rulesync 16.28.1 → 16.30.0

package/dist/{import-CwS7XtJP.js → import-BDlmyTcr.js}

@@ -505,7 +505,8 @@ const rulesProcessorToolTargetTuple = [
 	"zcode",
 	"zed",
 	"zoocode",
-	"pool"
+	"pool",
+	"dsh"
 ];
 const ignoreProcessorToolTargetTuple = [
 	"aiassistant",
@@ -683,7 +684,8 @@ const skillsProcessorToolTargetTuple = [
 	"devin",
 	"zcode",
 	"zed",
-	"zoocode"
+	"zoocode",
+	"dsh"
 ];
 const hooksProcessorToolTargetTuple = [
 	"amp",
@@ -4211,10 +4213,12 @@ const PI_HOOK_EVENTS = [
 	"sessionEnd",
 	"preToolUse",
 	"postToolUse",
+	"postToolUseFailure",
 	"preModelInvocation",
 	"postModelInvocation",
 	"beforeSubmitPrompt",
 	"stop",
+	"notification",
 	"preCompact",
 	"postCompact"
 ];
@@ -4393,6 +4397,7 @@ const CODEXCLI_HOOK_EVENTS = [
 	"postToolUse",
 	"beforeSubmitPrompt",
 	"stop",
+	"stopCancelled",
 	"permissionRequest",
 	"subagentStart",
 	"subagentStop",
@@ -4639,9 +4644,14 @@ const GROKCLI_HOOK_EVENTS = [
 *
 * Kimi Code also exposes `PermissionResult`, `Interrupt`, and the four events
 * added in 0.32.0 (`TurnStarted`, `UserPromptQueued`, `TaskStarted`,
-* `SessionHeartbeat`), none of which have a canonical rulesync event. They are
-* listed in `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override
-* can address them by their native name.
+* `SessionHeartbeat`), none of which is mapped onto a canonical rulesync event
+* here. `Interrupt` (fires instead of `Stop` when the user interrupts a turn)
+* does have a canonical shape — `stopCancelled`, which Grok CLI and Codex CLI
+* map — but Kimi keeps it native-only for now, since an existing `kimi-code`
+* override addressing it by name would otherwise double up with a canonical
+* `stopCancelled` block; folding it in is a follow-up. All six are listed in
+* `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override can
+* address them by their native name.
 *
 * @see https://moonshotai.github.io/kimi-code/en/customization/hooks.html
 */
@@ -5080,7 +5090,7 @@ const CANONICAL_TO_KILO_EVENT_NAMES = CANONICAL_TO_OPENCODE_EVENT_NAMES;
 * Stop, this also fires before Pi auto-retries or auto-compacts —
 * `agent_settled` would skip queued follow-ups instead, a pure trade-off).
 * Pi events without a faithful canonical counterpart (e.g. `turn_start`,
-* `agent_settled`) are intentionally unmapped.
+* `agent_settled`, `ui_prompt_end`) are intentionally unmapped.
 *
 * @see https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md
 */
@@ -5089,10 +5099,12 @@ const CANONICAL_TO_PI_EVENT_NAMES = {
 	sessionEnd: "session_shutdown",
 	preToolUse: "tool_call",
 	postToolUse: "tool_result",
+	postToolUseFailure: "tool_result",
 	preModelInvocation: "context",
 	postModelInvocation: "message_end",
 	beforeSubmitPrompt: "input",
 	stop: "agent_end",
+	notification: "ui_prompt_start",
 	preCompact: "session_before_compact",
 	postCompact: "session_compact"
 };
@@ -5174,6 +5186,7 @@ const CANONICAL_TO_CODEXCLI_EVENT_NAMES = {
 	postToolUse: "PostToolUse",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	stop: "Stop",
+	stopCancelled: "Interrupt",
 	permissionRequest: "PermissionRequest",
 	subagentStart: "SubagentStart",
 	subagentStop: "SubagentStop",
@@ -7975,7 +7988,7 @@ const RulesyncRuleFrontmatterSchema = z.object({
 		extends: z.optional(z.string()),
 		facet: z.optional(z.enum(["policies", "output-contracts"]))
 	})),
-	factorydroid: z.optional(z.looseObject({ channel: z.optional(z.enum(["design"])) }))
+	factorydroid: z.optional(z.looseObject({ channel: z.optional(z.enum(["design", "threat-model"])) }))
 });
 /**
 * The `agentsmd.subprojectPath` every consumer should act on, resolved once so
@@ -9189,6 +9202,12 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
 		"user-invocable": z.optional(z.boolean())
 	})),
+	dsh: z.optional(z.looseObject({
+		whenToUse: z.optional(z.string()),
+		metadata: z.optional(z.looseObject({})),
+		"disable-model-invocation": z.optional(z.boolean()),
+		"user-invocable": z.optional(z.boolean())
+	})),
 	"kimi-code": z.optional(z.looseObject({
 		type: z.optional(z.enum([
 			"prompt",
@@ -9453,7 +9472,7 @@ async function getLocalSkillDirNames(sourceTree) {
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
+* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid, dsh). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -9472,7 +9491,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
+* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -11074,6 +11093,13 @@ const FACTORYDROID_RULE_FILE_NAME = "AGENTS.md";
 * @see https://docs.factory.ai/cli/configuration/agents-md
 */
 const FACTORYDROID_DESIGN_FILE_NAME = "DESIGN.md";
+/**
+* Factory's Security Review threat model, kept inside the tool directory:
+* "if `.factory/threat-model.md` exists, Droid uses it as the attack-surface
+* map". Documented only as a repository file, so project scope only.
+* @see https://docs.factory.ai/software-factory/security-review
+*/
+const FACTORYDROID_THREAT_MODEL_FILE_NAME = "threat-model.md";
 const FACTORYDROID_MCP_FILE_NAME = "mcp.json";
 const FACTORYDROID_SETTINGS_FILE_NAME = "settings.json";
 const FACTORYDROID_HOOKS_FILE_NAME = "hooks.json";
@@ -11715,7 +11741,10 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
 	if (!isPlainObject$1(sanitized)) {
-		if (invalidRootPolicy === "error") throw new Error(`Failed to parse shared config${at}: expected a mapping at the root`);
+		if (invalidRootPolicy === "error") {
+			const reason = /* @__PURE__ */ new Error("expected a mapping at the root");
+			throw new Error(`Failed to parse shared config${at}: ${reason.message}`, { cause: reason });
+		}
 		return {};
 	}
 	return sanitized;
@@ -12717,7 +12746,9 @@ const SHARED_CONFIG_OWNERSHIP = {
 		}
 	},
 	".augment/settings.json": {
-		format: "json",
+		format: "jsonc",
+		invalidRootPolicy: "error",
+		jsoncParseErrors: "error",
 		features: {
 			mcp: {
 				kind: "replace-owned-keys",
@@ -13311,7 +13342,9 @@ function slugForGate({ gate, index, scope }) {
 *     agent step prompt as a completion directive;
 *   - with `command` in the check's `takt` frontmatter block, a **command
 *     gate** (`{type: command, name, command, cwd, timeout_ms}`), which Takt
-*     runs after the step and fails on a non-zero exit code.
+*     runs after the step (since 0.62.0: after rule resolution and before the
+*     transition, unless the selected rule sets `command_gates: skip`) and
+*     fails on a non-zero exit code.
 *
 * `steps` / `personas` in that block scope a gate to named workflow steps or
 * personas (`workflow_overrides.steps.<step>.quality_gates`); an unscoped gate
@@ -20573,14 +20606,14 @@ var AntigravityPluginHooks = class extends AntigravityIdeHooks {
 * Returns `null` when neither file exists and no `baseFallbackContent` is
 * given, so callers can tell "no settings at this scope" apart from empty ones.
 */
-async function readSettingsWithLocalOverlay({ outputRoot, relativeDirPath, baseFileName, localFileName, toolLabel, baseFallbackContent, sensitiveKeys = [], quiet = false, merge, logger }) {
+async function readSettingsWithLocalOverlay({ outputRoot, relativeDirPath, baseFileName, localFileName, toolLabel, baseFallbackContent, sensitiveKeys = [], quiet = false, parse = JSON.parse, merge, logger }) {
 	const baseContent = await readFileContentOrNull(join(outputRoot, relativeDirPath, baseFileName)) ?? baseFallbackContent ?? null;
 	const localContent = await readFileContentOrNull(join(outputRoot, relativeDirPath, localFileName));
 	if (localContent === null) return baseContent;
 	const configPath = join(relativeDirPath, localFileName);
 	let localParsed;
 	try {
-		localParsed = JSON.parse(localContent);
+		localParsed = parse(localContent);
 	} catch (error) {
 		throw new Error(`Failed to parse ${toolLabel} settings at ${configPath}: ${formatError(error)}`, { cause: error });
 	}
@@ -20589,7 +20622,7 @@ async function readSettingsWithLocalOverlay({ outputRoot, relativeDirPath, baseF
 	if (baseContent !== null) {
 		let parsed;
 		try {
-			parsed = JSON.parse(baseContent);
+			parsed = parse(baseContent);
 		} catch {
 			return baseContent;
 		}
@@ -20648,6 +20681,51 @@ function warnAboutLocalKeys({ localParsed, configPath, toolLabel, sensitiveKeys,
 //#endregion
 //#region src/utils/augmentcode-settings.ts
 /**
+* The one place that spells out how an AugmentCode settings file is parsed.
+*
+* Auggie reads `settings.json` / `settings.local.json` as JSON with Comments —
+* "The files support JSON with Comments (JSONC), allowing comments and trailing
+* commas for better documentation." (https://docs.augmentcode.com/cli/config) —
+* so a bare `JSON.parse` rejects a hand-written file the CLI itself accepts. The
+* parse is fail-closed: a syntax error or a non-object root throws instead of
+* yielding a partial document, because every caller either merges its own keys
+* back into this file or imports permissions from it, and neither may proceed
+* on a file it could not read in full. An empty file parses as `{}`.
+*
+* The generate direction registers the same file as `jsonc` in
+* `SHARED_CONFIG_OWNERSHIP`, so the in-place patch reads it the same way.
+*
+* Throws the bare reason (the parser's own error), without naming the file;
+* `parseAugmentcodeSettingsDocument` adds that, and so does
+* `readSettingsWithLocalOverlay` when this is handed over as its `parse`.
+*/
+function parseAugmentcodeSettingsContent(fileContent) {
+	try {
+		return parseSharedConfig({
+			format: "jsonc",
+			fileContent,
+			invalidRootPolicy: "error",
+			jsoncParseErrors: "error"
+		});
+	} catch (error) {
+		if (error instanceof Error && error.cause !== void 0) throw error.cause;
+		throw error;
+	}
+}
+/**
+* Parse an AugmentCode settings file (`settings.json` / `settings.local.json`)
+* into a plain object, naming `configPath` in the error when it cannot be read.
+* See `parseAugmentcodeSettingsContent` for the format and the fail-closed
+* policy.
+*/
+function parseAugmentcodeSettingsDocument({ fileContent, configPath }) {
+	try {
+		return parseAugmentcodeSettingsContent(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse AugmentCode settings at ${configPath}: ${formatError(error)}`, { cause: error });
+	}
+}
+/**
 * Top-level keys AugmentCode *replaces* (higher-precedence wins wholesale)
 * rather than combining across tiers. Everything else combines.
 *
@@ -20722,6 +20800,7 @@ async function readAugmentcodeSettingsWithLocalOverlay({ outputRoot, relativeDir
 		localFileName: "settings.local.json",
 		toolLabel: "AugmentCode",
 		sensitiveKeys: AUGMENTCODE_GUARDRAIL_KEYS,
+		parse: parseAugmentcodeSettingsContent,
 		baseFallbackContent,
 		merge: combineAugmentSettings,
 		logger
@@ -20801,8 +20880,10 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		let existingHooks = {};
 		try {
-			const parsed = JSON.parse(existingContent);
-			const candidate = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed.hooks : void 0;
+			const candidate = parseAugmentcodeSettingsDocument({
+				fileContent: existingContent,
+				configPath: join(paths.relativeDirPath, paths.relativeFilePath)
+			}).hooks;
 			if (candidate && typeof candidate === "object" && !Array.isArray(candidate)) existingHooks = candidate;
 		} catch {
 			existingHooks = {};
@@ -20824,7 +20905,8 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 				...preservedHooks,
 				...augmentHooks
 			} },
-			filePath
+			filePath,
+			logger
 		});
 		return new AugmentcodeHooks({
 			outputRoot,
@@ -20837,7 +20919,10 @@ var AugmentcodeHooks = class AugmentcodeHooks extends ToolHooks {
 	toRulesyncHooks({ logger } = {}) {
 		let settings;
 		try {
-			settings = JSON.parse(this.getFileContent());
+			settings = parseAugmentcodeSettingsDocument({
+				fileContent: this.getFileContent(),
+				configPath: join(this.getRelativeDirPath(), this.getRelativeFilePath())
+			});
 		} catch (error) {
 			throw new Error(`Failed to parse AugmentCode hooks content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
@@ -24152,9 +24237,10 @@ function stripTrustedDirectoryWrapper(command) {
 * to filter on in the first place.
 *
 * Keyed on native names because the check runs after the canonical → native
-* mapping: `SessionHeartbeat` and `Interrupt` have no canonical counterpart and
-* are only reachable through a per-tool `kimi-code` override naming them
-* directly.
+* mapping: `SessionHeartbeat` and `Interrupt` are not mapped from a canonical
+* event for Kimi (`Interrupt` is the shape of canonical `stopCancelled`, which
+* other tools map, but stays native-only here) and are only reachable through
+* a per-tool `kimi-code` override naming them directly.
 *
 * Deliberately narrower than Claude Code's equivalent set: Kimi Code's
 * `UserPromptSubmit` matches the submitted prompt text, and `PermissionResult`
@@ -24885,6 +24971,15 @@ const PI_TOOL_EVENTS = /* @__PURE__ */ new Set(["tool_call", "tool_result"]);
 */
 const PI_ASSISTANT_MESSAGE_EVENTS = /* @__PURE__ */ new Set(["message_end"]);
 /**
+* Canonical events whose Pi event also fires when nothing went wrong. Pi's
+* `tool_result` fires for every finished tool call and exposes `event.isError`,
+* so a `postToolUseFailure` handler is gated on that flag while a `postToolUse`
+* handler on the same Pi event runs regardless.
+*
+* @see https://github.com/earendil-works/pi/blob/v0.85.1/packages/coding-agent/docs/extensions.md#tool_result
+*/
+const PI_ERROR_GATED_CANONICAL_EVENTS = /* @__PURE__ */ new Set(["postToolUseFailure"]);
+/**
 * `tool_call` is Pi's tool gate. Its return contract is
 * `{ block: true, reason?: string, terminate?: boolean }`.
 *
@@ -25030,7 +25125,8 @@ function collectPiHandlers({ effectiveHooks, eventMap }) {
 			if (!def.command) continue;
 			handlers.push({
 				command: def.command,
-				matcher: def.matcher ? def.matcher : void 0
+				matcher: def.matcher ? def.matcher : void 0,
+				onlyOnError: PI_ERROR_GATED_CANONICAL_EVENTS.has(canonicalEvent)
 			});
 		}
 		if (handlers.length > 0) {
@@ -25043,10 +25139,13 @@ function collectPiHandlers({ effectiveHooks, eventMap }) {
 }
 function buildCommandLines({ handler, usesToolName, blocking }) {
 	const lines = [];
-	const gated = usesToolName && Boolean(handler.matcher);
+	const conditions = [];
+	if (handler.onlyOnError) conditions.push("event.isError");
+	if (usesToolName && handler.matcher) conditions.push(`new RegExp(${matcherToEmbeddedLiteral(handler.matcher)}).test(event.toolName)`);
+	const gated = conditions.length > 0;
 	const indent = gated ? "      " : "    ";
 	const embeddedCommand = JSON.stringify(handler.command);
-	if (gated && handler.matcher) lines.push(`    if (new RegExp(${matcherToEmbeddedLiteral(handler.matcher)}).test(event.toolName)) {`);
+	if (gated) lines.push(`    if (${conditions.join(" && ")}) {`);
 	const onFailure = FAILURE_LINES_BY_MODE[blocking];
 	if (onFailure.length > 0) {
 		lines.push(`${indent}try {`);
@@ -25064,8 +25163,9 @@ function buildSubscriptionLines(handlerGroups) {
 		const blocking = PI_BLOCKING_MODE_BY_EVENT[piEvent] ?? "none";
 		const isPromptGate = blocking === "prompt";
 		const usesToolName = PI_TOOL_EVENTS.has(piEvent) && handlers.some((h) => h.matcher);
+		const usesErrorFlag = handlers.some((h) => h.onlyOnError);
 		const gatesOnAssistant = PI_ASSISTANT_MESSAGE_EVENTS.has(piEvent);
-		const params = isPromptGate ? "event, ctx" : usesToolName || gatesOnAssistant || isPromptGate ? "event" : "";
+		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate ? "event" : "";
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${params}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
 		if (isPromptGate) lines.push(`    if (event.source === "extension") return { action: "continue" };`);
@@ -25087,6 +25187,8 @@ function buildSubscriptionLines(handlerGroups) {
 * gate — where a hook command that exits non-zero denies the call with
 * `{ block: true, reason }`, and on `input` — Pi's prompt-submission gate —
 * where a non-zero exit cancels the prompt with `{ action: "handled" }`.
+* `postToolUse` and `postToolUseFailure` share Pi's `tool_result` event; the
+* latter's commands run only when `event.isError` is set.
 *
 * @see https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md
 */
@@ -25655,12 +25757,29 @@ const VIBE_HOOKS_FILE_NAME = "hooks.toml";
 const VIBE_TOOL_EVENTS = /* @__PURE__ */ new Set(["pre_tool", "post_tool"]);
 const SUPPORTED_VIBE_EVENTS = new Set(VIBE_HOOK_EVENTS);
 /**
+* Vibe drops a hook whose `command` contains a backslash when it loads
+* `hooks.toml` (since v2.25.1; `load_hooks_config` at v2.25.3: "Hook '<name>' skipped:
+* backslash paths are not supported in hook commands. Use forward slashes
+* instead."), because its exec-based executor tokenizes the command with
+* `shlex.split`, which eats the backslash. The hook is still written — the
+* command is the user's to fix — but it is worth a warning, since Vibe itself
+* only reports the skip as a config issue rather than failing the run.
+* @see https://github.com/mistralai/mistral-vibe/blob/v2.25.3/vibe/core/hooks/config.py
+*/
+function warnAboutBackslashCommand({ name, command, logger }) {
+	if (!command.includes("\\")) return;
+	logger?.warn(`the command of hook ${quoteValueForWarning(name)} contains a backslash, which Vibe rejects when it loads hooks.toml — the hook is skipped with "backslash paths are not supported in hook commands". Use forward slashes and avoid backslash escapes so the hook runs.`);
+}
+/**
 * Build the flat `[[hooks]]` array for `.vibe/hooks.toml` from a canonical
 * hooks config. Vibe uses a flat array where each entry carries its own event
 * `type`, tool-name `match` glob/regex, and `command`. Only `type: "command"`
-* canonical hooks are emitted (Vibe hooks are always shell commands).
+* canonical hooks are emitted: a Vibe hook is a command line, which the legacy
+* backend hands to a shell and the unified harness tokenizes with `shlex.split`
+* and executes directly (v2.25.1: "Hook commands run without a shell to
+* prevent injection via hooks.toml").
 */
-function canonicalToVibeHooks(config, toolOverride) {
+function canonicalToVibeHooks({ config, toolOverride, logger }) {
 	const shared = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_VIBE_EVENTS.has(event)) shared[event] = defs;
 	const effective = {
@@ -25679,6 +25798,11 @@ function canonicalToVibeHooks(config, toolOverride) {
 			if ((def.type ?? "command") !== "command") continue;
 			if (typeof def.command !== "string") continue;
 			const name = typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`;
+			warnAboutBackslashCommand({
+				name,
+				command: def.command,
+				logger
+			});
 			const isToolEvent = VIBE_TOOL_EVENTS.has(vibeEvent);
 			const entry = {
 				name,
@@ -25779,10 +25903,14 @@ var VibeHooks = class VibeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = VibeHooks.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
-		const vibeHooks = canonicalToVibeHooks(config, config.vibe?.hooks);
+		const vibeHooks = canonicalToVibeHooks({
+			config,
+			toolOverride: config.vibe?.hooks,
+			logger
+		});
 		const fileContent = smolToml.stringify(vibeHooks);
 		return new VibeHooks({
 			outputRoot,
@@ -28715,15 +28843,10 @@ var AntigravityPluginMcp = class extends AntigravityIdeMcp {
 //#endregion
 //#region src/features/mcp/augmentcode-mcp.ts
 function parseAugmentcodeSettings(fileContent, relativeDirPath, relativeFilePath) {
-	const configPath = join(relativeDirPath, relativeFilePath);
-	let parsed;
-	try {
-		parsed = JSON.parse(fileContent);
-	} catch (error) {
-		throw new Error(`Failed to parse AugmentCode settings at ${configPath}: ${formatError(error)}`, { cause: error });
-	}
-	if (!isPlainObject$1(parsed)) throw new Error(`Failed to parse AugmentCode settings at ${configPath}: expected a JSON object`);
-	return parsed;
+	return parseAugmentcodeSettingsDocument({
+		fileContent,
+		configPath: join(relativeDirPath, relativeFilePath)
+	});
 }
 /**
 * AugmentCode (Auggie CLI) MCP servers.
@@ -28780,7 +28903,7 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 			global
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
@@ -28793,7 +28916,8 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 				feature: "mcp",
 				existingContent,
 				patch: { mcpServers: rulesyncMcp.getMcpServers() },
-				filePath
+				filePath,
+				logger
 			}),
 			validate,
 			global
@@ -36966,7 +37090,10 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
 		let settings;
 		try {
-			const parsed = JSON.parse(existingContent);
+			const parsed = parseAugmentcodeSettingsDocument({
+				fileContent: existingContent,
+				configPath: join(paths.relativeDirPath, paths.relativeFilePath)
+			});
 			const result = AugmentSettingsSchema.safeParse(parsed);
 			if (!result.success) throw new Error(formatError(result.error));
 			settings = result.data;
@@ -37006,7 +37133,8 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 			feature: "permissions",
 			existingContent,
 			patch: { toolPermissions: [...specialEntries, ...sortedBasic] },
-			filePath
+			filePath,
+			logger
 		});
 		return new AugmentcodePermissions({
 			outputRoot,
@@ -37019,7 +37147,10 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 	toRulesyncPermissions() {
 		let settings;
 		try {
-			const parsed = JSON.parse(this.getFileContent());
+			const parsed = parseAugmentcodeSettingsDocument({
+				fileContent: this.getFileContent(),
+				configPath: join(this.getRelativeDirPath(), this.getRelativeFilePath())
+			});
 			const result = AugmentSettingsSchema.safeParse(parsed);
 			if (!result.success) throw new Error(formatError(result.error));
 			settings = result.data;
@@ -37037,7 +37168,10 @@ var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermission
 	}
 	validate() {
 		try {
-			const parsed = JSON.parse(this.fileContent || "{}");
+			const parsed = parseAugmentcodeSettingsDocument({
+				fileContent: this.fileContent || "{}",
+				configPath: join(this.getRelativeDirPath(), this.getRelativeFilePath())
+			});
 			const result = AugmentSettingsSchema.safeParse(parsed);
 			if (!result.success) return {
 				success: false,
@@ -41387,19 +41521,27 @@ const CATEGORY_TO_GROK_TOOL = {
 	edit: "Edit",
 	write: "Edit",
 	grep: "Grep",
+	glob: "Glob",
 	webfetch: "WebFetch",
-	websearch: "WebSearch"
+	websearch: "WebSearch",
+	agent: "AgentMessage"
 };
 const GROK_TOOL_TO_CATEGORY = {
 	Bash: "bash",
 	Read: "read",
 	Edit: "edit",
 	Grep: "grep",
+	Glob: "glob",
 	WebFetch: "webfetch",
-	WebSearch: "websearch"
+	WebSearch: "websearch",
+	AgentMessage: "agent",
+	...Object.fromEntries(["SendSubagentMessage", "SendAgentMessage"].map((tool) => [tool, "agent"]))
 };
 const GROK_MCP_TOOL = "MCPTool";
-const GROK_TOOL_TO_CATEGORY_LOWER = Object.fromEntries(Object.entries(GROK_TOOL_TO_CATEGORY).map(([tool, category]) => [tool.toLowerCase(), category]));
+const GROK_TOOL_TO_CATEGORY_LOWER = {
+	...Object.fromEntries(Object.entries(GROK_TOOL_TO_CATEGORY).map(([tool, category]) => [tool.toLowerCase(), category])),
+	agent_message: "agent"
+};
 const GROK_MCP_TOOL_ALIASES = /* @__PURE__ */ new Set(["mcp", GROK_MCP_TOOL.toLowerCase()]);
 const GROKCLI_PERMISSION_RULES_KEY = "rules";
 /**
@@ -41502,13 +41644,16 @@ function parseGrokRule(rule) {
 * per-category, per-pattern model maps almost 1:1:
 *   - Generate: each `permission.<category>.<pattern> = allow|ask|deny` becomes
 *     the matching Grok entry and is bucketed into the `[permission]` array for
-*     that action. `bash|read|edit|grep|webfetch|websearch` map to their Grok
-*     tool; `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*`
-*     maps to `MCPTool(...)` (a scoped MCP category folds its address into the
-*     parentheses, so a non-`*` argument pattern on it is not represented).
-*     Categories with no Grok tool (`glob`, `notebookedit`, `agent`) are
-*     skipped (with a warning when they carry a `deny` rule, to
-*     surface the gap). When two canonical rules collapse onto the same Grok
+*     that action. `bash|read|edit|grep|glob|webfetch|websearch|agent` map to
+*     their Grok tool; `write` collapses onto `Edit` (Grok has no `Write`
+*     tool); `glob` maps to `Glob` (an upstream alias of the `Grep` filter);
+*     `agent` maps to `AgentMessage` (which gates messages to a running
+*     subagent rather than its launch, and whose pattern is a subagent id
+*     rather than a subagent type); `mcp__*` maps to `MCPTool(...)` (a scoped
+*     MCP category folds its address into the parentheses, so a non-`*`
+*     argument pattern on it is not represented). The one category with no Grok tool (`notebookedit`) is
+*     skipped (with a warning when it carries a `deny` rule, to surface the
+*     gap). When two canonical rules collapse onto the same Grok
 *     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
 *     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
 *     entry never lands contradictorily in two arrays.
@@ -42620,6 +42765,32 @@ function mergeKimiCodeToolsSection({ existingContent, patch }) {
 	return merged;
 }
 /**
+* Carry the existing `[permission]` siblings of `rules` over onto the generated
+* table. The gateway replaces the owned `permission` key wholesale and rulesync
+* only ever authors `rules`, so a hand-written sibling such as
+* `dangerous_command_guard = false` (Kimi Code 0.40.0) would otherwise be
+* deleted on every generate. Rulesync does not model these keys; they pass
+* through verbatim and `rules` always comes from the patch.
+*
+* @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
+*/
+function mergeKimiCodePermissionSection({ existingContent, patch }) {
+	let existing;
+	try {
+		existing = parseSharedConfig({
+			format: "toml",
+			fileContent: existingContent
+		}).permission;
+	} catch {
+		existing = void 0;
+	}
+	const { rules: _existingRules, ...siblings } = isRecord$1(existing) ? existing : {};
+	return {
+		...siblings,
+		...isRecord$1(patch.permission) ? patch.permission : {}
+	};
+}
+/**
 * Build Kimi's `[tools]` section from a rulesync override, or read one back on
 * import. Entries pass through verbatim: the section uses agent-file tool syntax
 * (exact built-in names, `mcp__server__*` globs), not the canonical
@@ -42799,12 +42970,17 @@ var KimiCodePermissions = class KimiCodePermissions extends ToolPermissions {
 			existingContent: fileContent,
 			patch
 		});
+		const mergedPermission = mergeKimiCodePermissionSection({
+			existingContent: fileContent,
+			patch
+		});
 		this.fileContent = applySharedConfigPatch({
 			fileKey: getKimiCodeConfigSharedFileKey({ global: this.global }),
 			feature: "permissions",
 			existingContent: fileContent,
 			patch: {
 				...patch,
+				permission: mergedPermission,
 				...mergedTools && { tools: mergedTools }
 			},
 			filePath: join(paths.relativeDirPath, paths.relativeFilePath)
@@ -52210,6 +52386,207 @@ var DevinSkill = class DevinSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/constants/dsh-paths.ts
+/**
+* DeepSeek Harness (`dsh`) configuration-layout conventions.
+*
+* The harness home is `$DSH_HOME`, which defaults to `~/.dsh`; rulesync writes
+* only the default location. Project-scoped assets live under a `.dsh/`
+* directory at the project root.
+*
+* Rules: `dsh-agent-instructions` loads the user-global `$DSH_HOME/AGENTS.md`
+* (root file only — the user-global file has no `.local.md` overlay), then the
+* project chain of `AGENTS.md` / `CLAUDE.md` files from the project root (the
+* nearest ancestor holding `.git`) down to the session cwd, broad to specific.
+* Rulesync emits `AGENTS.md` only; `CLAUDE.md` is the `claudecode` target's
+* file, and a `CLAUDE.md` duplicating its sibling `AGENTS.md` renders once.
+*
+* Skills: `dsh-skill-filesystem` scans `<projectRoot>/.dsh/skills` (rank 100),
+* `<projectRoot>/.agents/skills` (200), `<dshHome>/skills` (400) and
+* `<agentsHome>/skills` (500), each holding top-level `<name>/SKILL.md`
+* bundles or flat `<name>.md` files; nested `SKILL.md` files are deliberately
+* not discovered. Rulesync writes only the `dsh`-specific roots — the
+* `.agents/skills` roots are the `agentsskills` target's output.
+*
+* @see https://github.com/deepseek-ai/deepseek-harness
+* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/skill/skill-filesystem/README.md
+*/
+/**
+* Project-scoped `.dsh/` directory, and the harness home relative to the home
+* directory (`$DSH_HOME` default).
+*/
+const DSH_DIR = ".dsh";
+/** Skills root, relative to the project root or the harness home. */
+const DSH_SKILLS_DIR_PATH = join(DSH_DIR, "skills");
+//#endregion
+//#region src/features/skills/dsh-skill.ts
+const DshSkillFrontmatterSchema = z.looseObject({
+	name: z.string(),
+	description: z.string(),
+	whenToUse: z.optional(z.string()),
+	metadata: z.optional(z.looseObject({})),
+	"disable-model-invocation": z.optional(z.boolean()),
+	"user-invocable": z.optional(z.boolean())
+});
+/**
+* Represents a DeepSeek Harness skill directory.
+*
+* The harness scans `<projectRoot>/.dsh/skills` (project) and
+* `~/.dsh/skills` (global, the `$DSH_HOME` default) — plus the `.agents/skills`
+* roots the `agentsskills` target already writes — and discovers only the
+* top-level entries of each root: a `<name>/SKILL.md` bundle or a flat
+* `<name>.md` file. Nested `SKILL.md` files below a bundle are deliberately
+* not discovered, which matches what rulesync emits: one top-level bundle per
+* skill, supporting files carried inside it as plain files.
+*
+* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/skill/skill-filesystem/README.md
+*/
+var DshSkill = class DshSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = DSH_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global: _global = false } = {}) {
+		return { relativeDirPath: DSH_SKILLS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return DshSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (this.mainFile === void 0) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = DshSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const dshSection = {
+			...frontmatter.whenToUse !== void 0 && { whenToUse: frontmatter.whenToUse },
+			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata },
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] }
+		};
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"],
+			...Object.keys(dshSection).length > 0 && { dsh: dshSection }
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dshSection = rulesyncFrontmatter.dsh;
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: dshSection
+		});
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: dshSection
+		});
+		const metadata = resolveMetadata({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: dshSection
+		});
+		const dshFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...dshSection?.whenToUse !== void 0 && { whenToUse: dshSection.whenToUse },
+			...metadata !== void 0 && { metadata },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation },
+			...userInvocable !== void 0 && { "user-invocable": userInvocable }
+		};
+		const settablePaths = DshSkill.getSettablePaths({ global });
+		return new DshSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName: rulesyncSkill.getDirName(),
+			frontmatter: dshFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("dsh");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: DshSkill.getSettablePaths
+		});
+		const result = DshSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = join(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${join(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new DshSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		return new DshSkill({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/factorydroid-skill.ts
 const FactorydroidSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -54765,6 +55142,19 @@ const VibeSkillFrontmatterSchema = z.looseObject({
 	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 });
 /**
+* Skill names Vibe's built-in skills occupy. `SkillManager` treats them as
+* reserved: a project or user skill whose frontmatter `name` matches one is
+* skipped at load time with only a debug log ("Skipping skill '<name>' ...
+* because builtin skill names are reserved"), so a generated skill by that
+* name is silently never offered. That is the legacy backend, still the
+* default; the unified harness constructs the manager with
+* `include_builtins=False` because its built-ins arrive as skills of the
+* shipped `vibe` plugin under namespaced names, so it reserves nothing.
+* @see https://github.com/mistralai/mistral-vibe/blob/v2.25.3/vibe/core/skills/builtins/__init__.py
+* @see https://github.com/mistralai/mistral-vibe/blob/v2.25.3/vibe/core/skills/manager.py
+*/
+const VIBE_RESERVED_SKILL_NAMES = /* @__PURE__ */ new Set(["vibe", "skill-creator"]);
+/**
 * Build the Vibe frontmatter from a rulesync skill frontmatter, preferring the
 * dedicated `vibe` section over the shared root-level fields.
 */
@@ -54796,6 +55186,15 @@ function buildVibeFrontmatter(rulesyncFrontmatter) {
 		...vibeSection?.["allowed-tools"] !== void 0 && { "allowed-tools": vibeSection["allowed-tools"] }
 	};
 }
+/**
+* The skill is still generated under the reserved name — the name is the
+* user's to change, and a rename here would make it diverge from the other
+* targets — but Vibe would drop it without a visible word, so say so now.
+*/
+function warnAboutReservedSkillName({ name, logger }) {
+	if (!VIBE_RESERVED_SKILL_NAMES.has(name)) return;
+	logger?.warn(`Vibe skills: the skill name ${quoteValueForWarning(name)} is reserved for a Vibe built-in skill, so Vibe skips a project or user skill by that name when it loads skills. Rename the skill for it to be available in Vibe.`);
+}
 var VibeSkill = class VibeSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = VibeSkill.getSettablePaths().relativeDirPath, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
 		super({
@@ -54868,9 +55267,13 @@ var VibeSkill = class VibeSkill extends ToolSkill {
 			global: this.global
 		});
 	}
-	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
 		const settablePaths = VibeSkill.getSettablePaths({ global });
 		const vibeFrontmatter = buildVibeFrontmatter(rulesyncSkill.getFrontmatter());
+		warnAboutReservedSkillName({
+			name: vibeFrontmatter.name,
+			logger
+		});
 		return new VibeSkill({
 			outputRoot,
 			relativeDirPath: settablePaths.relativeDirPath,
@@ -55750,6 +56153,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsSimulated: false,
 			supportsGlobal: true
 		}
+	}],
+	["dsh", {
+		class: DshSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
 	}]
 ]);
 const defaultGetFactory$2 = (target) => {
@@ -55789,9 +56200,14 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		const rulesyncSkills = rulesyncDirs.filter((dir) => dir instanceof RulesyncSkill);
 		const factory = this.getFactory(this.toolTarget);
 		return (await Promise.all(rulesyncSkills.map(async (rulesyncSkill) => {
-			if (rulesyncSkill.getFrontmatter().claudecode?.["scheduled-task"] === true && this.toolTarget !== "claudecode" && this.toolTarget !== "claudecode-legacy") return null;
+			const isClaudecodeScheduledTask = rulesyncSkill.getFrontmatter().claudecode?.["scheduled-task"] === true;
+			if (isClaudecodeScheduledTask && this.toolTarget !== "claudecode" && this.toolTarget !== "claudecode-legacy") return null;
 			if (!factory.class.isTargetedByRulesyncSkill(rulesyncSkill)) return null;
 			const dirName = rulesyncSkill.getDirName();
+			if (isClaudecodeScheduledTask && !this.global) {
+				this.logger.warn(`Skipping skill ${quoteForLog(dirName)} for '${this.toolTarget}': 'claudecode.scheduled-task' skills are only read from the user config directory (~/.claude/scheduled-tasks/), so nothing is written at project scope. Generate it with --global instead; a stale copy an earlier generate left under .claude/scheduled-tasks/ is removed by a generate with --delete.`);
+				return null;
+			}
 			const dirWriteBlockReason = await factory.class.getDirWriteBlockReason?.({
 				outputRoot: this.outputRoot,
 				relativeDirPath: factory.class.getSettablePaths({ global: this.global }).relativeDirPath,
@@ -56932,13 +57348,26 @@ var AntigravityPluginSubagent = class extends AntigravitySharedSubagent {
 };
 //#endregion
 //#region src/features/subagents/augmentcode-subagent.ts
+const AugmentcodeToolListSchema = z.union([z.array(z.string()), z.string()]);
+/**
+* Normalize a documented tool-list value to the list form: a string is split on
+* commas, trimmed, and emptied of blank entries; a list is returned as is. A
+* string that names no tool (`""`, `", ,"`) is treated as unset rather than as
+* an empty allowlist — the author left the value blank, not the tool set — so
+* it yields `undefined`; an authored empty list is kept as written.
+*/
+function normalizeAugmentcodeToolList(value) {
+	if (Array.isArray(value)) return value;
+	const tools = value.split(",").map((tool) => tool.trim()).filter((tool) => tool.length > 0);
+	return tools.length > 0 ? tools : void 0;
+}
 const AugmentcodeSubagentFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.optional(z.string()),
 	color: z.optional(z.string()),
 	model: z.optional(z.string()),
-	tools: z.optional(z.array(z.string())),
-	disabled_tools: z.optional(z.array(z.string()))
+	tools: z.optional(AugmentcodeToolListSchema),
+	disabled_tools: z.optional(AugmentcodeToolListSchema)
 });
 /**
 * AugmentCode (Auggie CLI) subagents.
@@ -56977,14 +57406,24 @@ var AugmentcodeSubagent = class AugmentcodeSubagent extends ToolSubagent {
 		return this.body;
 	}
 	toRulesyncSubagent() {
-		const { name, description, ...rest } = this.frontmatter;
+		const { name, description, tools, disabled_tools, ...rest } = this.frontmatter;
+		const normalizedTools = tools === void 0 ? void 0 : normalizeAugmentcodeToolList(tools);
+		const normalizedDisabledTools = disabled_tools === void 0 ? void 0 : normalizeAugmentcodeToolList(disabled_tools);
+		const toolLists = {
+			...normalizedTools !== void 0 && { tools: normalizedTools },
+			...normalizedDisabledTools !== void 0 && { disabled_tools: normalizedDisabledTools }
+		};
+		const augmentcodeSection = {
+			...rest,
+			...toolLists
+		};
 		return new RulesyncSubagent({
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
 				name,
 				description,
-				...Object.keys(rest).length > 0 && { augmentcode: rest }
+				...Object.keys(augmentcodeSection).length > 0 && { augmentcode: augmentcodeSection }
 			},
 			body: this.body,
 			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
@@ -63297,13 +63736,40 @@ const CodebuddyRuleFrontmatterSchema = z.object({
 	enabled: z.optional(z.boolean())
 });
 /**
+* Splits a scalar `paths` value on the commas that separate patterns, leaving
+* the commas inside a brace group alone: CodeBuddy's memory docs say "You can
+* also combine multiple patterns with commas" and give
+* `paths: {src,lib}/**\/*.ts, tests/**\/*.test.ts` as the example, where the
+* first comma belongs to the brace expansion and the second separates the two
+* globs. Only a scalar is split — the docs describe the comma form for the
+* string shape, and a list already separates its patterns.
+*/
+function splitCodebuddyPathsScalar(paths) {
+	const patterns = [];
+	let current = "";
+	let braceDepth = 0;
+	for (const char of paths) {
+		if (char === "{") braceDepth += 1;
+		else if (char === "}" && braceDepth > 0) braceDepth -= 1;
+		else if (char === "," && braceDepth === 0) {
+			patterns.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	patterns.push(current);
+	return patterns.map((pattern) => pattern.trim());
+}
+/**
 * Normalizes the documented `string` / `string[]` shapes of `paths` to the
-* list form the rest of the adapter works with. An empty list and an empty
-* string both mean "no paths".
+* list form the rest of the adapter works with, splitting a comma-separated
+* scalar into its patterns (see `splitCodebuddyPathsScalar`). An empty list
+* and an empty string both mean "no paths".
 */
 function normalizeCodebuddyPaths(paths) {
 	if (paths === void 0) return;
-	const list = (typeof paths === "string" ? [paths] : paths).filter((path) => path.trim() !== "");
+	const list = (typeof paths === "string" ? splitCodebuddyPathsScalar(paths) : paths).filter((path) => path.trim() !== "");
 	return list.length > 0 ? list : void 0;
 }
 /**
@@ -64537,6 +65003,125 @@ var DevinRule = class DevinRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/features/rules/dsh-rule.ts
+/**
+* DeepSeek Harness (`dsh`) rules.
+*
+* Project scope writes the root `AGENTS.md` plus nested `<dir>/AGENTS.md`
+* files — the project chain `dsh-agent-instructions` loads from the `.git`
+* root down to the session cwd. Global scope writes the user-global
+* `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness reads as a
+* single root file with no local overlay, so non-root rules fold into it.
+*
+* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+*/
+var DshRule = class DshRule extends ToolRule {
+	static getSettablePaths({ global = false } = {}) {
+		if (global) return { root: {
+			relativeDirPath: DSH_DIR,
+			relativeFilePath: AGENTSMD_RULE_FILE_NAME
+		} };
+		return { root: {
+			relativeDirPath: ".",
+			relativeFilePath: AGENTSMD_RULE_FILE_NAME
+		} };
+	}
+	/**
+	* DeepSeek Harness loads the project chain of `AGENTS.md` files from the
+	* project root (the nearest ancestor holding `.git`) down through the session
+	* cwd, broad to specific, so a per-directory file applies only while working
+	* under that directory. Nested files are therefore a real scoping surface,
+	* not just the root file's overflow.
+	*
+	* The scan mirrors the AGENTS.md standard's nested discovery — same file
+	* name, same exclusions, import-only, project scope — because it discovers
+	* literally the same files.
+	* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+	*/
+	static getNestedFilePatterns() {
+		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
+	}
+	/**
+	* The subproject directory this rule scopes, or `undefined` for the root file
+	* (project or global).
+	*/
+	getSubprojectPath() {
+		return this.getNestedSubprojectPath({ fileName: AGENTSMD_RULE_FILE_NAME });
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
+			const fileContent = await readFileContent(join(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
+			return new DshRule({
+				outputRoot,
+				relativeDirPath: overrideDirPath,
+				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
+				fileContent,
+				validate,
+				root: false
+			});
+		}
+		const fileContent = await readFileContent(join(outputRoot, root.relativeDirPath, root.relativeFilePath));
+		return new DshRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const frontmatter = rulesyncRule.getFrontmatter();
+		const isRoot = frontmatter.root ?? false;
+		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
+		if (!global && !isRoot && subprojectPath) return new DshRule({
+			outputRoot,
+			relativeDirPath: join(subprojectPath),
+			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: false
+		});
+		return new DshRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		const subprojectPath = this.getSubprojectPath();
+		if (subprojectPath === void 0) return this.toRulesyncRuleDefault();
+		return this.toRulesyncRuleNestedAgentsmd({ subprojectPath });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new DshRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === ".dsh")
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "dsh"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/factorydroid-rule.ts
 /**
 * Rule generator for Factory Droid.
@@ -64545,27 +65130,36 @@ var DevinRule = class DevinRule extends ToolRule {
 * (global) as coding guidelines, plus non-root rules referenced from it via
 * `.factory/rules/*.md`.
 *
-* Factory Droid also loads `DESIGN.md` (project only) as a second,
-* independent instruction surface: "Always-on design-system, UX, visual, and
-* interaction guidance", loaded separately from `AGENTS.md`'s coding
-* guidelines. Rulesync emits it from any non-root rule that opts in via a
-* `factorydroid.channel: design` frontmatter block — those rule bodies are
-* routed to `DESIGN.md` instead of `AGENTS.md`/`.factory/rules/*.md`, and
-* multiple opted-in rules concatenate in source order. Factory's docs describe
-* `DESIGN.md` at the repository root and in nested subdirectories, like
-* `AGENTS.md`, but document no personal/global home-directory equivalent, so
-* this channel is project scope only.
+* Factory Droid also loads two further fixed files (project only) as
+* independent instruction surfaces, which rulesync emits from any non-root
+* rule that opts in via a `factorydroid.channel` frontmatter key. Opted-in
+* rule bodies are routed to the channel's file instead of
+* `AGENTS.md`/`.factory/rules/*.md`, and multiple opted-in rules concatenate
+* in source order:
+*
+* - `design` → `DESIGN.md`: "Always-on design-system, UX, visual, and
+*   interaction guidance", loaded separately from `AGENTS.md`'s coding
+*   guidelines. Factory's docs describe `DESIGN.md` at the repository root and
+*   in nested subdirectories, like `AGENTS.md`, but document no
+*   personal/global home-directory equivalent.
+* - `threat-model` → `.factory/threat-model.md`: the attack-surface map
+*   Factory's Security Review reads — "if `.factory/threat-model.md` exists,
+*   Droid uses it as the attack-surface map". It is documented only as a
+*   repository file, so it has no global scope either.
+*
+* Both channels are therefore project scope only.
 * @see https://docs.factory.ai/cli/configuration/agents-md
+* @see https://docs.factory.ai/software-factory/security-review
 */
 var FactorydroidRule = class FactorydroidRule extends ToolRule {
-	design;
-	constructor({ fileContent, root, design = false, ...rest }) {
+	channel;
+	constructor({ fileContent, root, channel, ...rest }) {
 		super({
 			...rest,
 			fileContent,
 			root: root ?? false
 		});
-		this.design = design;
+		this.channel = channel;
 	}
 	static getSettablePaths({ global, excludeToolDir } = {}) {
 		if (global) return { root: {
@@ -64581,41 +65175,75 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 			design: {
 				relativeDirPath: ".",
 				relativeFilePath: FACTORYDROID_DESIGN_FILE_NAME
+			},
+			threatModel: {
+				relativeDirPath: buildToolPath(FACTORYDROID_DIR, ".", excludeToolDir),
+				relativeFilePath: FACTORYDROID_THREAT_MODEL_FILE_NAME
 			}
 		};
 	}
 	/**
+	* The channel files in a fixed order, so that `getExtraFixedFiles` and the
+	* channel lookups below agree on which paths are channels. Empty in global
+	* mode, where neither file has a documented home-directory equivalent.
+	*/
+	static getChannelPaths({ global }) {
+		if (global) return [];
+		const paths = this.getSettablePaths({ global });
+		return [{
+			channel: "design",
+			path: paths.design
+		}, {
+			channel: "threat-model",
+			path: paths.threatModel
+		}];
+	}
+	/**
+	* Which channel, if any, owns the given output path. Matching on
+	* `relativeDirPath` too (not just the basename) keeps a non-root rule that
+	* happens to be named `DESIGN.md` or `threat-model.md` under
+	* `.factory/rules/` from being routed to a channel by mistake.
+	*/
+	static findChannelByPath({ relativeDirPath, relativeFilePath, global }) {
+		return this.getChannelPaths({ global }).find(({ path }) => relativeDirPath === path.relativeDirPath && relativeFilePath === path.relativeFilePath);
+	}
+	/**
 	* Extra fixed files this tool manages beyond the root/non-root rules. The
 	* RulesProcessor enumerates these for import and deletion so a stale
-	* `DESIGN.md` is cleaned up once no rule opts in anymore. Empty in global
-	* mode: `DESIGN.md` has no documented home-directory equivalent.
+	* `DESIGN.md` or `.factory/threat-model.md` is cleaned up once no rule opts
+	* in anymore. Empty in global mode: neither file has a documented
+	* home-directory equivalent.
 	*/
 	static getExtraFixedFiles({ global = false } = {}) {
-		if (global) return [];
-		return [this.getSettablePaths({ global }).design];
+		return this.getChannelPaths({ global }).map(({ path }) => path);
 	}
 	/**
-	* Factory Droid loads `DESIGN.md` itself, so listing it in the root rule's
-	* TOON reference section would double-load the content (and misrepresent it
-	* as a rule the model must remember to open).
+	* Factory Droid loads the channel files itself, so listing one in the root
+	* rule's TOON reference section would double-load the content (and
+	* misrepresent it as a rule the model must remember to open).
 	*/
 	isExcludedFromRootReferences() {
-		return this.design;
+		return this.channel !== void 0;
 	}
 	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const design = !global ? paths.design : void 0;
-		if (design !== void 0 && relativeDirPath === design.relativeDirPath && relativeFilePath === design.relativeFilePath) {
-			const relativePath = join(design.relativeDirPath, design.relativeFilePath);
+		const channelMatch = this.findChannelByPath({
+			relativeDirPath,
+			relativeFilePath,
+			global
+		});
+		if (channelMatch) {
+			const { channel, path } = channelMatch;
+			const relativePath = join(path.relativeDirPath, path.relativeFilePath);
 			const fileContent = await readFileContent(join(outputRoot, relativePath));
 			return new FactorydroidRule({
 				outputRoot,
-				relativeDirPath: design.relativeDirPath,
-				relativeFilePath: design.relativeFilePath,
+				relativeDirPath: path.relativeDirPath,
+				relativeFilePath: path.relativeFilePath,
 				fileContent,
 				validate,
 				root: false,
-				design: true
+				channel
 			});
 		}
 		if (relativeFilePath === paths.root.relativeFilePath) {
@@ -64644,9 +65272,12 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		const design = !global ? paths.design : void 0;
-		const isDesign = design !== void 0 && relativeDirPath === design.relativeDirPath && relativeFilePath === design.relativeFilePath;
-		const isRoot = !isDesign && relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
+		const channel = this.findChannelByPath({
+			relativeDirPath,
+			relativeFilePath,
+			global
+		})?.channel;
+		const isRoot = channel === void 0 && relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
 		return new FactorydroidRule({
 			outputRoot,
 			relativeDirPath,
@@ -64654,22 +65285,24 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 			fileContent: "",
 			validate: false,
 			root: isRoot,
-			design: isDesign
+			channel
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
 		const frontmatter = rulesyncRule.getFrontmatter();
 		const paths = this.getSettablePaths({ global });
-		if (!global && !frontmatter.root && frontmatter.factorydroid?.channel === "design") {
-			const { design } = paths;
+		const requestedChannel = frontmatter.factorydroid?.channel;
+		const channelMatch = !global && !frontmatter.root && requestedChannel !== void 0 ? this.getChannelPaths({ global }).find(({ channel }) => channel === requestedChannel) : void 0;
+		if (channelMatch) {
+			const { channel, path } = channelMatch;
 			return new FactorydroidRule({
 				outputRoot,
-				relativeDirPath: design.relativeDirPath,
-				relativeFilePath: design.relativeFilePath,
+				relativeDirPath: path.relativeDirPath,
+				relativeFilePath: path.relativeFilePath,
 				fileContent: rulesyncRule.getBody(),
 				validate,
 				root: false,
-				design: true
+				channel
 			});
 		}
 		return new FactorydroidRule(this.buildToolRuleParamsAgentsmd({
@@ -64681,14 +65314,14 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 		}));
 	}
 	toRulesyncRule() {
-		if (this.design) return new RulesyncRule({
+		if (this.channel !== void 0) return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
-			relativeFilePath: FACTORYDROID_DESIGN_FILE_NAME,
+			relativeFilePath: this.getRelativeFilePath(),
 			frontmatter: {
 				root: false,
 				targets: ["factorydroid"],
-				factorydroid: { channel: "design" }
+				factorydroid: { channel: this.channel }
 			},
 			body: this.getFileContent()
 		});
@@ -67655,6 +68288,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto",
 			collisionPolicy: "fold"
 		}
+	}],
+	["dsh", {
+		class: DshRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
 	}]
 ]);
 const allToolTargetKeys = [...toolRuleFactories.keys()];
@@ -70754,4 +71396,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCheck as $, ALL_TOOL_TARGETS as $t, CLAUDECODE_SKILLS_DIR_PATH as A, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as An, ensureDir as At, RulesyncSkill as B, quoteForLog as Bn, pathEscapesRoot as Bt, ChecksProcessor as C, RULESYNC_PERMISSIONS_FILE_NAME as Cn, applyFileMode as Ct, CLAUDECODE_LOCAL_RULE_FILE_NAME as D, RULESYNC_RELATIVE_DIR_PATH as Dn, checkPathTraversal as Dt, CLAUDECODE_DIR as E, RULESYNC_PERMISSIONS_SCHEMA_URL as En, assertWritablePathInsideRoot as Et, AUGMENTCODE_DIR as F, DEPRECATED_FEATURE_REPLACEMENTS as Fn, isFileSystemError as Ft, RulesyncMcp as G, removeFile as Gt, RulesyncRule as H, stripControlCharactersKeepingLineFeeds as Hn, readFileContentOrNull as Ht, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as I, formatError as In, isSymlink as It, getRulesyncSourceCandidates as J, resolvePath as Jt, RulesyncIgnore as K, removeFileStrict as Kt, getLocalSkillDirNames as L, truncateText as Ln, listDirectoryEntryNames as Lt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as M, parseCommaSeparatedList as Mn, getFileSize as Mt, caseFoldIdentity as N, ALL_FEATURES as Nn, getHomeDirectory as Nt, CLAUDECODE_MEMORIES_DIR_NAME as O, RULESYNC_RULES_RELATIVE_DIR_PATH as On, createTempDirectory as Ot, groupSpellingsByCaseFoldedIdentity as P, ALL_FEATURES_WITH_WILDCARD as Pn, isFileNotFoundError as Pt, RulesyncCommandFrontmatterSchema as Q, writeFileContent as Qt, RulesyncSubagent as R, hasDeceptiveHiddenCharacters as Rn, listFilePathsRecursively as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Sn, ErrorCodes as St, CODEXCLI_DIR as T, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Tn, assertTreeContainsNoSymlinks as Tt, RulesyncRuleFrontmatterSchema as U, stripHiddenCharacters as Un, removeDirectory as Ut, RulesyncSkillFrontmatterSchema as V, stripControlCharacters as Vn, readFileContent as Vt, RulesyncPermissions as W, removeDirectoryStrict as Wt, parseJsonc as X, toPosixPath as Xt, resolveRulesyncSourceWritePath as Y, runWithDirectoryRollback as Yt, RulesyncCommand as Z, writeFileBuffer as Zt, IgnoreProcessor as _, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as _n, warnOnConflictingFlags as _t, getProcessorRegistryEntry as a, RULESYNC_AIIGNORE_FILE_NAME as an, ConfigResolver as at, CommandsProcessor as b, RULESYNC_MCP_RELATIVE_FILE_PATH as bn, withWarnOnceScope as bt, RulesProcessor as c, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as cn, CONFLICTING_TARGET_PAIRS as ct, CODEBUDDY_DIR as d, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as dn, SourceEntrySchema as dt, ALL_TOOL_TARGETS_WITH_WILDCARD as en, RulesyncCheckFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as fn, findControlCharacter as ft, McpProcessor as g, RULESYNC_IGNORE_RELATIVE_FILE_PATH as gn, fallbackLogger as gt, shortenToWidth as h, RULESYNC_HOOKS_RELATIVE_FILE_PATH as hn, WarningCollectingLogger as ht, inspectInputRoots as i, MAX_FILE_SIZE as in, SKILL_FILE_NAME as it, FACTORYDROID_DIR as j, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as jn, fileExists as jt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as k, RULESYNC_SKILLS_RELATIVE_DIR_PATH as kn, directoryExists as kt, SubagentsProcessor as l, RULESYNC_CONFIG_RELATIVE_FILE_PATH as ln, ConfigFileSchema as lt, displayWidthOf as m, RULESYNC_HOOKS_LEGACY_FILE_NAME as mn, JsonLogger as mt, formatSourceLoadFailure as n, ToolTargetSchema as nn, loadYaml as nt, convertFromTool as o, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as on, mergeInputRootConfigs as ot, ELLIPSIS_WIDTH as p, RULESYNC_HOOKS_FILE_NAME as pn, ConsoleLogger as pt, RulesyncHooks as q, removeTempDirectory as qt, generate as r, CURATED_RULES_FEATURE_SUBDIR as rn, SHARED_USER_MANAGED_CONFIG_PATHS as rt, isPackagingToolTarget as s, RULESYNC_CHECKS_RELATIVE_DIR_PATH as sn, resolveEffectiveInputRoots as st, importFromTool as t, PACKAGING_TOOL_TARGETS as tn, stringifyFrontmatter as tt, SkillsProcessor as u, RULESYNC_CONFIG_SCHEMA_URL as un, GITIGNORE_DESTINATION_KEY as ut, CRUSH_LOCAL_RULE_FILE_NAME as v, RULESYNC_MCP_FILE_NAME as vn, withFallbackLoggerTarget as vt, CODEXCLI_BASH_RULES_FILE_NAME as w, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as wn, assertDirectoryIfExists as wt, QWENCODE_DIR as x, RULESYNC_MCP_SCHEMA_URL as xn, CLIError as xt, HooksProcessor as y, RULESYNC_MCP_LEGACY_FILE_NAME as yn, resetRunWarningState as yt, RulesyncSubagentFrontmatterSchema as z, hasEnclosingMarkOutsideKeycap as zn, listSubdirectoryNames as zt };
 
-//# sourceMappingURL=import-CwS7XtJP.js.map
+//# sourceMappingURL=import-BDlmyTcr.js.map