+	trust: zod_mini.z.optional(zod_mini.z.enum([
+		"ask",
+		"always",
+		"never"
+	]))
+});
+/**
 * The `[shell].allow_list` array itself is rulesync-owned, driven by the
 * shared `permission.bash` block, so it has no key here.
 */
 const DeepagentsPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	startup: zod_mini.z.optional(DeepagentsStartupOverrideSchema)
+	startup: zod_mini.z.optional(DeepagentsStartupOverrideSchema),
+	extensions: zod_mini.z.optional(DeepagentsExtensionsOverrideSchema)
 });
 /**
 * The actions Junie's allowlist accepts. Verified against the shipped Junie
@@ -7920,8 +7950,9 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 	agentsmd: zod_mini.z.optional(zod_mini.z.looseObject({ subprojectPath: zod_mini.z.optional(zod_mini.z.string()) })),
 	claudecode: zod_mini.z.optional(zod_mini.z.looseObject({ paths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })),
 	codebuddy: zod_mini.z.optional(zod_mini.z.looseObject({
-		paths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
 		alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
+		enabled: zod_mini.z.optional(zod_mini.z.boolean()),
 		description: zod_mini.z.optional(zod_mini.z.string())
 	})),
 	cursor: zod_mini.z.optional(zod_mini.z.looseObject({
@@ -9214,6 +9245,11 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		license: zod_mini.z.optional(zod_mini.z.string()),
 		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+	})),
+	zcode: zod_mini.z.optional(zod_mini.z.looseObject({
+		when_to_use: zod_mini.z.optional(zod_mini.z.string()),
+		license: zod_mini.z.optional(zod_mini.z.string()),
+		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	}))
 });
 /**
@@ -17796,6 +17832,20 @@ const ROO_MCP_FILE_NAME = "mcp.json";
 */
 const ROO_MODE_SLUG_PATTERN = /^[a-zA-Z0-9-]+$/;
 /**
+* `~/.roo/rules/AGENTS.md` — where the root rule goes in global scope.
+*
+* Roo/Zoo Code discover the agent-rules files (`AGENTS.md`, `AGENT.md`,
+* `AGENTS.local.md`) in the **workspace only**: `loadAllAgentRulesFiles` reads
+* `cwd`, plus subdirectories holding a `.roo` folder when `enableSubfolderRules`
+* is on. There is no home-directory branch, so a `~/AGENTS.md` is never read.
+* The global rules directory `~/.roo/rules/` *is* loaded, so the root rule is
+* written there alongside the non-root files rather than to an unread path.
+* The basename is kept so the file still reads as the root overview.
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/core/prompts/sections/custom-instructions.ts
+* @see https://github.com/Zoo-Code-Org/Zoo-Code/blob/main/src/services/roo-config/index.ts
+*/
+const ROO_GLOBAL_ROOT_RULE_FILE_NAME = "AGENTS.md";
+/**
 * `.roo/rules-{mode}/` — the mode-specific rule directory Roo/Zoo Code load
 * INSTEAD of `.roo/rules/` while that mode is active. The relative path is the
 * same in global scope, where it resolves under `~/.roo/`.
@@ -22855,7 +22905,7 @@ var DevinHooks = class DevinHooks extends ToolHooks {
 * adapter so the settings reader in `src/utils/` can name the same list without
 * importing a feature.
 *
-* @see https://docs.factory.ai/cli/configuration/settings
+* @see https://docs.factory.ai/droid-cli/settings
 */
 const FACTORYDROID_OVERRIDE_KEYS = [
 	"commandBlocklist",
@@ -22863,6 +22913,8 @@ const FACTORYDROID_OVERRIDE_KEYS = [
 	"sandbox",
 	"mcpPolicy",
 	"mcpAutonomyOverrides",
+	"mcpAutonomyUrlOverrides",
+	"builtInToolAutonomyOverrides",
 	"enableDroidShield",
 	"sessionDefaultSettings",
 	"maxAutonomyLevel",
@@ -22870,7 +22922,10 @@ const FACTORYDROID_OVERRIDE_KEYS = [
 	"interactionMode",
 	"extraKnownMarketplaces",
 	"enabledPlugins",
+	"strictEnabledPlugins",
+	"strictKnownMarketplaces",
 	"hooksDisabled",
+	"allowManagedHooksOnly",
 	"disabledSkills",
 	"modelPolicy",
 	"missionPolicy"
@@ -26911,6 +26966,7 @@ var ClineIgnore = class ClineIgnore extends ToolIgnore {
 //#region src/constants/crush-paths.ts
 const CRUSH_RULE_FILE_NAME = "CRUSH.md";
 const CRUSH_GLOBAL_DIR = (0, node_path.join)(".config", "crush");
+const CRUSH_LOCAL_RULE_FILE_NAME = "CRUSH.local.md";
 const CRUSH_IGNORE_FILE_NAME = ".crushignore";
 const CRUSH_SKILLS_PROJECT_DIR = (0, node_path.join)(".crush", "skills");
 const CRUSH_SKILLS_GLOBAL_DIR = (0, node_path.join)(CRUSH_GLOBAL_DIR, "skills");
@@ -33131,9 +33187,16 @@ function lookupTransport(map, key) {
 }
 /**
 * Read the "put this server's own instructions into the agent's prompt" flag
-* off an unfiltered canonical entry, under either spelling. Anything other
-* than a literal `true` reads as not enabled, matching Rovo Dev, where the key
-* is absent by default.
+* off an unfiltered canonical entry, under either spelling. `undefined` means
+* the entry says nothing, which is Rovo Dev's own default.
+*
+* The flag is a **tri-state**, not a switch that only exists when on. Atlassian
+* inverted the default on 2026-09-02: a server's instructions are now surfaced
+* when the key is absent or `true`, and `false` is what suppresses them — the
+* opposite of the opt-in wording this adapter was first written against, where
+* absent and `false` meant the same thing. So `false` has to travel end to end;
+* collapsing it away is what makes a suppression impossible to author, and
+* erases one on import.
 *
 * The canonical key decides whenever it is present, the way codex resolves the
 * same two-spelling conflict for `experimental_environment`. OR-ing the two
@@ -33141,28 +33204,25 @@ function lookupTransport(map, key) {
 * `enable_instructions: true` copied out of Atlassian's docs — fail-open, on
 * the one key whose whole purpose is a trust decision.
 *
+* A non-boolean under either spelling reads as `undefined` rather than as a
+* suppression: Rovo Dev surfaces the instructions for anything that is not
+* `false`, so writing `false` there would invent a restriction the tool is not
+* applying. (The canonical key is a strict boolean in the schema, so only the
+* raw spelling can carry one.)
+*
 * `isPlainObject` rather than `isRecord`: this walks a user-supplied key set,
 * so a `constructor` entry must not resolve up the prototype chain.
 */
 function readEnableInstructions(rawServer) {
-	if (!isPlainObject$1(rawServer)) return false;
-	if (rawServer.rovodevEnableInstructions !== void 0) return rawServer.rovodevEnableInstructions === true;
-	return rawServer.enable_instructions === true;
-}
-/**
-* Names that were emitted with `enable_instructions: true` during one
-* `fromRulesyncMcp` call, so the run can say so once rather than per server.
-* Atlassian gates this key on trust, and it is the only thing generate writes
-* that widens what steers the model — the quietest possible write is the wrong
-* one for it.
-*/
-function warnEnabledInstructions(names, logger) {
-	if (names.length === 0) return;
-	logger?.warn(`Rovo Dev MCP: writing enable_instructions: true for ${names.join(", ")}. Rovo Dev pastes ${names.length === 1 ? "that server's" : "those servers'"} own instructions into the agent's system prompt, so enable it only for servers you trust.`);
+	if (!isPlainObject$1(rawServer)) return;
+	const canonical = rawServer.rovodevEnableInstructions;
+	if (canonical !== void 0) return typeof canonical === "boolean" ? canonical : void 0;
+	const raw = rawServer.enable_instructions;
+	return typeof raw === "boolean" ? raw : void 0;
 }
 function toRovodevServer(name, server, logger) {
 	const { type, transport, disabled: _disabled, rovodevEnableInstructions, ...rest } = server;
-	if (rovodevEnableInstructions === true) rest.enable_instructions = true;
+	if (typeof rovodevEnableInstructions === "boolean") rest.enable_instructions = rovodevEnableInstructions;
 	const declared = typeof transport === "string" ? transport : typeof type === "string" ? type : void 0;
 	if (declared === void 0) return rest;
 	const mapped = lookupTransport(CANONICAL_TO_ROVODEV_TRANSPORT, declared);
@@ -33177,7 +33237,7 @@ function toRovodevServer(name, server, logger) {
 }
 function fromRovodevServer(server) {
 	const { transport, enable_instructions: enableInstructions, ...rest } = server;
-	if (enableInstructions === true) rest.rovodevEnableInstructions = true;
+	if (typeof enableInstructions === "boolean") rest.rovodevEnableInstructions = enableInstructions;
 	if (typeof transport !== "string") return rest;
 	const mapped = lookupTransport(ROVODEV_TO_CANONICAL_TRANSPORT, transport);
 	return mapped === void 0 ? rest : {
@@ -33618,10 +33678,10 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			canWriteDisableToggle = false;
 		}
 		const mcpServers = Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([name, server]) => {
-			const rawServer = rulesyncMcp.getRawMcpServer(name);
+			const enableInstructions = readEnableInstructions(rulesyncMcp.getRawMcpServer(name));
 			const record = {
 				...server,
-				...readEnableInstructions(rawServer) && { rovodevEnableInstructions: true }
+				...enableInstructions !== void 0 && { rovodevEnableInstructions: enableInstructions }
 			};
 			if (record.disabled === true && !canWriteDisableToggle) {
 				logger?.warn(`Rovo Dev MCP: skipping disabled server "${name}" because config.yml cannot be parsed, so mcp.disabledMcpServers cannot be written to switch it off.`);
@@ -33630,7 +33690,6 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			const converted = toRovodevServer(name, record, logger);
 			return converted === null ? null : [name, converted];
 		}).filter((entry) => entry !== null));
-		warnEnabledInstructions(Object.entries(mcpServers).filter(([, server]) => server.enable_instructions === true).map(([name]) => name), logger);
 		const rovodevConfig = {
 			...json,
 			mcpServers
@@ -39774,6 +39833,34 @@ const DEEPAGENTS_STARTUP_BOOLEAN_DEFAULTS = {
 	yolo_switcher: true,
 	read_project_dotenv: true
 };
+/**
+* `[extensions]` gates dcode's Python extension system. `discover_extensions`
+* auto-loads `*.py` from the user's `~/.deepagents/extensions/` and from the
+* checked-out project's `<root>/.deepagents/extensions/`, so this table decides
+* whether a cloned repository's Python is imported into the agent process.
+*/
+const EXTENSIONS_TABLE_KEY = "extensions";
+/**
+* Keys lifted back into the override on import. `extensions.extra_paths` is
+* deliberately absent: it names machine-local files and directories, which do
+* not belong in a committed `.rulesync/permissions.jsonc`, and it only ever
+* widens what loads.
+*/
+const DEEPAGENTS_EXTENSIONS_KEYS = ["enabled", "trust"];
+/** `TrustPolicy` in `extensions/settings.py`; dcode reads nothing else. */
+const DEEPAGENTS_EXTENSION_TRUST_POLICIES = [
+	"ask",
+	"always",
+	"never"
+];
+/**
+* `[extensions].enabled` defaults to `true` upstream, so writing `true` on a
+* machine that has not set it changes nothing — the same reasoning as
+* `DEEPAGENTS_STARTUP_BOOLEAN_DEFAULTS`.
+*
+* @see https://github.com/langchain-ai/deepagents `config_manifest.py`
+*/
+const DEEPAGENTS_EXTENSIONS_ENABLED_DEFAULT = true;
 const ALLOW_ALL_SENTINEL = "all";
 const RECOMMENDED_SENTINEL = "recommended";
 const GLOB_CHARACTERS_PATTERN = /[*?[\]]/;
@@ -39843,7 +39930,10 @@ const TRAILING_ARGUMENT_WILDCARD_PATTERN = /:\*$/;
 * `DeepagentsPermissionsOverrideSchema`): `[startup].mode`
 * (`manual` / `auto` / `yolo`), `[startup].yolo_switcher` and
 * `[startup].read_project_dotenv` are merged into the file on generate and
-* lifted back into the override on import.
+* lifted back into the override on import. The same override carries
+* `[extensions].enabled` and `[extensions].trust` (`ask` / `always` / `never`),
+* which decide whether the Python in a checked-out project's
+* `.deepagents/extensions/` is imported into the agent process.
 *
 * On **import** the allowlist comes back as `bash` `allow` rules named by the
 * executable — skipping any entry dcode could not match in the first place, so
@@ -39945,6 +40035,13 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			filePath,
 			logger
 		});
+		const extensionsOverride = config.deepagents?.extensions;
+		if (isPlainObject$1(extensionsOverride) && Object.keys(extensionsOverride).length > 0) mergeExtensionsOverride({
+			settings,
+			extensionsOverride,
+			filePath,
+			logger
+		});
 		return new DeepagentsPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -39969,8 +40066,15 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			startup: isPlainObject$1(settings[STARTUP_TABLE_KEY]) ? settings[STARTUP_TABLE_KEY] : {},
 			selfPath
 		});
+		const extensionsOverride = liftExtensionsOverride({
+			extensions: isPlainObject$1(settings[EXTENSIONS_TABLE_KEY]) ? settings[EXTENSIONS_TABLE_KEY] : {},
+			selfPath
+		});
 		const result = { ...config };
-		if (Object.keys(startupOverride).length > 0) result.deepagents = { startup: startupOverride };
+		const deepagents = {};
+		if (Object.keys(startupOverride).length > 0) deepagents.startup = startupOverride;
+		if (Object.keys(extensionsOverride).length > 0) deepagents.extensions = extensionsOverride;
+		if (Object.keys(deepagents).length > 0) result.deepagents = deepagents;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
@@ -40057,57 +40161,192 @@ function warnAboutUnwrittenBashRules({ allowAll, requestedAllowAll, askPatterns,
 	if (willWrite && allowAll) warnWithFallback(logger, "The bash '*' allow rule became allow_list = [\"all\"] for deepagents-cli, which auto-approves every command and skips its dangerous-pattern check (command substitution, redirects, process substitution). List the executables you want instead if that is more than you meant.");
 }
 /**
-* Lift the `[startup]` keys rulesync models back into the `deepagents`
-* override, keeping only values dcode itself accepts.
+* Lift the keys rulesync models from one `config.toml` table back into the
+* `deepagents` override, keeping only values dcode itself accepts.
+*
+* A value outside what the option's own parser reads is `Invalid` upstream —
+* dcode ignores it and falls back to its default. Importing it anyway would
+* record a setting the tool is not applying and, because the canonical schema
+* is stricter than TOML, would write a `.rulesync/permissions.jsonc` the next
+* `rulesync generate` cannot even read.
 *
-* A `mode` outside the three approval modes, or a non-boolean where a switch
-* belongs, is `Invalid` upstream — dcode ignores it and falls back to its
-* default. Importing it anyway would record a setting the tool is not applying
-* and, because the canonical schema is stricter than TOML, would write a
-* `.rulesync/permissions.jsonc` the next `rulesync generate` cannot even read.
+* `normalize` returns the value to keep, or `null` for one dcode would not
+* read — a wrapper rather than the bare value, so a legitimately falsy setting
+* is not mistaken for a rejection.
 */
-function liftStartupOverride({ startup, selfPath }) {
-	const startupOverride = {};
+function liftOverrideTable({ table, tableKey, keys, normalize, selfPath }) {
+	const override = {};
 	const rejected = [];
-	for (const key of DEEPAGENTS_STARTUP_KEYS) {
-		const value = startup[key];
+	for (const key of keys) {
+		const value = table[key];
 		if (value === void 0) continue;
-		if (key === "mode" ? DEEPAGENTS_STARTUP_MODES.includes(value) : typeof value === "boolean") startupOverride[key] = value;
+		const normalized = normalize({
+			key,
+			value
+		});
+		if (normalized) override[key] = normalized.value;
 		else rejected.push(`${key} = ${JSON.stringify(value)}`);
 	}
-	if (rejected.length > 0) warnWithFallback(void 0, `deepagents-cli falls back to its own default for a '[${STARTUP_TABLE_KEY}]' value it cannot read, so ${rejected.join(", ")} in ${selfPath} ${rejected.length === 1 ? "was" : "were"} not imported.`);
-	return startupOverride;
+	if (rejected.length > 0) warnWithFallback(void 0, `deepagents-cli falls back to its own default for a '[${tableKey}]' value it cannot read, so ${rejected.join(", ")} in ${selfPath} ${rejected.length === 1 ? "was" : "were"} not imported.`);
+	return override;
 }
 /**
-* Merge the `deepagents.startup` override into `[startup]`, preserving every
-* other key of that table. A `startup` that is not a table at all is something
-* rulesync did not write and cannot merge into, so it is left exactly as the
-* user has it rather than replaced.
+* Lift the `[startup]` keys rulesync models back into the `deepagents`
+* override. A `mode` outside the three approval modes, or a non-boolean where
+* a switch belongs, is one dcode ignores.
 */
-function mergeStartupOverride({ settings, startupOverride, filePath, logger }) {
-	const existingStartup = settings[STARTUP_TABLE_KEY];
-	if (existingStartup !== void 0 && !isPlainObject$1(existingStartup)) {
-		warnWithFallback(logger, `deepagents-cli: '${STARTUP_TABLE_KEY}' in ${filePath} is not a table, so the deepagents startup override was skipped rather than overwriting it.`);
+function liftStartupOverride({ startup, selfPath }) {
+	return liftOverrideTable({
+		table: startup,
+		tableKey: STARTUP_TABLE_KEY,
+		keys: DEEPAGENTS_STARTUP_KEYS,
+		normalize: ({ key, value }) => {
+			if (key === "mode") return DEEPAGENTS_STARTUP_MODES.includes(value) ? { value } : null;
+			return typeof value === "boolean" ? { value } : null;
+		},
+		selfPath
+	});
+}
+/**
+* Lift the `[extensions]` keys rulesync models back into the `deepagents`
+* override.
+*
+* `trust` is read the way `parse_trust_policy` reads it — trimmed and
+* lowercased — so `"Always"` comes back as the policy dcode is actually
+* applying rather than being dropped, the same courtesy the allowlist
+* sentinels already get. The canonical enum holds only the lowercase
+* spellings, so keeping the value verbatim would write a permissions file the
+* next generate could not parse.
+*/
+function liftExtensionsOverride({ extensions, selfPath }) {
+	return liftOverrideTable({
+		table: extensions,
+		tableKey: EXTENSIONS_TABLE_KEY,
+		keys: DEEPAGENTS_EXTENSIONS_KEYS,
+		normalize: ({ key, value }) => {
+			if (key === "trust") {
+				if (typeof value !== "string") return null;
+				const policy = value.trim().toLowerCase();
+				return DEEPAGENTS_EXTENSION_TRUST_POLICIES.includes(policy) ? { value: policy } : null;
+			}
+			return typeof value === "boolean" ? { value } : null;
+		},
+		selfPath
+	});
+}
+/**
+* Merge one block of the `deepagents` override into its `config.toml` table,
+* preserving every other key of that table. A table that is not a table at all
+* is something rulesync did not write and cannot merge into, so it is left
+* exactly as the user has it rather than replaced.
+*/
+function mergeOverrideTable({ settings, tableKey, override, knownKeys, isDroppedKey, warnAboutRelaxations, filePath, logger }) {
+	const existing = settings[tableKey];
+	if (existing !== void 0 && !isPlainObject$1(existing)) {
+		warnWithFallback(logger, `deepagents-cli: '${tableKey}' in ${filePath} is not a table, so the deepagents ${tableKey} override was skipped rather than overwriting it.`);
 		return;
 	}
-	const startup = isPlainObject$1(existingStartup) ? { ...existingStartup } : {};
-	const previousStartup = { ...startup };
+	const table = isPlainObject$1(existing) ? { ...existing } : {};
+	const previous = { ...table };
 	const writtenKeys = [];
-	for (const [key, value] of Object.entries(startupOverride)) {
+	for (const [key, value] of Object.entries(override)) {
 		if (isPrototypePollutionKey(key)) continue;
-		if (key === STARTUP_RECENT_KEY) continue;
+		if (isDroppedKey?.(key)) continue;
 		if (value === null || value === void 0) continue;
-		startup[key] = value;
+		table[key] = value;
 		writtenKeys.push(key);
 	}
-	warnAboutStartupRelaxations({
-		startupOverride,
-		previousStartup,
+	warnAboutRelaxations({
+		override,
+		previous,
+		filePath,
+		logger
+	});
+	warnAboutUncheckedKeys({
+		tableKey,
+		knownKeys,
 		writtenKeys,
 		filePath,
 		logger
 	});
-	if (Object.keys(startup).length > 0) settings[STARTUP_TABLE_KEY] = startup;
+	if (Object.keys(table).length > 0) settings[tableKey] = table;
+}
+/**
+* Name the keys the merge wrote that rulesync does not model. The override is a
+* loose object so a key added upstream still reaches the config, but this one
+* writes into the machine's global file: what rulesync cannot judge, it at
+* least names.
+*/
+function warnAboutUncheckedKeys({ tableKey, knownKeys, writtenKeys, filePath, logger }) {
+	const known = new Set(knownKeys);
+	const unknownKeys = writtenKeys.filter((key) => !known.has(key));
+	if (unknownKeys.length === 0) return;
+	warnWithFallback(logger, `The deepagents ${tableKey} override wrote ${unknownKeys.join(", ")} into ${filePath} unchecked — rulesync does not know what those keys grant, and that file is your global deepagents-cli config.`);
+}
+/**
+* Merge the `deepagents.startup` override into `[startup]`.
+*/
+function mergeStartupOverride({ settings, startupOverride, filePath, logger }) {
+	mergeOverrideTable({
+		settings,
+		tableKey: STARTUP_TABLE_KEY,
+		override: startupOverride,
+		knownKeys: DEEPAGENTS_STARTUP_KEYS,
+		isDroppedKey: (key) => key === STARTUP_RECENT_KEY,
+		warnAboutRelaxations: warnAboutStartupRelaxations,
+		filePath,
+		logger
+	});
+}
+/**
+* Merge the `deepagents.extensions` override into `[extensions]`. Nothing is
+* dropped here — `extra_paths` is not modeled, but it is a key the user may
+* legitimately want carried, so it passes through as any other unknown key
+* does, named by the unchecked-key warning.
+*/
+function mergeExtensionsOverride({ settings, extensionsOverride, filePath, logger }) {
+	mergeOverrideTable({
+		settings,
+		tableKey: EXTENSIONS_TABLE_KEY,
+		override: extensionsOverride,
+		knownKeys: DEEPAGENTS_EXTENSIONS_KEYS,
+		warnAboutRelaxations: warnAboutExtensionsRelaxations,
+		filePath,
+		logger
+	});
+}
+/**
+* Name the value an override key replaces, so a setting the user had turned
+* down is visible as such rather than reported as a bare new value.
+*/
+function describeOverriddenValue({ key, value, previous }) {
+	const previousValue = previous[key];
+	return previousValue === void 0 || previousValue === value ? `${key} = ${JSON.stringify(value)}` : `${key} = ${JSON.stringify(value)} (was ${JSON.stringify(previousValue)})`;
+}
+/**
+* Warn when the `deepagents` extensions override widens what dcode loads on its
+* own, for the same reason the startup one does: this block is written into the
+* user's **global** config from a `.rulesync/permissions.jsonc` a repository
+* can carry.
+*
+* `trust` decides what happens to the Python in a checked-out project's
+* `.deepagents/extensions/` — `always` imports it into the agent process with
+* no prompt at all — and `enabled` is the switch above it. `never` and `false`
+* restrict, so neither is reported.
+*/
+function warnAboutExtensionsRelaxations({ override, previous, filePath, logger }) {
+	const relaxations = [];
+	if (override.trust === "always") relaxations.push(describeOverriddenValue({
+		key: "trust",
+		value: "always",
+		previous
+	}));
+	if (override.enabled === true && (previous.enabled ?? DEEPAGENTS_EXTENSIONS_ENABLED_DEFAULT) !== true) relaxations.push(describeOverriddenValue({
+		key: "enabled",
+		value: true,
+		previous
+	}));
+	if (relaxations.length > 0) warnWithFallback(logger, `The deepagents extensions override wrote ${relaxations.join(", ")} into ${filePath}, which is your global deepagents-cli config: it decides whether the Python in a checked-out project's .deepagents/extensions/ is imported into dcode, for every project on this machine, not just this one.`);
 }
 /**
 * Warn when the `deepagents` startup override relaxes what dcode may do on its
@@ -40122,12 +40361,13 @@ function mergeStartupOverride({ settings, startupOverride, filePath, logger }) {
 * process environment. The value being replaced is named alongside, so a
 * setting the user had turned down is visible as such.
 */
-function warnAboutStartupRelaxations({ startupOverride, previousStartup, writtenKeys, filePath, logger }) {
+function warnAboutStartupRelaxations({ override: startupOverride, previous: previousStartup, filePath, logger }) {
 	const relaxations = [];
-	const describe = (key, value) => {
-		const previous = previousStartup[key];
-		return previous === void 0 || previous === value ? `${key} = ${JSON.stringify(value)}` : `${key} = ${JSON.stringify(value)} (was ${JSON.stringify(previous)})`;
-	};
+	const describe = (key, value) => describeOverriddenValue({
+		key,
+		value,
+		previous: previousStartup
+	});
 	const mode = startupOverride.mode;
 	if (mode === "auto" || mode === "yolo") relaxations.push(describe("mode", mode));
 	for (const [key, upstreamDefault] of Object.entries(DEEPAGENTS_STARTUP_BOOLEAN_DEFAULTS)) {
@@ -40137,9 +40377,6 @@ function warnAboutStartupRelaxations({ startupOverride, previousStartup, written
 	}
 	if (relaxations.length > 0) warnWithFallback(logger, `The deepagents startup override wrote ${relaxations.join(", ")} into ${filePath}, which is your global deepagents-cli config: it relaxes how much dcode does without asking, for every project on this machine, not just this one.`);
 	if (startupOverride[STARTUP_RECENT_KEY] !== void 0) warnWithFallback(logger, `The deepagents startup override's '${STARTUP_RECENT_KEY}' was not written to ${filePath}: dcode manages that key itself, and with no explicit 'mode' beside it, it is what restores auto-approval at launch. Set 'mode' if switching approval modes is the intent.`);
-	const known = new Set(DEEPAGENTS_STARTUP_KEYS);
-	const unknownKeys = writtenKeys.filter((key) => !known.has(key));
-	if (unknownKeys.length > 0) warnWithFallback(logger, `The deepagents startup override wrote ${unknownKeys.join(", ")} into ${filePath} unchecked — rulesync does not know what those keys grant, and that file is your global deepagents-cli config.`);
 }
 /**
 * Read `[shell].allow_list` the way dcode does: a TOML array is taken element
@@ -54760,7 +54997,10 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 //#region src/features/skills/zcode-skill.ts
 const ZcodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
-	description: zod_mini.z.string()
+	description: zod_mini.z.string(),
+	when_to_use: zod_mini.z.optional(zod_mini.z.string()),
+	license: zod_mini.z.optional(zod_mini.z.string()),
+	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 });
 /**
 * Represents a ZCode skill directory.
@@ -54823,10 +55063,16 @@ var ZcodeSkill = class ZcodeSkill extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
+		const zcodeSection = {
+			...frontmatter.when_to_use !== void 0 && { when_to_use: frontmatter.when_to_use },
+			...frontmatter.license !== void 0 && { license: frontmatter.license },
+			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
+		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
 			description: frontmatter.description,
-			targets: ["*"]
+			targets: ["*"],
+			...Object.keys(zcodeSection).length > 0 && { zcode: zcodeSection }
 		};
 		return new RulesyncSkill({
 			outputRoot: this.outputRoot,
@@ -54841,9 +55087,21 @@ var ZcodeSkill = class ZcodeSkill extends ToolSkill {
 	}
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const zcodeSection = rulesyncFrontmatter.zcode;
+		const license = resolveLicense({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: zcodeSection
+		});
+		const metadata = resolveMetadata({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: zcodeSection
+		});
 		const zcodeFrontmatter = {
 			name: rulesyncFrontmatter.name,
-			description: rulesyncFrontmatter.description
+			description: rulesyncFrontmatter.description,
+			...zcodeSection?.when_to_use !== void 0 && { when_to_use: zcodeSection.when_to_use },
+			...license !== void 0 && { license },
+			...metadata !== void 0 && { metadata }
 		};
 		const settablePaths = ZcodeSkill.getSettablePaths({ global });
 		return new ZcodeSkill({
@@ -62944,10 +63202,21 @@ var ClineRule = class ClineRule extends ToolRule {
 */
 const CodebuddyRuleFrontmatterSchema = zod_mini.z.object({
 	description: zod_mini.z.optional(zod_mini.z.string()),
-	paths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
-	alwaysApply: zod_mini.z.optional(zod_mini.z.boolean())
+	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
+	enabled: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
+* Normalizes the documented `string` / `string[]` shapes of `paths` to the
+* list form the rest of the adapter works with. An empty list and an empty
+* string both mean "no paths".
+*/
+function normalizeCodebuddyPaths(paths) {
+	if (paths === void 0) return;
+	const list = (typeof paths === "string" ? [paths] : paths).filter((path) => path.trim() !== "");
+	return list.length > 0 ? list : void 0;
+}
+/**
 * A universal glob (matching everything) is redundant on an Always Apply
 * rule and, paired with `alwaysApply: true`, is the same semantic conflict
 * `CursorRule.resolveCursorGlobs` avoids for Cursor: `alwaysApply` already
@@ -62965,7 +63234,7 @@ const UNIVERSAL_PATHS = /* @__PURE__ */ new Set(["**/*", "*"]);
 * Rules format:
 * - {project}/CODEBUDDY.md (root: true), also read from {project}/.codebuddy/CODEBUDDY.md
 * - {project}/.codebuddy/rules/*.md (root: false, with optional
-*   `description` / `paths` / `alwaysApply` frontmatter)
+*   `description` / `paths` / `alwaysApply` / `enabled` frontmatter)
 * - Global: ~/.codebuddy/CODEBUDDY.md and ~/.codebuddy/rules/*.md
 *
 * @see https://www.codebuddy.ai/docs/cli/memory
@@ -63007,9 +63276,10 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 		this.body = body;
 	}
 	static generateFileContent(body, frontmatter) {
-		if (frontmatter.description === void 0 && frontmatter.paths === void 0 && frontmatter.alwaysApply === void 0) return body;
+		if (frontmatter.description === void 0 && frontmatter.paths === void 0 && frontmatter.alwaysApply === void 0 && frontmatter.enabled === void 0) return body;
 		return stringifyFrontmatter(body, {
 			description: frontmatter.description,
+			enabled: frontmatter.enabled,
 			alwaysApply: frontmatter.alwaysApply,
 			paths: frontmatter.paths
 		});
@@ -63057,10 +63327,36 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 			root: isRoot
 		});
 	}
-	static resolveCodebuddyPaths({ paths, alwaysApply }) {
-		if (!paths || paths.length === 0) return;
-		if (alwaysApply && paths.every((path) => UNIVERSAL_PATHS.has(path.trim()))) return;
-		return paths;
+	/**
+	* Resolves the `paths` / `alwaysApply` pair against CodeBuddy's Rule Type
+	* Determination table, which reads:
+	*
+	* | `alwaysApply`    | `paths`   | Rule type                          |
+	* | ---------------- | --------- | ---------------------------------- |
+	* | `true` (default) | any       | ALWAYS — always injected            |
+	* | `false`          | has value | MANUAL — triggered on matching file |
+	* | `false`          | none      | not supported; the rule is dropped  |
+	*
+	* The default being `true` is the opposite of Cursor, which the adapter was
+	* modeled on: `paths` alone scopes nothing, so a rule meant to be path
+	* triggered has to carry an explicit `alwaysApply: false` alongside it.
+	*
+	* @see https://www.codebuddy.ai/docs/cli/memory
+	*/
+	static resolveCodebuddyRuleType({ paths, alwaysApply }) {
+		const scopedPaths = paths && paths.length > 0 && !paths.every((path) => UNIVERSAL_PATHS.has(path.trim())) ? paths : void 0;
+		if (alwaysApply === true) return {
+			paths: scopedPaths,
+			alwaysApply: true
+		};
+		if (scopedPaths === void 0) return {
+			paths: void 0,
+			alwaysApply: void 0
+		};
+		return {
+			paths: scopedPaths,
+			alwaysApply: false
+		};
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
@@ -63077,17 +63373,17 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 			root
 		});
 		if (!paths.nonRoot) throw new Error(`nonRoot path is not set for ${rulesyncRule.getRelativeFilePath()}`);
-		const codebuddyPaths = rulesyncFrontmatter.codebuddy?.paths;
+		const codebuddyPaths = normalizeCodebuddyPaths(rulesyncFrontmatter.codebuddy?.paths);
 		const globs = rulesyncFrontmatter.globs;
-		const alwaysApply = rulesyncFrontmatter.codebuddy?.alwaysApply;
-		const pathsValue = CodebuddyRule.resolveCodebuddyPaths({
+		const ruleType = CodebuddyRule.resolveCodebuddyRuleType({
 			paths: codebuddyPaths ?? (globs?.length ? globs : void 0),
-			alwaysApply: alwaysApply === true
+			alwaysApply: rulesyncFrontmatter.codebuddy?.alwaysApply
 		});
 		const codebuddyFrontmatter = {
 			description: rulesyncFrontmatter.codebuddy?.description ?? rulesyncFrontmatter.description,
-			paths: pathsValue,
-			alwaysApply
+			paths: ruleType.paths,
+			alwaysApply: ruleType.alwaysApply,
+			enabled: rulesyncFrontmatter.codebuddy?.enabled
 		};
 		return new CodebuddyRule({
 			outputRoot,
@@ -63117,17 +63413,19 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 				validate: true
 			});
 		}
-		const isAlways = this.frontmatter.alwaysApply === true;
-		const sourcePaths = this.frontmatter.paths ?? [];
+		const sourcePaths = normalizeCodebuddyPaths(this.frontmatter.paths) ?? [];
+		const isAlways = this.frontmatter.alwaysApply !== false;
 		const globs = sourcePaths.length === 0 && isAlways ? ["**/*"] : sourcePaths;
+		const alwaysApply = this.frontmatter.alwaysApply ?? (sourcePaths.length > 0 ? true : void 0);
 		const rulesyncFrontmatter = {
 			targets,
 			root: false,
 			description: this.frontmatter.description,
 			globs,
-			...(this.frontmatter.paths !== void 0 || this.frontmatter.alwaysApply !== void 0 || this.frontmatter.description !== void 0) && { codebuddy: {
-				paths: this.frontmatter.paths,
-				alwaysApply: this.frontmatter.alwaysApply,
+			...(this.frontmatter.paths !== void 0 || this.frontmatter.alwaysApply !== void 0 || this.frontmatter.enabled !== void 0 || this.frontmatter.description !== void 0) && { codebuddy: {
+				paths: sourcePaths.length > 0 ? sourcePaths : void 0,
+				alwaysApply,
+				enabled: this.frontmatter.enabled,
 				description: this.frontmatter.description
 			} }
 		};
@@ -65910,33 +66208,49 @@ var ReplitRule = class ReplitRule extends ToolRule {
 * Supports plain Markdown without frontmatter, mode-specific rules,
 * and both directory-based and single-file configurations.
 *
-* - Project scope writes the non-root directory `.roo/rules/`.
+* - Project scope writes the non-root directory `.roo/rules/`, and the root
+*   rule to the workspace-root `AGENTS.md` the extension reads from `cwd`.
 * - Global scope writes the same non-root directory resolved under the home
-*   directory (`~/.roo/rules/`), which Roo loads before workspace rules.
+*   directory (`~/.roo/rules/`), which Roo loads before workspace rules. The
+*   root rule joins it as `~/.roo/rules/AGENTS.md`: agent-rules discovery is
+*   workspace-only, so the default project-scope root would resolve to a
+*   `~/AGENTS.md` nothing ever reads.
 *   @see https://roocodeinc.github.io/Roo-Code/features/custom-instructions
 */
 var RooRule = class RooRule extends ToolRule {
-	static getSettablePaths(_options = {}) {
-		return { nonRoot: { relativeDirPath: buildToolPath(ROO_DIR, "rules", _options.excludeToolDir) } };
+	static getSettablePaths({ global, excludeToolDir } = {}) {
+		const rulesDirPath = buildToolPath(ROO_DIR, "rules", excludeToolDir);
+		if (global) return {
+			root: {
+				relativeDirPath: rulesDirPath,
+				relativeFilePath: ROO_GLOBAL_ROOT_RULE_FILE_NAME
+			},
+			nonRoot: { relativeDirPath: rulesDirPath }
+		};
+		return { nonRoot: { relativeDirPath: rulesDirPath } };
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, relativeDirPath: overrideDirPath, validate = true }) {
-		const relativeDirPath = overrideDirPath !== void 0 && RooRule.extractModeFromDirPath(overrideDirPath) !== void 0 ? overrideDirPath : this.getSettablePaths().nonRoot.relativeDirPath;
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const relativeDirPath = overrideDirPath !== void 0 && RooRule.extractModeFromDirPath(overrideDirPath) !== void 0 ? overrideDirPath : paths.nonRoot?.relativeDirPath ?? buildToolPath(".roo", "rules");
 		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath));
+		const isRoot = "root" in paths && relativeDirPath === paths.root.relativeDirPath && relativeFilePath === paths.root.relativeFilePath;
 		return new RooRule({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent,
 			validate,
-			root: false
+			root: isRoot
 		});
 	}
-	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
 		const params = this.buildToolRuleParamsDefault({
 			outputRoot,
 			rulesyncRule,
 			validate,
-			nonRootPath: this.getSettablePaths().nonRoot
+			..."root" in paths && { rootPath: paths.root },
+			nonRootPath: paths.nonRoot
 		});
 		const mode = rulesyncRule.getFrontmatter().roo?.mode;
 		if (!params.root && mode !== void 0 && mode !== "") {
@@ -66859,7 +67173,9 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			extension: "md",
 			supportsGlobal: true,
 			ruleDiscoveryMode: "auto",
-			collisionPolicy: "fold"
+			collisionPolicy: "fold",
+			localRootMode: "separate-local-file",
+			localRootFileName: CRUSH_LOCAL_RULE_FILE_NAME
 		}
 	}],
 	["cursor", {
@@ -67579,6 +67895,34 @@ var RulesProcessor = class extends FeatureProcessor {
 			root: true,
 			localRoot
 		});
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: CodebuddyRule
+		})) {
+			const paths = CodebuddyRule.getSettablePaths({ global: this.global });
+			return new CodebuddyRule({
+				outputRoot: this.outputRoot,
+				relativeDirPath: relativeDirPath ?? paths.root.relativeDirPath,
+				relativeFilePath: fileName,
+				frontmatter: {},
+				body,
+				validate: true,
+				root: true,
+				localRoot
+			});
+		}
+		if (isClassOrSubclassOf({
+			candidate: factory.class,
+			base: CrushRule
+		})) return new CrushRule({
+			outputRoot: this.outputRoot,
+			relativeDirPath: relativeDirPath ?? ".",
+			relativeFilePath: fileName,
+			fileContent: body,
+			validate: true,
+			root: true,
+			localRoot
+		});
 		if (isClassOrSubclassOf({
 			candidate: factory.class,
 			base: QwencodeRule
@@ -70279,6 +70623,12 @@ Object.defineProperty(exports, "CONFLICTING_TARGET_PAIRS", {
 		return CONFLICTING_TARGET_PAIRS;
 	}
 });
+Object.defineProperty(exports, "CRUSH_LOCAL_RULE_FILE_NAME", {
+	enumerable: true,
+	get: function() {
+		return CRUSH_LOCAL_RULE_FILE_NAME;
+	}
+});
 Object.defineProperty(exports, "CURATED_RULES_FEATURE_SUBDIR", {
 	enumerable: true,
 	get: function() {