rulesync 16.34.2 → 16.36.0

package/dist/{import-DoCUTXaU.js → import-D_iukHSy.js}

@@ -515,6 +515,7 @@ const rulesProcessorToolTargetTuple = [
 	"musecode",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"replit",
@@ -528,7 +529,6 @@ const rulesProcessorToolTargetTuple = [
 	"zcode",
 	"zed",
 	"zoocode",
-	"pool",
 	"dsh"
 ];
 const ignoreProcessorToolTargetTuple = [
@@ -4053,24 +4053,60 @@ const CONTROL_CHARS = [
 const hasControlChars = (val) => CONTROL_CHARS.some((char) => val.includes(char));
 const safeString = z.pipe(z.string(), z.custom((val) => typeof val === "string" && !hasControlChars(val), "must not contain newline, carriage return, or NUL characters"));
 /**
+* All canonical hook types — the union of the `type` values accepted by every
+* supported tool:
+* - `command` — universal (Claude Code, Codex CLI, Qwen Code, Cursor, …)
+* - `prompt` — Claude Code, Codex CLI, Qwen Code, Copilot CLI, Cursor, Devin
+* - `http` — Claude Code, Qwen Code, Copilot CLI, Grok CLI
+* - `agent` — Claude Code, Codex CLI
+* - `mcp_tool` — Claude Code
+* - `function` — Qwen Code (internal Skill-system executor)
+*/
+const HOOK_TYPES = [
+	"command",
+	"prompt",
+	"http",
+	"agent",
+	"mcp_tool",
+	"function"
+];
+/**
+* One choice offered by a Kiro `confirm` prompt: `run` decides whether picking
+* it executes the hook command. The prompt text is written back into JSON,
+* never embedded in generated code, so it is a plain string.
+*/
+const HookConfirmOptionSchema = z.looseObject({
+	id: z.string(),
+	label: z.string(),
+	run: z.boolean()
+});
+/**
+* Kiro's confirmation prompt shown before a `Stop`-trigger command hook runs.
+* `confirmCommand` (optional, inside the block) names a command whose JSON
+* stdout drives the prompt at run time: `{ "skip": true }` suppresses it, a
+* replacement `question` / `options` object overrides the static prompt, and
+* on failure or timeout the static prompt is used. Stored verbatim: Kiro is
+* the only consumer, and it owns the shape.
+* https://kiro.dev/docs/hooks/
+*/
+const HookConfirmSchema = z.looseObject({
+	question: z.string(),
+	options: z.array(HookConfirmOptionSchema),
+	confirmCommand: z.optional(safeString)
+});
+/**
 * Canonical hook definition.
 * Used in .rulesync/hooks.jsonc and mapped to tool-specific formats.
 */
 const HookDefinitionSchema = z.looseObject({
 	command: z.optional(safeString),
-	type: z.optional(z.enum([
-		"command",
-		"prompt",
-		"http",
-		"agent",
-		"mcp_tool",
-		"function"
-	])),
+	type: z.optional(z.enum(HOOK_TYPES)),
 	url: z.optional(safeString),
 	timeout: z.optional(z.number()),
 	cacheTtl: z.optional(z.number().check(nonnegative())),
 	matcher: z.optional(safeString),
 	enabled: z.optional(z.boolean()),
+	confirm: z.optional(HookConfirmSchema),
 	prompt: z.optional(safeString),
 	loop_limit: z.optional(z.nullable(z.number())),
 	name: z.optional(safeString),
@@ -4091,6 +4127,10 @@ const HookDefinitionSchema = z.looseObject({
 	model: z.optional(safeString),
 	args: z.optional(z.array(safeString)),
 	metadata: z.optional(z.looseObject({})),
+	source: z.optional(z.looseObject({
+		source: safeString,
+		ref: z.optional(safeString)
+	})),
 	if: z.optional(safeString),
 	commandWindows: z.optional(safeString),
 	additionalContextLimit: z.optional(z.int().check(nonnegative())),
@@ -4344,9 +4384,13 @@ const AMP_HOOK_EVENTS = [
 * the platform the other one owns — see `generateClineHookScript` and
 * `generateClineHookPowerShellScript`.
 *
-* `TaskResume` and `TaskCancel` have no canonical counterpart and stay
-* unmapped rather than being approximated by `sessionEnd` / `stop`, whose
-* semantics differ.
+* `TaskCancel` is the shape of canonical `stopCancelled` (as Grok CLI's
+* `StopCancelled` and Codex CLI's `Interrupt` are): both runtimes fire it
+* *instead of* `TaskComplete` when the run ends aborted — the VS Code
+* extension from `afterRun` when the result status is `aborted`, the SDK/CLI
+* as `agent_abort` — and neither lets the script cancel anything. `TaskResume`
+* has no canonical counterpart and stays unmapped rather than being
+* approximated by `sessionStart`, whose semantics differ.
 *
 * @see https://github.com/cline/cline/blob/main/apps/vscode/src/core/hooks/utils.ts
 * @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/hooks/hook-file-config.ts
@@ -4360,7 +4404,8 @@ const CLINE_HOOK_EVENTS = [
 	"preCompact",
 	"notification",
 	"taskCompleted",
-	"afterError"
+	"afterError",
+	"stopCancelled"
 ];
 /**
 * Hook events supported by GitHub Copilot (cloud coding agent).
@@ -4678,23 +4723,32 @@ const QWENCODE_HOOK_EVENTS = [
 * Hook events supported by Reasonix.
 *
 * Reasonix's `.reasonix/settings.json` (project) / `~/.reasonix/settings.json`
-* (global) documents a ten-event surface (`PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit`, `Stop`, `PostLLMCall`, `SessionStart`, `SessionEnd`,
-* `SubagentStop`, `Notification`, `PreCompact`). All ten have a clean canonical
+* (global) accepts the thirteen events declared in `internal/hook/hook.go`
+* (`var Events`): `PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest`, `UserPromptSubmit`, `Stop`, `StopFailure`,
+* `PostLLMCall`, `SessionStart`, `SessionEnd`, `SubagentStop`, `Notification`,
+* `PreCompact`. The zh-CN desktop hooks page documents only ten of them, so the
+* source file is the authoritative list. All thirteen have a clean canonical
 * equivalent and are mapped: `PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit` ← `beforeSubmitPrompt`, `Stop`, `SessionStart`,
-* `SessionEnd`, `SubagentStop`, `PostLLMCall` ← `postModelInvocation`,
-* `Notification` ← `notification`, and `PreCompact` ← `preCompact`.
-* `match` (Reasonix's matcher field name) is honored only on
-* `PreToolUse`/`PostToolUse`, matching the canonical `matcher` field's
-* tool-event scoping used by other adapters.
+* `PostToolUseFailure`, `PermissionRequest`, `UserPromptSubmit` ←
+* `beforeSubmitPrompt`, `Stop`, `StopFailure`, `SessionStart`, `SessionEnd`,
+* `SubagentStop`, `PostLLMCall` ← `postModelInvocation`, `Notification` ←
+* `notification`, and `PreCompact` ← `preCompact`.
+* `match` (Reasonix's matcher field name) is honored on the four tool-scoped
+* events (`PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest` — `UsesToolMatcher` in `internal/hook/inspect.go`) and
+* ignored everywhere else.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 const REASONIX_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
+	"postToolUseFailure",
+	"permissionRequest",
 	"beforeSubmitPrompt",
 	"stop",
+	"stopFailure",
 	"sessionStart",
 	"sessionEnd",
 	"subagentStop",
@@ -4740,8 +4794,8 @@ const GROKCLI_HOOK_EVENTS = [
 * added in 0.32.0 (`TurnStarted`, `UserPromptQueued`, `TaskStarted`,
 * `SessionHeartbeat`), none of which is mapped onto a canonical rulesync event
 * here. `Interrupt` (fires instead of `Stop` when the user interrupts a turn)
-* does have a canonical shape — `stopCancelled`, which Grok CLI and Codex CLI
-* map — but Kimi keeps it native-only for now, since an existing `kimi-code`
+* does have a canonical shape — `stopCancelled`, which Grok CLI, Codex CLI and
+* Cline map — but Kimi keeps it native-only for now, since an existing `kimi-code`
 * override addressing it by name would otherwise double up with a canonical
 * `stopCancelled` block; folding it in is a follow-up. All six are listed in
 * `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override can
@@ -4851,10 +4905,12 @@ const ZCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONIC
 *
 * Bob reads `hooks` from `.bob/settings.json` (project) and
 * `~/.bob/settings/settings.json` (user) in the Claude-Code shape and fires
-* five events: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse and
-* Stop. Only `command` hooks exist, and `matcher` (a regex over the tool
-* name) applies to the two tool events.
+* seven events: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse,
+* PreCompact, PostCompact (both added by Bob Shell 2.0.3) and Stop. Handlers
+* are `command` or `https` hooks, and `matcher` (a regex over the tool name)
+* applies to the two tool events.
 *
+* @see https://bob.ibm.com/docs/shell/configuration/lifecycle-hooks
 * @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
 */
 const BOB_HOOK_EVENTS = [
@@ -4862,6 +4918,8 @@ const BOB_HOOK_EVENTS = [
 	"beforeSubmitPrompt",
 	"preToolUse",
 	"postToolUse",
+	"preCompact",
+	"postCompact",
 	"stop"
 ];
 const CANONICAL_TO_BOB_EVENT_NAMES = {
@@ -4869,6 +4927,8 @@ const CANONICAL_TO_BOB_EVENT_NAMES = {
 	beforeSubmitPrompt: "UserPromptSubmit",
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
+	preCompact: "PreCompact",
+	postCompact: "PostCompact",
 	stop: "Stop"
 };
 const BOB_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_BOB_EVENT_NAMES).map(([k, v]) => [v, k]));
@@ -5030,8 +5090,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 37 entries as
-* of v0.20.2 (`v2026.8.16`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
+* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5055,11 +5115,13 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.8.16` (v0.20.2): `VALID_HOOKS` holds 37
-* entries, grown from 23 at `v2026.8.3` (v0.20.0). This list holds 36 of them —
-* see {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
+* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
+* This list holds 38 of them — see
+* {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5085,8 +5147,10 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"subagent_start",
 	"subagent_stop",
 	"pre_gateway_dispatch",
+	"agent_loop_stopped",
 	"pre_approval_request",
 	"post_approval_response",
+	"on_room_member_activity",
 	"pre_transcription",
 	"kanban_task_claimed",
 	"kanban_task_completed",
@@ -5109,8 +5173,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -5411,7 +5475,8 @@ const CANONICAL_TO_CLINE_EVENT_NAMES = {
 	preCompact: "PreCompact",
 	notification: "Notification",
 	taskCompleted: "TaskComplete",
-	afterError: "TaskError"
+	afterError: "TaskError",
+	stopCancelled: "TaskCancel"
 };
 /**
 * Map canonical camelCase event names to Copilot camelCase.
@@ -5729,8 +5794,11 @@ const QWENCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
+	postToolUseFailure: "PostToolUseFailure",
+	permissionRequest: "PermissionRequest",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	stop: "Stop",
+	stopFailure: "StopFailure",
 	sessionStart: "SessionStart",
 	sessionEnd: "SessionEnd",
 	subagentStop: "SubagentStop",
@@ -7280,13 +7348,30 @@ const DeepagentsExtensionsOverrideSchema = z.looseObject({
 	]))
 });
 /**
+* The `[mcp]` table of `~/.deepagents/config.toml`, where dcode keeps its
+* per-server trust for the MCP servers a project's `.mcp.json` /
+* `.deepagents/.mcp.json` declares. dcode reads these lists from the user-level
+* file only — never from a project file — which is exactly why the global
+* permissions adapter is the place to author them.
+*
+* `disabled_project_servers` names project MCP servers dcode always rejects;
+* a rejection wins over any approval or trust. The sibling
+* `enabled_project_server_approvals` is the fingerprint-bound approval store
+* the interactive prompt fills in, and `enabled_project_servers` is a
+* deprecated flat allowlist dcode ignores, so neither has a key here.
+*
+* @see https://docs.langchain.com/oss/deepagents/code/configuration
+*/
+const DeepagentsMcpOverrideSchema = z.looseObject({ disabled_project_servers: z.optional(z.array(z.string())) });
+/**
 * The `[shell].allow_list` array itself is rulesync-owned, driven by the
 * shared `permission.bash` block, so it has no key here.
 */
 const DeepagentsPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
 	startup: z.optional(DeepagentsStartupOverrideSchema),
-	extensions: z.optional(DeepagentsExtensionsOverrideSchema)
+	extensions: z.optional(DeepagentsExtensionsOverrideSchema),
+	mcp: z.optional(DeepagentsMcpOverrideSchema)
 });
 /**
 * The actions Junie's allowlist accepts. Verified against the shipped Junie
@@ -7604,11 +7689,15 @@ const KiroPermissionsOverrideSchema = z.looseObject({
 });
 /**
 * Codex CLI's approval-workflow policy. Serialized as a kebab-case string in
-* `.codex/config.toml`. `on-failure` is a legacy alias for `on-request` that
-* Codex still accepts, so it is included so existing configs round-trip. The
-* granular table form (`{ granular = { … } }`) is modeled separately in the
-* override union.
+* `.codex/config.toml`. `on-failure` is a deprecated alias for `on-request`
+* that Codex still reads, so it stays accepted (generate warns) so existing
+* configs round-trip. `untrusted` was retired in Codex 0.149.0 and makes
+* Codex refuse to start; it stays in the enum only so an existing
+* `.rulesync/permissions.jsonc` still parses — generate warns and does not
+* write it, and import does not lift it. The granular table form
+* (`{ granular = { … } }`) is modeled separately in the override union.
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
+* @see https://github.com/openai/codex/pull/39630
 */
 const CodexApprovalPolicySchema = z.enum([
 	"untrusted",
@@ -7678,11 +7767,12 @@ const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
 *   selected directly via `default_permissions` and skips the managed profile
 *   entirely — canonical filesystem/network rules are ignored in that mode.
 *   Defaults to `:workspace` when unspecified.
-* - `approval_policy` — `untrusted` | `on-request` (legacy alias `on-failure`) |
+* - `approval_policy` — `on-request` (deprecated alias `on-failure`) |
 *   `never`, or a `{ granular = { … } }` table (kept verbatim; the granular
 *   schema has required fields that are brittle to model as typed keys).
 *   Defaults to `on-request` when neither the override nor the existing
-*   config sets it.
+*   config sets it. `untrusted` (retired in Codex 0.149.0) is still parsed
+*   but skipped with a warning on generate, since Codex refuses to start on it.
 * - `sandbox_mode` — **deprecated.** `read-only` | `workspace-write` |
 *   `danger-full-access`, with the sibling `sandbox_workspace_write` table
 *   (`network_access`, `writable_roots`, …). Codex has superseded the classic
@@ -9568,7 +9658,8 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	grokcli: z.optional(z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
-		"user-invocable": z.optional(z.boolean())
+		"user-invocable": z.optional(z.boolean()),
+		paths: z.optional(z.union([z.string(), z.array(z.string())]))
 	})),
 	dsh: z.optional(z.looseObject({
 		whenToUse: z.optional(z.string()),
@@ -9600,7 +9691,13 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		"user-invocable": z.optional(z.boolean()),
 		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 	})),
-	commandcode: z.optional(z.looseObject({})),
+	commandcode: z.optional(z.looseObject({
+		license: z.optional(z.string()),
+		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
+		metadata: z.optional(z.looseObject({})),
+		"disable-model-invocation": z.optional(z.boolean()),
+		"user-invocable": z.optional(z.boolean())
+	})),
 	cortexcode: z.optional(z.looseObject({})),
 	continue: z.optional(z.looseObject({})),
 	tabnine: z.optional(z.looseObject({})),
@@ -9789,8 +9886,32 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 		});
 	}
 };
-//#endregion
-//#region src/features/skills/skills-utils.ts
+const SKILL_DESCRIPTION_MAX_LENGTH = 1024;
+const SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Check a skill `name` against the length and character rules, phrased for the
+* `authority` that enforces them (e.g. "the Agent Skills spec" or "Zed"). When
+* that authority does something with a bad name beyond flagging it — Zed
+* refuses to load the skill — `consequence` names it so the warning says what
+* the author is about to lose. An empty name is the caller's concern: what it
+* means differs per consumer.
+*/
+function collectSkillNameViolations({ name, authority, consequence }) {
+	const violations = [];
+	if (name.length > 64) violations.push(`\`name\` is ${name.length} characters; ${authority} allows at most 64${consequence === void 0 ? "" : ` and ${consequence}`}`);
+	if (!SKILL_NAME_PATTERN.test(name)) violations.push(`\`name\` ${quoteForLog(name)} must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens${consequence === void 0 ? "" : `; ${authority} ${consequence}`}`);
+	return violations;
+}
+/**
+* Report each violation as a warning prefixed with the skill file it concerns.
+* The path is shown POSIX-style and stripped of control characters so a hostile
+* directory name cannot forge log lines; `warnWithFallback` keeps the report
+* visible when the caller has no logger to hand.
+*/
+function warnSkillViolations({ skillPath, violations, logger }) {
+	const shownPath = stripControlCharacters(toPosixPath(skillPath));
+	for (const violation of violations) warnWithFallback(logger, `${shownPath}: ${violation}`);
+}
 /**
 * Whether a directory on disk can be addressed by its name.
 *
@@ -9844,7 +9965,7 @@ async function getLocalSkillDirNames(sourceTree) {
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid, dsh). Each tool's own section may override that
+* copilotcli, crush, cursor, zed, pi, qwencode, grokcli, factorydroid, dsh, commandcode). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -9863,7 +9984,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, copilot,
-* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh). Each tool's own section may override that default with a
+* copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh, commandcode). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -10614,10 +10735,13 @@ const AmpCheckFrontmatterSchema = z.looseObject({
 /**
 * Represents an Amp code review check.
 *
-* Amp natively reads code review checks as Markdown files with YAML frontmatter,
-* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`).
-* Each check runs as a per-check subagent during code review.
-* @see https://ampcode.com/manual
+* Amp reads code review checks as Markdown files with YAML frontmatter,
+* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`;
+* Amp also reads `~/.config/agents/checks/`, which rulesync does not write).
+* Since the docs rebuild the supported runner is the official
+* `@amp/review-checks` plugin (`amp review` is deprecated); existing checks in
+* this format continue to apply.
+* @see https://ampcode.com/docs/review
 */
 var AmpCheck = class AmpCheck extends ToolCheck {
 	frontmatter;
@@ -15431,6 +15555,7 @@ var CodexcliCommand = class CodexcliCommand extends ToolCommand {
 const COMMANDCODE_DIR = ".commandcode";
 const COMMANDCODE_RULE_FILE_NAME = "AGENTS.md";
 const COMMANDCODE_SETTINGS_FILE_NAME = "settings.json";
+const COMMANDCODE_SETTINGS_LOCAL_FILE_NAME = "settings.local.json";
 const COMMANDCODE_PROJECT_MCP_FILE_NAME = ".mcp.json";
 const COMMANDCODE_GLOBAL_MCP_FILE_NAME = "mcp.json";
 const COMMANDCODE_COMMANDS_DIR_PATH = join(COMMANDCODE_DIR, "commands");
@@ -16856,10 +16981,8 @@ const AgentsSkillsSkillFrontmatterSchema = z.looseObject({
 	metadata: z.optional(z.looseObject({})),
 	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 });
-const NAME_MAX_LENGTH = 64;
-const DESCRIPTION_MAX_LENGTH = 1024;
 const COMPATIBILITY_MAX_LENGTH = 500;
-const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const AGENT_SKILLS_SPEC = "the Agent Skills spec";
 /**
 * Placeholder for an object that has already been encoded once in the same
 * value. YAML anchors let one document reference the same node repeatedly, and
@@ -17023,12 +17146,14 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 	const { name, description } = frontmatter;
 	if (name.length === 0) violations.push("`name` is required and must not be empty");
 	else {
-		if (name.length > NAME_MAX_LENGTH) violations.push(`\`name\` is ${name.length} characters; the Agent Skills spec allows at most ${NAME_MAX_LENGTH}`);
-		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
+		violations.push(...collectSkillNameViolations({
+			name,
+			authority: AGENT_SKILLS_SPEC
+		}));
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
 	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
-	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
+	else if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${AGENT_SKILLS_SPEC} allows at most ${SKILL_DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
 	else if (compatibility !== void 0 && compatibility.length > COMPATIBILITY_MAX_LENGTH) violations.push(`\`compatibility\` is ${compatibility.length} characters; the Agent Skills spec allows at most ${COMPATIBILITY_MAX_LENGTH}`);
@@ -17146,16 +17271,19 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = agentSkillFilePath({
-			outputRoot,
-			relativeDirPath,
-			dirName
+		warnSkillViolations({
+			skillPath: agentSkillFilePath({
+				outputRoot,
+				relativeDirPath,
+				dirName
+			}),
+			violations: collectAgentSkillViolations({
+				frontmatter,
+				dirName,
+				sourceAllowedTools
+			}),
+			logger
 		});
-		for (const violation of collectAgentSkillViolations({
-			frontmatter,
-			dirName,
-			sourceAllowedTools
-		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -17795,6 +17923,15 @@ const KiloCommandFrontmatterSchema = z.looseObject({
 	model: z.optional(z.string()),
 	variant: z.optional(z.string())
 });
+/**
+* Command names Kilo keeps for itself. Its loader throws on a custom command
+* file named `goal.md` in either the project or the global directory ("The
+* /goal command is reserved for session goals. Rename the custom command."),
+* and a throw there aborts the whole command scan — every other custom
+* command becomes unreachable too, not only the reserved one.
+* https://github.com/Kilo-Org/kilocode/blob/v7.6.2/packages/opencode/src/command/index.ts
+*/
+const KILO_RESERVED_COMMAND_NAMES = /* @__PURE__ */ new Set(["goal"]);
 var KiloCommand = class KiloCommand extends ToolCommand {
 	frontmatter;
 	body;
@@ -17837,6 +17974,20 @@ var KiloCommand = class KiloCommand extends ToolCommand {
 			validate: true
 		});
 	}
+	/**
+	* Refuse to write a command Kilo reserves (see
+	* {@link KILO_RESERVED_COMMAND_NAMES}). The name Kilo loads is the file
+	* stem, and the processor calls this on the flattened path, so `goal.md`
+	* is refused at any nesting depth under the basename naming and only at the
+	* top level under the path naming, where `git/goal.md` becomes `git-goal`.
+	* Import is untouched: a `goal.md` already in `.kilo/commands/` is read as
+	* it is, since the reservation is Kilo's to enforce on its own files.
+	*/
+	static getWriteBlockReason({ rulesyncCommand }) {
+		const stem = basename(rulesyncCommand.getRelativeFilePath(), ".md");
+		if (!KILO_RESERVED_COMMAND_NAMES.has(stem)) return null;
+		return `Kilo reserves the /${stem} command for session goals and refuses to load a custom command by that name — it would abort Kilo's whole command scan, making every other custom command unreachable too. Rename the command, or exclude it from this target with \`targets\`.`;
+	}
 	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
 		const kiloFields = rulesyncFrontmatter.kilo ?? {};
@@ -20059,6 +20210,14 @@ var CommandsProcessor = class extends FeatureProcessor {
 			if (!factory.class.isTargetedByRulesyncCommand(rulesyncCommand)) return null;
 			const originalRelativePath = rulesyncCommand.getRelativeFilePath();
 			const commandToConvert = factory.meta.supportsSubdirectory ? rulesyncCommand : this.flattenRelativeFilePath(rulesyncCommand);
+			const writeBlockReason = factory.class.getWriteBlockReason?.({
+				rulesyncCommand: commandToConvert,
+				global: this.global
+			});
+			if (writeBlockReason !== void 0 && writeBlockReason !== null) {
+				this.logger.warn(`Skipping command ${quoteForLog(originalRelativePath)} for '${this.toolTarget}': ${writeBlockReason}`);
+				return null;
+			}
 			if (!factory.meta.supportsSubdirectory) {
 				const flattenedPath = commandToConvert.getRelativeFilePath();
 				const firstOrigin = flattenedPathOrigins.get(flattenedPath);
@@ -20645,6 +20804,18 @@ function isToolMatcherEntry(x) {
 	return true;
 }
 /**
+* Convert a canonical `timeout` (seconds) into the tool's unit.
+*/
+function emitTimeout({ timeout, converterConfig }) {
+	return converterConfig.timeoutUnit === "milliseconds" && Number.isFinite(timeout) ? Math.round(timeout * 1e3) : timeout;
+}
+/**
+* Convert a tool `timeout` back into the canonical unit (seconds).
+*/
+function importTimeout({ timeout, converterConfig }) {
+	return converterConfig.timeoutUnit === "milliseconds" && Number.isFinite(timeout) ? timeout / 1e3 : timeout;
+}
+/**
 * Filter the shared canonical hooks to the supported events and merge tool overrides on top.
 */
 function buildEffectiveHooks$1({ config, toolOverrideHooks, supportedEvents }) {
@@ -20785,6 +20956,7 @@ const isEmittableString = ({ value }) => isNonEmptyString(value);
 const isEmittableArray = ({ value }) => isStringArray$1(value);
 const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
 const isImportableArray = ({ value }) => isSafeStringArray(value);
+const isEmittableObject = ({ value }) => isPlainObject$1(value);
 /**
 * The canonical schema of one hook field, looked up by name. Read off the
 * schema's own shape rather than by parsing a one-field object, so a `canonical`
@@ -20819,11 +20991,17 @@ const isImportableNumber = ({ value, canonical }) => Number.isFinite(value) && s
 	value,
 	canonical
 });
+const isImportableObject = ({ value, canonical }) => isPlainObject$1(value) && satisfiesCanonicalField({
+	value,
+	canonical
+});
 /**
 * Say which rule the value broke, so the warning names the actual constraint
 * rather than asserting a canonical rejection that may not be the reason. A
 * closed enum lists its members; a rule carrying its own message (the
-* control-character check behind `safeString`) reuses it.
+* control-character check behind `safeString`) reuses it. An object field
+* names the offending key, since zod's generic "Invalid input" would not tell
+* the reader which key is missing or malformed.
 */
 function describeScalarConstraint({ canonical, value }) {
 	const schema = canonicalFieldSchema(canonical);
@@ -20831,13 +21009,22 @@ function describeScalarConstraint({ canonical, value }) {
 	if (result === void 0 || result.success) return `it is not a value this field carries through.`;
 	const issue = result.error.issues[0];
 	if (issue === void 0) return `it is not a value the canonical "${canonical}" field accepts.`;
-	return `it does not satisfy the canonical "${canonical}" field: ${issue.message}.`;
+	return `it does not satisfy the canonical "${canonical}" field${issue.path.length > 0 ? ` at ${quoteValueForWarning(issue.path.map(String).join("."))}` : ""}: ${issue.message}.`;
 }
 const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${quoteValueForWarning(value)}) while importing a hook: ${describeScalarConstraint({
 	canonical,
 	value
 })} Importing it would fail validation on the next run.`;
 const describeInvalidArray = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a list of strings without newline, carriage return or NUL characters.`;
+/**
+* An object is quoted by its offending key rather than its value: the payload
+* can be arbitrarily large, and the missing or malformed key is what the
+* reader needs to fix.
+*/
+const describeInvalidObject = ({ tool, canonical, value }) => isPlainObject$1(value) ? `Dropping "${tool}" while importing a hook: ${describeScalarConstraint({
+	canonical,
+	value
+})} Importing it would fail validation on the next run.` : `Dropping "${tool}" while importing a hook: it must be an object.`;
 const describeInvalidRecord = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a map of strings whose keys are non-empty and free of "=", and whose keys and values carry no newline, carriage return or NUL characters.`;
 /**
 * Check a value against the shape its field documents. A string field also
@@ -20900,6 +21087,72 @@ function isSupportedHookType({ type, converterConfig }) {
 	return converterConfig.supportedHookTypes?.has(type ?? "command") ?? true;
 }
 /**
+* Whether a keyword field applies to this hook, warning about the reason when
+* it does not. Shared by both directions: the field is unusable on the tool
+* side either way, so the value is dropped rather than carried into a config
+* the tool would ignore or refuse.
+*/
+function isKeywordFieldApplicable({ spec, hookType, eventName, direction, warn }) {
+	const { canonical, tool, commandOnly, events } = spec;
+	const field = direction === "generated" ? canonical : tool;
+	if (!isFieldApplicable({
+		commandOnly,
+		hookType
+	})) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not ${direction}.`);
+		return false;
+	}
+	if (events !== void 0 && !events.has(eventName)) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		return false;
+	}
+	return true;
+}
+/**
+* Emit the keyword passthrough fields: a canonical `true` becomes the tool's
+* keyword, while `false` is omitted as the tool's own default. A `true` the
+* tool would not honour on this hook is warned about, like the other kinds;
+* a `false` there is dropped silently, since omitting it changes nothing.
+*/
+function emitKeywordFields({ def, hookType, eventName, fields, warn }) {
+	const emitted = {};
+	for (const spec of fields) {
+		if (def[spec.canonical] !== true) continue;
+		if (isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "generated",
+			warn
+		})) emitted[spec.tool] = spec.trueValue;
+	}
+	return emitted;
+}
+/**
+* Import the keyword passthrough fields back into canonical booleans,
+* reversing {@link emitKeywordFields}. Only the two documented keywords are
+* read; anything else is warned about and dropped, so a typo in a hand-written
+* tool file never lands in `.rulesync/hooks.*` as a boolean it did not mean.
+*/
+function importKeywordFields({ h, hookType, eventName, fields, warn }) {
+	const imported = {};
+	for (const spec of fields) {
+		const value = h[spec.tool];
+		if (value === void 0) continue;
+		if (!isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "imported",
+			warn
+		})) continue;
+		if (value === spec.trueValue) imported[spec.canonical] = true;
+		else if (spec.falseValue !== void 0 && value === spec.falseValue) imported[spec.canonical] = false;
+		else warn?.(`Dropping "${spec.tool}" from an imported "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool documents for it.`);
+	}
+	return imported;
+}
+/**
 * Emit every per-hook passthrough kind for one canonical definition.
 */
 function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, warn }) {
@@ -20912,6 +21165,13 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 			isValid: isBooleanValue,
 			warn
 		}),
+		...emitKeywordFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...emitPassthroughFields({
 			def,
 			hookType,
@@ -20943,6 +21203,14 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 			fields: converterConfig.recordPassthroughFields ?? [],
 			isValid: isEmittableRecord,
 			warn
+		}),
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.objectPassthroughFields ?? [],
+			isValid: isEmittableObject,
+			warn
 		})
 	};
 }
@@ -20966,9 +21234,12 @@ function buildToolHooks({ defs, eventName, converterConfig, warn }) {
 				converterConfig,
 				warn
 			}),
-			type: hookType,
+			type: converterConfig.hookTypeNames?.[hookType] ?? hookType,
 			...command !== void 0 && command !== null && { command },
-			...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout },
+			...def.timeout !== void 0 && def.timeout !== null && { timeout: emitTimeout({
+				timeout: def.timeout,
+				converterConfig
+			}) },
 			...def.prompt !== void 0 && def.prompt !== null && { prompt: def.prompt },
 			...emitTypePayloadFields({
 				def,
@@ -21090,6 +21361,20 @@ const IMPORTED_HOOK_TYPES = /* @__PURE__ */ new Set([
 function isImportedHookType(value) {
 	return typeof value === "string" && IMPORTED_HOOK_TYPES.has(value);
 }
+/**
+* The canonical hook type a tool-side `type` value denotes: the tool's own
+* spelling from {@link ToolHooksConverterConfig.hookTypeNames} when it has
+* one, otherwise the value itself when it is a canonical type, and `command`
+* for anything else (the same coercion as before the renames existed).
+*/
+function resolveImportedHookType({ value, converterConfig }) {
+	const names = converterConfig.hookTypeNames;
+	if (names !== void 0 && typeof value === "string") {
+		for (const [canonical, tool] of Object.entries(names)) if (tool === value) return canonical;
+		if (Object.hasOwn(names, value)) return "command";
+	}
+	return isImportedHookType(value) ? value : "command";
+}
 function isStringRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	return Object.values(value).every((v) => typeof v === "string");
@@ -21215,7 +21500,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 * Import every per-hook passthrough kind for one tool hook record, reversing
 * the emit side in {@link buildToolHooks}.
 */
-function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
+function importAllPassthroughFields({ h, hookType, eventName, converterConfig, warn }) {
 	return {
 		...importPassthroughFields({
 			h,
@@ -21224,6 +21509,13 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 			isValid: isBooleanValue,
 			warn
 		}),
+		...importKeywordFields({
+			h,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...importPassthroughFields({
 			h,
 			hookType,
@@ -21255,14 +21547,25 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 			isValid: isEmittableRecord,
 			describeInvalid: describeInvalidRecord,
 			warn
+		}),
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.objectPassthroughFields ?? [],
+			isValid: isImportableObject,
+			describeInvalid: describeInvalidObject,
+			warn
 		})
 	};
 }
 /**
 * Convert a single tool hook record into a canonical hook definition.
 */
-function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
-	const hookType = isImportedHookType(h.type) ? h.type : "command";
+function toolHookToCanonical({ h, rawEntry, eventName, converterConfig, warn }) {
+	const hookType = resolveImportedHookType({
+		value: h.type,
+		converterConfig
+	});
 	const command = importCanonicalString({
 		value: stripCommandPrefix({
 			command: h.command,
@@ -21271,7 +21574,10 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 		canonical: "command",
 		warn
 	});
-	const timeout = typeof h.timeout === "number" ? h.timeout : void 0;
+	const timeout = typeof h.timeout === "number" ? importTimeout({
+		timeout: h.timeout,
+		converterConfig
+	}) : void 0;
 	const prompt = importCanonicalString({
 		value: h.prompt,
 		canonical: "prompt",
@@ -21303,6 +21609,7 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 		...importAllPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			converterConfig,
 			warn
 		}),
@@ -21389,7 +21696,7 @@ function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
 /**
 * Convert a single tool matcher entry into canonical hook definitions.
 */
-function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
+function toolMatcherEntryToCanonical({ rawEntry, eventName, converterConfig, warn }) {
 	const hookDefs = rawEntry.hooks ?? [];
 	const groupSkipReason = describeGroupSkipReason({
 		rawEntry,
@@ -21404,7 +21711,10 @@ function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
 		const skipReason = describeHookSkipReason({
 			h,
 			rawEntry,
-			hookType: isImportedHookType(h.type) ? h.type : "command",
+			hookType: resolveImportedHookType({
+				value: h.type,
+				converterConfig
+			}),
 			converterConfig
 		});
 		if (skipReason !== void 0) {
@@ -21414,6 +21724,7 @@ function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
 		definitions.push(toolHookToCanonical({
 			h,
 			rawEntry,
+			eventName,
 			converterConfig,
 			warn
 		}));
@@ -21461,6 +21772,7 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 			if (!isToolMatcherEntry(rawEntry)) continue;
 			defs.push(...toolMatcherEntryToCanonical({
 				rawEntry,
+				eventName,
 				converterConfig,
 				warn
 			}));
@@ -21889,6 +22201,7 @@ const AUGMENTCODE_CONVERTER_CONFIG = {
 		"beforeSubmitPrompt"
 	]),
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	timeoutUnit: "milliseconds",
 	arrayPassthroughFields: [{
 		canonical: "args",
 		tool: "args"
@@ -22487,9 +22800,12 @@ const BOB_SPEC = {
 		noMatcherEvents: /* @__PURE__ */ new Set([
 			"sessionStart",
 			"beforeSubmitPrompt",
+			"preCompact",
+			"postCompact",
 			"stop"
 		]),
-		supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+		supportedHookTypes: /* @__PURE__ */ new Set(["command", "http"]),
+		hookTypeNames: { http: "https" },
 		wildcardMatcherMeansAll: true
 	}
 };
@@ -22500,10 +22816,13 @@ const BOB_SPEC = {
 * `<project>/.bob/settings.json` (project scope) and
 * `~/.bob/settings/settings.json` (user scope) — in the Claude-Code shape:
 * `{ "<Event>": [{ "matcher"?: "<regex>", "hooks": [{ "type": "command",
-* "command": "...", "timeout"?: <seconds> }] }] }`. The file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into it
-* (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting the file.
+* "command": "...", "timeout"?: <seconds> }] }] }`, where a handler may
+* instead be `{ "type": "https", "url": "...", "timeout"?: <seconds> }`. The
+* file also holds settings rulesync does not own, so generation merges the
+* `hooks` key into it (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting
+* the file.
 *
+* @see https://bob.ibm.com/docs/shell/configuration/lifecycle-hooks
 * @see https://bob.ibm.com/docs/ide/configuration/lifecycle-hooks
 */
 var BobHooks = class extends SettingsJsonHooks {
@@ -23933,6 +24252,11 @@ const CORTEXCODE_SPEC = {
 		booleanPassthroughFields: [{
 			canonical: "enabled",
 			tool: "enabled"
+		}],
+		objectPassthroughFields: [{
+			canonical: "source",
+			tool: "source",
+			commandOnly: true
 		}]
 	}
 };
@@ -23943,8 +24267,9 @@ const CORTEXCODE_SPEC = {
 * (project scope) and of the dedicated `~/.snowflake/cortex/hooks.json` (user
 * scope), both in the Claude-Code shape: `{ "<Event>": [{ "matcher"?:
 * "<regex>", "hooks": [{ "type": "command" | "prompt", ..., "timeout"?:
-* <seconds>, "enabled"?: <boolean> }] }] }`. The project file also holds
-* settings rulesync does not own, so generation merges the `hooks` key into
+* <seconds>, "enabled"?: <boolean>, "source"?: { "source", "ref"? } }] }] }`.
+* The project file also holds settings rulesync does not own, so generation
+* merges the `hooks` key into
 * either file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it, and
 * neither file is removed wholesale (hooks.json sits in the CLI-owned
 * `~/.snowflake/cortex/` tree).
@@ -25068,7 +25393,15 @@ const GOOSE_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: GOOSE_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
+	wildcardMatcherMeansAll: true,
+	keywordPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "on_failure",
+		trueValue: "block",
+		falseValue: "allow",
+		commandOnly: true,
+		events: /* @__PURE__ */ new Set(["preToolUse"])
+	}]
 };
 /**
 * Represents a Goose lifecycle hooks file.
@@ -25377,7 +25710,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.2; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -26257,7 +26590,8 @@ const KiroIdeHookEntrySchema = z.looseObject({
 	matcher: z.optional(z.string()),
 	action: z.optional(KiroIdeHookActionSchema),
 	timeout: z.optional(z.number()),
-	enabled: z.optional(z.boolean())
+	enabled: z.optional(z.boolean()),
+	confirm: z.optional(HookConfirmSchema)
 });
 const KiroIdeHooksFileSchema = z.looseObject({
 	version: z.optional(z.string()),
@@ -26296,7 +26630,8 @@ function buildKiroIdeEntriesForEvent(trigger, definitions) {
 			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
 			action,
 			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
-			enabled: def.enabled ?? true
+			enabled: def.enabled ?? true,
+			...def.confirm !== void 0 && { confirm: def.confirm }
 		});
 	}
 	return entries;
@@ -26338,6 +26673,14 @@ function canonicalToKiroIdeHooks(config) {
 	}
 	return entries;
 }
+/**
+* Copies the optional per-hook fields (`enabled`, `confirm`) back onto the
+* canonical definition.
+*/
+function copyOptionalHookFields({ entry, def }) {
+	if (entry.enabled === false) def.enabled = false;
+	if (entry.confirm !== void 0 && entry.confirm !== null) def.confirm = omitPrototypePollutionKeysDeep(entry.confirm);
+}
 function kiroIdeHooksToCanonical(entries) {
 	const canonical = {};
 	for (const entry of entries) {
@@ -26361,7 +26704,10 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
-		if (entry.enabled === false) def.enabled = false;
+		copyOptionalHookFields({
+			entry,
+			def
+		});
 		const list = lookupOwn({
 			record: canonical,
 			key: eventName
@@ -27368,10 +27714,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/reasonix-hooks.ts
 /**
-* Only PreToolUse/PostToolUse honor the `match` field (an anchored regex
-* against the tool name); it is ignored on every other event.
+* Only the tool-scoped events honor the `match` field (an anchored regex
+* against the tool name); it is ignored on every other event. Mirrors
+* `UsesToolMatcher` in upstream `internal/hook/inspect.go`.
 */
-const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"PreToolUse",
+	"PostToolUse",
+	"PostToolUseFailure",
+	"PermissionRequest"
+]);
 const SUPPORTED_REASONIX_EVENTS = new Set(REASONIX_HOOK_EVENTS);
 /**
 * Convert canonical hooks config to the Reasonix `hooks` object.
@@ -27453,9 +27805,11 @@ function reasonixHooksToCanonical(hooks) {
 * Reasonix hooks live in a Claude-Code-style but standalone JSON file —
 * `.reasonix/settings.json` (project) or `~/.reasonix/settings.json`
 * (global) — separate from the `[permissions]`/`[[plugins]]` TOML config.
-* All ten upstream events have a clean canonical equivalent and are mapped:
-* PreToolUse/PostToolUse/UserPromptSubmit/Stop plus SessionStart/SessionEnd/
-* SubagentStop/PostLLMCall/Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* All thirteen upstream events have a clean canonical equivalent and are mapped:
+* PreToolUse/PostToolUse/PostToolUseFailure/PermissionRequest/UserPromptSubmit/
+* Stop/StopFailure plus SessionStart/SessionEnd/SubagentStop/PostLLMCall/
+* Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 var ReasonixHooks = class ReasonixHooks extends ToolHooks {
@@ -28281,6 +28635,23 @@ const PER_HOOK_ENABLED_TARGETS = /* @__PURE__ */ new Set([
 	"kiro-ide",
 	"zcode"
 ]);
+/** The targets whose hooks format carries the Kiro `confirm` prompt. */
+const PER_HOOK_CONFIRM_TARGETS = /* @__PURE__ */ new Set(["kiro-cli", "kiro-ide"]);
+/**
+* Names the shared events that carry a hook whose canonical definition
+* satisfies `predicate`, excluding events the target skips altogether (those
+* are already reported as skipped and produce no output, so warning about them
+* again would contradict that message).
+*/
+function emittedEventsWithHook(params) {
+	const { factory, sharedHooks, effectiveHooks, predicate } = params;
+	const skippedEvents = new Set(unsupportedEventNames({
+		factory,
+		sharedHooks,
+		effectiveHooks
+	}));
+	return Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => predicate(def))).map(([event]) => event);
+}
 const toolHooksFactories = /* @__PURE__ */ new Map([
 	["amp", {
 		class: AmpHooks,
@@ -28590,7 +28961,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		supportedEvents: BOB_HOOK_EVENTS,
-		supportedHookTypes: ["command"],
+		supportedHookTypes: ["command", "http"],
 		supportsMatcher: true,
 		matcherEvents: ["preToolUse", "postToolUse"]
 	}],
@@ -28851,15 +29222,11 @@ var HooksProcessor = class extends FeatureProcessor {
 			}
 			for (const [hookType, events] of unsupportedTypeToEvents) this.logger.warn(`Skipped ${hookType}-type hook(s) for ${this.toolTarget} (not supported): ${Array.from(events).join(", ")}`);
 		}
-		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
-			const skippedEvents = new Set(unsupportedEventNames({
-				factory,
-				sharedHooks,
-				effectiveHooks
-			}));
-			const eventsWithDisabledHooks = Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => def.enabled === false)).map(([event]) => event);
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
-		}
+		this.warnAboutDroppedPerHookFields({
+			factory,
+			sharedHooks,
+			effectiveHooks
+		});
 		const eventsWithUnsupportedMatcher = unsupportedMatcherEventNames({
 			factory,
 			effectiveHooks
@@ -28889,6 +29256,33 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (auxiliaryFiles && auxiliaryFiles.length > 0) result.push(...auxiliaryFiles);
 		return result;
 	}
+	/**
+	* Warns about canonical per-hook fields that this target's hooks format
+	* cannot express, so a hook does not silently change behavior on generation.
+	* Only canonical definitions are considered: a tool-native field inside an
+	* override block is passed through verbatim and honored by that tool.
+	*/
+	warnAboutDroppedPerHookFields(params) {
+		const { factory, sharedHooks, effectiveHooks } = params;
+		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
+			const eventsWithDisabledHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.enabled === false
+			});
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
+		}
+		if (!PER_HOOK_CONFIRM_TARGETS.has(this.toolTarget)) {
+			const eventsWithConfirmHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.confirm !== void 0
+			});
+			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the kiro-cli / kiro-ide hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
+		}
+	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
 		const hooks = toolFiles.filter((f) => f instanceof ToolHooks);
 		const logger = withToolTargetPrefix({
@@ -31404,6 +31798,50 @@ function parseBobMcpConfig({ fileContent, relativePath }) {
 /** The `type` Bob IDE writes for a streamable HTTP server. */
 const BOB_STREAMABLE_HTTP_TYPE = "streamable-http";
 /**
+* The OAuth keys Bob reads flat on a server entry, next to `oauth` (a
+* boolean: `true` forces the flow on, `false` off, absent lets Bob detect it).
+* The canonical shape is Claude Code's nested `oauth: { clientId, ... }`
+* object, so the two are translated in both directions.
+* @see https://bob.ibm.com/docs/ide/configuration/mcp/mcp-oauth
+*/
+const BOB_FLAT_OAUTH_KEYS = [
+	"clientId",
+	"clientSecret",
+	"scope"
+];
+/**
+* Flatten the canonical `oauth` object onto a Bob server entry: `oauth: true`
+* plus the string-valued keys Bob documents. A flat key the server already
+* carries (authored in Bob's own spelling) is kept over the nested one. Other
+* nested keys (`callbackPort`, `redirectUri`) have no Bob counterpart and are
+* dropped rather than nested under a key Bob reads as a boolean.
+*/
+function flattenOauthForBob({ oauth, converted }) {
+	converted.oauth = true;
+	for (const key of BOB_FLAT_OAUTH_KEYS) {
+		const value = oauth[key];
+		if (typeof value === "string" && converted[key] === void 0) converted[key] = value;
+	}
+}
+/**
+* Reverse of {@link flattenOauthForBob}: gather Bob's flat OAuth keys into the
+* canonical `oauth` object. `oauth: true` always folds (even with no keys, so
+* the explicit enable survives the round-trip as an empty object); with no
+* `oauth` key at all the fold happens only when a flat key is present, since
+* that is what makes the entry an OAuth one for Bob; `oauth: false` and
+* anything else leave the entry as it is.
+*/
+function nestOauthFromBob(converted) {
+	const flat = BOB_FLAT_OAUTH_KEYS.filter((key) => typeof converted[key] === "string");
+	if (!(converted.oauth === true || converted.oauth === void 0 && flat.length > 0)) return;
+	const oauth = {};
+	for (const key of flat) {
+		oauth[key] = converted[key];
+		delete converted[key];
+	}
+	converted.oauth = oauth;
+}
+/**
 * The remote transport Bob IDE reads a server as, spelled the way it writes
 * it: `streamable-http` needs an explicit `type`, while SSE (legacy) is a bare
 * `url` with no `type`. `http` is the canonical rulesync alias for streamable
@@ -31426,7 +31864,9 @@ function asBobRemoteType(stated, url) {
 * `headers`, `timeout`, `alwaysAllow` and `disabled` pass through, as Bob
 * documents all of them, with prototype-pollution keys dropped at every
 * nesting level (Bob spreads `env` and `headers` into the process environment
-* and the HTTP requests).
+* and the HTTP requests). The canonical `oauth` object is flattened onto the
+* entry as `oauth: true` plus `clientId` / `clientSecret` / `scope`, the keys
+* Bob reads; a boolean `oauth` passes through as Bob's own on/off switch.
 *
 * Bob Shell documents the same file with an `httpURL` key instead of
 * `type` + `url` for streamable HTTP. rulesync writes the IDE spelling (the two
@@ -31492,10 +31932,16 @@ function convertToBobFormat(mcpServers, logger) {
 			converted.command = command;
 			if (args.length > 0) converted.args = args;
 		}
-		for (const [key, value] of Object.entries(rest)) {
+		const { oauth, ...passthrough } = rest;
+		for (const [key, value] of Object.entries(passthrough)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			converted[key] = omitPrototypePollutionKeysDeep(value);
 		}
+		if (isRecord$1(oauth)) flattenOauthForBob({
+			oauth,
+			converted
+		});
+		else if (oauth !== void 0) converted.oauth = oauth;
 		result[serverName] = converted;
 	}
 	return result;
@@ -31505,9 +31951,10 @@ function convertToBobFormat(mcpServers, logger) {
 * (`type: "streamable-http"` + `url`) is already canonical and passes through;
 * the Bob Shell spelling `httpURL` becomes `url` with `type: "http"`; a bare
 * `url` is an SSE server in Bob, so it gains `type: "sse"` to keep that reading
-* on the next generate. Every other field passes through with its
-* prototype-pollution keys dropped at every nesting level, mirroring the
-* generate side's handling of `env` / `headers`.
+* on the next generate. Bob's flat OAuth keys are gathered back into the
+* canonical `oauth` object (see {@link nestOauthFromBob}). Every other field
+* passes through with its prototype-pollution keys dropped at every nesting
+* level, mirroring the generate side's handling of `env` / `headers`.
 */
 function convertFromBobFormat(mcpServers) {
 	if (!isMcpServers(mcpServers)) return {};
@@ -31528,6 +31975,7 @@ function convertFromBobFormat(mcpServers) {
 			converted.url = httpURL;
 			converted.type = "http";
 		} else if (typeof converted.url === "string" && converted.type === void 0) converted.type = "sse";
+		nestOauthFromBob(converted);
 		result[serverName] = converted;
 	}
 	return result;
@@ -32552,7 +33000,10 @@ function asContinueRemoteType(stated, url) {
 * file with a strict union — one server that matches neither shape (an
 * unknown transport, a non-string `env` value) makes Continue drop every
 * server in the file — so only the documented keys are emitted and anything
-* else (`timeout`, `oauth`, rulesync-only fields) is left out. `envFile` is
+* else is left out. The canonical keys a user would expect to take effect
+* (`cwd`, `timeout`, `oauth`) are dropped with a warning, since the JSON
+* schema has no place for them (the YAML block form does, but Rulesync writes
+* the JSON file); rulesync-only fields are dropped silently. `envFile` is
 * accepted by Continue's schema but ignored with a warning at load time, so
 * it is dropped here with a warning instead of being written as if it worked.
 *
@@ -32588,6 +33039,17 @@ function convertToContinueFormat(mcpServers, logger) {
 	}
 	return result;
 }
+/**
+* Warn for each canonical key Continue's JSON MCP schema cannot carry, so a
+* dropped `cwd`, `timeout` or `oauth` does not go unnoticed in a config that
+* otherwise looks complete.
+*/
+function warnUnsupportedContinueKeys({ serverName, serverConfig, keys, logger }) {
+	for (const key of keys) {
+		if (serverConfig[key] === void 0) continue;
+		logger?.warn(`Continue's MCP config has no "${key}" field, so the ${key} of server ${quoteValueForWarning(serverName)} was not written.`);
+	}
+}
 function convertRemoteServer({ serverName, serverConfig, logger }) {
 	const url = resolveRemoteMcpUrl(serverConfig);
 	if (!url) {
@@ -32615,6 +33077,12 @@ function convertRemoteServer({ serverName, serverConfig, logger }) {
 		url
 	};
 	if (isRecord$1(serverConfig.headers)) converted.headers = omitPrototypePollutionKeys(serverConfig.headers);
+	warnUnsupportedContinueKeys({
+		serverName,
+		serverConfig,
+		keys: ["timeout", "oauth"],
+		logger
+	});
 	return converted;
 }
 function convertStdioServer({ serverName, serverConfig, logger }) {
@@ -32635,6 +33103,12 @@ function convertStdioServer({ serverName, serverConfig, logger }) {
 	if (args.length > 0) converted.args = args;
 	if (isRecord$1(serverConfig.env)) converted.env = omitPrototypePollutionKeys(serverConfig.env);
 	if (typeof serverConfig.envFile === "string") logger?.warn(`Continue ignores "envFile" for MCP servers, so the envFile of server ${quoteValueForWarning(serverName)} was not written; put the variables in "env" instead.`);
+	warnUnsupportedContinueKeys({
+		serverName,
+		serverConfig,
+		keys: ["cwd", "timeout"],
+		logger
+	});
 	return converted;
 }
 /**
@@ -34610,28 +35084,60 @@ function resolveHermesTimeout(config) {
 	if (typeof config.networkTimeout === "number") return config.networkTimeout;
 }
 /**
-* Copies the advanced Hermes-recognized per-server fields that have no canonical
-* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
-* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
-* `connect_timeout` (seconds), `supports_parallel_tool_calls`,
-* `keepalive_interval`, `elicitation`, `trust`, and `identity_header` — verbatim
-* from `source` to `target`. Field names are identical on both sides (the
-* canonical `McpServerSchema` is a `looseObject`), so this serves export and
-* import alike. See the Hermes mcp-config-reference.
+* String-valued `oauth` keys Hermes reads (`tools/mcp_oauth.py`,
+* `tools/mcp_oauth_device.py`, v0.21.3): the callback overrides, the
+* pre-registered client, the CIMD document override, the DCR registration
+* fields, the token-request `user_agent`, the login `flow` (`device` for
+* RFC 8628) and the space-separated `scope` string sent on registration and
+* device authorization.
+*/
+const HERMES_OAUTH_STRING_KEYS = [
+	"redirect_uri",
+	"redirect_host",
+	"client_id",
+	"client_secret",
+	"client_name",
+	"client_metadata_url",
+	"token_endpoint_auth_method",
+	"application_type",
+	"user_agent",
+	"flow",
+	"scope"
+];
+/**
+* Copies the `oauth` mapping of a server, keeping only the keys Hermes reads.
+*
+* Hermes reads a single `scope` string, never a `scopes` list; earlier Rulesync
+* versions wrote `scopes` regardless, which Hermes silently ignored. A `scopes`
+* list is therefore folded into `scope` (space-separated, the OAuth wire form)
+* when no `scope` is given, in both directions, so an authored list finally
+* reaches the authorization server and an old `config.yaml` imports cleanly.
 */
 function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
-	for (const key of [
-		"redirect_uri",
-		"redirect_host",
-		"client_id",
-		"client_secret"
-	]) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof source.redirect_port === "number") oauth.redirect_port = source.redirect_port;
-	if (isStringArray$2(source.scopes)) oauth.scopes = source.scopes;
+	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
+	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
+	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_OPAQUE_MAPPING_KEYS = [
+	"sampling",
+	"elicitation",
+	"identity_header",
+	"lifecycle"
+];
+/**
+* Copies the advanced Hermes-recognized per-server fields that have no canonical
+* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
+* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
+* `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* verbatim from `source` to `target`. Field names are identical on both sides
+* (the canonical `McpServerSchema` is a `looseObject`), so this serves export
+* and import alike. See the Hermes mcp-config-reference.
+*/
 function copyHermesAdvancedFields(source, target) {
 	let copied = false;
 	if (typeof source.auth === "string") {
@@ -34663,6 +35169,14 @@ function copyHermesAdvancedFields(source, target) {
 		target[key] = source[key];
 		copied = true;
 	}
+	if (typeof source.protocol === "string") {
+		target.protocol = source.protocol;
+		copied = true;
+	}
+	if (typeof source.lazy === "boolean") {
+		target.lazy = source.lazy;
+		copied = true;
+	}
 	if (typeof source.ssl_verify === "boolean" || typeof source.ssl_verify === "string") {
 		target.ssl_verify = source.ssl_verify;
 		copied = true;
@@ -34671,25 +35185,20 @@ function copyHermesAdvancedFields(source, target) {
 		target.skip_preflight = source.skip_preflight;
 		copied = true;
 	}
-	if (isPlainObject$1(source.sampling)) {
-		target.sampling = omitPrototypePollutionKeys(structuredClone(source.sampling));
-		copied = true;
-	}
 	if (typeof source.keepalive_interval === "number") {
 		target.keepalive_interval = source.keepalive_interval;
 		copied = true;
 	}
-	if (isPlainObject$1(source.elicitation)) {
-		target.elicitation = omitPrototypePollutionKeys(structuredClone(source.elicitation));
-		copied = true;
-	}
 	if (typeof source.trust === "string") {
 		target.trust = source.trust;
 		copied = true;
 	}
-	if (isPlainObject$1(source.identity_header)) {
-		target.identity_header = omitPrototypePollutionKeys(structuredClone(source.identity_header));
-		copied = true;
+	for (const key of HERMES_OPAQUE_MAPPING_KEYS) {
+		const mapping = source[key];
+		if (isPlainObject$1(mapping)) {
+			target[key] = omitPrototypePollutionKeys(structuredClone(mapping));
+			copied = true;
+		}
 	}
 	return copied;
 }
@@ -35473,6 +35982,7 @@ function toKimiCodeServer({ name, server, logger }) {
 		"headers",
 		"bearerTokenEnvVar",
 		"enabled",
+		"deferred",
 		"startupTimeoutMs",
 		"toolTimeoutMs",
 		"enabledTools",
@@ -36130,7 +36640,12 @@ const OpencodeMcpRemoteServerSchema = z.looseObject({
 	headers: z.optional(z.record(z.string(), z.string())),
 	enabled: z._default(z.boolean(), true)
 });
-const OPENCODE_PASSTHROUGH_SERVER_FIELDS = ["timeout", "oauth"];
+const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
+	"timeout",
+	"oauth",
+	"protocol",
+	"codemode"
+];
 const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
 	...Object.keys(OpencodeMcpRemoteServerSchema.def.shape),
@@ -36272,7 +36787,7 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - env -> environment
 * - disabled -> enabled (inverted)
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
-* - OpenCode-supported extras (timeout, oauth) -> passed through verbatim
+* - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
 */
 function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, logger) {
 	const serverRecord = serverConfig;
@@ -39265,7 +39780,7 @@ var ToolPermissions = class extends ToolFile {
 * builtin of that name). It lives in the shared Amp settings file:
 * `.amp/settings.json` (project) and `~/.config/amp/settings.json` (global).
 *
-* Reference: https://ampcode.com/manual ("amp.tools.disable").
+* Reference: https://ampcode.com/docs/cli/settings ("amp.tools.disable").
 */
 const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 /**
@@ -39276,19 +39791,26 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * glob. Rules are evaluated **first-match-wins**. It lives in the same shared
 * Amp settings file as `amp.tools.disable`.
 *
-* `amp.permissions` is Amp's documented legacy/backwards-compat surface — it
-* remains functional and is the only place to express `allow`/`ask` and
-* argument-specific `reject` rules (the simpler `amp.tools.disable` array can
-* only disable whole tools).
+* `amp.permissions` is Amp's legacy/backwards-compat surface — it remains
+* functional in the shipped CLI and is the only place to express `allow`/`ask`
+* and argument-specific `reject` rules (the simpler `amp.tools.disable` array
+* can only disable whole tools). The web docs no longer describe it (the
+* permissions section only points at custom plugins), but the shipped CLI
+* still lists it in its built-in settings reference (`amp --help`) and
+* evaluates it through `amp permissions list|test`.
 *
-* Reference: https://ampcode.com/manual ("amp.permissions").
+* Reference: https://ampcode.com/docs/tools#permissions and
+* https://ampcode.com/docs/customize/plugins#example-plugin-permissions.
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
 /**
 * The `amp.guardedFiles.allowlist` array (file globs allowed without
 * confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
 * and `amp.mcpPermissions` array — sibling settings authored through the `amp`
-* permissions override. Reference: https://ampcode.com/manual.
+* permissions override. Only `amp.mcpPermissions` is still on the web docs
+* (https://ampcode.com/docs/cli/settings); the other two, like
+* `amp.permissions`, survive only in the CLI's built-in settings reference
+* (see `AMP_PERMISSIONS_KEY`).
 */
 const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
 const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
@@ -42617,6 +43139,8 @@ const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
 const CODEX_EXTENDABLE_BASELINES = new Set(CODEX_EXTENDABLE_BASELINE_PROFILES);
 const CODEX_DEFAULT_APPROVAL_POLICY = "on-request";
 const CODEX_DEFAULT_APPROVALS_REVIEWER = "auto_review";
+const CODEX_RETIRED_APPROVAL_POLICY = "untrusted";
+const CODEX_DEPRECATED_APPROVAL_POLICY = "on-failure";
 const CODEX_GLOB_SCAN_MAX_DEPTH = 8;
 const CODEX_MINIMAL_KEY = ":minimal";
 const CODEX_GIT_WRITE_RULES = { ".git/**": "write" };
@@ -42740,6 +43264,10 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			domainsHadUnknown
 		});
 		const override = extractCodexcliOverride(table);
+		if (override.approval_policy === CODEX_RETIRED_APPROVAL_POLICY) {
+			warnWithFallback(void 0, `${join(this.getRelativeDirPath(), this.getRelativeFilePath())} sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start. It was not imported; remove it from the file, or mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			delete override.approval_policy;
+		}
 		if (typeof profile?.extends === "string" && CODEX_EXTENDABLE_BASELINES.has(profile.extends)) override.base_permission_profile = profile.extends;
 		if (defaultProfile === CODEX_DANGER_FULL_ACCESS_BASELINE) override.base_permission_profile = CODEX_DANGER_FULL_ACCESS_BASELINE;
 		const result = Object.keys(override).length > 0 ? {
@@ -43028,6 +43556,10 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			continue;
 		}
 		if (value === void 0) continue;
+		if (key === "approval_policy" && !isWritableApprovalPolicy({
+			value,
+			logger
+		})) continue;
 		if (key === "sandbox_mode" || key === "sandbox_workspace_write") logger?.warn(`Codex CLI permission override key "${key}" is deprecated. Codex prioritizes the legacy sandbox settings over permission profiles when both are present, so it disables the generated "${RULESYNC_PROFILE_NAME}" permissions profile. Use "base_permission_profile" and the shared "permission" block instead.`);
 		const existingValue = existing[key];
 		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
@@ -43035,12 +43567,37 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			...value
 		} : value;
 	}
+	fillCodexcliDefaults({
+		existing,
+		patch,
+		logger
+	});
+	return patch;
+}
+function fillCodexcliDefaults({ existing, patch, logger }) {
 	const defaults = {
 		approval_policy: CODEX_DEFAULT_APPROVAL_POLICY,
 		approvals_reviewer: CODEX_DEFAULT_APPROVALS_REVIEWER
 	};
-	for (const [key, value] of Object.entries(defaults)) if (patch[key] === void 0 && existing[key] === void 0) patch[key] = value;
-	return patch;
+	for (const [key, value] of Object.entries(defaults)) {
+		if (patch[key] !== void 0) continue;
+		if (existing[key] === void 0) {
+			patch[key] = value;
+			continue;
+		}
+		if (key === "approval_policy" && existing[key] === CODEX_RETIRED_APPROVAL_POLICY) {
+			logger?.warn(`The existing Codex CLI config.toml sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start, so it was replaced with "${value}". To keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			patch[key] = value;
+		}
+	}
+}
+function isWritableApprovalPolicy({ value, logger }) {
+	if (value === CODEX_RETIRED_APPROVAL_POLICY) {
+		logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_RETIRED_APPROVAL_POLICY}" was retired in Codex 0.149.0 and makes Codex refuse to start, so it was not written. Remove it from the override; to keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+		return false;
+	}
+	if (value === CODEX_DEPRECATED_APPROVAL_POLICY) logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_DEPRECATED_APPROVAL_POLICY}" is deprecated; Codex reads it as "${CODEX_DEFAULT_APPROVAL_POLICY}". Use "${CODEX_DEFAULT_APPROVAL_POLICY}" instead.`);
+	return true;
 }
 function extractCodexcliOverride(table) {
 	const override = {};
@@ -45133,6 +45690,27 @@ const DEEPAGENTS_EXTENSION_TRUST_POLICIES = [
 * @see https://github.com/langchain-ai/deepagents `config_manifest.py`
 */
 const DEEPAGENTS_EXTENSIONS_ENABLED_DEFAULT = true;
+/**
+* `[mcp]` holds dcode's per-server trust for the MCP servers a project's
+* `.mcp.json` / `.deepagents/.mcp.json` declares. `load_mcp_server_trust_lists`
+* reads it from the user-level `config.toml` only — never from a project file —
+* so the global adapter is the one place rulesync can author it.
+*/
+const MCP_TABLE_KEY = "mcp";
+/**
+* Keys lifted back into the override on import. `disabled_project_servers` is
+* the deny list: a name on it is always rejected, over any approval or trust.
+*/
+const DEEPAGENTS_MCP_KEYS = ["disabled_project_servers"];
+const MCP_DISABLED_PROJECT_SERVERS_KEY = "disabled_project_servers";
+/**
+* dcode's own store of the project servers the user approved at the prompt,
+* each bound to a repository or worktree and a definition fingerprint. It is
+* machine-local state and a way to pre-approve a project's servers, so a
+* repository's `.rulesync/permissions.jsonc` must not reach it: generate drops
+* the key here, and import never lifts it (`DEEPAGENTS_MCP_KEYS`).
+*/
+const MCP_APPROVALS_KEY = "enabled_project_server_approvals";
 const ALLOW_ALL_SENTINEL = "all";
 const RECOMMENDED_SENTINEL = "recommended";
 const GLOB_CHARACTERS_PATTERN = /[*?[\]]/;
@@ -45205,7 +45783,9 @@ const TRAILING_ARGUMENT_WILDCARD_PATTERN = /:\*$/;
 * lifted back into the override on import. The same override carries
 * `[extensions].enabled` and `[extensions].trust` (`ask` / `always` / `never`),
 * which decide whether the Python in a checked-out project's
-* `.deepagents/extensions/` is imported into the agent process.
+* `.deepagents/extensions/` is imported into the agent process, and
+* `[mcp].disabled_project_servers`, the names of project MCP servers dcode
+* always rejects.
 *
 * On **import** the allowlist comes back as `bash` `allow` rules named by the
 * executable — skipping any entry dcode could not match in the first place, so
@@ -45303,17 +45883,9 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			if (Object.keys(shell).length > 0) settings[SHELL_TABLE_KEY] = shell;
 			else delete settings[SHELL_TABLE_KEY];
 		}
-		const startupOverride = config.deepagents?.startup;
-		if (isPlainObject$1(startupOverride) && Object.keys(startupOverride).length > 0) mergeStartupOverride({
+		mergeDeepagentsOverrides({
 			settings,
-			startupOverride,
-			filePath,
-			logger
-		});
-		const extensionsOverride = config.deepagents?.extensions;
-		if (isPlainObject$1(extensionsOverride) && Object.keys(extensionsOverride).length > 0) mergeExtensionsOverride({
-			settings,
-			extensionsOverride,
+			override: config.deepagents,
 			filePath,
 			logger
 		});
@@ -45345,10 +45917,15 @@ var DeepagentsPermissions = class DeepagentsPermissions extends ToolPermissions
 			extensions: isPlainObject$1(settings[EXTENSIONS_TABLE_KEY]) ? settings[EXTENSIONS_TABLE_KEY] : {},
 			selfPath
 		});
+		const mcpOverride = liftMcpOverride({
+			mcp: isPlainObject$1(settings[MCP_TABLE_KEY]) ? settings[MCP_TABLE_KEY] : {},
+			selfPath
+		});
 		const result = { ...config };
 		const deepagents = {};
 		if (Object.keys(startupOverride).length > 0) deepagents.startup = startupOverride;
 		if (Object.keys(extensionsOverride).length > 0) deepagents.extensions = extensionsOverride;
+		if (Object.keys(mcpOverride).length > 0) deepagents.mcp = mcpOverride;
 		if (Object.keys(deepagents).length > 0) result.deepagents = deepagents;
 		return RulesyncPermissions.fromImportedFileContent({
 			outputRoot: getDeepagentsRulesyncOutputRoot({
@@ -45456,7 +46033,7 @@ function warnAboutUnwrittenBashRules({ allowAll, requestedAllowAll, askPatterns,
 * read — a wrapper rather than the bare value, so a legitimately falsy setting
 * is not mistaken for a rejection.
 */
-function liftOverrideTable({ table, tableKey, keys, normalize, selfPath }) {
+function liftOverrideTable({ table, tableKey, keys, normalize, selfPath, describeRejection = `deepagents-cli falls back to its own default for a '[${tableKey}]' value it cannot read` }) {
 	const override = {};
 	const rejected = [];
 	for (const key of keys) {
@@ -45469,7 +46046,7 @@ function liftOverrideTable({ table, tableKey, keys, normalize, selfPath }) {
 		if (normalized) override[key] = normalized.value;
 		else rejected.push(`${key} = ${JSON.stringify(value)}`);
 	}
-	if (rejected.length > 0) warnWithFallback(void 0, `deepagents-cli falls back to its own default for a '[${tableKey}]' value it cannot read, so ${rejected.join(", ")} in ${selfPath} ${rejected.length === 1 ? "was" : "were"} not imported.`);
+	if (rejected.length > 0) warnWithFallback(void 0, `${describeRejection}, so ${rejected.join(", ")} in ${selfPath} ${rejected.length === 1 ? "was" : "were"} not imported.`);
 	return override;
 }
 /**
@@ -45517,6 +46094,37 @@ function liftExtensionsOverride({ extensions, selfPath }) {
 	});
 }
 /**
+* Read a `[mcp]` name list the way `_toml_str_list` reads it: a bare string
+* is split on commas, names are trimmed and empty ones dropped, and a
+* non-string element of a list is dropped while the names around it survive.
+* Anything else (a number, a table, a bool) is a value dcode cannot read as
+* names at all, so `null` says to leave it behind.
+*/
+function readMcpServerNames(value) {
+	if (typeof value === "string") return value.split(",").map((name) => name.trim()).filter((name) => name.length > 0);
+	if (!Array.isArray(value)) return null;
+	return value.filter((name) => typeof name === "string").map((name) => name.trim()).filter((name) => name.length > 0);
+}
+/**
+* Lift the `[mcp]` keys rulesync models back into the `deepagents` override.
+* The deny list comes back as the array dcode resolves it to, so the
+* comma-separated string form it also accepts does not survive as one bogus
+* name in a permissions file the canonical schema types as `string[]`.
+*/
+function liftMcpOverride({ mcp, selfPath }) {
+	return liftOverrideTable({
+		table: mcp,
+		tableKey: MCP_TABLE_KEY,
+		keys: DEEPAGENTS_MCP_KEYS,
+		normalize: ({ value }) => {
+			const names = readMcpServerNames(value);
+			return names ? { value: names } : null;
+		},
+		selfPath,
+		describeRejection: `deepagents-cli treats a '[${MCP_TABLE_KEY}]' value it cannot read as a broken trust policy and rejects every project MCP server until it is fixed`
+	});
+}
+/**
 * Merge one block of the `deepagents` override into its `config.toml` table,
 * preserving every other key of that table. A table that is not a table at all
 * is something rulesync did not write and cannot merge into, so it is left
@@ -45565,6 +46173,38 @@ function warnAboutUncheckedKeys({ tableKey, knownKeys, writtenKeys, filePath, lo
 	if (unknownKeys.length === 0) return;
 	warnWithFallback(logger, `The deepagents ${tableKey} override wrote ${unknownKeys.join(", ")} into ${filePath} unchecked — rulesync does not know what those keys grant, and that file is your global deepagents-cli config.`);
 }
+/** An override block with something in it to write. */
+function isSet(block) {
+	return isPlainObject$1(block) && Object.keys(block).length > 0;
+}
+/**
+* Merge each block of the `deepagents` override into its `config.toml` table.
+* A block that is absent, not a table, or empty has nothing to write and is
+* skipped without touching the table it would have gone into.
+*/
+function mergeDeepagentsOverrides({ settings, override, filePath, logger }) {
+	const startupOverride = override?.startup;
+	if (isSet(startupOverride)) mergeStartupOverride({
+		settings,
+		startupOverride,
+		filePath,
+		logger
+	});
+	const extensionsOverride = override?.extensions;
+	if (isSet(extensionsOverride)) mergeExtensionsOverride({
+		settings,
+		extensionsOverride,
+		filePath,
+		logger
+	});
+	const mcpOverride = override?.mcp;
+	if (isSet(mcpOverride)) mergeMcpOverride({
+		settings,
+		mcpOverride,
+		filePath,
+		logger
+	});
+}
 /**
 * Merge the `deepagents.startup` override into `[startup]`.
 */
@@ -45598,6 +46238,40 @@ function mergeExtensionsOverride({ settings, extensionsOverride, filePath, logge
 	});
 }
 /**
+* Merge the `deepagents.mcp` override into `[mcp]`. The approval store is
+* dropped (see `MCP_APPROVALS_KEY`); the deprecated flat
+* `enabled_project_servers` is not modeled but passes through like any other
+* unknown key, named by the unchecked-key warning — dcode ignores it anyway.
+*/
+function mergeMcpOverride({ settings, mcpOverride, filePath, logger }) {
+	mergeOverrideTable({
+		settings,
+		tableKey: MCP_TABLE_KEY,
+		override: mcpOverride,
+		knownKeys: DEEPAGENTS_MCP_KEYS,
+		isDroppedKey: (key) => key === MCP_APPROVALS_KEY,
+		warnAboutRelaxations: warnAboutMcpRelaxations,
+		filePath,
+		logger
+	});
+}
+/**
+* Warn when the `deepagents` mcp override re-enables project MCP servers the
+* machine's global config had rejected. The deny list is written as a whole,
+* so a shorter list from a repository's `.rulesync/permissions.jsonc` would
+* otherwise silently lift a rejection the user had put in place — the very
+* fail-open dcode's own env merge refuses to allow.
+*/
+function warnAboutMcpRelaxations({ override, previous, filePath, logger }) {
+	if (override[MCP_APPROVALS_KEY] !== void 0) warnWithFallback(logger, `The deepagents mcp override's '${MCP_APPROVALS_KEY}' was not written to ${filePath}: dcode builds that approval store itself from the project MCP servers you accept at launch, so a permissions file cannot pre-approve them.`);
+	const written = override[MCP_DISABLED_PROJECT_SERVERS_KEY];
+	if (written === void 0 || written === null) return;
+	const kept = new Set(readMcpServerNames(written) ?? []);
+	const reEnabled = (readMcpServerNames(previous[MCP_DISABLED_PROJECT_SERVERS_KEY]) ?? []).filter((name) => !kept.has(name));
+	if (reEnabled.length === 0) return;
+	warnWithFallback(logger, `The deepagents mcp override removed ${reEnabled.map((name) => JSON.stringify(name)).join(", ")} from [${MCP_TABLE_KEY}].${MCP_DISABLED_PROJECT_SERVERS_KEY} in ${filePath}, which is your global deepagents-cli config: dcode no longer rejects ${reEnabled.length === 1 ? "that project MCP server" : "those project MCP servers"} outright, for every project on this machine, not just this one.`);
+}
+/**
 * Name the value an override key replaces, so a setting the user had turned
 * down is visible as such rather than reported as a bare new value.
 */
@@ -51375,6 +52049,18 @@ const TAKT_RUNTIME_TARGETS_KEY = "targets";
 const TAKT_RUNTIME_AUTO_ROUTING_KEY = "auto_routing";
 const TAKT_RUNTIME_PROFILE_KEY = "profile";
 const TAKT_RUNTIME_OPTIONS_KEY = "options";
+const TAKT_RUNTIME_ASSIGNMENTS_KEY = "assignments";
+const TAKT_RUNTIME_LADDER_KEY = "ladder";
+const TAKT_RUNTIME_EXTENDS_KEY = "extends";
+const TAKT_RUNTIME_ROUTER_PROFILE_KEY = "router_profile";
+const TAKT_RUNTIME_POOLS_KEY = "pools";
+const TAKT_RUNTIME_CANDIDATES_KEY = "candidates";
+const TAKT_RUNTIME_FALLBACK_PROFILE_KEY = "fallback_profile";
+/** The one `targets` map that routes companion reviewers rather than agents. */
+const TAKT_RUNTIME_COMPANIONS_TARGET_KEY = "companions";
+const TAKT_RUNTIME_COMPANION_KEY = "companion";
+const TAKT_RUNTIME_ENABLED_KEY = "enabled";
+const TAKT_DEFAULT_COMPANION_ENABLED = false;
 const TAKT_SECURITY_POLICIES = {
 	workflow_arpeggio: [
 		"custom_data_source_modules",
@@ -51628,21 +52314,156 @@ function runtimeProfiles(runtime) {
 	const profiles = provider[TAKT_RUNTIME_PROFILES_KEY];
 	return isPlainObject$1(profiles) ? profiles : {};
 }
+/** A `targets` map (`personas`, `tags`, …) with at least one non-empty entry. */
+function hasTargetContent(targets) {
+	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+}
+/** The profile names an assignment points at: `profile` plus every `ladder` rung. */
+function assignmentProfileNames(assignment) {
+	if (!isPlainObject$1(assignment)) return [];
+	const names = [];
+	const profile = assignment[TAKT_RUNTIME_PROFILE_KEY];
+	if (typeof profile === "string") names.push(profile);
+	const ladder = assignment[TAKT_RUNTIME_LADDER_KEY];
+	if (Array.isArray(ladder)) names.push(...ladder.filter((rung) => typeof rung === "string"));
+	return names;
+}
+/** The assignments under a `targets` map, split by whether they route companions. */
+function targetAssignments(targets, { companions }) {
+	if (!isPlainObject$1(targets)) return [];
+	return Object.entries(targets).filter(([name]) => name === TAKT_RUNTIME_COMPANIONS_TARGET_KEY === companions).flatMap(([, targetMap]) => isPlainObject$1(targetMap) ? Object.values(targetMap) : []);
+}
+/**
+* Record the profiles a `defaults` + `targets` pair (the top-level provider
+* section or one named assignment set) reaches, keeping companion roots apart
+* from the roots agents use.
+*/
+function addAssignmentSetRoots({ set, companionRoots, agentRoots }) {
+	for (const name of assignmentProfileNames(set[TAKT_RUNTIME_DEFAULTS_KEY])) agentRoots.add(name);
+	const targets = set[TAKT_RUNTIME_TARGETS_KEY];
+	for (const assignment of targetAssignments(targets, { companions: false })) for (const name of assignmentProfileNames(assignment)) agentRoots.add(name);
+	for (const assignment of targetAssignments(targets, { companions: true })) for (const name of assignmentProfileNames(assignment)) companionRoots.add(name);
+}
+/** The profiles `auto_routing` reaches: the router plus every pool candidate/fallback. */
+function addAutoRoutingRoots(autoRouting, roots) {
+	if (!isPlainObject$1(autoRouting)) return;
+	const routerProfile = autoRouting[TAKT_RUNTIME_ROUTER_PROFILE_KEY];
+	if (typeof routerProfile === "string") roots.add(routerProfile);
+	const pools = autoRouting[TAKT_RUNTIME_POOLS_KEY];
+	if (!isPlainObject$1(pools)) return;
+	for (const pool of Object.values(pools)) {
+		if (!isPlainObject$1(pool)) continue;
+		const candidates = pool[TAKT_RUNTIME_CANDIDATES_KEY];
+		for (const candidate of Array.isArray(candidates) ? candidates : []) for (const name of assignmentProfileNames(candidate)) roots.add(name);
+		const fallback = pool[TAKT_RUNTIME_FALLBACK_PROFILE_KEY];
+		if (typeof fallback === "string") roots.add(fallback);
+	}
+}
+/** Every profile reachable from `roots` by following `extends`. */
+function profileClosure(profiles, roots) {
+	const closure = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		if (closure.has(name)) return;
+		closure.add(name);
+		const profile = profiles[name];
+		const parent = isPlainObject$1(profile) ? profile[TAKT_RUNTIME_EXTENDS_KEY] : void 0;
+		if (typeof parent === "string") visit(parent);
+	};
+	for (const root of roots) visit(root);
+	return closure;
+}
+/** The `targets` map minus its `companions` entry (`undefined` when not a map). */
+function withoutCompanionTargets(targets) {
+	if (!isPlainObject$1(targets)) return;
+	const { [TAKT_RUNTIME_COMPANIONS_TARGET_KEY]: _companions, ...remaining } = targets;
+	return remaining;
+}
+/**
+* The named assignment sets with their companion targets removed; a set left
+* with neither `defaults` nor a non-empty `targets` map is dropped, and
+* `undefined` means none survived.
+*/
+function withoutCompanionAssignments(assignments) {
+	if (!isPlainObject$1(assignments)) return;
+	const remaining = {};
+	for (const [name, set] of Object.entries(assignments)) {
+		if (!isPlainObject$1(set)) continue;
+		const defaults = set[TAKT_RUNTIME_DEFAULTS_KEY];
+		const targets = withoutCompanionTargets(set[TAKT_RUNTIME_TARGETS_KEY]);
+		const keepTargets = hasTargetContent(targets);
+		if (defaults === void 0 && !keepTargets) continue;
+		remaining[name] = {
+			...defaults === void 0 ? {} : { [TAKT_RUNTIME_DEFAULTS_KEY]: defaults },
+			...keepTargets ? { [TAKT_RUNTIME_TARGETS_KEY]: targets } : {}
+		};
+	}
+	return Object.keys(remaining).length > 0 ? remaining : void 0;
+}
+/** Whether the section (or any of its named assignment sets) routes companions at all. */
+function hasCompanionTargets(section) {
+	const routesCompanions = (set) => {
+		const targets = isPlainObject$1(set) ? set[TAKT_RUNTIME_TARGETS_KEY] : void 0;
+		return isPlainObject$1(targets) && targets[TAKT_RUNTIME_COMPANIONS_TARGET_KEY] !== void 0;
+	};
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	return routesCompanions(section) || isPlainObject$1(assignments) && Object.values(assignments).some(routesCompanions);
+}
+/**
+* The `provider:` section as Takt itself evaluates it, mirroring upstream's
+* `getEffectiveProviderSection`: unless `companion.enabled` is `true`
+* (companions are opt-in), the `targets.companions` maps — top-level and inside
+* every named assignment set — are dropped, along with each profile that only a
+* companion target reaches through `extends`. A profile an agent assignment
+* (`defaults`, the other `targets` maps, `auto_routing`) also reaches is kept.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/schema.ts
+*/
+function effectiveRuntimeProviderSection(runtime) {
+	const section = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	if (!isPlainObject$1(section)) return;
+	const companion = runtime[TAKT_RUNTIME_COMPANION_KEY];
+	if (((isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0) ?? TAKT_DEFAULT_COMPANION_ENABLED) === true || !hasCompanionTargets(section)) return section;
+	const profiles = runtimeProfiles(runtime);
+	const companionRoots = /* @__PURE__ */ new Set();
+	const agentRoots = /* @__PURE__ */ new Set();
+	addAssignmentSetRoots({
+		set: section,
+		companionRoots,
+		agentRoots
+	});
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	for (const set of isPlainObject$1(assignments) ? Object.values(assignments) : []) if (isPlainObject$1(set)) addAssignmentSetRoots({
+		set,
+		companionRoots,
+		agentRoots
+	});
+	addAutoRoutingRoots(section[TAKT_RUNTIME_AUTO_ROUTING_KEY], agentRoots);
+	const companionClosure = profileClosure(profiles, companionRoots);
+	const agentClosure = profileClosure(profiles, agentRoots);
+	const effective = {
+		...section,
+		[TAKT_RUNTIME_PROFILES_KEY]: Object.fromEntries(Object.entries(profiles).filter(([name]) => !companionClosure.has(name) || agentClosure.has(name)))
+	};
+	for (const [key, value] of [[TAKT_RUNTIME_TARGETS_KEY, withoutCompanionTargets(section[TAKT_RUNTIME_TARGETS_KEY])], [TAKT_RUNTIME_ASSIGNMENTS_KEY, withoutCompanionAssignments(assignments)]]) if (value === void 0) delete effective[key];
+	else effective[key] = value;
+	return effective;
+}
 /**
 * Whether a parsed `runtime.yaml` puts Takt into runtime mode, mirroring
-* upstream's mode detection: the `provider:` section must carry an actual
-* assignment — a non-empty `defaults`, `profiles` or `auto_routing`, or a
-* `targets` map with at least one non-empty nested map. The file existing is not
-* enough, and empty nested maps (`defaults: {}`, `targets: { personas: {} }`)
-* must not flip the mode.
+* upstream's mode detection: the effective `provider:` section (see
+* `effectiveRuntimeProviderSection` — companion-only routing does not count
+* while companions are disabled) must carry an actual assignment — a non-empty
+* `defaults`, `profiles` or `auto_routing`, a `targets` map with at least one
+* non-empty nested map, or a named assignment set with a non-empty `defaults`
+* or such a `targets` map. The file existing is not enough, and empty nested
+* maps (`defaults: {}`, `targets: { personas: {} }`) must not flip the mode.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/mode.ts
 */
 function isRuntimeModeActive(runtime) {
-	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
-	if (!isPlainObject$1(provider)) return false;
-	if (hasEntries(provider[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(provider[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(provider[TAKT_RUNTIME_AUTO_ROUTING_KEY])) return true;
-	const targets = provider[TAKT_RUNTIME_TARGETS_KEY];
-	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+	const section = effectiveRuntimeProviderSection(runtime);
+	if (section === void 0) return false;
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	const hasAssignments = isPlainObject$1(assignments) && Object.values(assignments).some((set) => isPlainObject$1(set) && (hasEntries(set[TAKT_RUNTIME_DEFAULTS_KEY]) || hasTargetContent(set[TAKT_RUNTIME_TARGETS_KEY])));
+	return hasEntries(section[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(section[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(section[TAKT_RUNTIME_AUTO_ROUTING_KEY]) || hasTargetContent(section[TAKT_RUNTIME_TARGETS_KEY]) || hasAssignments;
 }
 /** The provider named by the runtime profile Takt would use by default. */
 function resolveRuntimeProvider(runtime) {
@@ -51665,10 +52486,13 @@ function resolveRuntimeProvider(runtime) {
 * shape the `takt` override uses. Each profile's options belong to that
 * profile's own provider; when several profiles name the same provider they are
 * merged in document order, so a later profile wins on a colliding option key.
+* Profiles Takt itself ignores (companion-only ones while companions are
+* disabled) are skipped, as they never reach an agent.
 */
 function collectRuntimeProviderOptions(runtime) {
 	const collected = {};
-	for (const profile of Object.values(runtimeProfiles(runtime))) {
+	const profiles = effectiveRuntimeProviderSection(runtime)?.[TAKT_RUNTIME_PROFILES_KEY];
+	for (const profile of Object.values(isPlainObject$1(profiles) ? profiles : {})) {
 		if (!isPlainObject$1(profile)) continue;
 		const providerName = profile[TAKT_RUNTIME_PROVIDER_KEY];
 		const options = profile[TAKT_RUNTIME_OPTIONS_KEY];
@@ -51707,13 +52531,20 @@ async function readTaktRuntimeFile({ filePath, logger }) {
 		};
 	}
 }
+/** A map-valued key of a `provider:` section, or `undefined` when it is not a map. */
+function runtimeSectionMap(section, key) {
+	return isPlainObject$1(section[key]) ? section[key] : void 0;
+}
 /**
 * Collapse the project and global `runtime.yaml` into the single document Takt
-* itself resolves against, matching upstream's loader: `profiles` is a union
-* with the project definition of a same-named profile replacing the global one,
-* while `defaults`, `targets` and `auto_routing` are taken from the project file
-* whole whenever it states them at all (`??`, so a project `targets: {}` masks
-* the global one rather than merging with it).
+* itself resolves against, matching upstream's loader: `profiles` and
+* `assignments` are unions with the project definition of a same-named entry
+* replacing the global one, while `defaults`, `targets` and `auto_routing` are
+* taken from the project file whole whenever it states them at all (`??`, so a
+* project `targets: {}` masks the global one rather than merging with it). The
+* top-level `companion.enabled` — which decides whether companion routing
+* counts for mode detection — is carried as upstream carries it: unset when
+* neither file states it, otherwise on only when neither file turns it off.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/loader.ts
 *
 * Merging before mode detection matters in both directions: a project file
@@ -51729,14 +52560,15 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 	const projectSection = sectionOf(project);
 	const globalSection = sectionOf(globalConfig);
 	const replaced = (key) => projectSection[key] ?? globalSection[key];
-	const profilesOf = (section) => isPlainObject$1(section[TAKT_RUNTIME_PROFILES_KEY]) ? section[TAKT_RUNTIME_PROFILES_KEY] : void 0;
-	const globalProfiles = profilesOf(globalSection);
-	const projectProfiles = profilesOf(projectSection);
 	const provider = {};
-	if (globalProfiles !== void 0 || projectProfiles !== void 0) provider[TAKT_RUNTIME_PROFILES_KEY] = {
-		...globalProfiles,
-		...projectProfiles
-	};
+	for (const key of [TAKT_RUNTIME_PROFILES_KEY, TAKT_RUNTIME_ASSIGNMENTS_KEY]) {
+		const globalMap = runtimeSectionMap(globalSection, key);
+		const projectMap = runtimeSectionMap(projectSection, key);
+		if (globalMap !== void 0 || projectMap !== void 0) provider[key] = {
+			...globalMap,
+			...projectMap
+		};
+	}
 	for (const key of [
 		TAKT_RUNTIME_DEFAULTS_KEY,
 		TAKT_RUNTIME_TARGETS_KEY,
@@ -51745,7 +52577,17 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 		const value = replaced(key);
 		if (value !== void 0) provider[key] = value;
 	}
-	return { [TAKT_RUNTIME_PROVIDER_KEY]: provider };
+	const enabledOf = (config) => {
+		const companion = config?.[TAKT_RUNTIME_COMPANION_KEY];
+		return isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0;
+	};
+	const globalEnabled = enabledOf(globalConfig);
+	const projectEnabled = enabledOf(project);
+	const companion = globalEnabled === void 0 && projectEnabled === void 0 ? void 0 : { [TAKT_RUNTIME_ENABLED_KEY]: globalEnabled !== false && projectEnabled !== false };
+	return {
+		[TAKT_RUNTIME_PROVIDER_KEY]: provider,
+		...companion === void 0 ? {} : { [TAKT_RUNTIME_COMPANION_KEY]: companion }
+	};
 }
 /**
 * The runtime provider configuration in force for a generate run: the project
@@ -57350,7 +58192,12 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 //#region src/features/skills/commandcode-skill.ts
 const CommandcodeSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
-	description: z.string()
+	description: z.string(),
+	license: z.optional(z.string()),
+	compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
+	metadata: z.optional(z.looseObject({})),
+	"disable-model-invocation": z.optional(z.boolean()),
+	"user-invocable": z.optional(z.boolean())
 });
 /**
 * Represents a Command Code skill directory.
@@ -57433,10 +58280,35 @@ var CommandcodeSkill = class CommandcodeSkill extends ToolSkill {
 		const settablePaths = CommandcodeSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
 		const { name: _sectionName, description: _sectionDescription, ...commandcodeSection } = rulesyncFrontmatter.commandcode ?? {};
+		const license = resolveLicense({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const compatibility = resolveCompatibility({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const metadata = resolveMetadata({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: commandcodeSection
+		});
 		const commandcodeFrontmatter = {
 			...commandcodeSection,
 			name: rulesyncFrontmatter.name,
-			description: rulesyncFrontmatter.description
+			description: rulesyncFrontmatter.description,
+			...license !== void 0 && { license },
+			...compatibility !== void 0 && { compatibility },
+			...metadata !== void 0 && { metadata },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation },
+			...userInvocable !== void 0 && { "user-invocable": userInvocable }
 		};
 		return new CommandcodeSkill({
 			outputRoot,
@@ -59384,7 +60256,8 @@ const GrokcliSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	"user-invocable": z.optional(z.boolean()),
-	"disable-model-invocation": z.optional(z.boolean())
+	"disable-model-invocation": z.optional(z.boolean()),
+	paths: z.optional(z.union([z.string(), z.array(z.string())]))
 });
 /**
 * Represents a Grok Build skill directory.
@@ -59443,7 +60316,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const grokcliSection = {
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.paths !== void 0 && { paths: frontmatter.paths }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -59478,7 +60352,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
-			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...grokcliSection?.paths !== void 0 && { paths: grokcliSection.paths }
 		};
 		return new GrokcliSkill({
 			outputRoot,
@@ -62129,7 +63004,10 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: WARP_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: WARP_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return WarpSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -62193,12 +63071,14 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		return targets.includes("*") || targets.includes("warp");
 	}
 	/**
-	* Commands are emitted into this same skills tree as `<slug>/SKILL.md`
-	* (see `WarpCommand`), so a directory matching a current rulesync command
-	* slug is owned by the commands feature: it must not be imported as a
-	* skill nor deleted as an orphan skill.
+	* Commands are emitted into the `.warp/skills/` tree as `<slug>/SKILL.md`
+	* (see `WarpCommand`), so a directory there matching a current rulesync
+	* command slug is owned by the commands feature: it must not be imported as
+	* a skill nor deleted as an orphan skill. The import-only `.agents/skills/`
+	* root never receives commands, so a same-named skill in it stays a skill.
 	*/
-	static async isDirOwned({ dirName, inputRoots }) {
+	static async isDirOwned({ relativeDirPath, dirName, inputRoots }) {
+		if (relativeDirPath !== WARP_SKILLS_DIR_PATH) return true;
 		return !await rulesyncCommandSlugExists({
 			inputRoots,
 			dirName
@@ -62411,6 +63291,25 @@ const ZedSkillFrontmatterSchema = z.looseObject({
 	description: z.string(),
 	"disable-model-invocation": z.optional(z.boolean())
 });
+const ZED = "Zed";
+const ZED_LOAD_FAILURE = "does not load the skill otherwise";
+/**
+* Collect the rules Zed enforces on a skill's frontmatter that the loose
+* schema above does not — `name` rules first, then `description`. Returned as
+* warnings rather than thrown: the canonical skill is shared with every other
+* target, so a name Zed rejects must not stop the generate run for the rest.
+*/
+function collectZedSkillViolations({ name, description }) {
+	const violations = [];
+	if (name.length === 0) violations.push("`name` must not be empty; Zed does not load a skill without one");
+	else violations.push(...collectSkillNameViolations({
+		name,
+		authority: ZED,
+		consequence: ZED_LOAD_FAILURE
+	}));
+	if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${ZED} loads the skill but warns past ${SKILL_DESCRIPTION_MAX_LENGTH}`);
+	return violations;
+}
 /**
 * Represents a Zed agent skill directory.
 * Skills are stored under .agents/skills/ (project) or ~/.agents/skills/ (global)
@@ -62479,9 +63378,10 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global: this.global
 		});
 	}
-	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
 		const settablePaths = ZedSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
 		const zedSection = rulesyncFrontmatter.zed;
 		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
 			rootFrontmatter: rulesyncFrontmatter,
@@ -62493,10 +63393,17 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			...zedSection,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
+		ZedSkill.reportSkillViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: zedFrontmatter,
+			logger
+		});
 		return new ZedSkill({
 			outputRoot,
 			relativeDirPath: settablePaths.relativeDirPath,
-			dirName: rulesyncSkill.getDirName(),
+			dirName,
 			frontmatter: zedFrontmatter,
 			body: rulesyncSkill.getBody(),
 			otherFiles: rulesyncSkill.getOtherFiles(),
@@ -62504,6 +63411,18 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global
 		});
 	}
+	/**
+	* Warn about every rule Zed enforces on the skill about to be written. The
+	* reported path includes `outputRoot` so a global-scope skill points at the
+	* file under the home directory rather than a same-named project path.
+	*/
+	static reportSkillViolations({ outputRoot, relativeDirPath, dirName, frontmatter, logger }) {
+		warnSkillViolations({
+			skillPath: join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME),
+			violations: collectZedSkillViolations(frontmatter),
+			logger
+		});
+	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("zed");
@@ -64809,6 +65728,35 @@ const CommandcodeSubagentFrontmatterSchema = z.looseObject({
 	showOutput: z.optional(z.boolean())
 });
 /**
+* Names Command Code's built-in agents own. The loader runs the frontmatter
+* `name` (or the file stem when it has none) through `sanitizeAgentName`,
+* which rewrites every character outside `[a-zA-Z0-9_-]` to `_`, lowercases
+* it, and skips the file outright when the result is one of these
+* (`isReservedAgentName`) — with no message. Verified in the `command-code`
+* 1.54.2 bundle.
+* @see https://commandcode.ai/docs/agents
+*/
+const COMMANDCODE_RESERVED_AGENT_NAMES = /* @__PURE__ */ new Set([
+	"explore",
+	"plan",
+	"review",
+	"general"
+]);
+/** The name Command Code compares against its reserved list. */
+function toCommandcodeAgentName(name) {
+	return name.replace(/[^a-zA-Z0-9_-]/g, "_").toLowerCase();
+}
+/**
+* The subagent is still generated under the reserved name — the name is the
+* user's to change, and a rename here would make it diverge from the other
+* targets — but Command Code would drop it without a visible word, so say so
+* now (the same courtesy `VibeSkill` extends to its reserved skill names).
+*/
+function warnAboutReservedAgentName({ name, relativeFilePath, logger }) {
+	if (!COMMANDCODE_RESERVED_AGENT_NAMES.has(toCommandcodeAgentName(name))) return;
+	logger?.warn(`Command Code subagent ${relativeFilePath}: the name ${quoteValueForWarning(name)} is reserved for a Command Code built-in agent, so Command Code ignores a custom agent by that name when it loads agents. Rename the subagent for it to be available in Command Code.`);
+}
+/**
 * Command Code custom agent: a Markdown file with YAML frontmatter under
 * `.commandcode/agents/` (project) or `~/.commandcode/agents/` (user); the
 * body is the agent's system prompt.
@@ -64855,7 +65803,7 @@ var CommandcodeSubagent = class CommandcodeSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const commandcodeSection = rulesyncFrontmatter.commandcode ?? {};
 		const commandcodeSubagentFrontmatter = {
@@ -64863,6 +65811,11 @@ var CommandcodeSubagent = class CommandcodeSubagent extends ToolSubagent {
 			description: rulesyncFrontmatter.description,
 			...commandcodeSection
 		};
+		warnAboutReservedAgentName({
+			name: commandcodeSubagentFrontmatter.name,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			logger
+		});
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, commandcodeSubagentFrontmatter, { avoidBlockScalars: true });
 		const paths = this.getSettablePaths({ global });
@@ -71235,8 +72188,12 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 	* | `false`          | none      | not supported; the rule is dropped  |
 	*
 	* The default being `true` is the opposite of Cursor, which the adapter was
-	* modeled on: `paths` alone scopes nothing, so a rule meant to be path
-	* triggered has to carry an explicit `alwaysApply: false` alongside it.
+	* modeled on. The shipped loader (`@tencent-ai/codebuddy-code` 2.151.0,
+	* `dist/codebuddy.js`) is looser than the table — it resolves
+	* `alwaysApply = fm.alwaysApply === true || (!hasPaths && fm.alwaysApply !== false)`,
+	* so `paths` without `alwaysApply` is already MANUAL — but the explicit
+	* `alwaysApply: false` is written anyway: it is correct under both readings
+	* and the documented one is what a reader of the file goes by.
 	*
 	* @see https://www.codebuddy.ai/docs/cli/memory
 	*/
@@ -71311,9 +72268,9 @@ var CodebuddyRule = class CodebuddyRule extends ToolRule {
 			});
 		}
 		const sourcePaths = normalizeCodebuddyPaths(this.frontmatter.paths) ?? [];
-		const isAlways = this.frontmatter.alwaysApply !== false;
+		const isAlways = this.frontmatter.alwaysApply === true || sourcePaths.length === 0 && this.frontmatter.alwaysApply !== false;
 		const globs = sourcePaths.length === 0 && isAlways ? ["**/*"] : sourcePaths;
-		const alwaysApply = this.frontmatter.alwaysApply ?? (sourcePaths.length > 0 ? true : void 0);
+		const alwaysApply = this.frontmatter.alwaysApply;
 		const rulesyncFrontmatter = {
 			targets,
 			root: false,
@@ -76004,6 +76961,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold"
 		}
 	}],
+	["pool", {
+		class: PoolRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
+	}],
 	["qwencode", {
 		class: QwencodeRule,
 		meta: {
@@ -76127,15 +77093,6 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "auto"
 		}
 	}],
-	["pool", {
-		class: PoolRule,
-		meta: {
-			extension: "md",
-			supportsGlobal: true,
-			ruleDiscoveryMode: "auto",
-			collisionPolicy: "fold"
-		}
-	}],
 	["dsh", {
 		class: DshRule,
 		meta: {
@@ -79321,6 +80278,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { RulesyncCheck as $, writeFileContent as $t, CLAUDECODE_SKILLS_DIR_PATH as A, ALL_FEATURES as An, directoryExists as At, RulesyncSkill as B, stripHiddenCharacters as Bn, listSubdirectoryNames as Bt, ChecksProcessor as C, RULESYNC_RULES_RELATIVE_DIR_PATH as Cn, ErrorCodes as Ct, CLAUDECODE_LOCAL_RULE_FILE_NAME as D, RULESYNC_USER_CONFIG_DIR_NAME as Dn, assertWritablePathInsideRoot as Dt, CLAUDECODE_DIR as E, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as En, assertTreeContainsNoSymlinks as Et, AUGMENTCODE_DIR as F, hasDeceptiveHiddenCharacters as Fn, isFileNotFoundError as Ft, RulesyncMcp as G, removeDirectoryStrict as Gt, RulesyncRule as H, readFileContent as Ht, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as I, hasEnclosingMarkOutsideKeycap as In, isFileSystemError as It, getRulesyncSourceCandidates as J, removeTempDirectory as Jt, RulesyncIgnore as K, removeFile as Kt, getLocalSkillDirNames as L, quoteForLog as Ln, isSymlink as Lt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as M, DEPRECATED_FEATURE_REPLACEMENTS as Mn, fileExists as Mt, caseFoldIdentity as N, formatError as Nn, getFileSize as Nt, CLAUDECODE_MEMORIES_DIR_NAME as O, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as On, checkPathTraversal as Ot, groupSpellingsByCaseFoldedIdentity as P, truncateText as Pn, getHomeDirectory as Pt, RulesyncCommandFrontmatterSchema as Q, writeFileBuffer as Qt, RulesyncSubagent as R, stripControlCharacters as Rn, listDirectoryEntryNames as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_RELATIVE_DIR_PATH as Sn, CLIError as St, CODEXCLI_DIR as T, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Tn, assertDirectoryIfExists as Tt, RulesyncRuleFrontmatterSchema as U, readFileContentOrNull as Ut, RulesyncSkillFrontmatterSchema as V, pathEscapesRoot as Vt, RulesyncPermissions as W, removeDirectory as Wt, parseJsonc as X, runWithDirectoryRollback as Xt, resolveRulesyncSourceWritePath as Y, resolvePath as Yt, RulesyncCommand as Z, toPosixPath as Zt, IgnoreProcessor as _, RULESYNC_MCP_RELATIVE_FILE_PATH as _n, fallbackLogger as _t, getProcessorRegistryEntry as a, FEATURE_SOURCE_TREE_ENTRIES as an, ConfigResolver as at, CommandsProcessor as b, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as bn, resetRunWarningState as bt, RulesProcessor as c, RULESYNC_CHECKS_RELATIVE_DIR_PATH as cn, CONFLICTING_TARGET_PAIRS as ct, CODEBUDDY_DIR as d, RULESYNC_CONFIG_SCHEMA_URL as dn, SourceEntrySchema as dt, ALL_TOOL_TARGETS as en, RulesyncCheckFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as fn, assertTargetsFeaturesExclusive as ft, McpProcessor as g, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as gn, WarningCollectingLogger as gt, shortenToWidth as h, RULESYNC_IGNORE_RELATIVE_FILE_PATH as hn, JsonLogger as ht, inspectInputRoots as i, CURATED_RULES_FEATURE_SUBDIR as in, SKILL_FILE_NAME as it, FACTORYDROID_DIR as j, ALL_FEATURES_WITH_WILDCARD as jn, ensureDir as jt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as k, parseCommaSeparatedList as kn, createTempDirectory as kt, SubagentsProcessor as l, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as ln, ConfigFileSchema as lt, displayWidthOf as m, RULESYNC_HOOKS_RELATIVE_FILE_PATH as mn, ConsoleLogger as mt, formatSourceLoadFailure as n, PACKAGING_TOOL_TARGETS as nn, loadYaml as nt, convertFromTool as o, MAX_FILE_SIZE as on, mergeInputRootConfigs as ot, ELLIPSIS_WIDTH as p, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as pn, findControlCharacter as pt, RulesyncHooks as q, removeFileStrict as qt, generate as r, ToolTargetSchema as rn, SHARED_USER_MANAGED_CONFIG_PATHS as rt, isPackagingToolTarget as s, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as sn, resolveEffectiveInputRoots as st, importFromTool as t, ALL_TOOL_TARGETS_WITH_WILDCARD as tn, stringifyFrontmatter as tt, SkillsProcessor as u, RULESYNC_CONFIG_RELATIVE_FILE_PATH as un, GITIGNORE_DESTINATION_KEY as ut, HooksProcessor as v, RULESYNC_MCP_SCHEMA_URL as vn, warnOnConflictingFlags as vt, CODEXCLI_BASH_RULES_FILE_NAME as w, RULESYNC_SKILLS_RELATIVE_DIR_PATH as wn, applyFileMode as wt, QWENCODE_DIR as x, RULESYNC_PERMISSIONS_SCHEMA_URL as xn, withWarnOnceScope as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as yn, withFallbackLoggerTarget as yt, RulesyncSubagentFrontmatterSchema as z, stripControlCharactersKeepingLineFeeds as zn, listFilePathsRecursively as zt };
+export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
 
-//# sourceMappingURL=import-DoCUTXaU.js.map
+//# sourceMappingURL=import-D_iukHSy.js.map