rulesync 16.35.0 → 16.36.0

package/dist/{import-DxRza3o_.js → import-D_iukHSy.js}

@@ -4053,24 +4053,60 @@ const CONTROL_CHARS = [
 const hasControlChars = (val) => CONTROL_CHARS.some((char) => val.includes(char));
 const safeString = z.pipe(z.string(), z.custom((val) => typeof val === "string" && !hasControlChars(val), "must not contain newline, carriage return, or NUL characters"));
 /**
+* All canonical hook types — the union of the `type` values accepted by every
+* supported tool:
+* - `command` — universal (Claude Code, Codex CLI, Qwen Code, Cursor, …)
+* - `prompt` — Claude Code, Codex CLI, Qwen Code, Copilot CLI, Cursor, Devin
+* - `http` — Claude Code, Qwen Code, Copilot CLI, Grok CLI
+* - `agent` — Claude Code, Codex CLI
+* - `mcp_tool` — Claude Code
+* - `function` — Qwen Code (internal Skill-system executor)
+*/
+const HOOK_TYPES = [
+	"command",
+	"prompt",
+	"http",
+	"agent",
+	"mcp_tool",
+	"function"
+];
+/**
+* One choice offered by a Kiro `confirm` prompt: `run` decides whether picking
+* it executes the hook command. The prompt text is written back into JSON,
+* never embedded in generated code, so it is a plain string.
+*/
+const HookConfirmOptionSchema = z.looseObject({
+	id: z.string(),
+	label: z.string(),
+	run: z.boolean()
+});
+/**
+* Kiro's confirmation prompt shown before a `Stop`-trigger command hook runs.
+* `confirmCommand` (optional, inside the block) names a command whose JSON
+* stdout drives the prompt at run time: `{ "skip": true }` suppresses it, a
+* replacement `question` / `options` object overrides the static prompt, and
+* on failure or timeout the static prompt is used. Stored verbatim: Kiro is
+* the only consumer, and it owns the shape.
+* https://kiro.dev/docs/hooks/
+*/
+const HookConfirmSchema = z.looseObject({
+	question: z.string(),
+	options: z.array(HookConfirmOptionSchema),
+	confirmCommand: z.optional(safeString)
+});
+/**
 * Canonical hook definition.
 * Used in .rulesync/hooks.jsonc and mapped to tool-specific formats.
 */
 const HookDefinitionSchema = z.looseObject({
 	command: z.optional(safeString),
-	type: z.optional(z.enum([
-		"command",
-		"prompt",
-		"http",
-		"agent",
-		"mcp_tool",
-		"function"
-	])),
+	type: z.optional(z.enum(HOOK_TYPES)),
 	url: z.optional(safeString),
 	timeout: z.optional(z.number()),
 	cacheTtl: z.optional(z.number().check(nonnegative())),
 	matcher: z.optional(safeString),
 	enabled: z.optional(z.boolean()),
+	confirm: z.optional(HookConfirmSchema),
 	prompt: z.optional(safeString),
 	loop_limit: z.optional(z.nullable(z.number())),
 	name: z.optional(safeString),
@@ -4348,9 +4384,13 @@ const AMP_HOOK_EVENTS = [
 * the platform the other one owns — see `generateClineHookScript` and
 * `generateClineHookPowerShellScript`.
 *
-* `TaskResume` and `TaskCancel` have no canonical counterpart and stay
-* unmapped rather than being approximated by `sessionEnd` / `stop`, whose
-* semantics differ.
+* `TaskCancel` is the shape of canonical `stopCancelled` (as Grok CLI's
+* `StopCancelled` and Codex CLI's `Interrupt` are): both runtimes fire it
+* *instead of* `TaskComplete` when the run ends aborted — the VS Code
+* extension from `afterRun` when the result status is `aborted`, the SDK/CLI
+* as `agent_abort` — and neither lets the script cancel anything. `TaskResume`
+* has no canonical counterpart and stays unmapped rather than being
+* approximated by `sessionStart`, whose semantics differ.
 *
 * @see https://github.com/cline/cline/blob/main/apps/vscode/src/core/hooks/utils.ts
 * @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/hooks/hook-file-config.ts
@@ -4364,7 +4404,8 @@ const CLINE_HOOK_EVENTS = [
 	"preCompact",
 	"notification",
 	"taskCompleted",
-	"afterError"
+	"afterError",
+	"stopCancelled"
 ];
 /**
 * Hook events supported by GitHub Copilot (cloud coding agent).
@@ -4682,23 +4723,32 @@ const QWENCODE_HOOK_EVENTS = [
 * Hook events supported by Reasonix.
 *
 * Reasonix's `.reasonix/settings.json` (project) / `~/.reasonix/settings.json`
-* (global) documents a ten-event surface (`PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit`, `Stop`, `PostLLMCall`, `SessionStart`, `SessionEnd`,
-* `SubagentStop`, `Notification`, `PreCompact`). All ten have a clean canonical
+* (global) accepts the thirteen events declared in `internal/hook/hook.go`
+* (`var Events`): `PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest`, `UserPromptSubmit`, `Stop`, `StopFailure`,
+* `PostLLMCall`, `SessionStart`, `SessionEnd`, `SubagentStop`, `Notification`,
+* `PreCompact`. The zh-CN desktop hooks page documents only ten of them, so the
+* source file is the authoritative list. All thirteen have a clean canonical
 * equivalent and are mapped: `PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit` ← `beforeSubmitPrompt`, `Stop`, `SessionStart`,
-* `SessionEnd`, `SubagentStop`, `PostLLMCall` ← `postModelInvocation`,
-* `Notification` ← `notification`, and `PreCompact` ← `preCompact`.
-* `match` (Reasonix's matcher field name) is honored only on
-* `PreToolUse`/`PostToolUse`, matching the canonical `matcher` field's
-* tool-event scoping used by other adapters.
+* `PostToolUseFailure`, `PermissionRequest`, `UserPromptSubmit` ←
+* `beforeSubmitPrompt`, `Stop`, `StopFailure`, `SessionStart`, `SessionEnd`,
+* `SubagentStop`, `PostLLMCall` ← `postModelInvocation`, `Notification` ←
+* `notification`, and `PreCompact` ← `preCompact`.
+* `match` (Reasonix's matcher field name) is honored on the four tool-scoped
+* events (`PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest` — `UsesToolMatcher` in `internal/hook/inspect.go`) and
+* ignored everywhere else.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 const REASONIX_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
+	"postToolUseFailure",
+	"permissionRequest",
 	"beforeSubmitPrompt",
 	"stop",
+	"stopFailure",
 	"sessionStart",
 	"sessionEnd",
 	"subagentStop",
@@ -4744,8 +4794,8 @@ const GROKCLI_HOOK_EVENTS = [
 * added in 0.32.0 (`TurnStarted`, `UserPromptQueued`, `TaskStarted`,
 * `SessionHeartbeat`), none of which is mapped onto a canonical rulesync event
 * here. `Interrupt` (fires instead of `Stop` when the user interrupts a turn)
-* does have a canonical shape — `stopCancelled`, which Grok CLI and Codex CLI
-* map — but Kimi keeps it native-only for now, since an existing `kimi-code`
+* does have a canonical shape — `stopCancelled`, which Grok CLI, Codex CLI and
+* Cline map — but Kimi keeps it native-only for now, since an existing `kimi-code`
 * override addressing it by name would otherwise double up with a canonical
 * `stopCancelled` block; folding it in is a follow-up. All six are listed in
 * `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override can
@@ -5040,8 +5090,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 37 entries as
-* of v0.20.2 (`v2026.8.16`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
+* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5065,11 +5115,13 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.8.16` (v0.20.2): `VALID_HOOKS` holds 37
-* entries, grown from 23 at `v2026.8.3` (v0.20.0). This list holds 36 of them —
-* see {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
+* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
+* This list holds 38 of them — see
+* {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5095,8 +5147,10 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"subagent_start",
 	"subagent_stop",
 	"pre_gateway_dispatch",
+	"agent_loop_stopped",
 	"pre_approval_request",
 	"post_approval_response",
+	"on_room_member_activity",
 	"pre_transcription",
 	"kanban_task_claimed",
 	"kanban_task_completed",
@@ -5119,8 +5173,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -5421,7 +5475,8 @@ const CANONICAL_TO_CLINE_EVENT_NAMES = {
 	preCompact: "PreCompact",
 	notification: "Notification",
 	taskCompleted: "TaskComplete",
-	afterError: "TaskError"
+	afterError: "TaskError",
+	stopCancelled: "TaskCancel"
 };
 /**
 * Map canonical camelCase event names to Copilot camelCase.
@@ -5739,8 +5794,11 @@ const QWENCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
+	postToolUseFailure: "PostToolUseFailure",
+	permissionRequest: "PermissionRequest",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	stop: "Stop",
+	stopFailure: "StopFailure",
 	sessionStart: "SessionStart",
 	sessionEnd: "SessionEnd",
 	subagentStop: "SubagentStop",
@@ -7631,11 +7689,15 @@ const KiroPermissionsOverrideSchema = z.looseObject({
 });
 /**
 * Codex CLI's approval-workflow policy. Serialized as a kebab-case string in
-* `.codex/config.toml`. `on-failure` is a legacy alias for `on-request` that
-* Codex still accepts, so it is included so existing configs round-trip. The
-* granular table form (`{ granular = { … } }`) is modeled separately in the
-* override union.
+* `.codex/config.toml`. `on-failure` is a deprecated alias for `on-request`
+* that Codex still reads, so it stays accepted (generate warns) so existing
+* configs round-trip. `untrusted` was retired in Codex 0.149.0 and makes
+* Codex refuse to start; it stays in the enum only so an existing
+* `.rulesync/permissions.jsonc` still parses — generate warns and does not
+* write it, and import does not lift it. The granular table form
+* (`{ granular = { … } }`) is modeled separately in the override union.
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
+* @see https://github.com/openai/codex/pull/39630
 */
 const CodexApprovalPolicySchema = z.enum([
 	"untrusted",
@@ -7705,11 +7767,12 @@ const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
 *   selected directly via `default_permissions` and skips the managed profile
 *   entirely — canonical filesystem/network rules are ignored in that mode.
 *   Defaults to `:workspace` when unspecified.
-* - `approval_policy` — `untrusted` | `on-request` (legacy alias `on-failure`) |
+* - `approval_policy` — `on-request` (deprecated alias `on-failure`) |
 *   `never`, or a `{ granular = { … } }` table (kept verbatim; the granular
 *   schema has required fields that are brittle to model as typed keys).
 *   Defaults to `on-request` when neither the override nor the existing
-*   config sets it.
+*   config sets it. `untrusted` (retired in Codex 0.149.0) is still parsed
+*   but skipped with a warning on generate, since Codex refuses to start on it.
 * - `sandbox_mode` — **deprecated.** `read-only` | `workspace-write` |
 *   `danger-full-access`, with the sibling `sandbox_workspace_write` table
 *   (`network_access`, `writable_roots`, …). Codex has superseded the classic
@@ -9595,7 +9658,8 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	grokcli: z.optional(z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
-		"user-invocable": z.optional(z.boolean())
+		"user-invocable": z.optional(z.boolean()),
+		paths: z.optional(z.union([z.string(), z.array(z.string())]))
 	})),
 	dsh: z.optional(z.looseObject({
 		whenToUse: z.optional(z.string()),
@@ -9822,8 +9886,32 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 		});
 	}
 };
-//#endregion
-//#region src/features/skills/skills-utils.ts
+const SKILL_DESCRIPTION_MAX_LENGTH = 1024;
+const SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Check a skill `name` against the length and character rules, phrased for the
+* `authority` that enforces them (e.g. "the Agent Skills spec" or "Zed"). When
+* that authority does something with a bad name beyond flagging it — Zed
+* refuses to load the skill — `consequence` names it so the warning says what
+* the author is about to lose. An empty name is the caller's concern: what it
+* means differs per consumer.
+*/
+function collectSkillNameViolations({ name, authority, consequence }) {
+	const violations = [];
+	if (name.length > 64) violations.push(`\`name\` is ${name.length} characters; ${authority} allows at most 64${consequence === void 0 ? "" : ` and ${consequence}`}`);
+	if (!SKILL_NAME_PATTERN.test(name)) violations.push(`\`name\` ${quoteForLog(name)} must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens${consequence === void 0 ? "" : `; ${authority} ${consequence}`}`);
+	return violations;
+}
+/**
+* Report each violation as a warning prefixed with the skill file it concerns.
+* The path is shown POSIX-style and stripped of control characters so a hostile
+* directory name cannot forge log lines; `warnWithFallback` keeps the report
+* visible when the caller has no logger to hand.
+*/
+function warnSkillViolations({ skillPath, violations, logger }) {
+	const shownPath = stripControlCharacters(toPosixPath(skillPath));
+	for (const violation of violations) warnWithFallback(logger, `${shownPath}: ${violation}`);
+}
 /**
 * Whether a directory on disk can be addressed by its name.
 *
@@ -10647,10 +10735,13 @@ const AmpCheckFrontmatterSchema = z.looseObject({
 /**
 * Represents an Amp code review check.
 *
-* Amp natively reads code review checks as Markdown files with YAML frontmatter,
-* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`).
-* Each check runs as a per-check subagent during code review.
-* @see https://ampcode.com/manual
+* Amp reads code review checks as Markdown files with YAML frontmatter,
+* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`;
+* Amp also reads `~/.config/agents/checks/`, which rulesync does not write).
+* Since the docs rebuild the supported runner is the official
+* `@amp/review-checks` plugin (`amp review` is deprecated); existing checks in
+* this format continue to apply.
+* @see https://ampcode.com/docs/review
 */
 var AmpCheck = class AmpCheck extends ToolCheck {
 	frontmatter;
@@ -16890,10 +16981,8 @@ const AgentsSkillsSkillFrontmatterSchema = z.looseObject({
 	metadata: z.optional(z.looseObject({})),
 	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 });
-const NAME_MAX_LENGTH = 64;
-const DESCRIPTION_MAX_LENGTH = 1024;
 const COMPATIBILITY_MAX_LENGTH = 500;
-const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const AGENT_SKILLS_SPEC = "the Agent Skills spec";
 /**
 * Placeholder for an object that has already been encoded once in the same
 * value. YAML anchors let one document reference the same node repeatedly, and
@@ -17057,12 +17146,14 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 	const { name, description } = frontmatter;
 	if (name.length === 0) violations.push("`name` is required and must not be empty");
 	else {
-		if (name.length > NAME_MAX_LENGTH) violations.push(`\`name\` is ${name.length} characters; the Agent Skills spec allows at most ${NAME_MAX_LENGTH}`);
-		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
+		violations.push(...collectSkillNameViolations({
+			name,
+			authority: AGENT_SKILLS_SPEC
+		}));
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
 	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
-	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
+	else if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${AGENT_SKILLS_SPEC} allows at most ${SKILL_DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
 	else if (compatibility !== void 0 && compatibility.length > COMPATIBILITY_MAX_LENGTH) violations.push(`\`compatibility\` is ${compatibility.length} characters; the Agent Skills spec allows at most ${COMPATIBILITY_MAX_LENGTH}`);
@@ -17180,16 +17271,19 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = agentSkillFilePath({
-			outputRoot,
-			relativeDirPath,
-			dirName
+		warnSkillViolations({
+			skillPath: agentSkillFilePath({
+				outputRoot,
+				relativeDirPath,
+				dirName
+			}),
+			violations: collectAgentSkillViolations({
+				frontmatter,
+				dirName,
+				sourceAllowedTools
+			}),
+			logger
 		});
-		for (const violation of collectAgentSkillViolations({
-			frontmatter,
-			dirName,
-			sourceAllowedTools
-		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -17829,6 +17923,15 @@ const KiloCommandFrontmatterSchema = z.looseObject({
 	model: z.optional(z.string()),
 	variant: z.optional(z.string())
 });
+/**
+* Command names Kilo keeps for itself. Its loader throws on a custom command
+* file named `goal.md` in either the project or the global directory ("The
+* /goal command is reserved for session goals. Rename the custom command."),
+* and a throw there aborts the whole command scan — every other custom
+* command becomes unreachable too, not only the reserved one.
+* https://github.com/Kilo-Org/kilocode/blob/v7.6.2/packages/opencode/src/command/index.ts
+*/
+const KILO_RESERVED_COMMAND_NAMES = /* @__PURE__ */ new Set(["goal"]);
 var KiloCommand = class KiloCommand extends ToolCommand {
 	frontmatter;
 	body;
@@ -17871,6 +17974,20 @@ var KiloCommand = class KiloCommand extends ToolCommand {
 			validate: true
 		});
 	}
+	/**
+	* Refuse to write a command Kilo reserves (see
+	* {@link KILO_RESERVED_COMMAND_NAMES}). The name Kilo loads is the file
+	* stem, and the processor calls this on the flattened path, so `goal.md`
+	* is refused at any nesting depth under the basename naming and only at the
+	* top level under the path naming, where `git/goal.md` becomes `git-goal`.
+	* Import is untouched: a `goal.md` already in `.kilo/commands/` is read as
+	* it is, since the reservation is Kilo's to enforce on its own files.
+	*/
+	static getWriteBlockReason({ rulesyncCommand }) {
+		const stem = basename(rulesyncCommand.getRelativeFilePath(), ".md");
+		if (!KILO_RESERVED_COMMAND_NAMES.has(stem)) return null;
+		return `Kilo reserves the /${stem} command for session goals and refuses to load a custom command by that name — it would abort Kilo's whole command scan, making every other custom command unreachable too. Rename the command, or exclude it from this target with \`targets\`.`;
+	}
 	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
 		const kiloFields = rulesyncFrontmatter.kilo ?? {};
@@ -20093,6 +20210,14 @@ var CommandsProcessor = class extends FeatureProcessor {
 			if (!factory.class.isTargetedByRulesyncCommand(rulesyncCommand)) return null;
 			const originalRelativePath = rulesyncCommand.getRelativeFilePath();
 			const commandToConvert = factory.meta.supportsSubdirectory ? rulesyncCommand : this.flattenRelativeFilePath(rulesyncCommand);
+			const writeBlockReason = factory.class.getWriteBlockReason?.({
+				rulesyncCommand: commandToConvert,
+				global: this.global
+			});
+			if (writeBlockReason !== void 0 && writeBlockReason !== null) {
+				this.logger.warn(`Skipping command ${quoteForLog(originalRelativePath)} for '${this.toolTarget}': ${writeBlockReason}`);
+				return null;
+			}
 			if (!factory.meta.supportsSubdirectory) {
 				const flattenedPath = commandToConvert.getRelativeFilePath();
 				const firstOrigin = flattenedPathOrigins.get(flattenedPath);
@@ -20962,6 +21087,72 @@ function isSupportedHookType({ type, converterConfig }) {
 	return converterConfig.supportedHookTypes?.has(type ?? "command") ?? true;
 }
 /**
+* Whether a keyword field applies to this hook, warning about the reason when
+* it does not. Shared by both directions: the field is unusable on the tool
+* side either way, so the value is dropped rather than carried into a config
+* the tool would ignore or refuse.
+*/
+function isKeywordFieldApplicable({ spec, hookType, eventName, direction, warn }) {
+	const { canonical, tool, commandOnly, events } = spec;
+	const field = direction === "generated" ? canonical : tool;
+	if (!isFieldApplicable({
+		commandOnly,
+		hookType
+	})) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not ${direction}.`);
+		return false;
+	}
+	if (events !== void 0 && !events.has(eventName)) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		return false;
+	}
+	return true;
+}
+/**
+* Emit the keyword passthrough fields: a canonical `true` becomes the tool's
+* keyword, while `false` is omitted as the tool's own default. A `true` the
+* tool would not honour on this hook is warned about, like the other kinds;
+* a `false` there is dropped silently, since omitting it changes nothing.
+*/
+function emitKeywordFields({ def, hookType, eventName, fields, warn }) {
+	const emitted = {};
+	for (const spec of fields) {
+		if (def[spec.canonical] !== true) continue;
+		if (isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "generated",
+			warn
+		})) emitted[spec.tool] = spec.trueValue;
+	}
+	return emitted;
+}
+/**
+* Import the keyword passthrough fields back into canonical booleans,
+* reversing {@link emitKeywordFields}. Only the two documented keywords are
+* read; anything else is warned about and dropped, so a typo in a hand-written
+* tool file never lands in `.rulesync/hooks.*` as a boolean it did not mean.
+*/
+function importKeywordFields({ h, hookType, eventName, fields, warn }) {
+	const imported = {};
+	for (const spec of fields) {
+		const value = h[spec.tool];
+		if (value === void 0) continue;
+		if (!isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "imported",
+			warn
+		})) continue;
+		if (value === spec.trueValue) imported[spec.canonical] = true;
+		else if (spec.falseValue !== void 0 && value === spec.falseValue) imported[spec.canonical] = false;
+		else warn?.(`Dropping "${spec.tool}" from an imported "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool documents for it.`);
+	}
+	return imported;
+}
+/**
 * Emit every per-hook passthrough kind for one canonical definition.
 */
 function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, warn }) {
@@ -20974,6 +21165,13 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 			isValid: isBooleanValue,
 			warn
 		}),
+		...emitKeywordFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...emitPassthroughFields({
 			def,
 			hookType,
@@ -21302,7 +21500,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 * Import every per-hook passthrough kind for one tool hook record, reversing
 * the emit side in {@link buildToolHooks}.
 */
-function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
+function importAllPassthroughFields({ h, hookType, eventName, converterConfig, warn }) {
 	return {
 		...importPassthroughFields({
 			h,
@@ -21311,6 +21509,13 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 			isValid: isBooleanValue,
 			warn
 		}),
+		...importKeywordFields({
+			h,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...importPassthroughFields({
 			h,
 			hookType,
@@ -21356,7 +21561,7 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 /**
 * Convert a single tool hook record into a canonical hook definition.
 */
-function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
+function toolHookToCanonical({ h, rawEntry, eventName, converterConfig, warn }) {
 	const hookType = resolveImportedHookType({
 		value: h.type,
 		converterConfig
@@ -21404,6 +21609,7 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 		...importAllPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			converterConfig,
 			warn
 		}),
@@ -21490,7 +21696,7 @@ function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
 /**
 * Convert a single tool matcher entry into canonical hook definitions.
 */
-function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
+function toolMatcherEntryToCanonical({ rawEntry, eventName, converterConfig, warn }) {
 	const hookDefs = rawEntry.hooks ?? [];
 	const groupSkipReason = describeGroupSkipReason({
 		rawEntry,
@@ -21518,6 +21724,7 @@ function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
 		definitions.push(toolHookToCanonical({
 			h,
 			rawEntry,
+			eventName,
 			converterConfig,
 			warn
 		}));
@@ -21565,6 +21772,7 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 			if (!isToolMatcherEntry(rawEntry)) continue;
 			defs.push(...toolMatcherEntryToCanonical({
 				rawEntry,
+				eventName,
 				converterConfig,
 				warn
 			}));
@@ -25185,7 +25393,15 @@ const GOOSE_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: GOOSE_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
+	wildcardMatcherMeansAll: true,
+	keywordPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "on_failure",
+		trueValue: "block",
+		falseValue: "allow",
+		commandOnly: true,
+		events: /* @__PURE__ */ new Set(["preToolUse"])
+	}]
 };
 /**
 * Represents a Goose lifecycle hooks file.
@@ -25494,7 +25710,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.2; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -26374,7 +26590,8 @@ const KiroIdeHookEntrySchema = z.looseObject({
 	matcher: z.optional(z.string()),
 	action: z.optional(KiroIdeHookActionSchema),
 	timeout: z.optional(z.number()),
-	enabled: z.optional(z.boolean())
+	enabled: z.optional(z.boolean()),
+	confirm: z.optional(HookConfirmSchema)
 });
 const KiroIdeHooksFileSchema = z.looseObject({
 	version: z.optional(z.string()),
@@ -26413,7 +26630,8 @@ function buildKiroIdeEntriesForEvent(trigger, definitions) {
 			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
 			action,
 			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
-			enabled: def.enabled ?? true
+			enabled: def.enabled ?? true,
+			...def.confirm !== void 0 && { confirm: def.confirm }
 		});
 	}
 	return entries;
@@ -26455,6 +26673,14 @@ function canonicalToKiroIdeHooks(config) {
 	}
 	return entries;
 }
+/**
+* Copies the optional per-hook fields (`enabled`, `confirm`) back onto the
+* canonical definition.
+*/
+function copyOptionalHookFields({ entry, def }) {
+	if (entry.enabled === false) def.enabled = false;
+	if (entry.confirm !== void 0 && entry.confirm !== null) def.confirm = omitPrototypePollutionKeysDeep(entry.confirm);
+}
 function kiroIdeHooksToCanonical(entries) {
 	const canonical = {};
 	for (const entry of entries) {
@@ -26478,7 +26704,10 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
-		if (entry.enabled === false) def.enabled = false;
+		copyOptionalHookFields({
+			entry,
+			def
+		});
 		const list = lookupOwn({
 			record: canonical,
 			key: eventName
@@ -27485,10 +27714,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/reasonix-hooks.ts
 /**
-* Only PreToolUse/PostToolUse honor the `match` field (an anchored regex
-* against the tool name); it is ignored on every other event.
+* Only the tool-scoped events honor the `match` field (an anchored regex
+* against the tool name); it is ignored on every other event. Mirrors
+* `UsesToolMatcher` in upstream `internal/hook/inspect.go`.
 */
-const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"PreToolUse",
+	"PostToolUse",
+	"PostToolUseFailure",
+	"PermissionRequest"
+]);
 const SUPPORTED_REASONIX_EVENTS = new Set(REASONIX_HOOK_EVENTS);
 /**
 * Convert canonical hooks config to the Reasonix `hooks` object.
@@ -27570,9 +27805,11 @@ function reasonixHooksToCanonical(hooks) {
 * Reasonix hooks live in a Claude-Code-style but standalone JSON file —
 * `.reasonix/settings.json` (project) or `~/.reasonix/settings.json`
 * (global) — separate from the `[permissions]`/`[[plugins]]` TOML config.
-* All ten upstream events have a clean canonical equivalent and are mapped:
-* PreToolUse/PostToolUse/UserPromptSubmit/Stop plus SessionStart/SessionEnd/
-* SubagentStop/PostLLMCall/Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* All thirteen upstream events have a clean canonical equivalent and are mapped:
+* PreToolUse/PostToolUse/PostToolUseFailure/PermissionRequest/UserPromptSubmit/
+* Stop/StopFailure plus SessionStart/SessionEnd/SubagentStop/PostLLMCall/
+* Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 var ReasonixHooks = class ReasonixHooks extends ToolHooks {
@@ -28398,6 +28635,23 @@ const PER_HOOK_ENABLED_TARGETS = /* @__PURE__ */ new Set([
 	"kiro-ide",
 	"zcode"
 ]);
+/** The targets whose hooks format carries the Kiro `confirm` prompt. */
+const PER_HOOK_CONFIRM_TARGETS = /* @__PURE__ */ new Set(["kiro-cli", "kiro-ide"]);
+/**
+* Names the shared events that carry a hook whose canonical definition
+* satisfies `predicate`, excluding events the target skips altogether (those
+* are already reported as skipped and produce no output, so warning about them
+* again would contradict that message).
+*/
+function emittedEventsWithHook(params) {
+	const { factory, sharedHooks, effectiveHooks, predicate } = params;
+	const skippedEvents = new Set(unsupportedEventNames({
+		factory,
+		sharedHooks,
+		effectiveHooks
+	}));
+	return Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => predicate(def))).map(([event]) => event);
+}
 const toolHooksFactories = /* @__PURE__ */ new Map([
 	["amp", {
 		class: AmpHooks,
@@ -28968,15 +29222,11 @@ var HooksProcessor = class extends FeatureProcessor {
 			}
 			for (const [hookType, events] of unsupportedTypeToEvents) this.logger.warn(`Skipped ${hookType}-type hook(s) for ${this.toolTarget} (not supported): ${Array.from(events).join(", ")}`);
 		}
-		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
-			const skippedEvents = new Set(unsupportedEventNames({
-				factory,
-				sharedHooks,
-				effectiveHooks
-			}));
-			const eventsWithDisabledHooks = Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => def.enabled === false)).map(([event]) => event);
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
-		}
+		this.warnAboutDroppedPerHookFields({
+			factory,
+			sharedHooks,
+			effectiveHooks
+		});
 		const eventsWithUnsupportedMatcher = unsupportedMatcherEventNames({
 			factory,
 			effectiveHooks
@@ -29006,6 +29256,33 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (auxiliaryFiles && auxiliaryFiles.length > 0) result.push(...auxiliaryFiles);
 		return result;
 	}
+	/**
+	* Warns about canonical per-hook fields that this target's hooks format
+	* cannot express, so a hook does not silently change behavior on generation.
+	* Only canonical definitions are considered: a tool-native field inside an
+	* override block is passed through verbatim and honored by that tool.
+	*/
+	warnAboutDroppedPerHookFields(params) {
+		const { factory, sharedHooks, effectiveHooks } = params;
+		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
+			const eventsWithDisabledHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.enabled === false
+			});
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
+		}
+		if (!PER_HOOK_CONFIRM_TARGETS.has(this.toolTarget)) {
+			const eventsWithConfirmHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.confirm !== void 0
+			});
+			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the kiro-cli / kiro-ide hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
+		}
+	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
 		const hooks = toolFiles.filter((f) => f instanceof ToolHooks);
 		const logger = withToolTargetPrefix({
@@ -34807,28 +35084,60 @@ function resolveHermesTimeout(config) {
 	if (typeof config.networkTimeout === "number") return config.networkTimeout;
 }
 /**
-* Copies the advanced Hermes-recognized per-server fields that have no canonical
-* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
-* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
-* `connect_timeout` (seconds), `supports_parallel_tool_calls`,
-* `keepalive_interval`, `elicitation`, `trust`, and `identity_header` — verbatim
-* from `source` to `target`. Field names are identical on both sides (the
-* canonical `McpServerSchema` is a `looseObject`), so this serves export and
-* import alike. See the Hermes mcp-config-reference.
+* String-valued `oauth` keys Hermes reads (`tools/mcp_oauth.py`,
+* `tools/mcp_oauth_device.py`, v0.21.3): the callback overrides, the
+* pre-registered client, the CIMD document override, the DCR registration
+* fields, the token-request `user_agent`, the login `flow` (`device` for
+* RFC 8628) and the space-separated `scope` string sent on registration and
+* device authorization.
+*/
+const HERMES_OAUTH_STRING_KEYS = [
+	"redirect_uri",
+	"redirect_host",
+	"client_id",
+	"client_secret",
+	"client_name",
+	"client_metadata_url",
+	"token_endpoint_auth_method",
+	"application_type",
+	"user_agent",
+	"flow",
+	"scope"
+];
+/**
+* Copies the `oauth` mapping of a server, keeping only the keys Hermes reads.
+*
+* Hermes reads a single `scope` string, never a `scopes` list; earlier Rulesync
+* versions wrote `scopes` regardless, which Hermes silently ignored. A `scopes`
+* list is therefore folded into `scope` (space-separated, the OAuth wire form)
+* when no `scope` is given, in both directions, so an authored list finally
+* reaches the authorization server and an old `config.yaml` imports cleanly.
 */
 function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
-	for (const key of [
-		"redirect_uri",
-		"redirect_host",
-		"client_id",
-		"client_secret"
-	]) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof source.redirect_port === "number") oauth.redirect_port = source.redirect_port;
-	if (isStringArray$2(source.scopes)) oauth.scopes = source.scopes;
+	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
+	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
+	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_OPAQUE_MAPPING_KEYS = [
+	"sampling",
+	"elicitation",
+	"identity_header",
+	"lifecycle"
+];
+/**
+* Copies the advanced Hermes-recognized per-server fields that have no canonical
+* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
+* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
+* `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* verbatim from `source` to `target`. Field names are identical on both sides
+* (the canonical `McpServerSchema` is a `looseObject`), so this serves export
+* and import alike. See the Hermes mcp-config-reference.
+*/
 function copyHermesAdvancedFields(source, target) {
 	let copied = false;
 	if (typeof source.auth === "string") {
@@ -34860,6 +35169,14 @@ function copyHermesAdvancedFields(source, target) {
 		target[key] = source[key];
 		copied = true;
 	}
+	if (typeof source.protocol === "string") {
+		target.protocol = source.protocol;
+		copied = true;
+	}
+	if (typeof source.lazy === "boolean") {
+		target.lazy = source.lazy;
+		copied = true;
+	}
 	if (typeof source.ssl_verify === "boolean" || typeof source.ssl_verify === "string") {
 		target.ssl_verify = source.ssl_verify;
 		copied = true;
@@ -34868,25 +35185,20 @@ function copyHermesAdvancedFields(source, target) {
 		target.skip_preflight = source.skip_preflight;
 		copied = true;
 	}
-	if (isPlainObject$1(source.sampling)) {
-		target.sampling = omitPrototypePollutionKeys(structuredClone(source.sampling));
-		copied = true;
-	}
 	if (typeof source.keepalive_interval === "number") {
 		target.keepalive_interval = source.keepalive_interval;
 		copied = true;
 	}
-	if (isPlainObject$1(source.elicitation)) {
-		target.elicitation = omitPrototypePollutionKeys(structuredClone(source.elicitation));
-		copied = true;
-	}
 	if (typeof source.trust === "string") {
 		target.trust = source.trust;
 		copied = true;
 	}
-	if (isPlainObject$1(source.identity_header)) {
-		target.identity_header = omitPrototypePollutionKeys(structuredClone(source.identity_header));
-		copied = true;
+	for (const key of HERMES_OPAQUE_MAPPING_KEYS) {
+		const mapping = source[key];
+		if (isPlainObject$1(mapping)) {
+			target[key] = omitPrototypePollutionKeys(structuredClone(mapping));
+			copied = true;
+		}
 	}
 	return copied;
 }
@@ -35670,6 +35982,7 @@ function toKimiCodeServer({ name, server, logger }) {
 		"headers",
 		"bearerTokenEnvVar",
 		"enabled",
+		"deferred",
 		"startupTimeoutMs",
 		"toolTimeoutMs",
 		"enabledTools",
@@ -36327,7 +36640,12 @@ const OpencodeMcpRemoteServerSchema = z.looseObject({
 	headers: z.optional(z.record(z.string(), z.string())),
 	enabled: z._default(z.boolean(), true)
 });
-const OPENCODE_PASSTHROUGH_SERVER_FIELDS = ["timeout", "oauth"];
+const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
+	"timeout",
+	"oauth",
+	"protocol",
+	"codemode"
+];
 const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
 	...Object.keys(OpencodeMcpRemoteServerSchema.def.shape),
@@ -36469,7 +36787,7 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - env -> environment
 * - disabled -> enabled (inverted)
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
-* - OpenCode-supported extras (timeout, oauth) -> passed through verbatim
+* - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
 */
 function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, logger) {
 	const serverRecord = serverConfig;
@@ -39462,7 +39780,7 @@ var ToolPermissions = class extends ToolFile {
 * builtin of that name). It lives in the shared Amp settings file:
 * `.amp/settings.json` (project) and `~/.config/amp/settings.json` (global).
 *
-* Reference: https://ampcode.com/manual ("amp.tools.disable").
+* Reference: https://ampcode.com/docs/cli/settings ("amp.tools.disable").
 */
 const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 /**
@@ -39473,19 +39791,26 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * glob. Rules are evaluated **first-match-wins**. It lives in the same shared
 * Amp settings file as `amp.tools.disable`.
 *
-* `amp.permissions` is Amp's documented legacy/backwards-compat surface — it
-* remains functional and is the only place to express `allow`/`ask` and
-* argument-specific `reject` rules (the simpler `amp.tools.disable` array can
-* only disable whole tools).
+* `amp.permissions` is Amp's legacy/backwards-compat surface — it remains
+* functional in the shipped CLI and is the only place to express `allow`/`ask`
+* and argument-specific `reject` rules (the simpler `amp.tools.disable` array
+* can only disable whole tools). The web docs no longer describe it (the
+* permissions section only points at custom plugins), but the shipped CLI
+* still lists it in its built-in settings reference (`amp --help`) and
+* evaluates it through `amp permissions list|test`.
 *
-* Reference: https://ampcode.com/manual ("amp.permissions").
+* Reference: https://ampcode.com/docs/tools#permissions and
+* https://ampcode.com/docs/customize/plugins#example-plugin-permissions.
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
 /**
 * The `amp.guardedFiles.allowlist` array (file globs allowed without
 * confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
 * and `amp.mcpPermissions` array — sibling settings authored through the `amp`
-* permissions override. Reference: https://ampcode.com/manual.
+* permissions override. Only `amp.mcpPermissions` is still on the web docs
+* (https://ampcode.com/docs/cli/settings); the other two, like
+* `amp.permissions`, survive only in the CLI's built-in settings reference
+* (see `AMP_PERMISSIONS_KEY`).
 */
 const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
 const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
@@ -42814,6 +43139,8 @@ const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
 const CODEX_EXTENDABLE_BASELINES = new Set(CODEX_EXTENDABLE_BASELINE_PROFILES);
 const CODEX_DEFAULT_APPROVAL_POLICY = "on-request";
 const CODEX_DEFAULT_APPROVALS_REVIEWER = "auto_review";
+const CODEX_RETIRED_APPROVAL_POLICY = "untrusted";
+const CODEX_DEPRECATED_APPROVAL_POLICY = "on-failure";
 const CODEX_GLOB_SCAN_MAX_DEPTH = 8;
 const CODEX_MINIMAL_KEY = ":minimal";
 const CODEX_GIT_WRITE_RULES = { ".git/**": "write" };
@@ -42937,6 +43264,10 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			domainsHadUnknown
 		});
 		const override = extractCodexcliOverride(table);
+		if (override.approval_policy === CODEX_RETIRED_APPROVAL_POLICY) {
+			warnWithFallback(void 0, `${join(this.getRelativeDirPath(), this.getRelativeFilePath())} sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start. It was not imported; remove it from the file, or mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			delete override.approval_policy;
+		}
 		if (typeof profile?.extends === "string" && CODEX_EXTENDABLE_BASELINES.has(profile.extends)) override.base_permission_profile = profile.extends;
 		if (defaultProfile === CODEX_DANGER_FULL_ACCESS_BASELINE) override.base_permission_profile = CODEX_DANGER_FULL_ACCESS_BASELINE;
 		const result = Object.keys(override).length > 0 ? {
@@ -43225,6 +43556,10 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			continue;
 		}
 		if (value === void 0) continue;
+		if (key === "approval_policy" && !isWritableApprovalPolicy({
+			value,
+			logger
+		})) continue;
 		if (key === "sandbox_mode" || key === "sandbox_workspace_write") logger?.warn(`Codex CLI permission override key "${key}" is deprecated. Codex prioritizes the legacy sandbox settings over permission profiles when both are present, so it disables the generated "${RULESYNC_PROFILE_NAME}" permissions profile. Use "base_permission_profile" and the shared "permission" block instead.`);
 		const existingValue = existing[key];
 		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
@@ -43232,12 +43567,37 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			...value
 		} : value;
 	}
+	fillCodexcliDefaults({
+		existing,
+		patch,
+		logger
+	});
+	return patch;
+}
+function fillCodexcliDefaults({ existing, patch, logger }) {
 	const defaults = {
 		approval_policy: CODEX_DEFAULT_APPROVAL_POLICY,
 		approvals_reviewer: CODEX_DEFAULT_APPROVALS_REVIEWER
 	};
-	for (const [key, value] of Object.entries(defaults)) if (patch[key] === void 0 && existing[key] === void 0) patch[key] = value;
-	return patch;
+	for (const [key, value] of Object.entries(defaults)) {
+		if (patch[key] !== void 0) continue;
+		if (existing[key] === void 0) {
+			patch[key] = value;
+			continue;
+		}
+		if (key === "approval_policy" && existing[key] === CODEX_RETIRED_APPROVAL_POLICY) {
+			logger?.warn(`The existing Codex CLI config.toml sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start, so it was replaced with "${value}". To keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			patch[key] = value;
+		}
+	}
+}
+function isWritableApprovalPolicy({ value, logger }) {
+	if (value === CODEX_RETIRED_APPROVAL_POLICY) {
+		logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_RETIRED_APPROVAL_POLICY}" was retired in Codex 0.149.0 and makes Codex refuse to start, so it was not written. Remove it from the override; to keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+		return false;
+	}
+	if (value === CODEX_DEPRECATED_APPROVAL_POLICY) logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_DEPRECATED_APPROVAL_POLICY}" is deprecated; Codex reads it as "${CODEX_DEFAULT_APPROVAL_POLICY}". Use "${CODEX_DEFAULT_APPROVAL_POLICY}" instead.`);
+	return true;
 }
 function extractCodexcliOverride(table) {
 	const override = {};
@@ -51689,6 +52049,18 @@ const TAKT_RUNTIME_TARGETS_KEY = "targets";
 const TAKT_RUNTIME_AUTO_ROUTING_KEY = "auto_routing";
 const TAKT_RUNTIME_PROFILE_KEY = "profile";
 const TAKT_RUNTIME_OPTIONS_KEY = "options";
+const TAKT_RUNTIME_ASSIGNMENTS_KEY = "assignments";
+const TAKT_RUNTIME_LADDER_KEY = "ladder";
+const TAKT_RUNTIME_EXTENDS_KEY = "extends";
+const TAKT_RUNTIME_ROUTER_PROFILE_KEY = "router_profile";
+const TAKT_RUNTIME_POOLS_KEY = "pools";
+const TAKT_RUNTIME_CANDIDATES_KEY = "candidates";
+const TAKT_RUNTIME_FALLBACK_PROFILE_KEY = "fallback_profile";
+/** The one `targets` map that routes companion reviewers rather than agents. */
+const TAKT_RUNTIME_COMPANIONS_TARGET_KEY = "companions";
+const TAKT_RUNTIME_COMPANION_KEY = "companion";
+const TAKT_RUNTIME_ENABLED_KEY = "enabled";
+const TAKT_DEFAULT_COMPANION_ENABLED = false;
 const TAKT_SECURITY_POLICIES = {
 	workflow_arpeggio: [
 		"custom_data_source_modules",
@@ -51942,21 +52314,156 @@ function runtimeProfiles(runtime) {
 	const profiles = provider[TAKT_RUNTIME_PROFILES_KEY];
 	return isPlainObject$1(profiles) ? profiles : {};
 }
+/** A `targets` map (`personas`, `tags`, …) with at least one non-empty entry. */
+function hasTargetContent(targets) {
+	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+}
+/** The profile names an assignment points at: `profile` plus every `ladder` rung. */
+function assignmentProfileNames(assignment) {
+	if (!isPlainObject$1(assignment)) return [];
+	const names = [];
+	const profile = assignment[TAKT_RUNTIME_PROFILE_KEY];
+	if (typeof profile === "string") names.push(profile);
+	const ladder = assignment[TAKT_RUNTIME_LADDER_KEY];
+	if (Array.isArray(ladder)) names.push(...ladder.filter((rung) => typeof rung === "string"));
+	return names;
+}
+/** The assignments under a `targets` map, split by whether they route companions. */
+function targetAssignments(targets, { companions }) {
+	if (!isPlainObject$1(targets)) return [];
+	return Object.entries(targets).filter(([name]) => name === TAKT_RUNTIME_COMPANIONS_TARGET_KEY === companions).flatMap(([, targetMap]) => isPlainObject$1(targetMap) ? Object.values(targetMap) : []);
+}
+/**
+* Record the profiles a `defaults` + `targets` pair (the top-level provider
+* section or one named assignment set) reaches, keeping companion roots apart
+* from the roots agents use.
+*/
+function addAssignmentSetRoots({ set, companionRoots, agentRoots }) {
+	for (const name of assignmentProfileNames(set[TAKT_RUNTIME_DEFAULTS_KEY])) agentRoots.add(name);
+	const targets = set[TAKT_RUNTIME_TARGETS_KEY];
+	for (const assignment of targetAssignments(targets, { companions: false })) for (const name of assignmentProfileNames(assignment)) agentRoots.add(name);
+	for (const assignment of targetAssignments(targets, { companions: true })) for (const name of assignmentProfileNames(assignment)) companionRoots.add(name);
+}
+/** The profiles `auto_routing` reaches: the router plus every pool candidate/fallback. */
+function addAutoRoutingRoots(autoRouting, roots) {
+	if (!isPlainObject$1(autoRouting)) return;
+	const routerProfile = autoRouting[TAKT_RUNTIME_ROUTER_PROFILE_KEY];
+	if (typeof routerProfile === "string") roots.add(routerProfile);
+	const pools = autoRouting[TAKT_RUNTIME_POOLS_KEY];
+	if (!isPlainObject$1(pools)) return;
+	for (const pool of Object.values(pools)) {
+		if (!isPlainObject$1(pool)) continue;
+		const candidates = pool[TAKT_RUNTIME_CANDIDATES_KEY];
+		for (const candidate of Array.isArray(candidates) ? candidates : []) for (const name of assignmentProfileNames(candidate)) roots.add(name);
+		const fallback = pool[TAKT_RUNTIME_FALLBACK_PROFILE_KEY];
+		if (typeof fallback === "string") roots.add(fallback);
+	}
+}
+/** Every profile reachable from `roots` by following `extends`. */
+function profileClosure(profiles, roots) {
+	const closure = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		if (closure.has(name)) return;
+		closure.add(name);
+		const profile = profiles[name];
+		const parent = isPlainObject$1(profile) ? profile[TAKT_RUNTIME_EXTENDS_KEY] : void 0;
+		if (typeof parent === "string") visit(parent);
+	};
+	for (const root of roots) visit(root);
+	return closure;
+}
+/** The `targets` map minus its `companions` entry (`undefined` when not a map). */
+function withoutCompanionTargets(targets) {
+	if (!isPlainObject$1(targets)) return;
+	const { [TAKT_RUNTIME_COMPANIONS_TARGET_KEY]: _companions, ...remaining } = targets;
+	return remaining;
+}
+/**
+* The named assignment sets with their companion targets removed; a set left
+* with neither `defaults` nor a non-empty `targets` map is dropped, and
+* `undefined` means none survived.
+*/
+function withoutCompanionAssignments(assignments) {
+	if (!isPlainObject$1(assignments)) return;
+	const remaining = {};
+	for (const [name, set] of Object.entries(assignments)) {
+		if (!isPlainObject$1(set)) continue;
+		const defaults = set[TAKT_RUNTIME_DEFAULTS_KEY];
+		const targets = withoutCompanionTargets(set[TAKT_RUNTIME_TARGETS_KEY]);
+		const keepTargets = hasTargetContent(targets);
+		if (defaults === void 0 && !keepTargets) continue;
+		remaining[name] = {
+			...defaults === void 0 ? {} : { [TAKT_RUNTIME_DEFAULTS_KEY]: defaults },
+			...keepTargets ? { [TAKT_RUNTIME_TARGETS_KEY]: targets } : {}
+		};
+	}
+	return Object.keys(remaining).length > 0 ? remaining : void 0;
+}
+/** Whether the section (or any of its named assignment sets) routes companions at all. */
+function hasCompanionTargets(section) {
+	const routesCompanions = (set) => {
+		const targets = isPlainObject$1(set) ? set[TAKT_RUNTIME_TARGETS_KEY] : void 0;
+		return isPlainObject$1(targets) && targets[TAKT_RUNTIME_COMPANIONS_TARGET_KEY] !== void 0;
+	};
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	return routesCompanions(section) || isPlainObject$1(assignments) && Object.values(assignments).some(routesCompanions);
+}
+/**
+* The `provider:` section as Takt itself evaluates it, mirroring upstream's
+* `getEffectiveProviderSection`: unless `companion.enabled` is `true`
+* (companions are opt-in), the `targets.companions` maps — top-level and inside
+* every named assignment set — are dropped, along with each profile that only a
+* companion target reaches through `extends`. A profile an agent assignment
+* (`defaults`, the other `targets` maps, `auto_routing`) also reaches is kept.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/schema.ts
+*/
+function effectiveRuntimeProviderSection(runtime) {
+	const section = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	if (!isPlainObject$1(section)) return;
+	const companion = runtime[TAKT_RUNTIME_COMPANION_KEY];
+	if (((isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0) ?? TAKT_DEFAULT_COMPANION_ENABLED) === true || !hasCompanionTargets(section)) return section;
+	const profiles = runtimeProfiles(runtime);
+	const companionRoots = /* @__PURE__ */ new Set();
+	const agentRoots = /* @__PURE__ */ new Set();
+	addAssignmentSetRoots({
+		set: section,
+		companionRoots,
+		agentRoots
+	});
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	for (const set of isPlainObject$1(assignments) ? Object.values(assignments) : []) if (isPlainObject$1(set)) addAssignmentSetRoots({
+		set,
+		companionRoots,
+		agentRoots
+	});
+	addAutoRoutingRoots(section[TAKT_RUNTIME_AUTO_ROUTING_KEY], agentRoots);
+	const companionClosure = profileClosure(profiles, companionRoots);
+	const agentClosure = profileClosure(profiles, agentRoots);
+	const effective = {
+		...section,
+		[TAKT_RUNTIME_PROFILES_KEY]: Object.fromEntries(Object.entries(profiles).filter(([name]) => !companionClosure.has(name) || agentClosure.has(name)))
+	};
+	for (const [key, value] of [[TAKT_RUNTIME_TARGETS_KEY, withoutCompanionTargets(section[TAKT_RUNTIME_TARGETS_KEY])], [TAKT_RUNTIME_ASSIGNMENTS_KEY, withoutCompanionAssignments(assignments)]]) if (value === void 0) delete effective[key];
+	else effective[key] = value;
+	return effective;
+}
 /**
 * Whether a parsed `runtime.yaml` puts Takt into runtime mode, mirroring
-* upstream's mode detection: the `provider:` section must carry an actual
-* assignment — a non-empty `defaults`, `profiles` or `auto_routing`, or a
-* `targets` map with at least one non-empty nested map. The file existing is not
-* enough, and empty nested maps (`defaults: {}`, `targets: { personas: {} }`)
-* must not flip the mode.
+* upstream's mode detection: the effective `provider:` section (see
+* `effectiveRuntimeProviderSection` — companion-only routing does not count
+* while companions are disabled) must carry an actual assignment — a non-empty
+* `defaults`, `profiles` or `auto_routing`, a `targets` map with at least one
+* non-empty nested map, or a named assignment set with a non-empty `defaults`
+* or such a `targets` map. The file existing is not enough, and empty nested
+* maps (`defaults: {}`, `targets: { personas: {} }`) must not flip the mode.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/mode.ts
 */
 function isRuntimeModeActive(runtime) {
-	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
-	if (!isPlainObject$1(provider)) return false;
-	if (hasEntries(provider[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(provider[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(provider[TAKT_RUNTIME_AUTO_ROUTING_KEY])) return true;
-	const targets = provider[TAKT_RUNTIME_TARGETS_KEY];
-	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+	const section = effectiveRuntimeProviderSection(runtime);
+	if (section === void 0) return false;
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	const hasAssignments = isPlainObject$1(assignments) && Object.values(assignments).some((set) => isPlainObject$1(set) && (hasEntries(set[TAKT_RUNTIME_DEFAULTS_KEY]) || hasTargetContent(set[TAKT_RUNTIME_TARGETS_KEY])));
+	return hasEntries(section[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(section[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(section[TAKT_RUNTIME_AUTO_ROUTING_KEY]) || hasTargetContent(section[TAKT_RUNTIME_TARGETS_KEY]) || hasAssignments;
 }
 /** The provider named by the runtime profile Takt would use by default. */
 function resolveRuntimeProvider(runtime) {
@@ -51979,10 +52486,13 @@ function resolveRuntimeProvider(runtime) {
 * shape the `takt` override uses. Each profile's options belong to that
 * profile's own provider; when several profiles name the same provider they are
 * merged in document order, so a later profile wins on a colliding option key.
+* Profiles Takt itself ignores (companion-only ones while companions are
+* disabled) are skipped, as they never reach an agent.
 */
 function collectRuntimeProviderOptions(runtime) {
 	const collected = {};
-	for (const profile of Object.values(runtimeProfiles(runtime))) {
+	const profiles = effectiveRuntimeProviderSection(runtime)?.[TAKT_RUNTIME_PROFILES_KEY];
+	for (const profile of Object.values(isPlainObject$1(profiles) ? profiles : {})) {
 		if (!isPlainObject$1(profile)) continue;
 		const providerName = profile[TAKT_RUNTIME_PROVIDER_KEY];
 		const options = profile[TAKT_RUNTIME_OPTIONS_KEY];
@@ -52021,13 +52531,20 @@ async function readTaktRuntimeFile({ filePath, logger }) {
 		};
 	}
 }
+/** A map-valued key of a `provider:` section, or `undefined` when it is not a map. */
+function runtimeSectionMap(section, key) {
+	return isPlainObject$1(section[key]) ? section[key] : void 0;
+}
 /**
 * Collapse the project and global `runtime.yaml` into the single document Takt
-* itself resolves against, matching upstream's loader: `profiles` is a union
-* with the project definition of a same-named profile replacing the global one,
-* while `defaults`, `targets` and `auto_routing` are taken from the project file
-* whole whenever it states them at all (`??`, so a project `targets: {}` masks
-* the global one rather than merging with it).
+* itself resolves against, matching upstream's loader: `profiles` and
+* `assignments` are unions with the project definition of a same-named entry
+* replacing the global one, while `defaults`, `targets` and `auto_routing` are
+* taken from the project file whole whenever it states them at all (`??`, so a
+* project `targets: {}` masks the global one rather than merging with it). The
+* top-level `companion.enabled` — which decides whether companion routing
+* counts for mode detection — is carried as upstream carries it: unset when
+* neither file states it, otherwise on only when neither file turns it off.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/loader.ts
 *
 * Merging before mode detection matters in both directions: a project file
@@ -52043,14 +52560,15 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 	const projectSection = sectionOf(project);
 	const globalSection = sectionOf(globalConfig);
 	const replaced = (key) => projectSection[key] ?? globalSection[key];
-	const profilesOf = (section) => isPlainObject$1(section[TAKT_RUNTIME_PROFILES_KEY]) ? section[TAKT_RUNTIME_PROFILES_KEY] : void 0;
-	const globalProfiles = profilesOf(globalSection);
-	const projectProfiles = profilesOf(projectSection);
 	const provider = {};
-	if (globalProfiles !== void 0 || projectProfiles !== void 0) provider[TAKT_RUNTIME_PROFILES_KEY] = {
-		...globalProfiles,
-		...projectProfiles
-	};
+	for (const key of [TAKT_RUNTIME_PROFILES_KEY, TAKT_RUNTIME_ASSIGNMENTS_KEY]) {
+		const globalMap = runtimeSectionMap(globalSection, key);
+		const projectMap = runtimeSectionMap(projectSection, key);
+		if (globalMap !== void 0 || projectMap !== void 0) provider[key] = {
+			...globalMap,
+			...projectMap
+		};
+	}
 	for (const key of [
 		TAKT_RUNTIME_DEFAULTS_KEY,
 		TAKT_RUNTIME_TARGETS_KEY,
@@ -52059,7 +52577,17 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 		const value = replaced(key);
 		if (value !== void 0) provider[key] = value;
 	}
-	return { [TAKT_RUNTIME_PROVIDER_KEY]: provider };
+	const enabledOf = (config) => {
+		const companion = config?.[TAKT_RUNTIME_COMPANION_KEY];
+		return isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0;
+	};
+	const globalEnabled = enabledOf(globalConfig);
+	const projectEnabled = enabledOf(project);
+	const companion = globalEnabled === void 0 && projectEnabled === void 0 ? void 0 : { [TAKT_RUNTIME_ENABLED_KEY]: globalEnabled !== false && projectEnabled !== false };
+	return {
+		[TAKT_RUNTIME_PROVIDER_KEY]: provider,
+		...companion === void 0 ? {} : { [TAKT_RUNTIME_COMPANION_KEY]: companion }
+	};
 }
 /**
 * The runtime provider configuration in force for a generate run: the project
@@ -59728,7 +60256,8 @@ const GrokcliSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	"user-invocable": z.optional(z.boolean()),
-	"disable-model-invocation": z.optional(z.boolean())
+	"disable-model-invocation": z.optional(z.boolean()),
+	paths: z.optional(z.union([z.string(), z.array(z.string())]))
 });
 /**
 * Represents a Grok Build skill directory.
@@ -59787,7 +60316,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const grokcliSection = {
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.paths !== void 0 && { paths: frontmatter.paths }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -59822,7 +60352,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
-			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...grokcliSection?.paths !== void 0 && { paths: grokcliSection.paths }
 		};
 		return new GrokcliSkill({
 			outputRoot,
@@ -62473,7 +63004,10 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: WARP_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: WARP_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return WarpSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -62537,12 +63071,14 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		return targets.includes("*") || targets.includes("warp");
 	}
 	/**
-	* Commands are emitted into this same skills tree as `<slug>/SKILL.md`
-	* (see `WarpCommand`), so a directory matching a current rulesync command
-	* slug is owned by the commands feature: it must not be imported as a
-	* skill nor deleted as an orphan skill.
+	* Commands are emitted into the `.warp/skills/` tree as `<slug>/SKILL.md`
+	* (see `WarpCommand`), so a directory there matching a current rulesync
+	* command slug is owned by the commands feature: it must not be imported as
+	* a skill nor deleted as an orphan skill. The import-only `.agents/skills/`
+	* root never receives commands, so a same-named skill in it stays a skill.
 	*/
-	static async isDirOwned({ dirName, inputRoots }) {
+	static async isDirOwned({ relativeDirPath, dirName, inputRoots }) {
+		if (relativeDirPath !== WARP_SKILLS_DIR_PATH) return true;
 		return !await rulesyncCommandSlugExists({
 			inputRoots,
 			dirName
@@ -62755,6 +63291,25 @@ const ZedSkillFrontmatterSchema = z.looseObject({
 	description: z.string(),
 	"disable-model-invocation": z.optional(z.boolean())
 });
+const ZED = "Zed";
+const ZED_LOAD_FAILURE = "does not load the skill otherwise";
+/**
+* Collect the rules Zed enforces on a skill's frontmatter that the loose
+* schema above does not — `name` rules first, then `description`. Returned as
+* warnings rather than thrown: the canonical skill is shared with every other
+* target, so a name Zed rejects must not stop the generate run for the rest.
+*/
+function collectZedSkillViolations({ name, description }) {
+	const violations = [];
+	if (name.length === 0) violations.push("`name` must not be empty; Zed does not load a skill without one");
+	else violations.push(...collectSkillNameViolations({
+		name,
+		authority: ZED,
+		consequence: ZED_LOAD_FAILURE
+	}));
+	if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${ZED} loads the skill but warns past ${SKILL_DESCRIPTION_MAX_LENGTH}`);
+	return violations;
+}
 /**
 * Represents a Zed agent skill directory.
 * Skills are stored under .agents/skills/ (project) or ~/.agents/skills/ (global)
@@ -62823,9 +63378,10 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global: this.global
 		});
 	}
-	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
 		const settablePaths = ZedSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
 		const zedSection = rulesyncFrontmatter.zed;
 		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
 			rootFrontmatter: rulesyncFrontmatter,
@@ -62837,10 +63393,17 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			...zedSection,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
+		ZedSkill.reportSkillViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: zedFrontmatter,
+			logger
+		});
 		return new ZedSkill({
 			outputRoot,
 			relativeDirPath: settablePaths.relativeDirPath,
-			dirName: rulesyncSkill.getDirName(),
+			dirName,
 			frontmatter: zedFrontmatter,
 			body: rulesyncSkill.getBody(),
 			otherFiles: rulesyncSkill.getOtherFiles(),
@@ -62848,6 +63411,18 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global
 		});
 	}
+	/**
+	* Warn about every rule Zed enforces on the skill about to be written. The
+	* reported path includes `outputRoot` so a global-scope skill points at the
+	* file under the home directory rather than a same-named project path.
+	*/
+	static reportSkillViolations({ outputRoot, relativeDirPath, dirName, frontmatter, logger }) {
+		warnSkillViolations({
+			skillPath: join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME),
+			violations: collectZedSkillViolations(frontmatter),
+			logger
+		});
+	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("zed");
@@ -79705,4 +80280,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
 
-//# sourceMappingURL=import-DxRza3o_.js.map
+//# sourceMappingURL=import-D_iukHSy.js.map