rulesync 16.34.2 → 16.36.0

package/dist/{import-D50FT0lm.cjs → import-D_daTMgR.cjs}

@@ -540,6 +540,7 @@ const rulesProcessorToolTargetTuple = [
 	"musecode",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"replit",
@@ -553,7 +554,6 @@ const rulesProcessorToolTargetTuple = [
 	"zcode",
 	"zed",
 	"zoocode",
-	"pool",
 	"dsh"
 ];
 const ignoreProcessorToolTargetTuple = [
@@ -4078,24 +4078,60 @@ const CONTROL_CHARS = [
 const hasControlChars = (val) => CONTROL_CHARS.some((char) => val.includes(char));
 const safeString = zod_mini.z.pipe(zod_mini.z.string(), zod_mini.z.custom((val) => typeof val === "string" && !hasControlChars(val), "must not contain newline, carriage return, or NUL characters"));
 /**
+* All canonical hook types — the union of the `type` values accepted by every
+* supported tool:
+* - `command` — universal (Claude Code, Codex CLI, Qwen Code, Cursor, …)
+* - `prompt` — Claude Code, Codex CLI, Qwen Code, Copilot CLI, Cursor, Devin
+* - `http` — Claude Code, Qwen Code, Copilot CLI, Grok CLI
+* - `agent` — Claude Code, Codex CLI
+* - `mcp_tool` — Claude Code
+* - `function` — Qwen Code (internal Skill-system executor)
+*/
+const HOOK_TYPES = [
+	"command",
+	"prompt",
+	"http",
+	"agent",
+	"mcp_tool",
+	"function"
+];
+/**
+* One choice offered by a Kiro `confirm` prompt: `run` decides whether picking
+* it executes the hook command. The prompt text is written back into JSON,
+* never embedded in generated code, so it is a plain string.
+*/
+const HookConfirmOptionSchema = zod_mini.z.looseObject({
+	id: zod_mini.z.string(),
+	label: zod_mini.z.string(),
+	run: zod_mini.z.boolean()
+});
+/**
+* Kiro's confirmation prompt shown before a `Stop`-trigger command hook runs.
+* `confirmCommand` (optional, inside the block) names a command whose JSON
+* stdout drives the prompt at run time: `{ "skip": true }` suppresses it, a
+* replacement `question` / `options` object overrides the static prompt, and
+* on failure or timeout the static prompt is used. Stored verbatim: Kiro is
+* the only consumer, and it owns the shape.
+* https://kiro.dev/docs/hooks/
+*/
+const HookConfirmSchema = zod_mini.z.looseObject({
+	question: zod_mini.z.string(),
+	options: zod_mini.z.array(HookConfirmOptionSchema),
+	confirmCommand: zod_mini.z.optional(safeString)
+});
+/**
 * Canonical hook definition.
 * Used in .rulesync/hooks.jsonc and mapped to tool-specific formats.
 */
 const HookDefinitionSchema = zod_mini.z.looseObject({
 	command: zod_mini.z.optional(safeString),
-	type: zod_mini.z.optional(zod_mini.z.enum([
-		"command",
-		"prompt",
-		"http",
-		"agent",
-		"mcp_tool",
-		"function"
-	])),
+	type: zod_mini.z.optional(zod_mini.z.enum(HOOK_TYPES)),
 	url: zod_mini.z.optional(safeString),
 	timeout: zod_mini.z.optional(zod_mini.z.number()),
 	cacheTtl: zod_mini.z.optional(zod_mini.z.number().check((0, zod_mini.nonnegative)())),
 	matcher: zod_mini.z.optional(safeString),
 	enabled: zod_mini.z.optional(zod_mini.z.boolean()),
+	confirm: zod_mini.z.optional(HookConfirmSchema),
 	prompt: zod_mini.z.optional(safeString),
 	loop_limit: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.number())),
 	name: zod_mini.z.optional(safeString),
@@ -4116,6 +4152,10 @@ const HookDefinitionSchema = zod_mini.z.looseObject({
 	model: zod_mini.z.optional(safeString),
 	args: zod_mini.z.optional(zod_mini.z.array(safeString)),
 	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	source: zod_mini.z.optional(zod_mini.z.looseObject({
+		source: safeString,
+		ref: zod_mini.z.optional(safeString)
+	})),
 	if: zod_mini.z.optional(safeString),
 	commandWindows: zod_mini.z.optional(safeString),
 	additionalContextLimit: zod_mini.z.optional(zod_mini.z.int().check((0, zod_mini.nonnegative)())),
@@ -4369,9 +4409,13 @@ const AMP_HOOK_EVENTS = [
 * the platform the other one owns — see `generateClineHookScript` and
 * `generateClineHookPowerShellScript`.
 *
-* `TaskResume` and `TaskCancel` have no canonical counterpart and stay
-* unmapped rather than being approximated by `sessionEnd` / `stop`, whose
-* semantics differ.
+* `TaskCancel` is the shape of canonical `stopCancelled` (as Grok CLI's
+* `StopCancelled` and Codex CLI's `Interrupt` are): both runtimes fire it
+* *instead of* `TaskComplete` when the run ends aborted — the VS Code
+* extension from `afterRun` when the result status is `aborted`, the SDK/CLI
+* as `agent_abort` — and neither lets the script cancel anything. `TaskResume`
+* has no canonical counterpart and stays unmapped rather than being
+* approximated by `sessionStart`, whose semantics differ.
 *
 * @see https://github.com/cline/cline/blob/main/apps/vscode/src/core/hooks/utils.ts
 * @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/hooks/hook-file-config.ts
@@ -4385,7 +4429,8 @@ const CLINE_HOOK_EVENTS = [
 	"preCompact",
 	"notification",
 	"taskCompleted",
-	"afterError"
+	"afterError",
+	"stopCancelled"
 ];
 /**
 * Hook events supported by GitHub Copilot (cloud coding agent).
@@ -4703,23 +4748,32 @@ const QWENCODE_HOOK_EVENTS = [
 * Hook events supported by Reasonix.
 *
 * Reasonix's `.reasonix/settings.json` (project) / `~/.reasonix/settings.json`
-* (global) documents a ten-event surface (`PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit`, `Stop`, `PostLLMCall`, `SessionStart`, `SessionEnd`,
-* `SubagentStop`, `Notification`, `PreCompact`). All ten have a clean canonical
+* (global) accepts the thirteen events declared in `internal/hook/hook.go`
+* (`var Events`): `PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest`, `UserPromptSubmit`, `Stop`, `StopFailure`,
+* `PostLLMCall`, `SessionStart`, `SessionEnd`, `SubagentStop`, `Notification`,
+* `PreCompact`. The zh-CN desktop hooks page documents only ten of them, so the
+* source file is the authoritative list. All thirteen have a clean canonical
 * equivalent and are mapped: `PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit` ← `beforeSubmitPrompt`, `Stop`, `SessionStart`,
-* `SessionEnd`, `SubagentStop`, `PostLLMCall` ← `postModelInvocation`,
-* `Notification` ← `notification`, and `PreCompact` ← `preCompact`.
-* `match` (Reasonix's matcher field name) is honored only on
-* `PreToolUse`/`PostToolUse`, matching the canonical `matcher` field's
-* tool-event scoping used by other adapters.
+* `PostToolUseFailure`, `PermissionRequest`, `UserPromptSubmit` ←
+* `beforeSubmitPrompt`, `Stop`, `StopFailure`, `SessionStart`, `SessionEnd`,
+* `SubagentStop`, `PostLLMCall` ← `postModelInvocation`, `Notification` ←
+* `notification`, and `PreCompact` ← `preCompact`.
+* `match` (Reasonix's matcher field name) is honored on the four tool-scoped
+* events (`PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest` — `UsesToolMatcher` in `internal/hook/inspect.go`) and
+* ignored everywhere else.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 const REASONIX_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
+	"postToolUseFailure",
+	"permissionRequest",
 	"beforeSubmitPrompt",
 	"stop",
+	"stopFailure",
 	"sessionStart",
 	"sessionEnd",
 	"subagentStop",
@@ -4765,8 +4819,8 @@ const GROKCLI_HOOK_EVENTS = [
 * added in 0.32.0 (`TurnStarted`, `UserPromptQueued`, `TaskStarted`,
 * `SessionHeartbeat`), none of which is mapped onto a canonical rulesync event
 * here. `Interrupt` (fires instead of `Stop` when the user interrupts a turn)
-* does have a canonical shape — `stopCancelled`, which Grok CLI and Codex CLI
-* map — but Kimi keeps it native-only for now, since an existing `kimi-code`
+* does have a canonical shape — `stopCancelled`, which Grok CLI, Codex CLI and
+* Cline map — but Kimi keeps it native-only for now, since an existing `kimi-code`
 * override addressing it by name would otherwise double up with a canonical
 * `stopCancelled` block; folding it in is a follow-up. All six are listed in
 * `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override can
@@ -4876,10 +4930,12 @@ const ZCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONIC
 *
 * Bob reads `hooks` from `.bob/settings.json` (project) and
 * `~/.bob/settings/settings.json` (user) in the Claude-Code shape and fires
-* five events: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse and
-* Stop. Only `command` hooks exist, and `matcher` (a regex over the tool
-* name) applies to the two tool events.
+* seven events: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse,
+* PreCompact, PostCompact (both added by Bob Shell 2.0.3) and Stop. Handlers
+* are `command` or `https` hooks, and `matcher` (a regex over the tool name)
+* applies to the two tool events.
 *
+* @see https://bob.ibm.com/docs/shell/configuration/lifecycle-hooks
 * @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
 */
 const BOB_HOOK_EVENTS = [
@@ -4887,6 +4943,8 @@ const BOB_HOOK_EVENTS = [
 	"beforeSubmitPrompt",
 	"preToolUse",
 	"postToolUse",
+	"preCompact",
+	"postCompact",
 	"stop"
 ];
 const CANONICAL_TO_BOB_EVENT_NAMES = {
@@ -4894,6 +4952,8 @@ const CANONICAL_TO_BOB_EVENT_NAMES = {
 	beforeSubmitPrompt: "UserPromptSubmit",
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
+	preCompact: "PreCompact",
+	postCompact: "PostCompact",
 	stop: "Stop"
 };
 const BOB_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_BOB_EVENT_NAMES).map(([k, v]) => [v, k]));
@@ -5055,8 +5115,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 37 entries as
-* of v0.20.2 (`v2026.8.16`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
+* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5080,11 +5140,13 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.8.16` (v0.20.2): `VALID_HOOKS` holds 37
-* entries, grown from 23 at `v2026.8.3` (v0.20.0). This list holds 36 of them —
-* see {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
+* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
+* This list holds 38 of them — see
+* {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5110,8 +5172,10 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"subagent_start",
 	"subagent_stop",
 	"pre_gateway_dispatch",
+	"agent_loop_stopped",
 	"pre_approval_request",
 	"post_approval_response",
+	"on_room_member_activity",
 	"pre_transcription",
 	"kanban_task_claimed",
 	"kanban_task_completed",
@@ -5134,8 +5198,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -5436,7 +5500,8 @@ const CANONICAL_TO_CLINE_EVENT_NAMES = {
 	preCompact: "PreCompact",
 	notification: "Notification",
 	taskCompleted: "TaskComplete",
-	afterError: "TaskError"
+	afterError: "TaskError",
+	stopCancelled: "TaskCancel"
 };
 /**
 * Map canonical camelCase event names to Copilot camelCase.
@@ -5754,8 +5819,11 @@ const QWENCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
+	postToolUseFailure: "PostToolUseFailure",
+	permissionRequest: "PermissionRequest",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	stop: "Stop",
+	stopFailure: "StopFailure",
 	sessionStart: "SessionStart",
 	sessionEnd: "SessionEnd",
 	subagentStop: "SubagentStop",
@@ -7305,13 +7373,30 @@ const DeepagentsExtensionsOverrideSchema = zod_mini.z.looseObject({
 	]))
 });
 /**
+* The `[mcp]` table of `~/.deepagents/config.toml`, where dcode keeps its
+* per-server trust for the MCP servers a project's `.mcp.json` /
+* `.deepagents/.mcp.json` declares. dcode reads these lists from the user-level
+* file only — never from a project file — which is exactly why the global
+* permissions adapter is the place to author them.
+*
+* `disabled_project_servers` names project MCP servers dcode always rejects;
+* a rejection wins over any approval or trust. The sibling
+* `enabled_project_server_approvals` is the fingerprint-bound approval store
+* the interactive prompt fills in, and `enabled_project_servers` is a
+* deprecated flat allowlist dcode ignores, so neither has a key here.
+*
+* @see https://docs.langchain.com/oss/deepagents/code/configuration
+*/
+const DeepagentsMcpOverrideSchema = zod_mini.z.looseObject({ disabled_project_servers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) });
+/**
 * The `[shell].allow_list` array itself is rulesync-owned, driven by the
 * shared `permission.bash` block, so it has no key here.
 */
 const DeepagentsPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
 	startup: zod_mini.z.optional(DeepagentsStartupOverrideSchema),
-	extensions: zod_mini.z.optional(DeepagentsExtensionsOverrideSchema)
+	extensions: zod_mini.z.optional(DeepagentsExtensionsOverrideSchema),
+	mcp: zod_mini.z.optional(DeepagentsMcpOverrideSchema)
 });
 /**
 * The actions Junie's allowlist accepts. Verified against the shipped Junie
@@ -7629,11 +7714,15 @@ const KiroPermissionsOverrideSchema = zod_mini.z.looseObject({
 });
 /**
 * Codex CLI's approval-workflow policy. Serialized as a kebab-case string in
-* `.codex/config.toml`. `on-failure` is a legacy alias for `on-request` that
-* Codex still accepts, so it is included so existing configs round-trip. The
-* granular table form (`{ granular = { … } }`) is modeled separately in the
-* override union.
+* `.codex/config.toml`. `on-failure` is a deprecated alias for `on-request`
+* that Codex still reads, so it stays accepted (generate warns) so existing
+* configs round-trip. `untrusted` was retired in Codex 0.149.0 and makes
+* Codex refuse to start; it stays in the enum only so an existing
+* `.rulesync/permissions.jsonc` still parses — generate warns and does not
+* write it, and import does not lift it. The granular table form
+* (`{ granular = { … } }`) is modeled separately in the override union.
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
+* @see https://github.com/openai/codex/pull/39630
 */
 const CodexApprovalPolicySchema = zod_mini.z.enum([
 	"untrusted",
@@ -7703,11 +7792,12 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 *   selected directly via `default_permissions` and skips the managed profile
 *   entirely — canonical filesystem/network rules are ignored in that mode.
 *   Defaults to `:workspace` when unspecified.
-* - `approval_policy` — `untrusted` | `on-request` (legacy alias `on-failure`) |
+* - `approval_policy` — `on-request` (deprecated alias `on-failure`) |
 *   `never`, or a `{ granular = { … } }` table (kept verbatim; the granular
 *   schema has required fields that are brittle to model as typed keys).
 *   Defaults to `on-request` when neither the override nor the existing
-*   config sets it.
+*   config sets it. `untrusted` (retired in Codex 0.149.0) is still parsed
+*   but skipped with a warning on generate, since Codex refuses to start on it.
 * - `sandbox_mode` — **deprecated.** `read-only` | `workspace-write` |
 *   `danger-full-access`, with the sibling `sandbox_workspace_write` table
 *   (`network_access`, `writable_roots`, …). Codex has superseded the classic
@@ -9593,7 +9683,8 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	})),
 	grokcli: zod_mini.z.optional(zod_mini.z.looseObject({
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
-		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean())
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 	})),
 	dsh: zod_mini.z.optional(zod_mini.z.looseObject({
 		whenToUse: zod_mini.z.optional(zod_mini.z.string()),
@@ -9625,7 +9716,13 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 	})),
-	commandcode: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	commandcode: zod_mini.z.optional(zod_mini.z.looseObject({
+		license: zod_mini.z.optional(zod_mini.z.string()),
+		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+		metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean())
+	})),
 	cortexcode: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	tabnine: zod_mini.z.optional(zod_mini.z.looseObject({})),
@@ -9814,8 +9911,32 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 		});
 	}
 };
-//#endregion
-//#region src/features/skills/skills-utils.ts
+const SKILL_DESCRIPTION_MAX_LENGTH = 1024;
+const SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Check a skill `name` against the length and character rules, phrased for the
+* `authority` that enforces them (e.g. "the Agent Skills spec" or "Zed"). When
+* that authority does something with a bad name beyond flagging it — Zed
+* refuses to load the skill — `consequence` names it so the warning says what
+* the author is about to lose. An empty name is the caller's concern: what it
+* means differs per consumer.
+*/
+function collectSkillNameViolations({ name, authority, consequence }) {
+	const violations = [];
+	if (name.length > 64) violations.push(`\`name\` is ${name.length} characters; ${authority} allows at most 64${consequence === void 0 ? "" : ` and ${consequence}`}`);
+	if (!SKILL_NAME_PATTERN.test(name)) violations.push(`\`name\` ${quoteForLog(name)} must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens${consequence === void 0 ? "" : `; ${authority} ${consequence}`}`);
+	return violations;
+}
+/**
+* Report each violation as a warning prefixed with the skill file it concerns.
+* The path is shown POSIX-style and stripped of control characters so a hostile
+* directory name cannot forge log lines; `warnWithFallback` keeps the report
+* visible when the caller has no logger to hand.
+*/
+function warnSkillViolations({ skillPath, violations, logger }) {
+	const shownPath = stripControlCharacters(toPosixPath(skillPath));
+	for (const violation of violations) warnWithFallback(logger, `${shownPath}: ${violation}`);
+}
 /**
 * Whether a directory on disk can be addressed by its name.
 *
@@ -9869,7 +9990,7 @@ async function getLocalSkillDirNames(sourceTree) {
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid, dsh). Each tool's own section may override that
+* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid, dsh, commandcode). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -9888,7 +10009,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh). Each tool's own section may override that default with a
+* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh, commandcode). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -10639,10 +10760,13 @@ const AmpCheckFrontmatterSchema = zod_mini.z.looseObject({
 /**
 * Represents an Amp code review check.
 *
-* Amp natively reads code review checks as Markdown files with YAML frontmatter,
-* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`).
-* Each check runs as a per-check subagent during code review.
-* @see https://ampcode.com/manual
+* Amp reads code review checks as Markdown files with YAML frontmatter,
+* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`;
+* Amp also reads `~/.config/agents/checks/`, which rulesync does not write).
+* Since the docs rebuild the supported runner is the official
+* `@amp/review-checks` plugin (`amp review` is deprecated); existing checks in
+* this format continue to apply.
+* @see https://ampcode.com/docs/review
 */
 var AmpCheck = class AmpCheck extends ToolCheck {
 	frontmatter;
@@ -15456,6 +15580,7 @@ var CodexcliCommand = class CodexcliCommand extends ToolCommand {
 const COMMANDCODE_DIR = ".commandcode";
 const COMMANDCODE_RULE_FILE_NAME = "AGENTS.md";
 const COMMANDCODE_SETTINGS_FILE_NAME = "settings.json";
+const COMMANDCODE_SETTINGS_LOCAL_FILE_NAME = "settings.local.json";
 const COMMANDCODE_PROJECT_MCP_FILE_NAME = ".mcp.json";
 const COMMANDCODE_GLOBAL_MCP_FILE_NAME = "mcp.json";
 const COMMANDCODE_COMMANDS_DIR_PATH = (0, node_path.join)(COMMANDCODE_DIR, "commands");
@@ -16881,10 +17006,8 @@ const AgentsSkillsSkillFrontmatterSchema = zod_mini.z.looseObject({
 	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 });
-const NAME_MAX_LENGTH = 64;
-const DESCRIPTION_MAX_LENGTH = 1024;
 const COMPATIBILITY_MAX_LENGTH = 500;
-const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const AGENT_SKILLS_SPEC = "the Agent Skills spec";
 /**
 * Placeholder for an object that has already been encoded once in the same
 * value. YAML anchors let one document reference the same node repeatedly, and
@@ -17048,12 +17171,14 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 	const { name, description } = frontmatter;
 	if (name.length === 0) violations.push("`name` is required and must not be empty");
 	else {
-		if (name.length > NAME_MAX_LENGTH) violations.push(`\`name\` is ${name.length} characters; the Agent Skills spec allows at most ${NAME_MAX_LENGTH}`);
-		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
+		violations.push(...collectSkillNameViolations({
+			name,
+			authority: AGENT_SKILLS_SPEC
+		}));
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
 	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
-	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
+	else if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${AGENT_SKILLS_SPEC} allows at most ${SKILL_DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
 	else if (compatibility !== void 0 && compatibility.length > COMPATIBILITY_MAX_LENGTH) violations.push(`\`compatibility\` is ${compatibility.length} characters; the Agent Skills spec allows at most ${COMPATIBILITY_MAX_LENGTH}`);
@@ -17171,16 +17296,19 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = agentSkillFilePath({
-			outputRoot,
-			relativeDirPath,
-			dirName
+		warnSkillViolations({
+			skillPath: agentSkillFilePath({
+				outputRoot,
+				relativeDirPath,
+				dirName
+			}),
+			violations: collectAgentSkillViolations({
+				frontmatter,
+				dirName,
+				sourceAllowedTools
+			}),
+			logger
 		});
-		for (const violation of collectAgentSkillViolations({
-			frontmatter,
-			dirName,
-			sourceAllowedTools
-		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -17820,6 +17948,15 @@ const KiloCommandFrontmatterSchema = zod_mini.z.looseObject({
 	model: zod_mini.z.optional(zod_mini.z.string()),
 	variant: zod_mini.z.optional(zod_mini.z.string())
 });
+/**
+* Command names Kilo keeps for itself. Its loader throws on a custom command
+* file named `goal.md` in either the project or the global directory ("The
+* /goal command is reserved for session goals. Rename the custom command."),
+* and a throw there aborts the whole command scan — every other custom
+* command becomes unreachable too, not only the reserved one.
+* https://github.com/Kilo-Org/kilocode/blob/v7.6.2/packages/opencode/src/command/index.ts
+*/
+const KILO_RESERVED_COMMAND_NAMES = /* @__PURE__ */ new Set(["goal"]);
 var KiloCommand = class KiloCommand extends ToolCommand {
 	frontmatter;
 	body;
@@ -17862,6 +17999,20 @@ var KiloCommand = class KiloCommand extends ToolCommand {
 			validate: true
 		});
 	}
+	/**
+	* Refuse to write a command Kilo reserves (see
+	* {@link KILO_RESERVED_COMMAND_NAMES}). The name Kilo loads is the file
+	* stem, and the processor calls this on the flattened path, so `goal.md`
+	* is refused at any nesting depth under the basename naming and only at the
+	* top level under the path naming, where `git/goal.md` becomes `git-goal`.
+	* Import is untouched: a `goal.md` already in `.kilo/commands/` is read as
+	* it is, since the reservation is Kilo's to enforce on its own files.
+	*/
+	static getWriteBlockReason({ rulesyncCommand }) {
+		const stem = (0, node_path.basename)(rulesyncCommand.getRelativeFilePath(), ".md");
+		if (!KILO_RESERVED_COMMAND_NAMES.has(stem)) return null;
+		return `Kilo reserves the /${stem} command for session goals and refuses to load a custom command by that name — it would abort Kilo's whole command scan, making every other custom command unreachable too. Rename the command, or exclude it from this target with \`targets\`.`;
+	}
 	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
 		const kiloFields = rulesyncFrontmatter.kilo ?? {};
@@ -20084,6 +20235,14 @@ var CommandsProcessor = class extends FeatureProcessor {
 			if (!factory.class.isTargetedByRulesyncCommand(rulesyncCommand)) return null;
 			const originalRelativePath = rulesyncCommand.getRelativeFilePath();
 			const commandToConvert = factory.meta.supportsSubdirectory ? rulesyncCommand : this.flattenRelativeFilePath(rulesyncCommand);
+			const writeBlockReason = factory.class.getWriteBlockReason?.({
+				rulesyncCommand: commandToConvert,
+				global: this.global
+			});
+			if (writeBlockReason !== void 0 && writeBlockReason !== null) {
+				this.logger.warn(`Skipping command ${quoteForLog(originalRelativePath)} for '${this.toolTarget}': ${writeBlockReason}`);
+				return null;
+			}
 			if (!factory.meta.supportsSubdirectory) {
 				const flattenedPath = commandToConvert.getRelativeFilePath();
 				const firstOrigin = flattenedPathOrigins.get(flattenedPath);
@@ -20670,6 +20829,18 @@ function isToolMatcherEntry(x) {
 	return true;
 }
 /**
+* Convert a canonical `timeout` (seconds) into the tool's unit.
+*/
+function emitTimeout({ timeout, converterConfig }) {
+	return converterConfig.timeoutUnit === "milliseconds" && Number.isFinite(timeout) ? Math.round(timeout * 1e3) : timeout;
+}
+/**
+* Convert a tool `timeout` back into the canonical unit (seconds).
+*/
+function importTimeout({ timeout, converterConfig }) {
+	return converterConfig.timeoutUnit === "milliseconds" && Number.isFinite(timeout) ? timeout / 1e3 : timeout;
+}
+/**
 * Filter the shared canonical hooks to the supported events and merge tool overrides on top.
 */
 function buildEffectiveHooks$1({ config, toolOverrideHooks, supportedEvents }) {
@@ -20810,6 +20981,7 @@ const isEmittableString = ({ value }) => isNonEmptyString(value);
 const isEmittableArray = ({ value }) => isStringArray$1(value);
 const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
 const isImportableArray = ({ value }) => isSafeStringArray(value);
+const isEmittableObject = ({ value }) => isPlainObject$1(value);
 /**
 * The canonical schema of one hook field, looked up by name. Read off the
 * schema's own shape rather than by parsing a one-field object, so a `canonical`
@@ -20844,11 +21016,17 @@ const isImportableNumber = ({ value, canonical }) => Number.isFinite(value) && s
 	value,
 	canonical
 });
+const isImportableObject = ({ value, canonical }) => isPlainObject$1(value) && satisfiesCanonicalField({
+	value,
+	canonical
+});
 /**
 * Say which rule the value broke, so the warning names the actual constraint
 * rather than asserting a canonical rejection that may not be the reason. A
 * closed enum lists its members; a rule carrying its own message (the
-* control-character check behind `safeString`) reuses it.
+* control-character check behind `safeString`) reuses it. An object field
+* names the offending key, since zod's generic "Invalid input" would not tell
+* the reader which key is missing or malformed.
 */
 function describeScalarConstraint({ canonical, value }) {
 	const schema = canonicalFieldSchema(canonical);
@@ -20856,13 +21034,22 @@ function describeScalarConstraint({ canonical, value }) {
 	if (result === void 0 || result.success) return `it is not a value this field carries through.`;
 	const issue = result.error.issues[0];
 	if (issue === void 0) return `it is not a value the canonical "${canonical}" field accepts.`;
-	return `it does not satisfy the canonical "${canonical}" field: ${issue.message}.`;
+	return `it does not satisfy the canonical "${canonical}" field${issue.path.length > 0 ? ` at ${quoteValueForWarning(issue.path.map(String).join("."))}` : ""}: ${issue.message}.`;
 }
 const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${quoteValueForWarning(value)}) while importing a hook: ${describeScalarConstraint({
 	canonical,
 	value
 })} Importing it would fail validation on the next run.`;
 const describeInvalidArray = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a list of strings without newline, carriage return or NUL characters.`;
+/**
+* An object is quoted by its offending key rather than its value: the payload
+* can be arbitrarily large, and the missing or malformed key is what the
+* reader needs to fix.
+*/
+const describeInvalidObject = ({ tool, canonical, value }) => isPlainObject$1(value) ? `Dropping "${tool}" while importing a hook: ${describeScalarConstraint({
+	canonical,
+	value
+})} Importing it would fail validation on the next run.` : `Dropping "${tool}" while importing a hook: it must be an object.`;
 const describeInvalidRecord = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a map of strings whose keys are non-empty and free of "=", and whose keys and values carry no newline, carriage return or NUL characters.`;
 /**
 * Check a value against the shape its field documents. A string field also
@@ -20925,6 +21112,72 @@ function isSupportedHookType({ type, converterConfig }) {
 	return converterConfig.supportedHookTypes?.has(type ?? "command") ?? true;
 }
 /**
+* Whether a keyword field applies to this hook, warning about the reason when
+* it does not. Shared by both directions: the field is unusable on the tool
+* side either way, so the value is dropped rather than carried into a config
+* the tool would ignore or refuse.
+*/
+function isKeywordFieldApplicable({ spec, hookType, eventName, direction, warn }) {
+	const { canonical, tool, commandOnly, events } = spec;
+	const field = direction === "generated" ? canonical : tool;
+	if (!isFieldApplicable({
+		commandOnly,
+		hookType
+	})) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not ${direction}.`);
+		return false;
+	}
+	if (events !== void 0 && !events.has(eventName)) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		return false;
+	}
+	return true;
+}
+/**
+* Emit the keyword passthrough fields: a canonical `true` becomes the tool's
+* keyword, while `false` is omitted as the tool's own default. A `true` the
+* tool would not honour on this hook is warned about, like the other kinds;
+* a `false` there is dropped silently, since omitting it changes nothing.
+*/
+function emitKeywordFields({ def, hookType, eventName, fields, warn }) {
+	const emitted = {};
+	for (const spec of fields) {
+		if (def[spec.canonical] !== true) continue;
+		if (isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "generated",
+			warn
+		})) emitted[spec.tool] = spec.trueValue;
+	}
+	return emitted;
+}
+/**
+* Import the keyword passthrough fields back into canonical booleans,
+* reversing {@link emitKeywordFields}. Only the two documented keywords are
+* read; anything else is warned about and dropped, so a typo in a hand-written
+* tool file never lands in `.rulesync/hooks.*` as a boolean it did not mean.
+*/
+function importKeywordFields({ h, hookType, eventName, fields, warn }) {
+	const imported = {};
+	for (const spec of fields) {
+		const value = h[spec.tool];
+		if (value === void 0) continue;
+		if (!isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "imported",
+			warn
+		})) continue;
+		if (value === spec.trueValue) imported[spec.canonical] = true;
+		else if (spec.falseValue !== void 0 && value === spec.falseValue) imported[spec.canonical] = false;
+		else warn?.(`Dropping "${spec.tool}" from an imported "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool documents for it.`);
+	}
+	return imported;
+}
+/**
 * Emit every per-hook passthrough kind for one canonical definition.
 */
 function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, warn }) {
@@ -20937,6 +21190,13 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 			isValid: isBooleanValue,
 			warn
 		}),
+		...emitKeywordFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...emitPassthroughFields({
 			def,
 			hookType,
@@ -20968,6 +21228,14 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 			fields: converterConfig.recordPassthroughFields ?? [],
 			isValid: isEmittableRecord,
 			warn
+		}),
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.objectPassthroughFields ?? [],
+			isValid: isEmittableObject,
+			warn
 		})
 	};
 }
@@ -20991,9 +21259,12 @@ function buildToolHooks({ defs, eventName, converterConfig, warn }) {
 				converterConfig,
 				warn
 			}),
-			type: hookType,
+			type: converterConfig.hookTypeNames?.[hookType] ?? hookType,
 			...command !== void 0 && command !== null && { command },
-			...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout },
+			...def.timeout !== void 0 && def.timeout !== null && { timeout: emitTimeout({
+				timeout: def.timeout,
+				converterConfig
+			}) },
 			...def.prompt !== void 0 && def.prompt !== null && { prompt: def.prompt },
 			...emitTypePayloadFields({
 				def,
@@ -21115,6 +21386,20 @@ const IMPORTED_HOOK_TYPES = /* @__PURE__ */ new Set([
 function isImportedHookType(value) {
 	return typeof value === "string" && IMPORTED_HOOK_TYPES.has(value);
 }
+/**
+* The canonical hook type a tool-side `type` value denotes: the tool's own
+* spelling from {@link ToolHooksConverterConfig.hookTypeNames} when it has
+* one, otherwise the value itself when it is a canonical type, and `command`
+* for anything else (the same coercion as before the renames existed).
+*/
+function resolveImportedHookType({ value, converterConfig }) {
+	const names = converterConfig.hookTypeNames;
+	if (names !== void 0 && typeof value === "string") {
+		for (const [canonical, tool] of Object.entries(names)) if (tool === value) return canonical;
+		if (Object.hasOwn(names, value)) return "command";
+	}
+	return isImportedHookType(value) ? value : "command";
+}
 function isStringRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	return Object.values(value).every((v) => typeof v === "string");
@@ -21240,7 +21525,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 * Import every per-hook passthrough kind for one tool hook record, reversing
 * the emit side in {@link buildToolHooks}.
 */
-function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
+function importAllPassthroughFields({ h, hookType, eventName, converterConfig, warn }) {
 	return {
 		...importPassthroughFields({
 			h,
@@ -21249,6 +21534,13 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 			isValid: isBooleanValue,
 			warn
 		}),
+		...importKeywordFields({
+			h,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...importPassthroughFields({
 			h,
 			hookType,
@@ -21280,14 +21572,25 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 			isValid: isEmittableRecord,
 			describeInvalid: describeInvalidRecord,
 			warn
+		}),
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.objectPassthroughFields ?? [],
+			isValid: isImportableObject,
+			describeInvalid: describeInvalidObject,
+			warn
 		})
 	};
 }
 /**
 * Convert a single tool hook record into a canonical hook definition.
 */
-function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
-	const hookType = isImportedHookType(h.type) ? h.type : "command";
+function toolHookToCanonical({ h, rawEntry, eventName, converterConfig, warn }) {
+	const hookType = resolveImportedHookType({
+		value: h.type,
+		converterConfig
+	});
 	const command = importCanonicalString({
 		value: stripCommandPrefix({
 			command: h.command,
@@ -21296,7 +21599,10 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 		canonical: "command",
 		warn
 	});
-	const timeout = typeof h.timeout === "number" ? h.timeout : void 0;
+	const timeout = typeof h.timeout === "number" ? importTimeout({
+		timeout: h.timeout,
+		converterConfig
+	}) : void 0;
 	const prompt = importCanonicalString({
 		value: h.prompt,
 		canonical: "prompt",
@@ -21328,6 +21634,7 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 		...importAllPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			converterConfig,
 			warn
 		}),
@@ -21414,7 +21721,7 @@ function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
 /**
 * Convert a single tool matcher entry into canonical hook definitions.
 */
-function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
+function toolMatcherEntryToCanonical({ rawEntry, eventName, converterConfig, warn }) {
 	const hookDefs = rawEntry.hooks ?? [];
 	const groupSkipReason = describeGroupSkipReason({
 		rawEntry,
@@ -21429,7 +21736,10 @@ function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
 		const skipReason = describeHookSkipReason({
 			h,
 			rawEntry,
-			hookType: isImportedHookType(h.type) ? h.type : "command",
+			hookType: resolveImportedHookType({
+				value: h.type,
+				converterConfig
+			}),
 			converterConfig
 		});
 		if (skipReason !== void 0) {
@@ -21439,6 +21749,7 @@ function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
 		definitions.push(toolHookToCanonical({
 			h,
 			rawEntry,
+			eventName,
 			converterConfig,
 			warn
 		}));
@@ -21486,6 +21797,7 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 			if (!isToolMatcherEntry(rawEntry)) continue;
 			defs.push(...toolMatcherEntryToCanonical({
 				rawEntry,
+				eventName,
 				converterConfig,
 				warn
 			}));
@@ -21914,6 +22226,7 @@ const AUGMENTCODE_CONVERTER_CONFIG = {
 		"beforeSubmitPrompt"
 	]),
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	timeoutUnit: "milliseconds",
 	arrayPassthroughFields: [{
 		canonical: "args",
 		tool: "args"
@@ -22512,9 +22825,12 @@ const BOB_SPEC = {
 		noMatcherEvents: /* @__PURE__ */ new Set([
 			"sessionStart",
 			"beforeSubmitPrompt",
+			"preCompact",
+			"postCompact",
 			"stop"
 		]),
-		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command", "http"]),
+		hookTypeNames: { http: "https" },
 		wildcardMatcherMeansAll: true
 	}
 };
@@ -22525,10 +22841,13 @@ const BOB_SPEC = {
 * `<project>/.bob/settings.json` (project scope) and
 * `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
 * `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
-* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into it
-* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
+* "command": "...", "timeout"?: <seconds> }] }] }`, where a handler may
+* instead be `{ "type": "https", "url": "...", "timeout"?: <seconds> }`. The
+* file also holds settings rulesync does not own, so generation merges the
+* `hooks` key into it (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting
+* the file.
 *
+* @see https://bob.ibm.com/docs/shell/configuration/lifecycle-hooks
 * @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
 */
 var BobHooks = class extends SettingsJsonHooks {
@@ -23958,6 +24277,11 @@ const CORTEXCODE_SPEC = {
 		booleanPassthroughFields: [{
 			canonical: "enabled",
 			tool: "enabled"
+		}],
+		objectPassthroughFields: [{
+			canonical: "source",
+			tool: "source",
+			commandOnly: true
 		}]
 	}
 };
@@ -23968,8 +24292,9 @@ const CORTEXCODE_SPEC = {
 * (project scope) and of the dedicated `~/.snowflake/cortex/hooks.json` (user
 * scope), both in the Claude-Code shape: `{ "<Event>": [{ "matcher"?:
 * "<regex>", "hooks": [{ "type": "command" | "prompt", ..., "timeout"?:
-* <seconds>, "enabled"?: <boolean> }] }] }`. The project file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into
+* <seconds>, "enabled"?: <boolean>, "source"?: { "source", "ref"? } }] }] }`.
+* The project file also holds settings rulesync does not own, so generation
+* merges the `hooks` key into
 * either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it, and
 * neither file is removed wholesale (hooks.json sits in the CLI-owned
 * `~/.snowflake/cortex/` tree).
@@ -25093,7 +25418,15 @@ const GOOSE_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: GOOSE_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
+	wildcardMatcherMeansAll: true,
+	keywordPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "on_failure",
+		trueValue: "block",
+		falseValue: "allow",
+		commandOnly: true,
+		events: /* @__PURE__ */ new Set(["preToolUse"])
+	}]
 };
 /**
 * Represents a Goose lifecycle hooks file.
@@ -25402,7 +25735,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.2; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -26282,7 +26615,8 @@ const KiroIdeHookEntrySchema = zod_mini.z.looseObject({
 	matcher: zod_mini.z.optional(zod_mini.z.string()),
 	action: zod_mini.z.optional(KiroIdeHookActionSchema),
 	timeout: zod_mini.z.optional(zod_mini.z.number()),
-	enabled: zod_mini.z.optional(zod_mini.z.boolean())
+	enabled: zod_mini.z.optional(zod_mini.z.boolean()),
+	confirm: zod_mini.z.optional(HookConfirmSchema)
 });
 const KiroIdeHooksFileSchema = zod_mini.z.looseObject({
 	version: zod_mini.z.optional(zod_mini.z.string()),
@@ -26321,7 +26655,8 @@ function buildKiroIdeEntriesForEvent(trigger, definitions) {
 			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
 			action,
 			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
-			enabled: def.enabled ?? true
+			enabled: def.enabled ?? true,
+			...def.confirm !== void 0 && { confirm: def.confirm }
 		});
 	}
 	return entries;
@@ -26363,6 +26698,14 @@ function canonicalToKiroIdeHooks(config) {
 	}
 	return entries;
 }
+/**
+* Copies the optional per-hook fields (`enabled`, `confirm`) back onto the
+* canonical definition.
+*/
+function copyOptionalHookFields({ entry, def }) {
+	if (entry.enabled === false) def.enabled = false;
+	if (entry.confirm !== void 0 && entry.confirm !== null) def.confirm = omitPrototypePollutionKeysDeep(entry.confirm);
+}
 function kiroIdeHooksToCanonical(entries) {
 	const canonical = {};
 	for (const entry of entries) {
@@ -26386,7 +26729,10 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
-		if (entry.enabled === false) def.enabled = false;
+		copyOptionalHookFields({
+			entry,
+			def
+		});
 		const list = lookupOwn({
 			record: canonical,
 			key: eventName
@@ -27393,10 +27739,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/reasonix-hooks.ts
 /**
-* Only PreToolUse/PostToolUse honor the `match` field (an anchored regex
-* against the tool name); it is ignored on every other event.
+* Only the tool-scoped events honor the `match` field (an anchored regex
+* against the tool name); it is ignored on every other event. Mirrors
+* `UsesToolMatcher` in upstream `internal/hook/inspect.go`.
 */
-const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"PreToolUse",
+	"PostToolUse",
+	"PostToolUseFailure",
+	"PermissionRequest"
+]);
 const SUPPORTED_REASONIX_EVENTS = new Set(REASONIX_HOOK_EVENTS);
 /**
 * Convert canonical hooks config to the Reasonix `hooks` object.
@@ -27478,9 +27830,11 @@ function reasonixHooksToCanonical(hooks) {
 * Reasonix hooks live in a Claude-Code-style but standalone JSON file —
 * `.reasonix/settings.json` (project) or `~/.reasonix/settings.json`
 * (global) — separate from the `[permissions]`/`[[plugins]]` TOML config.
-* All ten upstream events have a clean canonical equivalent and are mapped:
-* PreToolUse/PostToolUse/UserPromptSubmit/Stop plus SessionStart/SessionEnd/
-* SubagentStop/PostLLMCall/Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* All thirteen upstream events have a clean canonical equivalent and are mapped:
+* PreToolUse/PostToolUse/PostToolUseFailure/PermissionRequest/UserPromptSubmit/
+* Stop/StopFailure plus SessionStart/SessionEnd/SubagentStop/PostLLMCall/
+* Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 var ReasonixHooks = class ReasonixHooks extends ToolHooks {
@@ -28306,6 +28660,23 @@ const PER_HOOK_ENABLED_TARGETS = /* @__PURE__ */ new Set([
 	"kiro-ide",
 	"zcode"
 ]);
+/** The targets whose hooks format carries the Kiro `confirm` prompt. */
+const PER_HOOK_CONFIRM_TARGETS = /* @__PURE__ */ new Set(["kiro-cli", "kiro-ide"]);
+/**
+* Names the shared events that carry a hook whose canonical definition
+* satisfies `predicate`, excluding events the target skips altogether (those
+* are already reported as skipped and produce no output, so warning about them
+* again would contradict that message).
+*/
+function emittedEventsWithHook(params) {
+	const { factory, sharedHooks, effectiveHooks, predicate } = params;
+	const skippedEvents = new Set(unsupportedEventNames({
+		factory,
+		sharedHooks,
+		effectiveHooks
+	}));
+	return Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => predicate(def))).map(([event]) => event);
+}
 const toolHooksFactories = /* @__PURE__ */ new Map([
 	["amp", {
 		class: AmpHooks,
@@ -28615,7 +28986,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		supportedEvents: BOB_HOOK_EVENTS,
-		supportedHookTypes: ["command"],
+		supportedHookTypes: ["command", "http"],
 		supportsMatcher: true,
 		matcherEvents: ["preToolUse", "postToolUse"]
 	}],
@@ -28876,15 +29247,11 @@ var HooksProcessor = class extends FeatureProcessor {
 			}
 			for (const [hookType, events] of unsupportedTypeToEvents) this.logger.warn(`Skipped ${hookType}-type hook(s) for ${this.toolTarget} (not supported): ${Array.from(events).join(", ")}`);
 		}
-		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
-			const skippedEvents = new Set(unsupportedEventNames({
-				factory,
-				sharedHooks,
-				effectiveHooks
-			}));
-			const eventsWithDisabledHooks = Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => def.enabled === false)).map(([event]) => event);
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
-		}
+		this.warnAboutDroppedPerHookFields({
+			factory,
+			sharedHooks,
+			effectiveHooks
+		});
 		const eventsWithUnsupportedMatcher = unsupportedMatcherEventNames({
 			factory,
 			effectiveHooks
@@ -28914,6 +29281,33 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (auxiliaryFiles && auxiliaryFiles.length > 0) result.push(...auxiliaryFiles);
 		return result;
 	}
+	/**
+	* Warns about canonical per-hook fields that this target's hooks format
+	* cannot express, so a hook does not silently change behavior on generation.
+	* Only canonical definitions are considered: a tool-native field inside an
+	* override block is passed through verbatim and honored by that tool.
+	*/
+	warnAboutDroppedPerHookFields(params) {
+		const { factory, sharedHooks, effectiveHooks } = params;
+		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
+			const eventsWithDisabledHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.enabled === false
+			});
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
+		}
+		if (!PER_HOOK_CONFIRM_TARGETS.has(this.toolTarget)) {
+			const eventsWithConfirmHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.confirm !== void 0
+			});
+			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the kiro-cli / kiro-ide hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
+		}
+	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
 		const hooks = toolFiles.filter((f) => f instanceof ToolHooks);
 		const logger = withToolTargetPrefix({
@@ -31429,6 +31823,50 @@ function parseBobMcpConfig({ fileContent, relativePath }) {
 /** The `type` Bob IDE writes for a streamable HTTP server. */
 const BOB_STREAMABLE_HTTP_TYPE = "streamable-http";
 /**
+* The OAuth keys Bob reads flat on a server entry, next to `oauth` (a
+* boolean: `true` forces the flow on, `false` off, absent lets Bob detect it).
+* The canonical shape is Claude Code's nested `oauth: { clientId, ... }`
+* object, so the two are translated in both directions.
+* @see https://bob.ibm.com/docs/ide/configuration/mcp/mcp-oauth
+*/
+const BOB_FLAT_OAUTH_KEYS = [
+	"clientId",
+	"clientSecret",
+	"scope"
+];
+/**
+* Flatten the canonical `oauth` object onto a Bob server entry: `oauth: true`
+* plus the string-valued keys Bob documents. A flat key the server already
+* carries (authored in Bob's own spelling) is kept over the nested one. Other
+* nested keys (`callbackPort`, `redirectUri`) have no Bob counterpart and are
+* dropped rather than nested under a key Bob reads as a boolean.
+*/
+function flattenOauthForBob({ oauth, converted }) {
+	converted.oauth = true;
+	for (const key of BOB_FLAT_OAUTH_KEYS) {
+		const value = oauth[key];
+		if (typeof value === "string" && converted[key] === void 0) converted[key] = value;
+	}
+}
+/**
+* Reverse of {@link flattenOauthForBob}: gather Bob's flat OAuth keys into the
+* canonical `oauth` object. `oauth: true` always folds (even with no keys, so
+* the explicit enable survives the round-trip as an empty object); with no
+* `oauth` key at all the fold happens only when a flat key is present, since
+* that is what makes the entry an OAuth one for Bob; `oauth: false` and
+* anything else leave the entry as it is.
+*/
+function nestOauthFromBob(converted) {
+	const flat = BOB_FLAT_OAUTH_KEYS.filter((key) => typeof converted[key] === "string");
+	if (!(converted.oauth === true || converted.oauth === void 0 && flat.length > 0)) return;
+	const oauth = {};
+	for (const key of flat) {
+		oauth[key] = converted[key];
+		delete converted[key];
+	}
+	converted.oauth = oauth;
+}
+/**
 * The remote transport Bob IDE reads a server as, spelled the way it writes
 * it: `streamable-http` needs an explicit `type`, while SSE (legacy) is a bare
 * `url` with no `type`. `http` is the canonical rulesync alias for streamable
@@ -31451,7 +31889,9 @@ function asBobRemoteType(stated, url) {
 * `headers`, `timeout`, `alwaysAllow` and `disabled` pass through, as Bob
 * documents all of them, with prototype-pollution keys dropped at every
 * nesting level (Bob spreads `env` and `headers` into the process environment
-* and the HTTP requests).
+* and the HTTP requests). The canonical `oauth` object is flattened onto the
+* entry as `oauth: true` plus `clientId` / `clientSecret` / `scope`, the keys
+* Bob reads; a boolean `oauth` passes through as Bob's own on/off switch.
 *
 * Bob Shell documents the same file with an `httpURL` key instead of
 * `type` + `url` for streamable HTTP. rulesync writes the IDE spelling (the two
@@ -31517,10 +31957,16 @@ function convertToBobFormat(mcpServers, logger) {
 			converted.command = command;
 			if (args.length > 0) converted.args = args;
 		}
-		for (const [key, value] of Object.entries(rest)) {
+		const { oauth, ...passthrough } = rest;
+		for (const [key, value] of Object.entries(passthrough)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
+		if (isRecord$1(oauth)) flattenOauthForBob({
+			oauth,
+			converted
+		});
+		else if (oauth !== void 0) converted.oauth = oauth;
 		result[serverName] = converted;
 	}
 	return result;
@@ -31530,9 +31976,10 @@ function convertToBobFormat(mcpServers, logger) {
 * (`type: "streamable-http"` + `url`) is already canonical and passes through;
 * the Bob Shell spelling `httpURL` becomes `url` with `type: "http"`; a bare
 * `url` is an SSE server in Bob, so it gains `type: "sse"` to keep that reading
-* on the next generate. Every other field passes through with its
-* prototype-pollution keys dropped at every nesting level, mirroring the
-* generate side's handling of `env` / `headers`.
+* on the next generate. Bob's flat OAuth keys are gathered back into the
+* canonical `oauth` object (see {@link nestOauthFromBob}). Every other field
+* passes through with its prototype-pollution keys dropped at every nesting
+* level, mirroring the generate side's handling of `env` / `headers`.
 */
 function convertFromBobFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -31553,6 +32000,7 @@ function convertFromBobFormat(mcpServers) {
 			converted.url = httpURL;
 			converted.type = "http";
 		} else if (typeof converted.url === "string" && converted.type === void 0) converted.type = "sse";
+		nestOauthFromBob(converted);
 		result[serverName] = converted;
 	}
 	return result;
@@ -32577,7 +33025,10 @@ function asContinueRemoteType(stated, url) {
 * file with a strict union — one server that matches neither shape (an
 * unknown transport, a non-string `env` value) makes Continue drop every
 * server in the file — so only the documented keys are emitted and anything
-* else (`timeout`, `oauth`, rulesync-only fields) is left out. `envFile` is
+* else is left out. The canonical keys a user would expect to take effect
+* (`cwd`, `timeout`, `oauth`) are dropped with a warning, since the JSON
+* schema has no place for them (the YAML block form does, but Rulesync writes
+* the JSON file); rulesync-only fields are dropped silently. `envFile` is
 * accepted by Continue's schema but ignored with a warning at load time, so
 * it is dropped here with a warning instead of being written as if it worked.
 *
@@ -32613,6 +33064,17 @@ function convertToContinueFormat(mcpServers, logger) {
 	}
 	return result;
 }
+/**
+* Warn for each canonical key Continue's JSON MCP schema cannot carry, so a
+* dropped `cwd`, `timeout` or `oauth` does not go unnoticed in a config that
+* otherwise looks complete.
+*/
+function warnUnsupportedContinueKeys({ serverName, serverConfig, keys, logger }) {
+	for (const key of keys) {
+		if (serverConfig[key] === void 0) continue;
+		logger?.warn(`Continue's MCP config has no "${key}" field, so the ${key} of server ${quoteValueForWarning(serverName)} was not written.`);
+	}
+}
 function convertRemoteServer({ serverName, serverConfig, logger }) {
 	const url = resolveRemoteMcpUrl(serverConfig);
 	if (!url) {
@@ -32640,6 +33102,12 @@ function convertRemoteServer({ serverName, serverConfig, logger }) {
 		url
 	};
 	if (isRecord$1(serverConfig.headers)) converted.headers = omitPrototypePollutionKeys(serverConfig.headers);
+	warnUnsupportedContinueKeys({
+		serverName,
+		serverConfig,
+		keys: ["timeout", "oauth"],
+		logger
+	});
 	return converted;
 }
 function convertStdioServer({ serverName, serverConfig, logger }) {
@@ -32660,6 +33128,12 @@ function convertStdioServer({ serverName, serverConfig, logger }) {
 	if (args.length > 0) converted.args = args;
 	if (isRecord$1(serverConfig.env)) converted.env = omitPrototypePollutionKeys(serverConfig.env);
 	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server ${quoteValueForWarning(serverName)} was not written; put the variables in "env" instead.`);
+	warnUnsupportedContinueKeys({
+		serverName,
+		serverConfig,
+		keys: ["cwd", "timeout"],
+		logger
+	});
 	return converted;
 }
 /**
@@ -34635,28 +35109,60 @@ function resolveHermesTimeout(config) {
 	if (typeof config.networkTimeout === "number") return config.networkTimeout;
 }
 /**
-* Copies the advanced Hermes-recognized per-server fields that have no canonical
-* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
-* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
-* `connect_timeout` (seconds), `supports_parallel_tool_calls`,
-* `keepalive_interval`, `elicitation`, `trust`, and `identity_header` — verbatim
-* from `source` to `target`. Field names are identical on both sides (the
-* canonical `McpServerSchema` is a `looseObject`), so this serves export and
-* import alike. See the Hermes mcp-config-reference.
+* String-valued `oauth` keys Hermes reads (`tools/mcp_oauth.py`,
+* `tools/mcp_oauth_device.py`, v0.21.3): the callback overrides, the
+* pre-registered client, the CIMD document override, the DCR registration
+* fields, the token-request `user_agent`, the login `flow` (`device` for
+* RFC 8628) and the space-separated `scope` string sent on registration and
+* device authorization.
+*/
+const HERMES_OAUTH_STRING_KEYS = [
+	"redirect_uri",
+	"redirect_host",
+	"client_id",
+	"client_secret",
+	"client_name",
+	"client_metadata_url",
+	"token_endpoint_auth_method",
+	"application_type",
+	"user_agent",
+	"flow",
+	"scope"
+];
+/**
+* Copies the `oauth` mapping of a server, keeping only the keys Hermes reads.
+*
+* Hermes reads a single `scope` string, never a `scopes` list; earlier Rulesync
+* versions wrote `scopes` regardless, which Hermes silently ignored. A `scopes`
+* list is therefore folded into `scope` (space-separated, the OAuth wire form)
+* when no `scope` is given, in both directions, so an authored list finally
+* reaches the authorization server and an old `config.yaml` imports cleanly.
 */
 function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
-	for (const key of [
-		"redirect_uri",
-		"redirect_host",
-		"client_id",
-		"client_secret"
-	]) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof source.redirect_port === "number") oauth.redirect_port = source.redirect_port;
-	if (isStringArray$2(source.scopes)) oauth.scopes = source.scopes;
+	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
+	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
+	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_OPAQUE_MAPPING_KEYS = [
+	"sampling",
+	"elicitation",
+	"identity_header",
+	"lifecycle"
+];
+/**
+* Copies the advanced Hermes-recognized per-server fields that have no canonical
+* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
+* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
+* `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* verbatim from `source` to `target`. Field names are identical on both sides
+* (the canonical `McpServerSchema` is a `looseObject`), so this serves export
+* and import alike. See the Hermes mcp-config-reference.
+*/
 function copyHermesAdvancedFields(source, target) {
 	let copied = false;
 	if (typeof source.auth === "string") {
@@ -34688,6 +35194,14 @@ function copyHermesAdvancedFields(source, target) {
 		target[key] = source[key];
 		copied = true;
 	}
+	if (typeof source.protocol === "string") {
+		target.protocol = source.protocol;
+		copied = true;
+	}
+	if (typeof source.lazy === "boolean") {
+		target.lazy = source.lazy;
+		copied = true;
+	}
 	if (typeof source.ssl_verify === "boolean" || typeof source.ssl_verify === "string") {
 		target.ssl_verify = source.ssl_verify;
 		copied = true;
@@ -34696,25 +35210,20 @@ function copyHermesAdvancedFields(source, target) {
 		target.skip_preflight = source.skip_preflight;
 		copied = true;
 	}
-	if (isPlainObject$1(source.sampling)) {
-		target.sampling = omitPrototypePollutionKeys(structuredClone(source.sampling));
-		copied = true;
-	}
 	if (typeof source.keepalive_interval === "number") {
 		target.keepalive_interval = source.keepalive_interval;
 		copied = true;
 	}
-	if (isPlainObject$1(source.elicitation)) {
-		target.elicitation = omitPrototypePollutionKeys(structuredClone(source.elicitation));
-		copied = true;
-	}
 	if (typeof source.trust === "string") {
 		target.trust = source.trust;
 		copied = true;
 	}
-	if (isPlainObject$1(source.identity_header)) {
-		target.identity_header = omitPrototypePollutionKeys(structuredClone(source.identity_header));
-		copied = true;
+	for (const key of HERMES_OPAQUE_MAPPING_KEYS) {
+		const mapping = source[key];
+		if (isPlainObject$1(mapping)) {
+			target[key] = omitPrototypePollutionKeys(structuredClone(mapping));
+			copied = true;
+		}
 	}
 	return copied;
 }
@@ -35498,6 +36007,7 @@ function toKimiCodeServer({ name, server, logger }) {
 		"headers",
 		"bearerTokenEnvVar",
 		"enabled",
+		"deferred",
 		"startupTimeoutMs",
 		"toolTimeoutMs",
 		"enabledTools",
@@ -36155,7 +36665,12 @@ const OpencodeMcpRemoteServerSchema = zod_mini.z.looseObject({
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	enabled: zod_mini.z._default(zod_mini.z.boolean(), true)
 });
-const OPENCODE_PASSTHROUGH_SERVER_FIELDS = ["timeout", "oauth"];
+const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
+	"timeout",
+	"oauth",
+	"protocol",
+	"codemode"
+];
 const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
 	...Object.keys(OpencodeMcpRemoteServerSchema.def.shape),
@@ -36297,7 +36812,7 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - env -> environment
 * - disabled -> enabled (inverted)
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
-* - OpenCode-supported extras (timeout, oauth) -> passed through verbatim
+* - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
 */
 function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, logger) {
 	const serverRecord = serverConfig;
@@ -39290,7 +39805,7 @@ var ToolPermissions = class extends ToolFile {
 * builtin of that name). It lives in the shared Amp settings file:
 * `.amp/settings.json` (project) and `~/.config/amp/settings.json` (global).
 *
-* Reference: https://ampcode.com/manual ("amp.tools.disable").
+* Reference: https://ampcode.com/docs/cli/settings ("amp.tools.disable").
 */
 const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 /**
@@ -39301,19 +39816,26 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * glob. Rules are evaluated **first-match-wins**. It lives in the same shared
 * Amp settings file as `amp.tools.disable`.
 *
-* `amp.permissions` is Amp's documented legacy/backwards-compat surface — it
-* remains functional and is the only place to express `allow`/`ask` and
-* argument-specific `reject` rules (the simpler `amp.tools.disable` array can
-* only disable whole tools).
+* `amp.permissions` is Amp's legacy/backwards-compat surface — it remains
+* functional in the shipped CLI and is the only place to express `allow`/`ask`
+* and argument-specific `reject` rules (the simpler `amp.tools.disable` array
+* can only disable whole tools). The web docs no longer describe it (the
+* permissions section only points at custom plugins), but the shipped CLI
+* still lists it in its built-in settings reference (`amp --help`) and
+* evaluates it through `amp permissions list|test`.
 *
-* Reference: https://ampcode.com/manual ("amp.permissions").
+* Reference: https://ampcode.com/docs/tools#permissions and
+* https://ampcode.com/docs/customize/plugins#example-plugin-permissions.
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
 /**
 * The `amp.guardedFiles.allowlist` array (file globs allowed without
 * confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
 * and `amp.mcpPermissions` array — sibling settings authored through the `amp`
-* permissions override. Reference: https://ampcode.com/manual.
+* permissions override. Only `amp.mcpPermissions` is still on the web docs
+* (https://ampcode.com/docs/cli/settings); the other two, like
+* `amp.permissions`, survive only in the CLI's built-in settings reference
+* (see `AMP_PERMISSIONS_KEY`).
 */
 const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
 const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
@@ -42642,6 +43164,8 @@ const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
 const CODEX_EXTENDABLE_BASELINES = new Set(CODEX_EXTENDABLE_BASELINE_PROFILES);
 const CODEX_DEFAULT_APPROVAL_POLICY = "on-request";
 const CODEX_DEFAULT_APPROVALS_REVIEWER = "auto_review";
+const CODEX_RETIRED_APPROVAL_POLICY = "untrusted";
+const CODEX_DEPRECATED_APPROVAL_POLICY = "on-failure";
 const CODEX_GLOB_SCAN_MAX_DEPTH = 8;
 const CODEX_MINIMAL_KEY = ":minimal";
 const CODEX_GIT_WRITE_RULES = { ".git/**": "write" };
@@ -42765,6 +43289,10 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			domainsHadUnknown
 		});
 		const override = extractCodexcliOverride(table);
+		if (override.approval_policy === CODEX_RETIRED_APPROVAL_POLICY) {
+			warnWithFallback(void 0, `${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())} sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start. It was not imported; remove it from the file, or mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			delete override.approval_policy;
+		}
 		if (typeof profile?.extends === "string" && CODEX_EXTENDABLE_BASELINES.has(profile.extends)) override.base_permission_profile = profile.extends;
 		if (defaultProfile === CODEX_DANGER_FULL_ACCESS_BASELINE) override.base_permission_profile = CODEX_DANGER_FULL_ACCESS_BASELINE;
 		const result = Object.keys(override).length > 0 ? {
@@ -43053,6 +43581,10 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			continue;
 		}
 		if (value === void 0) continue;
+		if (key === "approval_policy" && !isWritableApprovalPolicy({
+			value,
+			logger
+		})) continue;
 		if (key === "sandbox_mode" || key === "sandbox_workspace_write") logger?.warn(`Codex CLI permission override key "${key}" is deprecated. Codex prioritizes the legacy sandbox settings over permission profiles when both are present, so it disables the generated "${RULESYNC_PROFILE_NAME}" permissions profile. Use "base_permission_profile" and the shared "permission" block instead.`);
 		const existingValue = existing[key];
 		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
@@ -43060,12 +43592,37 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			...value
 		} : value;
 	}
+	fillCodexcliDefaults({
+		existing,
+		patch,
+		logger
+	});
+	return patch;
+}
+function fillCodexcliDefaults({ existing, patch, logger }) {
 	const defaults = {
 		approval_policy: CODEX_DEFAULT_APPROVAL_POLICY,
 		approvals_reviewer: CODEX_DEFAULT_APPROVALS_REVIEWER
 	};
-	for (const [key, value] of Object.entries(defaults)) if (patch[key] === void 0 && existing[key] === void 0) patch[key] = value;
-	return patch;
+	for (const [key, value] of Object.entries(defaults)) {
+		if (patch[key] !== void 0) continue;
+		if (existing[key] === void 0) {
+			patch[key] = value;
+			continue;
+		}
+		if (key === "approval_policy" && existing[key] === CODEX_RETIRED_APPROVAL_POLICY) {
+			logger?.warn(`The existing Codex CLI config.toml sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start, so it was replaced with "${value}". To keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			patch[key] = value;
+		}
+	}
+}
+function isWritableApprovalPolicy({ value, logger }) {
+	if (value === CODEX_RETIRED_APPROVAL_POLICY) {
+		logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_RETIRED_APPROVAL_POLICY}" was retired in Codex 0.149.0 and makes Codex refuse to start, so it was not written. Remove it from the override; to keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+		return false;
+	}
+	if (value === CODEX_DEPRECATED_APPROVAL_POLICY) logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_DEPRECATED_APPROVAL_POLICY}" is deprecated; Codex reads it as "${CODEX_DEFAULT_APPROVAL_POLICY}". Use "${CODEX_DEFAULT_APPROVAL_POLICY}" instead.`);
+	return true;
 }
 function extractCodexcliOverride(table) {
 	const override = {};
@@ -45158,6 +45715,27 @@ const DEEPAGENTS_EXTENSION_TRUST_POLICIES = [
 * @see https://github.com/langchain-ai/deepagents `config_manifest.py`
 */
 const DEEPAGENTS_EXTENSIONS_ENABLED_DEFAULT = true;
+/**
+* `[mcp]` holds dcode's per-server trust for the MCP servers a project's
+* `.mcp.json` / `.deepagents/.mcp.json` declares. `load_mcp_server_trust_lists`
+* reads it from the user-level `config.toml` only — never from a project file —
+* so the global adapter is the one place rulesync can author it.
+*/
+const MCP_TABLE_KEY = "mcp";
+/**
+* Keys lifted back into the override on import. `disabled_project_servers` is
+* the deny list: a name on it is always rejected, over any approval or trust.
+*/
+const DEEPAGENTS_MCP_KEYS = ["disabled_project_servers"];
+const MCP_DISABLED_PROJECT_SERVERS_KEY = "disabled_project_servers";
+/**
+* dcode's own store of the project servers the user approved at the prompt,
+* each bound to a repository or worktree and a definition fingerprint. It is
+* machine-local state and a way to pre-approve a project's servers, so a
+* repository's `.rulesync/permissions.jsonc` must not reach it: generate drops
+* the key here, and import never lifts it (`DEEPAGENTS_MCP_KEYS`).
+*/
+const MCP_APPROVALS_KEY = "enabled_project_server_approvals";
 const ALLOW_ALL_SENTINEL = "all";
 const RECOMMENDED_SENTINEL = "recommended";
 const GLOB_CHARACTERS_PATTERN = /[*?[\]]/;
@@ -45230,7 +45808,9 @@ const TRAILING_ARGUMENT_WILDCARD_PATTERN = /:\*$/;
 * lifted back into the override on import. The same override carries
 * `[extensions].enabled` and `[extensions].trust` (`ask` / `always` / `never`),
 * which decide whether the Python in a checked-out project's
-* `.deepagents/extensions/` is imported into the agent process.
+* `.deepagents/extensions/` is imported into the agent process, and
+* `[mcp].disabled_project_servers`, the names of project MCP servers dcode
+* always rejects.
 *
 * On **import** the allowlist comes back as `bash` `allow` rules named by the
 * executable — skipping any entry dcode could not match in the first place, so
@@ -45328,17 +45908,9 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			if (Object.keys(shell).length > 0) settings[SHELL_TABLE_KEY] = shell;
 			else delete settings[SHELL_TABLE_KEY];
 		}
-		const startupOverride = config.deepagents?.startup;
-		if (isPlainObject$1(startupOverride) && Object.keys(startupOverride).length > 0) mergeStartupOverride({
+		mergeDeepagentsOverrides({
 			settings,
-			startupOverride,
-			filePath,
-			logger
-		});
-		const extensionsOverride = config.deepagents?.extensions;
-		if (isPlainObject$1(extensionsOverride) && Object.keys(extensionsOverride).length > 0) mergeExtensionsOverride({
-			settings,
-			extensionsOverride,
+			override: config.deepagents,
 			filePath,
 			logger
 		});
@@ -45370,10 +45942,15 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			extensions: isPlainObject$1(settings[EXTENSIONS_TABLE_KEY]) ? settings[EXTENSIONS_TABLE_KEY] : {},
 			selfPath
 		});
+		const mcpOverride = liftMcpOverride({
+			mcp: isPlainObject$1(settings[MCP_TABLE_KEY]) ? settings[MCP_TABLE_KEY] : {},
+			selfPath
+		});
 		const result = { ...config };
 		const deepagents = {};
 		if (Object.keys(startupOverride).length > 0) deepagents.startup = startupOverride;
 		if (Object.keys(extensionsOverride).length > 0) deepagents.extensions = extensionsOverride;
+		if (Object.keys(mcpOverride).length > 0) deepagents.mcp = mcpOverride;
 		if (Object.keys(deepagents).length > 0) result.deepagents = deepagents;
 		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: getDeepagentsRulesyncOutputRoot({
@@ -45481,7 +46058,7 @@ function warnAboutUnwrittenBashRules({ allowAll, requestedAllowAll, askPatterns,
 * read — a wrapper rather than the bare value, so a legitimately falsy setting
 * is not mistaken for a rejection.
 */
-function liftOverrideTable({ table, tableKey, keys, normalize, selfPath }) {
+function liftOverrideTable({ table, tableKey, keys, normalize, selfPath, describeRejection = `deepagents-cli falls back to its own default for a '[${tableKey}]' value it cannot read` }) {
 	const override = {};
 	const rejected = [];
 	for (const key of keys) {
@@ -45494,7 +46071,7 @@ function liftOverrideTable({ table, tableKey, keys, normalize, selfPath }) {
 		if (normalized) override[key] = normalized.value;
 		else rejected.push(`${key} = ${JSON.stringify(value)}`);
 	}
-	if (rejected.length > 0) warnWithFallback(void 0, `deepagents-cli falls back to its own default for a '[${tableKey}]' value it cannot read, so ${rejected.join(", ")} in ${selfPath} ${rejected.length === 1 ? "was" : "were"} not imported.`);
+	if (rejected.length > 0) warnWithFallback(void 0, `${describeRejection}, so ${rejected.join(", ")} in ${selfPath} ${rejected.length === 1 ? "was" : "were"} not imported.`);
 	return override;
 }
 /**
@@ -45542,6 +46119,37 @@ function liftExtensionsOverride({ extensions, selfPath }) {
 	});
 }
 /**
+* Read a `[mcp]` name list the way `_toml_str_list` reads it: a bare string
+* is split on commas, names are trimmed and empty ones dropped, and a
+* non-string element of a list is dropped while the names around it survive.
+* Anything else (a number, a table, a bool) is a value dcode cannot read as
+* names at all, so `null` says to leave it behind.
+*/
+function readMcpServerNames(value) {
+	if (typeof value === "string") return value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
+	if (!Array.isArray(value)) return null;
+	return value.filter((name) => typeof name === "string").map((name) => name.trim()).filter((name) => name.length > 0);
+}
+/**
+* Lift the `[mcp]` keys rulesync models back into the `deepagents` override.
+* The deny list comes back as the array dcode resolves it to, so the
+* comma-separated string form it also accepts does not survive as one bogus
+* name in a permissions file the canonical schema types as `string[]`.
+*/
+function liftMcpOverride({ mcp, selfPath }) {
+	return liftOverrideTable({
+		table: mcp,
+		tableKey: MCP_TABLE_KEY,
+		keys: DEEPAGENTS_MCP_KEYS,
+		normalize: ({ value }) => {
+			const names = readMcpServerNames(value);
+			return names ? { value: names } : null;
+		},
+		selfPath,
+		describeRejection: `deepagents-cli treats a '[${MCP_TABLE_KEY}]' value it cannot read as a broken trust policy and rejects every project MCP server until it is fixed`
+	});
+}
+/**
 * Merge one block of the `deepagents` override into its `config.toml` table,
 * preserving every other key of that table. A table that is not a table at all
 * is something rulesync did not write and cannot merge into, so it is left
@@ -45590,6 +46198,38 @@ function warnAboutUncheckedKeys({ tableKey, knownKeys, writtenKeys, filePath, lo
 	if (unknownKeys.length === 0) return;
 	warnWithFallback(logger, `The deepagents ${tableKey} override wrote ${unknownKeys.join(", ")} into ${filePath} unchecked — rulesync does not know what those keys grant, and that file is your global deepagents-cli config.`);
 }
+/** An override block with something in it to write. */
+function isSet(block) {
+	return isPlainObject$1(block) && Object.keys(block).length > 0;
+}
+/**
+* Merge each block of the `deepagents` override into its `config.toml` table.
+* A block that is absent, not a table, or empty has nothing to write and is
+* skipped without touching the table it would have gone into.
+*/
+function mergeDeepagentsOverrides({ settings, override, filePath, logger }) {
+	const startupOverride = override?.startup;
+	if (isSet(startupOverride)) mergeStartupOverride({
+		settings,
+		startupOverride,
+		filePath,
+		logger
+	});
+	const extensionsOverride = override?.extensions;
+	if (isSet(extensionsOverride)) mergeExtensionsOverride({
+		settings,
+		extensionsOverride,
+		filePath,
+		logger
+	});
+	const mcpOverride = override?.mcp;
+	if (isSet(mcpOverride)) mergeMcpOverride({
+		settings,
+		mcpOverride,
+		filePath,
+		logger
+	});
+}
 /**
 * Merge the `deepagents.startup` override into `[startup]`.
 */
@@ -45623,6 +46263,40 @@ function mergeExtensionsOverride({ settings, extensionsOverride, filePath, logge
 	});
 }
 /**
+* Merge the `deepagents.mcp` override into `[mcp]`. The approval store is
+* dropped (see `MCP_APPROVALS_KEY`); the deprecated flat
+* `enabled_project_servers` is not modeled but passes through like any other
+* unknown key, named by the unchecked-key warning — dcode ignores it anyway.
+*/
+function mergeMcpOverride({ settings, mcpOverride, filePath, logger }) {
+	mergeOverrideTable({
+		settings,
+		tableKey: MCP_TABLE_KEY,
+		override: mcpOverride,
+		knownKeys: DEEPAGENTS_MCP_KEYS,
+		isDroppedKey: (key) => key === MCP_APPROVALS_KEY,
+		warnAboutRelaxations: warnAboutMcpRelaxations,
+		filePath,
+		logger
+	});
+}
+/**
+* Warn when the `deepagents` mcp override re-enables project MCP servers the
+* machine's global config had rejected. The deny list is written as a whole,
+* so a shorter list from a repository's `.rulesync/permissions.jsonc` would
+* otherwise silently lift a rejection the user had put in place — the very
+* fail-open dcode's own env merge refuses to allow.
+*/
+function warnAboutMcpRelaxations({ override, previous, filePath, logger }) {
+	if (override[MCP_APPROVALS_KEY] !== void 0) warnWithFallback(logger, `The deepagents mcp override's '${MCP_APPROVALS_KEY}' was not written to ${filePath}: dcode builds that approval store itself from the project MCP servers you accept at launch, so a permissions file cannot pre-approve them.`);
+	const written = override[MCP_DISABLED_PROJECT_SERVERS_KEY];
+	if (written === void 0 || written === null) return;
+	const kept = new Set(readMcpServerNames(written) ?? []);
+	const reEnabled = (readMcpServerNames(previous[MCP_DISABLED_PROJECT_SERVERS_KEY]) ?? []).filter((name) => !kept.has(name));
+	if (reEnabled.length === 0) return;
+	warnWithFallback(logger, `The deepagents mcp override removed ${reEnabled.map((name) => JSON.stringify(name)).join(", ")} from [${MCP_TABLE_KEY}].${MCP_DISABLED_PROJECT_SERVERS_KEY} in ${filePath}, which is your global deepagents-cli config: dcode no longer rejects ${reEnabled.length === 1 ? "that project MCP server" : "those project MCP servers"} outright, for every project on this machine, not just this one.`);
+}
+/**
 * Name the value an override key replaces, so a setting the user had turned
 * down is visible as such rather than reported as a bare new value.
 */
@@ -51400,6 +52074,18 @@ const TAKT_RUNTIME_TARGETS_KEY = "targets";
 const TAKT_RUNTIME_AUTO_ROUTING_KEY = "auto_routing";
 const TAKT_RUNTIME_PROFILE_KEY = "profile";
 const TAKT_RUNTIME_OPTIONS_KEY = "options";
+const TAKT_RUNTIME_ASSIGNMENTS_KEY = "assignments";
+const TAKT_RUNTIME_LADDER_KEY = "ladder";
+const TAKT_RUNTIME_EXTENDS_KEY = "extends";
+const TAKT_RUNTIME_ROUTER_PROFILE_KEY = "router_profile";
+const TAKT_RUNTIME_POOLS_KEY = "pools";
+const TAKT_RUNTIME_CANDIDATES_KEY = "candidates";
+const TAKT_RUNTIME_FALLBACK_PROFILE_KEY = "fallback_profile";
+/** The one `targets` map that routes companion reviewers rather than agents. */
+const TAKT_RUNTIME_COMPANIONS_TARGET_KEY = "companions";
+const TAKT_RUNTIME_COMPANION_KEY = "companion";
+const TAKT_RUNTIME_ENABLED_KEY = "enabled";
+const TAKT_DEFAULT_COMPANION_ENABLED = false;
 const TAKT_SECURITY_POLICIES = {
 	workflow_arpeggio: [
 		"custom_data_source_modules",
@@ -51653,21 +52339,156 @@ function runtimeProfiles(runtime) {
 	const profiles = provider[TAKT_RUNTIME_PROFILES_KEY];
 	return isPlainObject$1(profiles) ? profiles : {};
 }
+/** A `targets` map (`personas`, `tags`, …) with at least one non-empty entry. */
+function hasTargetContent(targets) {
+	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+}
+/** The profile names an assignment points at: `profile` plus every `ladder` rung. */
+function assignmentProfileNames(assignment) {
+	if (!isPlainObject$1(assignment)) return [];
+	const names = [];
+	const profile = assignment[TAKT_RUNTIME_PROFILE_KEY];
+	if (typeof profile === "string") names.push(profile);
+	const ladder = assignment[TAKT_RUNTIME_LADDER_KEY];
+	if (Array.isArray(ladder)) names.push(...ladder.filter((rung) => typeof rung === "string"));
+	return names;
+}
+/** The assignments under a `targets` map, split by whether they route companions. */
+function targetAssignments(targets, { companions }) {
+	if (!isPlainObject$1(targets)) return [];
+	return Object.entries(targets).filter(([name]) => name === TAKT_RUNTIME_COMPANIONS_TARGET_KEY === companions).flatMap(([, targetMap]) => isPlainObject$1(targetMap) ? Object.values(targetMap) : []);
+}
+/**
+* Record the profiles a `defaults` + `targets` pair (the top-level provider
+* section or one named assignment set) reaches, keeping companion roots apart
+* from the roots agents use.
+*/
+function addAssignmentSetRoots({ set, companionRoots, agentRoots }) {
+	for (const name of assignmentProfileNames(set[TAKT_RUNTIME_DEFAULTS_KEY])) agentRoots.add(name);
+	const targets = set[TAKT_RUNTIME_TARGETS_KEY];
+	for (const assignment of targetAssignments(targets, { companions: false })) for (const name of assignmentProfileNames(assignment)) agentRoots.add(name);
+	for (const assignment of targetAssignments(targets, { companions: true })) for (const name of assignmentProfileNames(assignment)) companionRoots.add(name);
+}
+/** The profiles `auto_routing` reaches: the router plus every pool candidate/fallback. */
+function addAutoRoutingRoots(autoRouting, roots) {
+	if (!isPlainObject$1(autoRouting)) return;
+	const routerProfile = autoRouting[TAKT_RUNTIME_ROUTER_PROFILE_KEY];
+	if (typeof routerProfile === "string") roots.add(routerProfile);
+	const pools = autoRouting[TAKT_RUNTIME_POOLS_KEY];
+	if (!isPlainObject$1(pools)) return;
+	for (const pool of Object.values(pools)) {
+		if (!isPlainObject$1(pool)) continue;
+		const candidates = pool[TAKT_RUNTIME_CANDIDATES_KEY];
+		for (const candidate of Array.isArray(candidates) ? candidates : []) for (const name of assignmentProfileNames(candidate)) roots.add(name);
+		const fallback = pool[TAKT_RUNTIME_FALLBACK_PROFILE_KEY];
+		if (typeof fallback === "string") roots.add(fallback);
+	}
+}
+/** Every profile reachable from `roots` by following `extends`. */
+function profileClosure(profiles, roots) {
+	const closure = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		if (closure.has(name)) return;
+		closure.add(name);
+		const profile = profiles[name];
+		const parent = isPlainObject$1(profile) ? profile[TAKT_RUNTIME_EXTENDS_KEY] : void 0;
+		if (typeof parent === "string") visit(parent);
+	};
+	for (const root of roots) visit(root);
+	return closure;
+}
+/** The `targets` map minus its `companions` entry (`undefined` when not a map). */
+function withoutCompanionTargets(targets) {
+	if (!isPlainObject$1(targets)) return;
+	const { [TAKT_RUNTIME_COMPANIONS_TARGET_KEY]: _companions, ...remaining } = targets;
+	return remaining;
+}
+/**
+* The named assignment sets with their companion targets removed; a set left
+* with neither `defaults` nor a non-empty `targets` map is dropped, and
+* `undefined` means none survived.
+*/
+function withoutCompanionAssignments(assignments) {
+	if (!isPlainObject$1(assignments)) return;
+	const remaining = {};
+	for (const [name, set] of Object.entries(assignments)) {
+		if (!isPlainObject$1(set)) continue;
+		const defaults = set[TAKT_RUNTIME_DEFAULTS_KEY];
+		const targets = withoutCompanionTargets(set[TAKT_RUNTIME_TARGETS_KEY]);
+		const keepTargets = hasTargetContent(targets);
+		if (defaults === void 0 && !keepTargets) continue;
+		remaining[name] = {
+			...defaults === void 0 ? {} : { [TAKT_RUNTIME_DEFAULTS_KEY]: defaults },
+			...keepTargets ? { [TAKT_RUNTIME_TARGETS_KEY]: targets } : {}
+		};
+	}
+	return Object.keys(remaining).length > 0 ? remaining : void 0;
+}
+/** Whether the section (or any of its named assignment sets) routes companions at all. */
+function hasCompanionTargets(section) {
+	const routesCompanions = (set) => {
+		const targets = isPlainObject$1(set) ? set[TAKT_RUNTIME_TARGETS_KEY] : void 0;
+		return isPlainObject$1(targets) && targets[TAKT_RUNTIME_COMPANIONS_TARGET_KEY] !== void 0;
+	};
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	return routesCompanions(section) || isPlainObject$1(assignments) && Object.values(assignments).some(routesCompanions);
+}
+/**
+* The `provider:` section as Takt itself evaluates it, mirroring upstream's
+* `getEffectiveProviderSection`: unless `companion.enabled` is `true`
+* (companions are opt-in), the `targets.companions` maps — top-level and inside
+* every named assignment set — are dropped, along with each profile that only a
+* companion target reaches through `extends`. A profile an agent assignment
+* (`defaults`, the other `targets` maps, `auto_routing`) also reaches is kept.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/schema.ts
+*/
+function effectiveRuntimeProviderSection(runtime) {
+	const section = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	if (!isPlainObject$1(section)) return;
+	const companion = runtime[TAKT_RUNTIME_COMPANION_KEY];
+	if (((isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0) ?? TAKT_DEFAULT_COMPANION_ENABLED) === true || !hasCompanionTargets(section)) return section;
+	const profiles = runtimeProfiles(runtime);
+	const companionRoots = /* @__PURE__ */ new Set();
+	const agentRoots = /* @__PURE__ */ new Set();
+	addAssignmentSetRoots({
+		set: section,
+		companionRoots,
+		agentRoots
+	});
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	for (const set of isPlainObject$1(assignments) ? Object.values(assignments) : []) if (isPlainObject$1(set)) addAssignmentSetRoots({
+		set,
+		companionRoots,
+		agentRoots
+	});
+	addAutoRoutingRoots(section[TAKT_RUNTIME_AUTO_ROUTING_KEY], agentRoots);
+	const companionClosure = profileClosure(profiles, companionRoots);
+	const agentClosure = profileClosure(profiles, agentRoots);
+	const effective = {
+		...section,
+		[TAKT_RUNTIME_PROFILES_KEY]: Object.fromEntries(Object.entries(profiles).filter(([name]) => !companionClosure.has(name) || agentClosure.has(name)))
+	};
+	for (const [key, value] of [[TAKT_RUNTIME_TARGETS_KEY, withoutCompanionTargets(section[TAKT_RUNTIME_TARGETS_KEY])], [TAKT_RUNTIME_ASSIGNMENTS_KEY, withoutCompanionAssignments(assignments)]]) if (value === void 0) delete effective[key];
+	else effective[key] = value;
+	return effective;
+}
 /**
 * Whether a parsed `runtime.yaml` puts Takt into runtime mode, mirroring
-* upstream's mode detection: the `provider:` section must carry an actual
-* assignment — a non-empty `defaults`, `profiles` or `auto_routing`, or a
-* `targets` map with at least one non-empty nested map. The file existing is not
-* enough, and empty nested maps (`defaults: {}`, `targets: { personas: {} }`)
-* must not flip the mode.
+* upstream's mode detection: the effective `provider:` section (see
+* `effectiveRuntimeProviderSection` — companion-only routing does not count
+* while companions are disabled) must carry an actual assignment — a non-empty
+* `defaults`, `profiles` or `auto_routing`, a `targets` map with at least one
+* non-empty nested map, or a named assignment set with a non-empty `defaults`
+* or such a `targets` map. The file existing is not enough, and empty nested
+* maps (`defaults: {}`, `targets: { personas: {} }`) must not flip the mode.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/mode.ts
 */
 function isRuntimeModeActive(runtime) {
-	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
-	if (!isPlainObject$1(provider)) return false;
-	if (hasEntries(provider[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(provider[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(provider[TAKT_RUNTIME_AUTO_ROUTING_KEY])) return true;
-	const targets = provider[TAKT_RUNTIME_TARGETS_KEY];
-	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+	const section = effectiveRuntimeProviderSection(runtime);
+	if (section === void 0) return false;
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	const hasAssignments = isPlainObject$1(assignments) && Object.values(assignments).some((set) => isPlainObject$1(set) && (hasEntries(set[TAKT_RUNTIME_DEFAULTS_KEY]) || hasTargetContent(set[TAKT_RUNTIME_TARGETS_KEY])));
+	return hasEntries(section[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(section[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(section[TAKT_RUNTIME_AUTO_ROUTING_KEY]) || hasTargetContent(section[TAKT_RUNTIME_TARGETS_KEY]) || hasAssignments;
 }
 /** The provider named by the runtime profile Takt would use by default. */
 function resolveRuntimeProvider(runtime) {
@@ -51690,10 +52511,13 @@ function resolveRuntimeProvider(runtime) {
 * shape the `takt` override uses. Each profile's options belong to that
 * profile's own provider; when several profiles name the same provider they are
 * merged in document order, so a later profile wins on a colliding option key.
+* Profiles Takt itself ignores (companion-only ones while companions are
+* disabled) are skipped, as they never reach an agent.
 */
 function collectRuntimeProviderOptions(runtime) {
 	const collected = {};
-	for (const profile of Object.values(runtimeProfiles(runtime))) {
+	const profiles = effectiveRuntimeProviderSection(runtime)?.[TAKT_RUNTIME_PROFILES_KEY];
+	for (const profile of Object.values(isPlainObject$1(profiles) ? profiles : {})) {
 		if (!isPlainObject$1(profile)) continue;
 		const providerName = profile[TAKT_RUNTIME_PROVIDER_KEY];
 		const options = profile[TAKT_RUNTIME_OPTIONS_KEY];
@@ -51732,13 +52556,20 @@ async function readTaktRuntimeFile({ filePath, logger }) {
 		};
 	}
 }
+/** A map-valued key of a `provider:` section, or `undefined` when it is not a map. */
+function runtimeSectionMap(section, key) {
+	return isPlainObject$1(section[key]) ? section[key] : void 0;
+}
 /**
 * Collapse the project and global `runtime.yaml` into the single document Takt
-* itself resolves against, matching upstream's loader: `profiles` is a union
-* with the project definition of a same-named profile replacing the global one,
-* while `defaults`, `targets` and `auto_routing` are taken from the project file
-* whole whenever it states them at all (`??`, so a project `targets: {}` masks
-* the global one rather than merging with it).
+* itself resolves against, matching upstream's loader: `profiles` and
+* `assignments` are unions with the project definition of a same-named entry
+* replacing the global one, while `defaults`, `targets` and `auto_routing` are
+* taken from the project file whole whenever it states them at all (`??`, so a
+* project `targets: {}` masks the global one rather than merging with it). The
+* top-level `companion.enabled` — which decides whether companion routing
+* counts for mode detection — is carried as upstream carries it: unset when
+* neither file states it, otherwise on only when neither file turns it off.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/loader.ts
 *
 * Merging before mode detection matters in both directions: a project file
@@ -51754,14 +52585,15 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 	const projectSection = sectionOf(project);
 	const globalSection = sectionOf(globalConfig);
 	const replaced = (key) => projectSection[key] ?? globalSection[key];
-	const profilesOf = (section) => isPlainObject$1(section[TAKT_RUNTIME_PROFILES_KEY]) ? section[TAKT_RUNTIME_PROFILES_KEY] : void 0;
-	const globalProfiles = profilesOf(globalSection);
-	const projectProfiles = profilesOf(projectSection);
 	const provider = {};
-	if (globalProfiles !== void 0 || projectProfiles !== void 0) provider[TAKT_RUNTIME_PROFILES_KEY] = {
-		...globalProfiles,
-		...projectProfiles
-	};
+	for (const key of [TAKT_RUNTIME_PROFILES_KEY, TAKT_RUNTIME_ASSIGNMENTS_KEY]) {
+		const globalMap = runtimeSectionMap(globalSection, key);
+		const projectMap = runtimeSectionMap(projectSection, key);
+		if (globalMap !== void 0 || projectMap !== void 0) provider[key] = {
+			...globalMap,
+			...projectMap
+		};
+	}
 	for (const key of [
 		TAKT_RUNTIME_DEFAULTS_KEY,
 		TAKT_RUNTIME_TARGETS_KEY,
@@ -51770,7 +52602,17 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 		const value = replaced(key);
 		if (value !== void 0) provider[key] = value;
 	}
-	return { [TAKT_RUNTIME_PROVIDER_KEY]: provider };
+	const enabledOf = (config) => {
+		const companion = config?.[TAKT_RUNTIME_COMPANION_KEY];
+		return isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0;
+	};
+	const globalEnabled = enabledOf(globalConfig);
+	const projectEnabled = enabledOf(project);
+	const companion = globalEnabled === void 0 && projectEnabled === void 0 ? void 0 : { [TAKT_RUNTIME_ENABLED_KEY]: globalEnabled !== false && projectEnabled !== false };
+	return {
+		[TAKT_RUNTIME_PROVIDER_KEY]: provider,
+		...companion === void 0 ? {} : { [TAKT_RUNTIME_COMPANION_KEY]: companion }
+	};
 }
 /**
 * The runtime provider configuration in force for a generate run: the project
@@ -57375,7 +58217,12 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 //#region src/features/skills/commandcode-skill.ts
 const CommandcodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
-	description: zod_mini.z.string()
+	description: zod_mini.z.string(),
+	license: zod_mini.z.optional(zod_mini.z.string()),
+	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
 * Represents a Command Code skill directory.
@@ -57458,10 +58305,35 @@ var CommandcodeSkill = class CommandcodeSkill extends ToolSkill {
 		const settablePaths = CommandcodeSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
 		const { name: _sectionName, description: _sectionDescription, ...commandcodeSection } = rulesyncFrontmatter.commandcode ?? {};
+		const license = resolveLicense({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const compatibility = resolveCompatibility({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const metadata = resolveMetadata({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
 		const commandcodeFrontmatter = {
 			...commandcodeSection,
 			name: rulesyncFrontmatter.name,
-			description: rulesyncFrontmatter.description
+			description: rulesyncFrontmatter.description,
+			...license !== void 0 && { license },
+			...compatibility !== void 0 && { compatibility },
+			...metadata !== void 0 && { metadata },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation },
+			...userInvocable !== void 0 && { "user-invocable": userInvocable }
 		};
 		return new CommandcodeSkill({
 			outputRoot,
@@ -59409,7 +60281,8 @@ const GrokcliSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
 	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
-	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 });
 /**
 * Represents a Grok Build skill directory.
@@ -59468,7 +60341,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const grokcliSection = {
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.paths !== void 0 && { paths: frontmatter.paths }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -59503,7 +60377,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
-			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...grokcliSection?.paths !== void 0 && { paths: grokcliSection.paths }
 		};
 		return new GrokcliSkill({
 			outputRoot,
@@ -62154,7 +63029,10 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: WARP_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: WARP_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return WarpSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -62218,12 +63096,14 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		return targets.includes("*") || targets.includes("warp");
 	}
 	/**
-	* Commands are emitted into this same skills tree as `<slug>/SKILL.md`
-	* (see `WarpCommand`), so a directory matching a current rulesync command
-	* slug is owned by the commands feature: it must not be imported as a
-	* skill nor deleted as an orphan skill.
+	* Commands are emitted into the `.warp/skills/` tree as `<slug>/SKILL.md`
+	* (see `WarpCommand`), so a directory there matching a current rulesync
+	* command slug is owned by the commands feature: it must not be imported as
+	* a skill nor deleted as an orphan skill. The import-only `.agents/skills/`
+	* root never receives commands, so a same-named skill in it stays a skill.
 	*/
-	static async isDirOwned({ dirName, inputRoots }) {
+	static async isDirOwned({ relativeDirPath, dirName, inputRoots }) {
+		if (relativeDirPath !== WARP_SKILLS_DIR_PATH) return true;
 		return !await rulesyncCommandSlugExists({
 			inputRoots,
 			dirName
@@ -62436,6 +63316,25 @@ const ZedSkillFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.string(),
 	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
 });
+const ZED = "Zed";
+const ZED_LOAD_FAILURE = "does not load the skill otherwise";
+/**
+* Collect the rules Zed enforces on a skill's frontmatter that the loose
+* schema above does not — `name` rules first, then `description`. Returned as
+* warnings rather than thrown: the canonical skill is shared with every other
+* target, so a name Zed rejects must not stop the generate run for the rest.
+*/
+function collectZedSkillViolations({ name, description }) {
+	const violations = [];
+	if (name.length === 0) violations.push("`name` must not be empty; Zed does not load a skill without one");
+	else violations.push(...collectSkillNameViolations({
+		name,
+		authority: ZED,
+		consequence: ZED_LOAD_FAILURE
+	}));
+	if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${ZED} loads the skill but warns past ${SKILL_DESCRIPTION_MAX_LENGTH}`);
+	return violations;
+}
 /**
 * Represents a Zed agent skill directory.
 * Skills are stored under .agents/skills/ (project) or ~/.agents/skills/ (global)
@@ -62504,9 +63403,10 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global: this.global
 		});
 	}
-	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
 		const settablePaths = ZedSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
 		const zedSection = rulesyncFrontmatter.zed;
 		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
 			rootFrontmatter: rulesyncFrontmatter,
@@ -62518,10 +63418,17 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			...zedSection,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
+		ZedSkill.reportSkillViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: zedFrontmatter,
+			logger
+		});
 		return new ZedSkill({
 			outputRoot,
 			relativeDirPath: settablePaths.relativeDirPath,
-			dirName: rulesyncSkill.getDirName(),
+			dirName,
 			frontmatter: zedFrontmatter,
 			body: rulesyncSkill.getBody(),
 			otherFiles: rulesyncSkill.getOtherFiles(),
@@ -62529,6 +63436,18 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global
 		});
 	}
+	/**
+	* Warn about every rule Zed enforces on the skill about to be written. The
+	* reported path includes `outputRoot` so a global-scope skill points at the
+	* file under the home directory rather than a same-named project path.
+	*/
+	static reportSkillViolations({ outputRoot, relativeDirPath, dirName, frontmatter, logger }) {
+		warnSkillViolations({
+			skillPath: (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME),
+			violations: collectZedSkillViolations(frontmatter),
+			logger
+		});
+	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("zed");
@@ -64834,6 +65753,35 @@ const CommandcodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	showOutput: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
+* Names Command Code's built-in agents own. The loader runs the frontmatter
+* `name` (or the file stem when it has none) through `sanitizeAgentName`,
+* which rewrites every character outside `[a-zA-Z0-9_-]` to `_`, lowercases
+* it, and skips the file outright when the result is one of these
+* (`isReservedAgentName`) — with no message. Verified in the `command-code`
+* 1.54.2 bundle.
+* @see https://commandcode.ai/docs/agents
+*/
+const COMMANDCODE_RESERVED_AGENT_NAMES = /* @__PURE__ */ new Set([
+	"explore",
+	"plan",
+	"review",
+	"general"
+]);
+/** The name Command Code compares against its reserved list. */
+function toCommandcodeAgentName(name) {
+	return name.replace(/[^a-zA-Z0-9_-]/g, "_").toLowerCase();
+}
+/**
+* The subagent is still generated under the reserved name — the name is the
+* user's to change, and a rename here would make it diverge from the other
+* targets — but Command Code would drop it without a visible word, so say so
+* now (the same courtesy `VibeSkill` extends to its reserved skill names).
+*/
+function warnAboutReservedAgentName({ name, relativeFilePath, logger }) {
+	if (!COMMANDCODE_RESERVED_AGENT_NAMES.has(toCommandcodeAgentName(name))) return;
+	logger?.warn(`Command Code subagent ${relativeFilePath}: the name ${quoteValueForWarning(name)} is reserved for a Command Code built-in agent, so Command Code ignores a custom agent by that name when it loads agents. Rename the subagent for it to be available in Command Code.`);
+}
+/**
 * Command Code custom agent: a Markdown file with YAML frontmatter under
 * `.commandcode/agents/` (project) or `~/.commandcode/agents/` (user); the
 * body is the agent's system prompt.
@@ -64880,7 +65828,7 @@ var CommandcodeSubagent = class CommandcodeSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const commandcodeSection = rulesyncFrontmatter.commandcode ?? {};
 		const commandcodeSubagentFrontmatter = {
@@ -64888,6 +65836,11 @@ var CommandcodeSubagent = class CommandcodeSubagent extends ToolSubagent {
 			description: rulesyncFrontmatter.description,
 			...commandcodeSection
 		};
+		warnAboutReservedAgentName({
+			name: commandcodeSubagentFrontmatter.name,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			logger
+		});
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, commandcodeSubagentFrontmatter, { avoidBlockScalars: true });
 		const paths = this.getSettablePaths({ global });
@@ -71260,8 +72213,12 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 	* | `false`          | none      | not supported; the rule is dropped  |
 	*
 	* The default being `true` is the opposite of Cursor, which the adapter was
-	* modeled on: `paths` alone scopes nothing, so a rule meant to be path
-	* triggered has to carry an explicit `alwaysApply: false` alongside it.
+	* modeled on. The shipped loader (`@tencent-ai/codebuddy-code` 2.151.0,
+	* `dist/codebuddy.js`) is looser than the table — it resolves
+	* `alwaysApply = fm.alwaysApply === true || (!hasPaths && fm.alwaysApply !== false)`,
+	* so `paths` without `alwaysApply` is already MANUAL — but the explicit
+	* `alwaysApply: false` is written anyway: it is correct under both readings
+	* and the documented one is what a reader of the file goes by.
 	*
 	* @see https://www.codebuddy.ai/docs/cli/memory
 	*/
@@ -71336,9 +72293,9 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 			});
 		}
 		const sourcePaths = normalizeCodebuddyPaths(this.frontmatter.paths) ?? [];
-		const isAlways = this.frontmatter.alwaysApply !== false;
+		const isAlways = this.frontmatter.alwaysApply === true || sourcePaths.length === 0 && this.frontmatter.alwaysApply !== false;
 		const globs = sourcePaths.length === 0 && isAlways ? ["**/*"] : sourcePaths;
-		const alwaysApply = this.frontmatter.alwaysApply ?? (sourcePaths.length > 0 ? true : void 0);
+		const alwaysApply = this.frontmatter.alwaysApply;
 		const rulesyncFrontmatter = {
 			targets,
 			root: false,
@@ -76029,6 +76986,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold"
 		}
 	}],
+	["pool", {
+		class: PoolRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
+	}],
 	["qwencode", {
 		class: QwencodeRule,
 		meta: {
@@ -76152,15 +77118,6 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto"
 		}
 	}],
-	["pool", {
-		class: PoolRule,
-		meta: {
-			extension: "md",
-			supportsGlobal: true,
-			ruleDiscoveryMode: "auto",
-			collisionPolicy: "fold"
-		}
-	}],
 	["dsh", {
 		class: DshRule,
 		meta: {
@@ -79442,6 +80399,18 @@ Object.defineProperty(exports, "CODEXCLI_DIR", {
 		return CODEXCLI_DIR;
 	}
 });
+Object.defineProperty(exports, "COMMANDCODE_DIR", {
+	enumerable: true,
+	get: function() {
+		return COMMANDCODE_DIR;
+	}
+});
+Object.defineProperty(exports, "COMMANDCODE_SETTINGS_LOCAL_FILE_NAME", {
+	enumerable: true,
+	get: function() {
+		return COMMANDCODE_SETTINGS_LOCAL_FILE_NAME;
+	}
+});
 Object.defineProperty(exports, "CONFLICTING_TARGET_PAIRS", {
 	enumerable: true,
 	get: function() {