rulesync 16.35.0 → 16.37.0

package/dist/{import-DxRza3o_.js → import-BnF2J75x.js}

@@ -4053,24 +4053,60 @@ const CONTROL_CHARS = [
 const hasControlChars = (val) => CONTROL_CHARS.some((char) => val.includes(char));
 const safeString = z.pipe(z.string(), z.custom((val) => typeof val === "string" && !hasControlChars(val), "must not contain newline, carriage return, or NUL characters"));
 /**
+* All canonical hook types — the union of the `type` values accepted by every
+* supported tool:
+* - `command` — universal (Claude Code, Codex CLI, Qwen Code, Cursor, …)
+* - `prompt` — Claude Code, Codex CLI, Qwen Code, Copilot CLI, Cursor, Devin
+* - `http` — Claude Code, Qwen Code, Copilot CLI, Grok CLI
+* - `agent` — Claude Code, Codex CLI
+* - `mcp_tool` — Claude Code
+* - `function` — Qwen Code (internal Skill-system executor)
+*/
+const HOOK_TYPES = [
+	"command",
+	"prompt",
+	"http",
+	"agent",
+	"mcp_tool",
+	"function"
+];
+/**
+* One choice offered by a Kiro `confirm` prompt: `run` decides whether picking
+* it executes the hook command. The prompt text is written back into JSON,
+* never embedded in generated code, so it is a plain string.
+*/
+const HookConfirmOptionSchema = z.looseObject({
+	id: z.string(),
+	label: z.string(),
+	run: z.boolean()
+});
+/**
+* Kiro's confirmation prompt shown before a `Stop`-trigger command hook runs.
+* `confirmCommand` (optional, inside the block) names a command whose JSON
+* stdout drives the prompt at run time: `{ "skip": true }` suppresses it, a
+* replacement `question` / `options` object overrides the static prompt, and
+* on failure or timeout the static prompt is used. Stored verbatim: Kiro is
+* the only consumer, and it owns the shape.
+* https://kiro.dev/docs/hooks/
+*/
+const HookConfirmSchema = z.looseObject({
+	question: z.string(),
+	options: z.array(HookConfirmOptionSchema),
+	confirmCommand: z.optional(safeString)
+});
+/**
 * Canonical hook definition.
 * Used in .rulesync/hooks.jsonc and mapped to tool-specific formats.
 */
 const HookDefinitionSchema = z.looseObject({
 	command: z.optional(safeString),
-	type: z.optional(z.enum([
-		"command",
-		"prompt",
-		"http",
-		"agent",
-		"mcp_tool",
-		"function"
-	])),
+	type: z.optional(z.enum(HOOK_TYPES)),
 	url: z.optional(safeString),
 	timeout: z.optional(z.number()),
 	cacheTtl: z.optional(z.number().check(nonnegative())),
 	matcher: z.optional(safeString),
 	enabled: z.optional(z.boolean()),
+	confirm: z.optional(HookConfirmSchema),
 	prompt: z.optional(safeString),
 	loop_limit: z.optional(z.nullable(z.number())),
 	name: z.optional(safeString),
@@ -4348,9 +4384,13 @@ const AMP_HOOK_EVENTS = [
 * the platform the other one owns — see `generateClineHookScript` and
 * `generateClineHookPowerShellScript`.
 *
-* `TaskResume` and `TaskCancel` have no canonical counterpart and stay
-* unmapped rather than being approximated by `sessionEnd` / `stop`, whose
-* semantics differ.
+* `TaskCancel` is the shape of canonical `stopCancelled` (as Grok CLI's
+* `StopCancelled` and Codex CLI's `Interrupt` are): both runtimes fire it
+* *instead of* `TaskComplete` when the run ends aborted — the VS Code
+* extension from `afterRun` when the result status is `aborted`, the SDK/CLI
+* as `agent_abort` — and neither lets the script cancel anything. `TaskResume`
+* has no canonical counterpart and stays unmapped rather than being
+* approximated by `sessionStart`, whose semantics differ.
 *
 * @see https://github.com/cline/cline/blob/main/apps/vscode/src/core/hooks/utils.ts
 * @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/hooks/hook-file-config.ts
@@ -4364,7 +4404,8 @@ const CLINE_HOOK_EVENTS = [
 	"preCompact",
 	"notification",
 	"taskCompleted",
-	"afterError"
+	"afterError",
+	"stopCancelled"
 ];
 /**
 * Hook events supported by GitHub Copilot (cloud coding agent).
@@ -4682,23 +4723,32 @@ const QWENCODE_HOOK_EVENTS = [
 * Hook events supported by Reasonix.
 *
 * Reasonix's `.reasonix/settings.json` (project) / `~/.reasonix/settings.json`
-* (global) documents a ten-event surface (`PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit`, `Stop`, `PostLLMCall`, `SessionStart`, `SessionEnd`,
-* `SubagentStop`, `Notification`, `PreCompact`). All ten have a clean canonical
+* (global) accepts the thirteen events declared in `internal/hook/hook.go`
+* (`var Events`): `PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest`, `UserPromptSubmit`, `Stop`, `StopFailure`,
+* `PostLLMCall`, `SessionStart`, `SessionEnd`, `SubagentStop`, `Notification`,
+* `PreCompact`. The zh-CN desktop hooks page documents only ten of them, so the
+* source file is the authoritative list. All thirteen have a clean canonical
 * equivalent and are mapped: `PreToolUse`, `PostToolUse`,
-* `UserPromptSubmit` ← `beforeSubmitPrompt`, `Stop`, `SessionStart`,
-* `SessionEnd`, `SubagentStop`, `PostLLMCall` ← `postModelInvocation`,
-* `Notification` ← `notification`, and `PreCompact` ← `preCompact`.
-* `match` (Reasonix's matcher field name) is honored only on
-* `PreToolUse`/`PostToolUse`, matching the canonical `matcher` field's
-* tool-event scoping used by other adapters.
+* `PostToolUseFailure`, `PermissionRequest`, `UserPromptSubmit` ←
+* `beforeSubmitPrompt`, `Stop`, `StopFailure`, `SessionStart`, `SessionEnd`,
+* `SubagentStop`, `PostLLMCall` ← `postModelInvocation`, `Notification` ←
+* `notification`, and `PreCompact` ← `preCompact`.
+* `match` (Reasonix's matcher field name) is honored on the four tool-scoped
+* events (`PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
+* `PermissionRequest` — `UsesToolMatcher` in `internal/hook/inspect.go`) and
+* ignored everywhere else.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 const REASONIX_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
+	"postToolUseFailure",
+	"permissionRequest",
 	"beforeSubmitPrompt",
 	"stop",
+	"stopFailure",
 	"sessionStart",
 	"sessionEnd",
 	"subagentStop",
@@ -4744,8 +4794,8 @@ const GROKCLI_HOOK_EVENTS = [
 * added in 0.32.0 (`TurnStarted`, `UserPromptQueued`, `TaskStarted`,
 * `SessionHeartbeat`), none of which is mapped onto a canonical rulesync event
 * here. `Interrupt` (fires instead of `Stop` when the user interrupts a turn)
-* does have a canonical shape — `stopCancelled`, which Grok CLI and Codex CLI
-* map — but Kimi keeps it native-only for now, since an existing `kimi-code`
+* does have a canonical shape — `stopCancelled`, which Grok CLI, Codex CLI and
+* Cline map — but Kimi keeps it native-only for now, since an existing `kimi-code`
 * override addressing it by name would otherwise double up with a canonical
 * `stopCancelled` block; folding it in is a follow-up. All six are listed in
 * `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override can
@@ -5040,8 +5090,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 37 entries as
-* of v0.20.2 (`v2026.8.16`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
+* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5065,11 +5115,13 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.8.16` (v0.20.2): `VALID_HOOKS` holds 37
-* entries, grown from 23 at `v2026.8.3` (v0.20.0). This list holds 36 of them —
-* see {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
+* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
+* This list holds 38 of them — see
+* {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5095,8 +5147,10 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"subagent_start",
 	"subagent_stop",
 	"pre_gateway_dispatch",
+	"agent_loop_stopped",
 	"pre_approval_request",
 	"post_approval_response",
+	"on_room_member_activity",
 	"pre_transcription",
 	"kanban_task_claimed",
 	"kanban_task_completed",
@@ -5119,8 +5173,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.8.16/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -5421,7 +5475,8 @@ const CANONICAL_TO_CLINE_EVENT_NAMES = {
 	preCompact: "PreCompact",
 	notification: "Notification",
 	taskCompleted: "TaskComplete",
-	afterError: "TaskError"
+	afterError: "TaskError",
+	stopCancelled: "TaskCancel"
 };
 /**
 * Map canonical camelCase event names to Copilot camelCase.
@@ -5739,8 +5794,11 @@ const QWENCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 const CANONICAL_TO_REASONIX_EVENT_NAMES = {
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
+	postToolUseFailure: "PostToolUseFailure",
+	permissionRequest: "PermissionRequest",
 	beforeSubmitPrompt: "UserPromptSubmit",
 	stop: "Stop",
+	stopFailure: "StopFailure",
 	sessionStart: "SessionStart",
 	sessionEnd: "SessionEnd",
 	subagentStop: "SubagentStop",
@@ -7631,11 +7689,15 @@ const KiroPermissionsOverrideSchema = z.looseObject({
 });
 /**
 * Codex CLI's approval-workflow policy. Serialized as a kebab-case string in
-* `.codex/config.toml`. `on-failure` is a legacy alias for `on-request` that
-* Codex still accepts, so it is included so existing configs round-trip. The
-* granular table form (`{ granular = { … } }`) is modeled separately in the
-* override union.
+* `.codex/config.toml`. `on-failure` is a deprecated alias for `on-request`
+* that Codex still reads, so it stays accepted (generate warns) so existing
+* configs round-trip. `untrusted` was retired in Codex 0.149.0 and makes
+* Codex refuse to start; it stays in the enum only so an existing
+* `.rulesync/permissions.jsonc` still parses — generate warns and does not
+* write it, and import does not lift it. The granular table form
+* (`{ granular = { … } }`) is modeled separately in the override union.
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
+* @see https://github.com/openai/codex/pull/39630
 */
 const CodexApprovalPolicySchema = z.enum([
 	"untrusted",
@@ -7705,11 +7767,12 @@ const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
 *   selected directly via `default_permissions` and skips the managed profile
 *   entirely — canonical filesystem/network rules are ignored in that mode.
 *   Defaults to `:workspace` when unspecified.
-* - `approval_policy` — `untrusted` | `on-request` (legacy alias `on-failure`) |
+* - `approval_policy` — `on-request` (deprecated alias `on-failure`) |
 *   `never`, or a `{ granular = { … } }` table (kept verbatim; the granular
 *   schema has required fields that are brittle to model as typed keys).
 *   Defaults to `on-request` when neither the override nor the existing
-*   config sets it.
+*   config sets it. `untrusted` (retired in Codex 0.149.0) is still parsed
+*   but skipped with a warning on generate, since Codex refuses to start on it.
 * - `sandbox_mode` — **deprecated.** `read-only` | `workspace-write` |
 *   `danger-full-access`, with the sibling `sandbox_workspace_write` table
 *   (`network_access`, `writable_roots`, …). Codex has superseded the classic
@@ -8357,6 +8420,7 @@ const RulesyncRuleFrontmatterSchema = z.object({
 		trigger: z.optional(z.string()),
 		globs: z.optional(z.array(z.string()))
 	})),
+	aiassistant: z.optional(z.looseObject({ apply: z.optional(z.string()) })),
 	devin: z.optional(z.looseObject({
 		trigger: z.optional(z.string()),
 		globs: z.optional(z.array(z.string())),
@@ -9581,6 +9645,8 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		paths: z.optional(z.union([z.string(), z.array(z.string())])),
 		"disable-model-invocation": z.optional(z.boolean()),
 		"user-invocable": z.optional(z.boolean()),
+		icon: z.optional(z.string()),
+		color: z.optional(z.string()),
 		metadata: z.optional(z.looseObject({}))
 	})),
 	factorydroid: z.optional(z.looseObject({
@@ -9595,7 +9661,8 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	grokcli: z.optional(z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
-		"user-invocable": z.optional(z.boolean())
+		"user-invocable": z.optional(z.boolean()),
+		paths: z.optional(z.union([z.string(), z.array(z.string())]))
 	})),
 	dsh: z.optional(z.looseObject({
 		whenToUse: z.optional(z.string()),
@@ -9822,8 +9889,32 @@ var RulesyncSubagent = class RulesyncSubagent extends RulesyncFile {
 		});
 	}
 };
-//#endregion
-//#region src/features/skills/skills-utils.ts
+const SKILL_DESCRIPTION_MAX_LENGTH = 1024;
+const SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* Check a skill `name` against the length and character rules, phrased for the
+* `authority` that enforces them (e.g. "the Agent Skills spec" or "Zed"). When
+* that authority does something with a bad name beyond flagging it — Zed
+* refuses to load the skill — `consequence` names it so the warning says what
+* the author is about to lose. An empty name is the caller's concern: what it
+* means differs per consumer.
+*/
+function collectSkillNameViolations({ name, authority, consequence }) {
+	const violations = [];
+	if (name.length > 64) violations.push(`\`name\` is ${name.length} characters; ${authority} allows at most 64${consequence === void 0 ? "" : ` and ${consequence}`}`);
+	if (!SKILL_NAME_PATTERN.test(name)) violations.push(`\`name\` ${quoteForLog(name)} must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens${consequence === void 0 ? "" : `; ${authority} ${consequence}`}`);
+	return violations;
+}
+/**
+* Report each violation as a warning prefixed with the skill file it concerns.
+* The path is shown POSIX-style and stripped of control characters so a hostile
+* directory name cannot forge log lines; `warnWithFallback` keeps the report
+* visible when the caller has no logger to hand.
+*/
+function warnSkillViolations({ skillPath, violations, logger }) {
+	const shownPath = stripControlCharacters(toPosixPath(skillPath));
+	for (const violation of violations) warnWithFallback(logger, `${shownPath}: ${violation}`);
+}
 /**
 * Whether a directory on disk can be addressed by its name.
 *
@@ -10647,10 +10738,13 @@ const AmpCheckFrontmatterSchema = z.looseObject({
 /**
 * Represents an Amp code review check.
 *
-* Amp natively reads code review checks as Markdown files with YAML frontmatter,
-* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`).
-* Each check runs as a per-check subagent during code review.
-* @see https://ampcode.com/manual
+* Amp reads code review checks as Markdown files with YAML frontmatter,
+* scoped to the project (`.agents/checks/`) and user-wide (`~/.config/amp/checks/`;
+* Amp also reads `~/.config/agents/checks/`, which rulesync does not write).
+* Since the docs rebuild the supported runner is the official
+* `@amp/review-checks` plugin (`amp review` is deprecated); existing checks in
+* this format continue to apply.
+* @see https://ampcode.com/docs/review
 */
 var AmpCheck = class AmpCheck extends ToolCheck {
 	frontmatter;
@@ -16890,10 +16984,8 @@ const AgentsSkillsSkillFrontmatterSchema = z.looseObject({
 	metadata: z.optional(z.looseObject({})),
 	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 });
-const NAME_MAX_LENGTH = 64;
-const DESCRIPTION_MAX_LENGTH = 1024;
 const COMPATIBILITY_MAX_LENGTH = 500;
-const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const AGENT_SKILLS_SPEC = "the Agent Skills spec";
 /**
 * Placeholder for an object that has already been encoded once in the same
 * value. YAML anchors let one document reference the same node repeatedly, and
@@ -17057,12 +17149,14 @@ function collectAgentSkillViolations({ frontmatter, dirName, sourceAllowedTools
 	const { name, description } = frontmatter;
 	if (name.length === 0) violations.push("`name` is required and must not be empty");
 	else {
-		if (name.length > NAME_MAX_LENGTH) violations.push(`\`name\` is ${name.length} characters; the Agent Skills spec allows at most ${NAME_MAX_LENGTH}`);
-		if (!NAME_PATTERN.test(name)) violations.push(`\`name\` "${name}" must contain only lowercase letters, digits and single hyphens, with no leading, trailing or consecutive hyphens`);
+		violations.push(...collectSkillNameViolations({
+			name,
+			authority: AGENT_SKILLS_SPEC
+		}));
 		if (name !== dirName) violations.push(`\`name\` "${name}" must match its parent directory name "${dirName}"; conformant clients require them to be equal`);
 	}
 	if (description.length === 0) violations.push(EMPTY_SKILL_DESCRIPTION_VIOLATION);
-	else if (description.length > DESCRIPTION_MAX_LENGTH) violations.push(`\`description\` is ${description.length} characters; the Agent Skills spec allows at most ${DESCRIPTION_MAX_LENGTH}`);
+	else if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${AGENT_SKILLS_SPEC} allows at most ${SKILL_DESCRIPTION_MAX_LENGTH}`);
 	const { compatibility } = frontmatter;
 	if (typeof compatibility !== "string" && compatibility !== void 0) violations.push("`compatibility` must be a string; the Agent Skills spec does not allow a mapping here");
 	else if (compatibility !== void 0 && compatibility.length > COMPATIBILITY_MAX_LENGTH) violations.push(`\`compatibility\` is ${compatibility.length} characters; the Agent Skills spec allows at most ${COMPATIBILITY_MAX_LENGTH}`);
@@ -17180,16 +17274,19 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 	* directory rather than a same-named project path.
 	*/
 	static reportSpecViolations({ outputRoot, relativeDirPath, dirName, frontmatter, sourceAllowedTools, logger }) {
-		const skillPath = agentSkillFilePath({
-			outputRoot,
-			relativeDirPath,
-			dirName
+		warnSkillViolations({
+			skillPath: agentSkillFilePath({
+				outputRoot,
+				relativeDirPath,
+				dirName
+			}),
+			violations: collectAgentSkillViolations({
+				frontmatter,
+				dirName,
+				sourceAllowedTools
+			}),
+			logger
 		});
-		for (const violation of collectAgentSkillViolations({
-			frontmatter,
-			dirName,
-			sourceAllowedTools
-		})) warnWithFallback(logger, `${stripControlCharacters(toPosixPath(skillPath))}: ${violation}`);
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
@@ -17829,6 +17926,15 @@ const KiloCommandFrontmatterSchema = z.looseObject({
 	model: z.optional(z.string()),
 	variant: z.optional(z.string())
 });
+/**
+* Command names Kilo keeps for itself. Its loader throws on a custom command
+* file named `goal.md` in either the project or the global directory ("The
+* /goal command is reserved for session goals. Rename the custom command."),
+* and a throw there aborts the whole command scan — every other custom
+* command becomes unreachable too, not only the reserved one.
+* https://github.com/Kilo-Org/kilocode/blob/v7.6.2/packages/opencode/src/command/index.ts
+*/
+const KILO_RESERVED_COMMAND_NAMES = /* @__PURE__ */ new Set(["goal"]);
 var KiloCommand = class KiloCommand extends ToolCommand {
 	frontmatter;
 	body;
@@ -17871,6 +17977,20 @@ var KiloCommand = class KiloCommand extends ToolCommand {
 			validate: true
 		});
 	}
+	/**
+	* Refuse to write a command Kilo reserves (see
+	* {@link KILO_RESERVED_COMMAND_NAMES}). The name Kilo loads is the file
+	* stem, and the processor calls this on the flattened path, so `goal.md`
+	* is refused at any nesting depth under the basename naming and only at the
+	* top level under the path naming, where `git/goal.md` becomes `git-goal`.
+	* Import is untouched: a `goal.md` already in `.kilo/commands/` is read as
+	* it is, since the reservation is Kilo's to enforce on its own files.
+	*/
+	static getWriteBlockReason({ rulesyncCommand }) {
+		const stem = basename(rulesyncCommand.getRelativeFilePath(), ".md");
+		if (!KILO_RESERVED_COMMAND_NAMES.has(stem)) return null;
+		return `Kilo reserves the /${stem} command for session goals and refuses to load a custom command by that name — it would abort Kilo's whole command scan, making every other custom command unreachable too. Rename the command, or exclude it from this target with \`targets\`.`;
+	}
 	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
 		const kiloFields = rulesyncFrontmatter.kilo ?? {};
@@ -20093,6 +20213,14 @@ var CommandsProcessor = class extends FeatureProcessor {
 			if (!factory.class.isTargetedByRulesyncCommand(rulesyncCommand)) return null;
 			const originalRelativePath = rulesyncCommand.getRelativeFilePath();
 			const commandToConvert = factory.meta.supportsSubdirectory ? rulesyncCommand : this.flattenRelativeFilePath(rulesyncCommand);
+			const writeBlockReason = factory.class.getWriteBlockReason?.({
+				rulesyncCommand: commandToConvert,
+				global: this.global
+			});
+			if (writeBlockReason !== void 0 && writeBlockReason !== null) {
+				this.logger.warn(`Skipping command ${quoteForLog(originalRelativePath)} for '${this.toolTarget}': ${writeBlockReason}`);
+				return null;
+			}
 			if (!factory.meta.supportsSubdirectory) {
 				const flattenedPath = commandToConvert.getRelativeFilePath();
 				const firstOrigin = flattenedPathOrigins.get(flattenedPath);
@@ -20962,6 +21090,72 @@ function isSupportedHookType({ type, converterConfig }) {
 	return converterConfig.supportedHookTypes?.has(type ?? "command") ?? true;
 }
 /**
+* Whether a keyword field applies to this hook, warning about the reason when
+* it does not. Shared by both directions: the field is unusable on the tool
+* side either way, so the value is dropped rather than carried into a config
+* the tool would ignore or refuse.
+*/
+function isKeywordFieldApplicable({ spec, hookType, eventName, direction, warn }) {
+	const { canonical, tool, commandOnly, events } = spec;
+	const field = direction === "generated" ? canonical : tool;
+	if (!isFieldApplicable({
+		commandOnly,
+		hookType
+	})) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not ${direction}.`);
+		return false;
+	}
+	if (events !== void 0 && !events.has(eventName)) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		return false;
+	}
+	return true;
+}
+/**
+* Emit the keyword passthrough fields: a canonical `true` becomes the tool's
+* keyword, while `false` is omitted as the tool's own default. A `true` the
+* tool would not honour on this hook is warned about, like the other kinds;
+* a `false` there is dropped silently, since omitting it changes nothing.
+*/
+function emitKeywordFields({ def, hookType, eventName, fields, warn }) {
+	const emitted = {};
+	for (const spec of fields) {
+		if (def[spec.canonical] !== true) continue;
+		if (isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "generated",
+			warn
+		})) emitted[spec.tool] = spec.trueValue;
+	}
+	return emitted;
+}
+/**
+* Import the keyword passthrough fields back into canonical booleans,
+* reversing {@link emitKeywordFields}. Only the two documented keywords are
+* read; anything else is warned about and dropped, so a typo in a hand-written
+* tool file never lands in `.rulesync/hooks.*` as a boolean it did not mean.
+*/
+function importKeywordFields({ h, hookType, eventName, fields, warn }) {
+	const imported = {};
+	for (const spec of fields) {
+		const value = h[spec.tool];
+		if (value === void 0) continue;
+		if (!isKeywordFieldApplicable({
+			spec,
+			hookType,
+			eventName,
+			direction: "imported",
+			warn
+		})) continue;
+		if (value === spec.trueValue) imported[spec.canonical] = true;
+		else if (spec.falseValue !== void 0 && value === spec.falseValue) imported[spec.canonical] = false;
+		else warn?.(`Dropping "${spec.tool}" from an imported "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool documents for it.`);
+	}
+	return imported;
+}
+/**
 * Emit every per-hook passthrough kind for one canonical definition.
 */
 function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, warn }) {
@@ -20974,6 +21168,13 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 			isValid: isBooleanValue,
 			warn
 		}),
+		...emitKeywordFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...emitPassthroughFields({
 			def,
 			hookType,
@@ -21302,7 +21503,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 * Import every per-hook passthrough kind for one tool hook record, reversing
 * the emit side in {@link buildToolHooks}.
 */
-function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
+function importAllPassthroughFields({ h, hookType, eventName, converterConfig, warn }) {
 	return {
 		...importPassthroughFields({
 			h,
@@ -21311,6 +21512,13 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 			isValid: isBooleanValue,
 			warn
 		}),
+		...importKeywordFields({
+			h,
+			hookType,
+			eventName,
+			fields: converterConfig.keywordPassthroughFields ?? [],
+			warn
+		}),
 		...importPassthroughFields({
 			h,
 			hookType,
@@ -21356,7 +21564,7 @@ function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
 /**
 * Convert a single tool hook record into a canonical hook definition.
 */
-function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
+function toolHookToCanonical({ h, rawEntry, eventName, converterConfig, warn }) {
 	const hookType = resolveImportedHookType({
 		value: h.type,
 		converterConfig
@@ -21404,6 +21612,7 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 		...importAllPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			converterConfig,
 			warn
 		}),
@@ -21490,7 +21699,7 @@ function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
 /**
 * Convert a single tool matcher entry into canonical hook definitions.
 */
-function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
+function toolMatcherEntryToCanonical({ rawEntry, eventName, converterConfig, warn }) {
 	const hookDefs = rawEntry.hooks ?? [];
 	const groupSkipReason = describeGroupSkipReason({
 		rawEntry,
@@ -21518,6 +21727,7 @@ function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
 		definitions.push(toolHookToCanonical({
 			h,
 			rawEntry,
+			eventName,
 			converterConfig,
 			warn
 		}));
@@ -21565,6 +21775,7 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 			if (!isToolMatcherEntry(rawEntry)) continue;
 			defs.push(...toolMatcherEntryToCanonical({
 				rawEntry,
+				eventName,
 				converterConfig,
 				warn
 			}));
@@ -23450,14 +23661,23 @@ var ContinueHooks = class extends SettingsJsonHooks {
 * portable `command` field is written, which upstream copies to both when
 * neither is present. Note the cloud agent runs hooks in a Linux sandbox and
 * honors only `bash` and `command` — a `powershell` entry is ignored there.
+* VS Code reads the same file and maps `bash` to `osx` / `linux` and
+* `powershell` to `windows`; it also documents its own per-OS overrides
+* (`windows`, `linux`, `osx`) next to `command`, which are typed here so an
+* entry that uses them instead of a shell field is not mistaken for one
+* without a command.
 *
 * @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agents/reference/hooks-reference
 */
 const CopilotHookEntrySchema = z.looseObject({
 	type: z.string(),
 	bash: z.optional(z.string()),
 	powershell: z.optional(z.string()),
 	command: z.optional(z.string()),
+	windows: z.optional(z.string()),
+	linux: z.optional(z.string()),
+	osx: z.optional(z.string()),
 	cwd: z.optional(z.string()),
 	env: z.optional(z.record(z.string(), z.string())),
 	timeoutSec: z.optional(z.number()),
@@ -23548,17 +23768,30 @@ function resolveImportCommand$1(entry, logger) {
 *
 * Generate re-emits any non-canonical key verbatim through `rest`, so a key
 * dropped here does not survive an import → generate round trip. `cwd` is a
-* documented Copilot hook field and was previously lost that way.
+* documented Copilot hook field and was previously lost that way, as were the
+* VS Code per-OS overrides `windows` / `linux` / `osx`: an entry authored with
+* only those (no `command`) imported as a hook with no command at all and was
+* regenerated empty.
 *
 * @see https://docs.github.com/en/copilot/reference/hooks-reference
 * @see https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-hooks
+* @see https://code.visualstudio.com/docs/agents/reference/hooks-reference
 */
 function importPassthrough$1(entry) {
 	const passthrough = {};
 	if (entry.cwd !== void 0) passthrough.cwd = entry.cwd;
 	if (entry.env !== void 0) passthrough.env = entry.env;
+	for (const key of OS_OVERRIDE_KEYS) if (entry[key] !== void 0) passthrough[key] = entry[key];
 	return passthrough;
 }
+const OS_OVERRIDE_KEYS = [
+	"windows",
+	"linux",
+	"osx"
+];
+function hasOsOverride(passthrough) {
+	return OS_OVERRIDE_KEYS.some((key) => passthrough[key] !== void 0);
+}
 /**
 * Extract hooks from Copilot hooks JSON into canonical format.
 * Copilot format: { version: 1, hooks: { eventName: [...hookEntries] } }
@@ -23579,12 +23812,14 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			const entry = parseResult.data;
 			const { command, shell } = resolveImportCommand$1(entry, logger);
 			const timeout = entry.timeoutSec ?? entry.timeout;
+			const passthrough = importPassthrough$1(entry);
+			if (command === void 0 && hasOsOverride(passthrough)) logger?.warn(`Copilot hook on '${copilotEventName}' has only VS Code per-OS overrides (windows/linux/osx) and no portable command; it is preserved for copilot, but other targets will generate it without a command until a \`command\` is added.`);
 			defs.push({
 				type: "command",
 				...command !== void 0 && { command },
 				...shell !== void 0 && { shell },
 				...timeout !== void 0 && { timeout },
-				...importPassthrough$1(entry)
+				...passthrough
 			});
 		}
 		if (defs.length > 0) canonical[eventName] = defs;
@@ -23747,6 +23982,8 @@ const CopilotCliHookEntrySchema = z.looseObject({
 	bash: z.optional(z.string()),
 	powershell: z.optional(z.string()),
 	command: z.optional(z.string()),
+	exec: z.optional(z.string()),
+	args: z.optional(z.array(z.string())),
 	prompt: z.optional(z.string()),
 	url: z.optional(z.string()),
 	headers: z.optional(z.record(z.string(), z.string())),
@@ -23776,6 +24013,32 @@ function resolveExportMatcherPart({ matcher, matcherSupported, eventName, logger
 	return {};
 }
 /**
+* Pick the command fields of an exported `command` entry.
+*
+* A canonical `args` list (an empty one counts) selects the CLI's shell-free
+* form: `command` becomes `exec` and the list is written as `args`, so the
+* executable is spawned directly. The `shell` selector is meaningless there
+* and is dropped with a warning. Otherwise the canonical `shell` selector
+* picks the shell-specific field; without it the portable `command` field is
+* written, which upstream copies to both `bash` and `powershell`. Keying off
+* `shell` rather than `process.platform` keeps the generated file identical
+* on every machine.
+*/
+function resolveExportCommandPart({ def, eventName, logger }) {
+	if (Array.isArray(def.args)) {
+		if (def.shell !== void 0) logger?.warn(`Copilot CLI runs an \`exec\` hook without a shell; dropping shell "${def.shell}" on '${eventName}'.`);
+		return compact({
+			exec: def.command,
+			args: def.args,
+			env: def.env
+		});
+	}
+	return compact({
+		[def.shell ?? "command"]: def.command,
+		env: def.env
+	});
+}
+/**
 * Build the exported entries for a single canonical event. Returns an empty
 * array when no entries are emitted (e.g. all prompt hooks were skipped).
 */
@@ -23815,19 +24078,17 @@ function buildCopilotCliEntriesForEvent({ eventName, definitions, canonicalSchem
 			...timeoutPart,
 			...rest
 		});
-		else if (hookType === "command") {
-			const commandField = def.shell ?? "command";
-			entries.push({
-				type: "command",
-				...matcherPart,
-				...compact({
-					[commandField]: def.command,
-					env: def.env
-				}),
-				...timeoutPart,
-				...rest
-			});
-		}
+		else if (hookType === "command") entries.push({
+			type: "command",
+			...matcherPart,
+			...resolveExportCommandPart({
+				def,
+				eventName,
+				logger
+			}),
+			...timeoutPart,
+			...rest
+		});
 	}
 	return entries;
 }
@@ -23867,6 +24128,10 @@ function importPassthrough(entry) {
 /**
 * Resolve the canonical command and its `shell` selector from an imported entry.
 *
+* The CLI-only `exec` form maps to canonical `command` + `args`, the exec form
+* shared with AugmentCode and Claude Code, so it no longer imports as a hook
+* with no command at all.
+*
 * A shell-specific field carries its `shell` through so re-export writes the
 * same field back. An entry using only the portable `command` field leaves
 * `shell` unset, which re-export renders as the portable field again.
@@ -23880,6 +24145,13 @@ function importPassthrough(entry) {
 function resolveImportCommand(entry, logger) {
 	const hasBash = typeof entry.bash === "string";
 	const hasPowershell = typeof entry.powershell === "string";
+	if (typeof entry.exec === "string") {
+		if (hasBash || hasPowershell || typeof entry.command === "string") logger?.warn("Copilot CLI hook has both exec and a shell command; using exec and ignoring the shell fields, as the hooks reference says not to combine them.");
+		return {
+			command: entry.exec,
+			args: entry.args ?? []
+		};
+	}
 	if (hasBash && hasPowershell) {
 		logger?.warn("Copilot CLI hook has both bash and powershell commands; using bash and ignoring powershell, so the imported config does not depend on the machine the import ran on.");
 		return {
@@ -23929,11 +24201,12 @@ function copilotCliHooksToCanonical(rawHooks, logger) {
 				...passthrough
 			});
 			else {
-				const { command, shell } = resolveImportCommand(entry, logger);
+				const { command, shell, args } = resolveImportCommand(entry, logger);
 				defs.push({
 					type: "command",
 					...command !== void 0 && { command },
 					...shell !== void 0 && { shell },
+					...args !== void 0 && { args },
 					...matcherPart,
 					...timeoutPart,
 					...passthrough
@@ -24483,6 +24756,7 @@ var CursorHooks = class CursorHooks extends ToolHooks {
 				...def.loop_limit !== void 0 && { loop_limit: def.loop_limit },
 				...def.matcher !== void 0 && def.matcher !== null && { matcher: def.matcher },
 				...def.prompt !== void 0 && def.prompt !== null && { prompt: def.prompt },
+				...def.type === "prompt" && def.model !== void 0 && def.model !== null && { model: def.model },
 				...def.failClosed !== void 0 && def.failClosed !== null && { failClosed: def.failClosed }
 			}));
 			if (mappedDefs.length > 0) mappedHooks[cursorEventName] = mappedDefs;
@@ -25185,7 +25459,15 @@ const GOOSE_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: GOOSE_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
-	wildcardMatcherMeansAll: true
+	wildcardMatcherMeansAll: true,
+	keywordPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "on_failure",
+		trueValue: "block",
+		falseValue: "allow",
+		commandOnly: true,
+		events: /* @__PURE__ */ new Set(["preToolUse"])
+	}]
 };
 /**
 * Represents a Goose lifecycle hooks file.
@@ -25494,7 +25776,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.2; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -26374,7 +26656,8 @@ const KiroIdeHookEntrySchema = z.looseObject({
 	matcher: z.optional(z.string()),
 	action: z.optional(KiroIdeHookActionSchema),
 	timeout: z.optional(z.number()),
-	enabled: z.optional(z.boolean())
+	enabled: z.optional(z.boolean()),
+	confirm: z.optional(HookConfirmSchema)
 });
 const KiroIdeHooksFileSchema = z.looseObject({
 	version: z.optional(z.string()),
@@ -26413,7 +26696,8 @@ function buildKiroIdeEntriesForEvent(trigger, definitions) {
 			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
 			action,
 			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
-			enabled: def.enabled ?? true
+			enabled: def.enabled ?? true,
+			...def.confirm !== void 0 && { confirm: def.confirm }
 		});
 	}
 	return entries;
@@ -26455,6 +26739,14 @@ function canonicalToKiroIdeHooks(config) {
 	}
 	return entries;
 }
+/**
+* Copies the optional per-hook fields (`enabled`, `confirm`) back onto the
+* canonical definition.
+*/
+function copyOptionalHookFields({ entry, def }) {
+	if (entry.enabled === false) def.enabled = false;
+	if (entry.confirm !== void 0 && entry.confirm !== null) def.confirm = omitPrototypePollutionKeysDeep(entry.confirm);
+}
 function kiroIdeHooksToCanonical(entries) {
 	const canonical = {};
 	for (const entry of entries) {
@@ -26478,7 +26770,10 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
-		if (entry.enabled === false) def.enabled = false;
+		copyOptionalHookFields({
+			entry,
+			def
+		});
 		const list = lookupOwn({
 			record: canonical,
 			key: eventName
@@ -27485,10 +27780,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 //#endregion
 //#region src/features/hooks/reasonix-hooks.ts
 /**
-* Only PreToolUse/PostToolUse honor the `match` field (an anchored regex
-* against the tool name); it is ignored on every other event.
+* Only the tool-scoped events honor the `match` field (an anchored regex
+* against the tool name); it is ignored on every other event. Mirrors
+* `UsesToolMatcher` in upstream `internal/hook/inspect.go`.
 */
-const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+const REASONIX_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"PreToolUse",
+	"PostToolUse",
+	"PostToolUseFailure",
+	"PermissionRequest"
+]);
 const SUPPORTED_REASONIX_EVENTS = new Set(REASONIX_HOOK_EVENTS);
 /**
 * Convert canonical hooks config to the Reasonix `hooks` object.
@@ -27570,9 +27871,11 @@ function reasonixHooksToCanonical(hooks) {
 * Reasonix hooks live in a Claude-Code-style but standalone JSON file —
 * `.reasonix/settings.json` (project) or `~/.reasonix/settings.json`
 * (global) — separate from the `[permissions]`/`[[plugins]]` TOML config.
-* All ten upstream events have a clean canonical equivalent and are mapped:
-* PreToolUse/PostToolUse/UserPromptSubmit/Stop plus SessionStart/SessionEnd/
-* SubagentStop/PostLLMCall/Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* All thirteen upstream events have a clean canonical equivalent and are mapped:
+* PreToolUse/PostToolUse/PostToolUseFailure/PermissionRequest/UserPromptSubmit/
+* Stop/StopFailure plus SessionStart/SessionEnd/SubagentStop/PostLLMCall/
+* Notification/PreCompact (see REASONIX_HOOK_EVENTS).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/hook/hook.go
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/DESKTOP_HOOKS.zh-CN.md
 */
 var ReasonixHooks = class ReasonixHooks extends ToolHooks {
@@ -28398,6 +28701,23 @@ const PER_HOOK_ENABLED_TARGETS = /* @__PURE__ */ new Set([
 	"kiro-ide",
 	"zcode"
 ]);
+/** The targets whose hooks format carries the Kiro `confirm` prompt. */
+const PER_HOOK_CONFIRM_TARGETS = /* @__PURE__ */ new Set(["kiro-cli", "kiro-ide"]);
+/**
+* Names the shared events that carry a hook whose canonical definition
+* satisfies `predicate`, excluding events the target skips altogether (those
+* are already reported as skipped and produce no output, so warning about them
+* again would contradict that message).
+*/
+function emittedEventsWithHook(params) {
+	const { factory, sharedHooks, effectiveHooks, predicate } = params;
+	const skippedEvents = new Set(unsupportedEventNames({
+		factory,
+		sharedHooks,
+		effectiveHooks
+	}));
+	return Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => predicate(def))).map(([event]) => event);
+}
 const toolHooksFactories = /* @__PURE__ */ new Map([
 	["amp", {
 		class: AmpHooks,
@@ -28968,15 +29288,11 @@ var HooksProcessor = class extends FeatureProcessor {
 			}
 			for (const [hookType, events] of unsupportedTypeToEvents) this.logger.warn(`Skipped ${hookType}-type hook(s) for ${this.toolTarget} (not supported): ${Array.from(events).join(", ")}`);
 		}
-		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
-			const skippedEvents = new Set(unsupportedEventNames({
-				factory,
-				sharedHooks,
-				effectiveHooks
-			}));
-			const eventsWithDisabledHooks = Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => def.enabled === false)).map(([event]) => event);
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
-		}
+		this.warnAboutDroppedPerHookFields({
+			factory,
+			sharedHooks,
+			effectiveHooks
+		});
 		const eventsWithUnsupportedMatcher = unsupportedMatcherEventNames({
 			factory,
 			effectiveHooks
@@ -29006,6 +29322,33 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (auxiliaryFiles && auxiliaryFiles.length > 0) result.push(...auxiliaryFiles);
 		return result;
 	}
+	/**
+	* Warns about canonical per-hook fields that this target's hooks format
+	* cannot express, so a hook does not silently change behavior on generation.
+	* Only canonical definitions are considered: a tool-native field inside an
+	* override block is passed through verbatim and honored by that tool.
+	*/
+	warnAboutDroppedPerHookFields(params) {
+		const { factory, sharedHooks, effectiveHooks } = params;
+		if (!PER_HOOK_ENABLED_TARGETS.has(this.toolTarget)) {
+			const eventsWithDisabledHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.enabled === false
+			});
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide / zcode hooks formats support the flag): ${eventsWithDisabledHooks.join(", ")}`);
+		}
+		if (!PER_HOOK_CONFIRM_TARGETS.has(this.toolTarget)) {
+			const eventsWithConfirmHooks = emittedEventsWithHook({
+				factory,
+				sharedHooks,
+				effectiveHooks,
+				predicate: (def) => def.confirm !== void 0
+			});
+			if (eventsWithConfirmHooks.length > 0) this.logger.warn(`Emitting hook(s) without their "confirm" prompt for ${this.toolTarget} (only the kiro-cli / kiro-ide hooks formats support it): ${eventsWithConfirmHooks.join(", ")}`);
+		}
+	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
 		const hooks = toolFiles.filter((f) => f instanceof ToolHooks);
 		const logger = withToolTargetPrefix({
@@ -34807,28 +35150,60 @@ function resolveHermesTimeout(config) {
 	if (typeof config.networkTimeout === "number") return config.networkTimeout;
 }
 /**
-* Copies the advanced Hermes-recognized per-server fields that have no canonical
-* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
-* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
-* `connect_timeout` (seconds), `supports_parallel_tool_calls`,
-* `keepalive_interval`, `elicitation`, `trust`, and `identity_header` — verbatim
-* from `source` to `target`. Field names are identical on both sides (the
-* canonical `McpServerSchema` is a `looseObject`), so this serves export and
-* import alike. See the Hermes mcp-config-reference.
+* String-valued `oauth` keys Hermes reads (`tools/mcp_oauth.py`,
+* `tools/mcp_oauth_device.py`, v0.21.3): the callback overrides, the
+* pre-registered client, the CIMD document override, the DCR registration
+* fields, the token-request `user_agent`, the login `flow` (`device` for
+* RFC 8628) and the space-separated `scope` string sent on registration and
+* device authorization.
+*/
+const HERMES_OAUTH_STRING_KEYS = [
+	"redirect_uri",
+	"redirect_host",
+	"client_id",
+	"client_secret",
+	"client_name",
+	"client_metadata_url",
+	"token_endpoint_auth_method",
+	"application_type",
+	"user_agent",
+	"flow",
+	"scope"
+];
+/**
+* Copies the `oauth` mapping of a server, keeping only the keys Hermes reads.
+*
+* Hermes reads a single `scope` string, never a `scopes` list; earlier Rulesync
+* versions wrote `scopes` regardless, which Hermes silently ignored. A `scopes`
+* list is therefore folded into `scope` (space-separated, the OAuth wire form)
+* when no `scope` is given, in both directions, so an authored list finally
+* reaches the authorization server and an old `config.yaml` imports cleanly.
 */
 function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
-	for (const key of [
-		"redirect_uri",
-		"redirect_host",
-		"client_id",
-		"client_secret"
-	]) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof source.redirect_port === "number") oauth.redirect_port = source.redirect_port;
-	if (isStringArray$2(source.scopes)) oauth.scopes = source.scopes;
+	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
+	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
+	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_OPAQUE_MAPPING_KEYS = [
+	"sampling",
+	"elicitation",
+	"identity_header",
+	"lifecycle"
+];
+/**
+* Copies the advanced Hermes-recognized per-server fields that have no canonical
+* alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
+* path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
+* `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* verbatim from `source` to `target`. Field names are identical on both sides
+* (the canonical `McpServerSchema` is a `looseObject`), so this serves export
+* and import alike. See the Hermes mcp-config-reference.
+*/
 function copyHermesAdvancedFields(source, target) {
 	let copied = false;
 	if (typeof source.auth === "string") {
@@ -34860,6 +35235,14 @@ function copyHermesAdvancedFields(source, target) {
 		target[key] = source[key];
 		copied = true;
 	}
+	if (typeof source.protocol === "string") {
+		target.protocol = source.protocol;
+		copied = true;
+	}
+	if (typeof source.lazy === "boolean") {
+		target.lazy = source.lazy;
+		copied = true;
+	}
 	if (typeof source.ssl_verify === "boolean" || typeof source.ssl_verify === "string") {
 		target.ssl_verify = source.ssl_verify;
 		copied = true;
@@ -34868,25 +35251,20 @@ function copyHermesAdvancedFields(source, target) {
 		target.skip_preflight = source.skip_preflight;
 		copied = true;
 	}
-	if (isPlainObject$1(source.sampling)) {
-		target.sampling = omitPrototypePollutionKeys(structuredClone(source.sampling));
-		copied = true;
-	}
 	if (typeof source.keepalive_interval === "number") {
 		target.keepalive_interval = source.keepalive_interval;
 		copied = true;
 	}
-	if (isPlainObject$1(source.elicitation)) {
-		target.elicitation = omitPrototypePollutionKeys(structuredClone(source.elicitation));
-		copied = true;
-	}
 	if (typeof source.trust === "string") {
 		target.trust = source.trust;
 		copied = true;
 	}
-	if (isPlainObject$1(source.identity_header)) {
-		target.identity_header = omitPrototypePollutionKeys(structuredClone(source.identity_header));
-		copied = true;
+	for (const key of HERMES_OPAQUE_MAPPING_KEYS) {
+		const mapping = source[key];
+		if (isPlainObject$1(mapping)) {
+			target[key] = omitPrototypePollutionKeys(structuredClone(mapping));
+			copied = true;
+		}
 	}
 	return copied;
 }
@@ -35670,6 +36048,7 @@ function toKimiCodeServer({ name, server, logger }) {
 		"headers",
 		"bearerTokenEnvVar",
 		"enabled",
+		"deferred",
 		"startupTimeoutMs",
 		"toolTimeoutMs",
 		"enabledTools",
@@ -36327,7 +36706,12 @@ const OpencodeMcpRemoteServerSchema = z.looseObject({
 	headers: z.optional(z.record(z.string(), z.string())),
 	enabled: z._default(z.boolean(), true)
 });
-const OPENCODE_PASSTHROUGH_SERVER_FIELDS = ["timeout", "oauth"];
+const OPENCODE_PASSTHROUGH_SERVER_FIELDS = [
+	"timeout",
+	"oauth",
+	"protocol",
+	"codemode"
+];
 const OPENCODE_MCP_TRANSPORT_KEYS = [
 	...Object.keys(OpencodeMcpLocalServerSchema.def.shape),
 	...Object.keys(OpencodeMcpRemoteServerSchema.def.shape),
@@ -36469,7 +36853,7 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - env -> environment
 * - disabled -> enabled (inverted)
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
-* - OpenCode-supported extras (timeout, oauth) -> passed through verbatim
+* - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
 */
 function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, logger) {
 	const serverRecord = serverConfig;
@@ -39462,7 +39846,7 @@ var ToolPermissions = class extends ToolFile {
 * builtin of that name). It lives in the shared Amp settings file:
 * `.amp/settings.json` (project) and `~/.config/amp/settings.json` (global).
 *
-* Reference: https://ampcode.com/manual ("amp.tools.disable").
+* Reference: https://ampcode.com/docs/cli/settings ("amp.tools.disable").
 */
 const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 /**
@@ -39473,19 +39857,26 @@ const AMP_TOOLS_DISABLE_KEY = "amp.tools.disable";
 * glob. Rules are evaluated **first-match-wins**. It lives in the same shared
 * Amp settings file as `amp.tools.disable`.
 *
-* `amp.permissions` is Amp's documented legacy/backwards-compat surface — it
-* remains functional and is the only place to express `allow`/`ask` and
-* argument-specific `reject` rules (the simpler `amp.tools.disable` array can
-* only disable whole tools).
+* `amp.permissions` is Amp's legacy/backwards-compat surface — it remains
+* functional in the shipped CLI and is the only place to express `allow`/`ask`
+* and argument-specific `reject` rules (the simpler `amp.tools.disable` array
+* can only disable whole tools). The web docs no longer describe it (the
+* permissions section only points at custom plugins), but the shipped CLI
+* still lists it in its built-in settings reference (`amp --help`) and
+* evaluates it through `amp permissions list|test`.
 *
-* Reference: https://ampcode.com/manual ("amp.permissions").
+* Reference: https://ampcode.com/docs/tools#permissions and
+* https://ampcode.com/docs/customize/plugins#example-plugin-permissions.
 */
 const AMP_PERMISSIONS_KEY = "amp.permissions";
 /**
 * The `amp.guardedFiles.allowlist` array (file globs allowed without
 * confirmation), `amp.dangerouslyAllowAll` boolean (disable all confirmation),
 * and `amp.mcpPermissions` array — sibling settings authored through the `amp`
-* permissions override. Reference: https://ampcode.com/manual.
+* permissions override. Only `amp.mcpPermissions` is still on the web docs
+* (https://ampcode.com/docs/cli/settings); the other two, like
+* `amp.permissions`, survive only in the CLI's built-in settings reference
+* (see `AMP_PERMISSIONS_KEY`).
 */
 const AMP_GUARDED_FILES_ALLOWLIST_KEY = "amp.guardedFiles.allowlist";
 const AMP_DANGEROUSLY_ALLOW_ALL_KEY = "amp.dangerouslyAllowAll";
@@ -42814,6 +43205,8 @@ const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
 const CODEX_EXTENDABLE_BASELINES = new Set(CODEX_EXTENDABLE_BASELINE_PROFILES);
 const CODEX_DEFAULT_APPROVAL_POLICY = "on-request";
 const CODEX_DEFAULT_APPROVALS_REVIEWER = "auto_review";
+const CODEX_RETIRED_APPROVAL_POLICY = "untrusted";
+const CODEX_DEPRECATED_APPROVAL_POLICY = "on-failure";
 const CODEX_GLOB_SCAN_MAX_DEPTH = 8;
 const CODEX_MINIMAL_KEY = ":minimal";
 const CODEX_GIT_WRITE_RULES = { ".git/**": "write" };
@@ -42937,6 +43330,10 @@ var CodexcliPermissions = class CodexcliPermissions extends ToolPermissions {
 			domainsHadUnknown
 		});
 		const override = extractCodexcliOverride(table);
+		if (override.approval_policy === CODEX_RETIRED_APPROVAL_POLICY) {
+			warnWithFallback(void 0, `${join(this.getRelativeDirPath(), this.getRelativeFilePath())} sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start. It was not imported; remove it from the file, or mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			delete override.approval_policy;
+		}
 		if (typeof profile?.extends === "string" && CODEX_EXTENDABLE_BASELINES.has(profile.extends)) override.base_permission_profile = profile.extends;
 		if (defaultProfile === CODEX_DANGER_FULL_ACCESS_BASELINE) override.base_permission_profile = CODEX_DANGER_FULL_ACCESS_BASELINE;
 		const result = Object.keys(override).length > 0 ? {
@@ -43225,6 +43622,10 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			continue;
 		}
 		if (value === void 0) continue;
+		if (key === "approval_policy" && !isWritableApprovalPolicy({
+			value,
+			logger
+		})) continue;
 		if (key === "sandbox_mode" || key === "sandbox_workspace_write") logger?.warn(`Codex CLI permission override key "${key}" is deprecated. Codex prioritizes the legacy sandbox settings over permission profiles when both are present, so it disables the generated "${RULESYNC_PROFILE_NAME}" permissions profile. Use "base_permission_profile" and the shared "permission" block instead.`);
 		const existingValue = existing[key];
 		patch[key] = isPlainObject(existingValue) && isPlainObject(value) ? {
@@ -43232,12 +43633,37 @@ function computeCodexcliOverridePatch({ existing, override, logger }) {
 			...value
 		} : value;
 	}
+	fillCodexcliDefaults({
+		existing,
+		patch,
+		logger
+	});
+	return patch;
+}
+function fillCodexcliDefaults({ existing, patch, logger }) {
 	const defaults = {
 		approval_policy: CODEX_DEFAULT_APPROVAL_POLICY,
 		approvals_reviewer: CODEX_DEFAULT_APPROVALS_REVIEWER
 	};
-	for (const [key, value] of Object.entries(defaults)) if (patch[key] === void 0 && existing[key] === void 0) patch[key] = value;
-	return patch;
+	for (const [key, value] of Object.entries(defaults)) {
+		if (patch[key] !== void 0) continue;
+		if (existing[key] === void 0) {
+			patch[key] = value;
+			continue;
+		}
+		if (key === "approval_policy" && existing[key] === CODEX_RETIRED_APPROVAL_POLICY) {
+			logger?.warn(`The existing Codex CLI config.toml sets approval_policy = "${CODEX_RETIRED_APPROVAL_POLICY}", which was retired in Codex 0.149.0 and makes Codex refuse to start, so it was replaced with "${value}". To keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+			patch[key] = value;
+		}
+	}
+}
+function isWritableApprovalPolicy({ value, logger }) {
+	if (value === CODEX_RETIRED_APPROVAL_POLICY) {
+		logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_RETIRED_APPROVAL_POLICY}" was retired in Codex 0.149.0 and makes Codex refuse to start, so it was not written. Remove it from the override; to keep the strict behavior, mark the project untrusted in your user config instead ([projects."<path>"] trust_level = "${CODEX_RETIRED_APPROVAL_POLICY}").`);
+		return false;
+	}
+	if (value === CODEX_DEPRECATED_APPROVAL_POLICY) logger?.warn(`Codex CLI permission override "approval_policy": "${CODEX_DEPRECATED_APPROVAL_POLICY}" is deprecated; Codex reads it as "${CODEX_DEFAULT_APPROVAL_POLICY}". Use "${CODEX_DEFAULT_APPROVAL_POLICY}" instead.`);
+	return true;
 }
 function extractCodexcliOverride(table) {
 	const override = {};
@@ -51689,6 +52115,18 @@ const TAKT_RUNTIME_TARGETS_KEY = "targets";
 const TAKT_RUNTIME_AUTO_ROUTING_KEY = "auto_routing";
 const TAKT_RUNTIME_PROFILE_KEY = "profile";
 const TAKT_RUNTIME_OPTIONS_KEY = "options";
+const TAKT_RUNTIME_ASSIGNMENTS_KEY = "assignments";
+const TAKT_RUNTIME_LADDER_KEY = "ladder";
+const TAKT_RUNTIME_EXTENDS_KEY = "extends";
+const TAKT_RUNTIME_ROUTER_PROFILE_KEY = "router_profile";
+const TAKT_RUNTIME_POOLS_KEY = "pools";
+const TAKT_RUNTIME_CANDIDATES_KEY = "candidates";
+const TAKT_RUNTIME_FALLBACK_PROFILE_KEY = "fallback_profile";
+/** The one `targets` map that routes companion reviewers rather than agents. */
+const TAKT_RUNTIME_COMPANIONS_TARGET_KEY = "companions";
+const TAKT_RUNTIME_COMPANION_KEY = "companion";
+const TAKT_RUNTIME_ENABLED_KEY = "enabled";
+const TAKT_DEFAULT_COMPANION_ENABLED = false;
 const TAKT_SECURITY_POLICIES = {
 	workflow_arpeggio: [
 		"custom_data_source_modules",
@@ -51942,21 +52380,156 @@ function runtimeProfiles(runtime) {
 	const profiles = provider[TAKT_RUNTIME_PROFILES_KEY];
 	return isPlainObject$1(profiles) ? profiles : {};
 }
+/** A `targets` map (`personas`, `tags`, …) with at least one non-empty entry. */
+function hasTargetContent(targets) {
+	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+}
+/** The profile names an assignment points at: `profile` plus every `ladder` rung. */
+function assignmentProfileNames(assignment) {
+	if (!isPlainObject$1(assignment)) return [];
+	const names = [];
+	const profile = assignment[TAKT_RUNTIME_PROFILE_KEY];
+	if (typeof profile === "string") names.push(profile);
+	const ladder = assignment[TAKT_RUNTIME_LADDER_KEY];
+	if (Array.isArray(ladder)) names.push(...ladder.filter((rung) => typeof rung === "string"));
+	return names;
+}
+/** The assignments under a `targets` map, split by whether they route companions. */
+function targetAssignments(targets, { companions }) {
+	if (!isPlainObject$1(targets)) return [];
+	return Object.entries(targets).filter(([name]) => name === TAKT_RUNTIME_COMPANIONS_TARGET_KEY === companions).flatMap(([, targetMap]) => isPlainObject$1(targetMap) ? Object.values(targetMap) : []);
+}
+/**
+* Record the profiles a `defaults` + `targets` pair (the top-level provider
+* section or one named assignment set) reaches, keeping companion roots apart
+* from the roots agents use.
+*/
+function addAssignmentSetRoots({ set, companionRoots, agentRoots }) {
+	for (const name of assignmentProfileNames(set[TAKT_RUNTIME_DEFAULTS_KEY])) agentRoots.add(name);
+	const targets = set[TAKT_RUNTIME_TARGETS_KEY];
+	for (const assignment of targetAssignments(targets, { companions: false })) for (const name of assignmentProfileNames(assignment)) agentRoots.add(name);
+	for (const assignment of targetAssignments(targets, { companions: true })) for (const name of assignmentProfileNames(assignment)) companionRoots.add(name);
+}
+/** The profiles `auto_routing` reaches: the router plus every pool candidate/fallback. */
+function addAutoRoutingRoots(autoRouting, roots) {
+	if (!isPlainObject$1(autoRouting)) return;
+	const routerProfile = autoRouting[TAKT_RUNTIME_ROUTER_PROFILE_KEY];
+	if (typeof routerProfile === "string") roots.add(routerProfile);
+	const pools = autoRouting[TAKT_RUNTIME_POOLS_KEY];
+	if (!isPlainObject$1(pools)) return;
+	for (const pool of Object.values(pools)) {
+		if (!isPlainObject$1(pool)) continue;
+		const candidates = pool[TAKT_RUNTIME_CANDIDATES_KEY];
+		for (const candidate of Array.isArray(candidates) ? candidates : []) for (const name of assignmentProfileNames(candidate)) roots.add(name);
+		const fallback = pool[TAKT_RUNTIME_FALLBACK_PROFILE_KEY];
+		if (typeof fallback === "string") roots.add(fallback);
+	}
+}
+/** Every profile reachable from `roots` by following `extends`. */
+function profileClosure(profiles, roots) {
+	const closure = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		if (closure.has(name)) return;
+		closure.add(name);
+		const profile = profiles[name];
+		const parent = isPlainObject$1(profile) ? profile[TAKT_RUNTIME_EXTENDS_KEY] : void 0;
+		if (typeof parent === "string") visit(parent);
+	};
+	for (const root of roots) visit(root);
+	return closure;
+}
+/** The `targets` map minus its `companions` entry (`undefined` when not a map). */
+function withoutCompanionTargets(targets) {
+	if (!isPlainObject$1(targets)) return;
+	const { [TAKT_RUNTIME_COMPANIONS_TARGET_KEY]: _companions, ...remaining } = targets;
+	return remaining;
+}
+/**
+* The named assignment sets with their companion targets removed; a set left
+* with neither `defaults` nor a non-empty `targets` map is dropped, and
+* `undefined` means none survived.
+*/
+function withoutCompanionAssignments(assignments) {
+	if (!isPlainObject$1(assignments)) return;
+	const remaining = {};
+	for (const [name, set] of Object.entries(assignments)) {
+		if (!isPlainObject$1(set)) continue;
+		const defaults = set[TAKT_RUNTIME_DEFAULTS_KEY];
+		const targets = withoutCompanionTargets(set[TAKT_RUNTIME_TARGETS_KEY]);
+		const keepTargets = hasTargetContent(targets);
+		if (defaults === void 0 && !keepTargets) continue;
+		remaining[name] = {
+			...defaults === void 0 ? {} : { [TAKT_RUNTIME_DEFAULTS_KEY]: defaults },
+			...keepTargets ? { [TAKT_RUNTIME_TARGETS_KEY]: targets } : {}
+		};
+	}
+	return Object.keys(remaining).length > 0 ? remaining : void 0;
+}
+/** Whether the section (or any of its named assignment sets) routes companions at all. */
+function hasCompanionTargets(section) {
+	const routesCompanions = (set) => {
+		const targets = isPlainObject$1(set) ? set[TAKT_RUNTIME_TARGETS_KEY] : void 0;
+		return isPlainObject$1(targets) && targets[TAKT_RUNTIME_COMPANIONS_TARGET_KEY] !== void 0;
+	};
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	return routesCompanions(section) || isPlainObject$1(assignments) && Object.values(assignments).some(routesCompanions);
+}
+/**
+* The `provider:` section as Takt itself evaluates it, mirroring upstream's
+* `getEffectiveProviderSection`: unless `companion.enabled` is `true`
+* (companions are opt-in), the `targets.companions` maps — top-level and inside
+* every named assignment set — are dropped, along with each profile that only a
+* companion target reaches through `extends`. A profile an agent assignment
+* (`defaults`, the other `targets` maps, `auto_routing`) also reaches is kept.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/schema.ts
+*/
+function effectiveRuntimeProviderSection(runtime) {
+	const section = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	if (!isPlainObject$1(section)) return;
+	const companion = runtime[TAKT_RUNTIME_COMPANION_KEY];
+	if (((isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0) ?? TAKT_DEFAULT_COMPANION_ENABLED) === true || !hasCompanionTargets(section)) return section;
+	const profiles = runtimeProfiles(runtime);
+	const companionRoots = /* @__PURE__ */ new Set();
+	const agentRoots = /* @__PURE__ */ new Set();
+	addAssignmentSetRoots({
+		set: section,
+		companionRoots,
+		agentRoots
+	});
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	for (const set of isPlainObject$1(assignments) ? Object.values(assignments) : []) if (isPlainObject$1(set)) addAssignmentSetRoots({
+		set,
+		companionRoots,
+		agentRoots
+	});
+	addAutoRoutingRoots(section[TAKT_RUNTIME_AUTO_ROUTING_KEY], agentRoots);
+	const companionClosure = profileClosure(profiles, companionRoots);
+	const agentClosure = profileClosure(profiles, agentRoots);
+	const effective = {
+		...section,
+		[TAKT_RUNTIME_PROFILES_KEY]: Object.fromEntries(Object.entries(profiles).filter(([name]) => !companionClosure.has(name) || agentClosure.has(name)))
+	};
+	for (const [key, value] of [[TAKT_RUNTIME_TARGETS_KEY, withoutCompanionTargets(section[TAKT_RUNTIME_TARGETS_KEY])], [TAKT_RUNTIME_ASSIGNMENTS_KEY, withoutCompanionAssignments(assignments)]]) if (value === void 0) delete effective[key];
+	else effective[key] = value;
+	return effective;
+}
 /**
 * Whether a parsed `runtime.yaml` puts Takt into runtime mode, mirroring
-* upstream's mode detection: the `provider:` section must carry an actual
-* assignment — a non-empty `defaults`, `profiles` or `auto_routing`, or a
-* `targets` map with at least one non-empty nested map. The file existing is not
-* enough, and empty nested maps (`defaults: {}`, `targets: { personas: {} }`)
-* must not flip the mode.
+* upstream's mode detection: the effective `provider:` section (see
+* `effectiveRuntimeProviderSection` — companion-only routing does not count
+* while companions are disabled) must carry an actual assignment — a non-empty
+* `defaults`, `profiles` or `auto_routing`, a `targets` map with at least one
+* non-empty nested map, or a named assignment set with a non-empty `defaults`
+* or such a `targets` map. The file existing is not enough, and empty nested
+* maps (`defaults: {}`, `targets: { personas: {} }`) must not flip the mode.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/mode.ts
 */
 function isRuntimeModeActive(runtime) {
-	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
-	if (!isPlainObject$1(provider)) return false;
-	if (hasEntries(provider[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(provider[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(provider[TAKT_RUNTIME_AUTO_ROUTING_KEY])) return true;
-	const targets = provider[TAKT_RUNTIME_TARGETS_KEY];
-	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+	const section = effectiveRuntimeProviderSection(runtime);
+	if (section === void 0) return false;
+	const assignments = section[TAKT_RUNTIME_ASSIGNMENTS_KEY];
+	const hasAssignments = isPlainObject$1(assignments) && Object.values(assignments).some((set) => isPlainObject$1(set) && (hasEntries(set[TAKT_RUNTIME_DEFAULTS_KEY]) || hasTargetContent(set[TAKT_RUNTIME_TARGETS_KEY])));
+	return hasEntries(section[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(section[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(section[TAKT_RUNTIME_AUTO_ROUTING_KEY]) || hasTargetContent(section[TAKT_RUNTIME_TARGETS_KEY]) || hasAssignments;
 }
 /** The provider named by the runtime profile Takt would use by default. */
 function resolveRuntimeProvider(runtime) {
@@ -51979,10 +52552,13 @@ function resolveRuntimeProvider(runtime) {
 * shape the `takt` override uses. Each profile's options belong to that
 * profile's own provider; when several profiles name the same provider they are
 * merged in document order, so a later profile wins on a colliding option key.
+* Profiles Takt itself ignores (companion-only ones while companions are
+* disabled) are skipped, as they never reach an agent.
 */
 function collectRuntimeProviderOptions(runtime) {
 	const collected = {};
-	for (const profile of Object.values(runtimeProfiles(runtime))) {
+	const profiles = effectiveRuntimeProviderSection(runtime)?.[TAKT_RUNTIME_PROFILES_KEY];
+	for (const profile of Object.values(isPlainObject$1(profiles) ? profiles : {})) {
 		if (!isPlainObject$1(profile)) continue;
 		const providerName = profile[TAKT_RUNTIME_PROVIDER_KEY];
 		const options = profile[TAKT_RUNTIME_OPTIONS_KEY];
@@ -52021,13 +52597,20 @@ async function readTaktRuntimeFile({ filePath, logger }) {
 		};
 	}
 }
+/** A map-valued key of a `provider:` section, or `undefined` when it is not a map. */
+function runtimeSectionMap(section, key) {
+	return isPlainObject$1(section[key]) ? section[key] : void 0;
+}
 /**
 * Collapse the project and global `runtime.yaml` into the single document Takt
-* itself resolves against, matching upstream's loader: `profiles` is a union
-* with the project definition of a same-named profile replacing the global one,
-* while `defaults`, `targets` and `auto_routing` are taken from the project file
-* whole whenever it states them at all (`??`, so a project `targets: {}` masks
-* the global one rather than merging with it).
+* itself resolves against, matching upstream's loader: `profiles` and
+* `assignments` are unions with the project definition of a same-named entry
+* replacing the global one, while `defaults`, `targets` and `auto_routing` are
+* taken from the project file whole whenever it states them at all (`??`, so a
+* project `targets: {}` masks the global one rather than merging with it). The
+* top-level `companion.enabled` — which decides whether companion routing
+* counts for mode detection — is carried as upstream carries it: unset when
+* neither file states it, otherwise on only when neither file turns it off.
 * https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/loader.ts
 *
 * Merging before mode detection matters in both directions: a project file
@@ -52043,14 +52626,15 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 	const projectSection = sectionOf(project);
 	const globalSection = sectionOf(globalConfig);
 	const replaced = (key) => projectSection[key] ?? globalSection[key];
-	const profilesOf = (section) => isPlainObject$1(section[TAKT_RUNTIME_PROFILES_KEY]) ? section[TAKT_RUNTIME_PROFILES_KEY] : void 0;
-	const globalProfiles = profilesOf(globalSection);
-	const projectProfiles = profilesOf(projectSection);
 	const provider = {};
-	if (globalProfiles !== void 0 || projectProfiles !== void 0) provider[TAKT_RUNTIME_PROFILES_KEY] = {
-		...globalProfiles,
-		...projectProfiles
-	};
+	for (const key of [TAKT_RUNTIME_PROFILES_KEY, TAKT_RUNTIME_ASSIGNMENTS_KEY]) {
+		const globalMap = runtimeSectionMap(globalSection, key);
+		const projectMap = runtimeSectionMap(projectSection, key);
+		if (globalMap !== void 0 || projectMap !== void 0) provider[key] = {
+			...globalMap,
+			...projectMap
+		};
+	}
 	for (const key of [
 		TAKT_RUNTIME_DEFAULTS_KEY,
 		TAKT_RUNTIME_TARGETS_KEY,
@@ -52059,7 +52643,17 @@ function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
 		const value = replaced(key);
 		if (value !== void 0) provider[key] = value;
 	}
-	return { [TAKT_RUNTIME_PROVIDER_KEY]: provider };
+	const enabledOf = (config) => {
+		const companion = config?.[TAKT_RUNTIME_COMPANION_KEY];
+		return isPlainObject$1(companion) ? companion[TAKT_RUNTIME_ENABLED_KEY] : void 0;
+	};
+	const globalEnabled = enabledOf(globalConfig);
+	const projectEnabled = enabledOf(project);
+	const companion = globalEnabled === void 0 && projectEnabled === void 0 ? void 0 : { [TAKT_RUNTIME_ENABLED_KEY]: globalEnabled !== false && projectEnabled !== false };
+	return {
+		[TAKT_RUNTIME_PROVIDER_KEY]: provider,
+		...companion === void 0 ? {} : { [TAKT_RUNTIME_COMPANION_KEY]: companion }
+	};
 }
 /**
 * The runtime provider configuration in force for a generate run: the project
@@ -58647,8 +59241,11 @@ const CursorSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	paths: z.optional(z.union([z.string(), z.array(z.string())])),
+	globs: z.optional(z.union([z.string(), z.array(z.string())])),
 	"disable-model-invocation": z.optional(z.boolean()),
 	"user-invocable": z.optional(z.boolean()),
+	icon: z.optional(z.string()),
+	color: z.optional(z.string()),
 	metadata: z.optional(z.looseObject({}))
 });
 /**
@@ -58700,10 +59297,13 @@ var CursorSkill = class CursorSkill extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
+		const paths = frontmatter.paths ?? frontmatter.globs;
 		const cursorSection = {
-			...frontmatter.paths !== void 0 && { paths: frontmatter.paths },
+			...paths !== void 0 && { paths },
 			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
+			...frontmatter.icon !== void 0 && { icon: frontmatter.icon },
+			...frontmatter.color !== void 0 && { color: frontmatter.color },
 			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
 		};
 		const rulesyncFrontmatter = {
@@ -58745,6 +59345,8 @@ var CursorSkill = class CursorSkill extends ToolSkill {
 			...cursorSection?.paths !== void 0 && { paths: cursorSection.paths },
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
 			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...cursorSection?.icon !== void 0 && { icon: cursorSection.icon },
+			...cursorSection?.color !== void 0 && { color: cursorSection.color },
 			...metadata !== void 0 && { metadata }
 		};
 		return new CursorSkill({
@@ -59728,7 +60330,8 @@ const GrokcliSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	"user-invocable": z.optional(z.boolean()),
-	"disable-model-invocation": z.optional(z.boolean())
+	"disable-model-invocation": z.optional(z.boolean()),
+	paths: z.optional(z.union([z.string(), z.array(z.string())]))
 });
 /**
 * Represents a Grok Build skill directory.
@@ -59787,7 +60390,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const grokcliSection = {
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.paths !== void 0 && { paths: frontmatter.paths }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -59822,7 +60426,8 @@ var GrokcliSkill = class GrokcliSkill extends ToolSkill {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
-			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...grokcliSection?.paths !== void 0 && { paths: grokcliSection.paths }
 		};
 		return new GrokcliSkill({
 			outputRoot,
@@ -62473,7 +63078,10 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: WARP_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: WARP_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return WarpSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -62537,12 +63145,14 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 		return targets.includes("*") || targets.includes("warp");
 	}
 	/**
-	* Commands are emitted into this same skills tree as `<slug>/SKILL.md`
-	* (see `WarpCommand`), so a directory matching a current rulesync command
-	* slug is owned by the commands feature: it must not be imported as a
-	* skill nor deleted as an orphan skill.
+	* Commands are emitted into the `.warp/skills/` tree as `<slug>/SKILL.md`
+	* (see `WarpCommand`), so a directory there matching a current rulesync
+	* command slug is owned by the commands feature: it must not be imported as
+	* a skill nor deleted as an orphan skill. The import-only `.agents/skills/`
+	* root never receives commands, so a same-named skill in it stays a skill.
 	*/
-	static async isDirOwned({ dirName, inputRoots }) {
+	static async isDirOwned({ relativeDirPath, dirName, inputRoots }) {
+		if (relativeDirPath !== WARP_SKILLS_DIR_PATH) return true;
 		return !await rulesyncCommandSlugExists({
 			inputRoots,
 			dirName
@@ -62755,6 +63365,25 @@ const ZedSkillFrontmatterSchema = z.looseObject({
 	description: z.string(),
 	"disable-model-invocation": z.optional(z.boolean())
 });
+const ZED = "Zed";
+const ZED_LOAD_FAILURE = "does not load the skill otherwise";
+/**
+* Collect the rules Zed enforces on a skill's frontmatter that the loose
+* schema above does not — `name` rules first, then `description`. Returned as
+* warnings rather than thrown: the canonical skill is shared with every other
+* target, so a name Zed rejects must not stop the generate run for the rest.
+*/
+function collectZedSkillViolations({ name, description }) {
+	const violations = [];
+	if (name.length === 0) violations.push("`name` must not be empty; Zed does not load a skill without one");
+	else violations.push(...collectSkillNameViolations({
+		name,
+		authority: ZED,
+		consequence: ZED_LOAD_FAILURE
+	}));
+	if (description.length > 1024) violations.push(`\`description\` is ${description.length} characters; ${ZED} loads the skill but warns past ${SKILL_DESCRIPTION_MAX_LENGTH}`);
+	return violations;
+}
 /**
 * Represents a Zed agent skill directory.
 * Skills are stored under .agents/skills/ (project) or ~/.agents/skills/ (global)
@@ -62823,9 +63452,10 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global: this.global
 		});
 	}
-	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
 		const settablePaths = ZedSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
 		const zedSection = rulesyncFrontmatter.zed;
 		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
 			rootFrontmatter: rulesyncFrontmatter,
@@ -62837,10 +63467,17 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			...zedSection,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
+		ZedSkill.reportSkillViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: zedFrontmatter,
+			logger
+		});
 		return new ZedSkill({
 			outputRoot,
 			relativeDirPath: settablePaths.relativeDirPath,
-			dirName: rulesyncSkill.getDirName(),
+			dirName,
 			frontmatter: zedFrontmatter,
 			body: rulesyncSkill.getBody(),
 			otherFiles: rulesyncSkill.getOtherFiles(),
@@ -62848,6 +63485,18 @@ var ZedSkill = class ZedSkill extends ToolSkill {
 			global
 		});
 	}
+	/**
+	* Warn about every rule Zed enforces on the skill about to be written. The
+	* reported path includes `outputRoot` so a global-scope skill points at the
+	* file under the home directory rather than a same-named project path.
+	*/
+	static reportSkillViolations({ outputRoot, relativeDirPath, dirName, frontmatter, logger }) {
+		warnSkillViolations({
+			skillPath: join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME),
+			violations: collectZedSkillViolations(frontmatter),
+			logger
+		});
+	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("zed");
@@ -65457,11 +66106,17 @@ var CopilotSubagent = class CopilotSubagent extends ToolSubagent {
 *
 * Reference: https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/create-custom-agents-for-cli
 *            https://docs.github.com/en/copilot/reference/custom-agents-configuration
+*            https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference
 *
 * Per the configuration docs:
 *  - `description` is required.
 *  - `name`, `target`, `tools`, `model`, `disable-model-invocation`,
 *    `user-invocable`, `mcp-servers`, and `metadata` are optional.
+*  - The CLI command reference adds `models` (authored models in priority
+*    order, overriding `model` when both are set) and `modelPolicy`
+*    (`preferred` lets a `subagents` settings override or the `/subagents`
+*    picker replace the model; `required` locks dispatch to the authored
+*    list). CLI v1.0.81+; the shared reference page still lists `model` only.
 *
 * `looseObject` is used so that future additional fields are passed through
 * unchanged (consistent with the rest of rulesync's frontmatter schemas).
@@ -65472,6 +66127,8 @@ const CopilotCliSubagentFrontmatterSchema = z.looseObject({
 	target: z.optional(z.string()),
 	tools: z.optional(z.union([z.string(), z.array(z.string())])),
 	model: z.optional(z.string()),
+	models: z.optional(z.array(z.string())),
+	modelPolicy: z.optional(z.enum(["preferred", "required"])),
 	"disable-model-invocation": z.optional(z.boolean()),
 	"user-invocable": z.optional(z.boolean()),
 	"mcp-servers": z.optional(z.record(z.string(), z.unknown())),
@@ -69848,16 +70505,131 @@ var AgentsMdRule = class AgentsMdRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/utils/brace-aware-list.ts
+/**
+* Splits a comma-separated pattern list on the commas that separate its
+* entries, leaving the commas inside a brace group alone: in
+* `{src,lib}/**\/*.ts, tests/**\/*.test.ts` the first comma belongs to the
+* brace expansion and the second separates the two globs. Entries are trimmed;
+* empty entries are dropped.
+*
+* @example
+* splitBraceAwareList("src/**\/*.{ts,tsx}, docs/**")
+* // => ["src/**\/*.{ts,tsx}", "docs/**"]
+*/
+const splitBraceAwareList = (value) => {
+	const entries = [];
+	let current = "";
+	let braceDepth = 0;
+	for (const char of value) {
+		if (char === "{") braceDepth += 1;
+		else if (char === "}" && braceDepth > 0) braceDepth -= 1;
+		else if (char === "," && braceDepth === 0) {
+			entries.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	entries.push(current);
+	return entries.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+};
+/**
+* Upper bound on the patterns one glob may expand to; past it the glob is
+* returned verbatim, since `{a,b}` repeated k times yields 2^k branches.
+*/
+const MAX_BRACE_EXPANSIONS = 256;
+/** Matches an innermost brace group with at least one comma: `{a,b}`, not `{a}` or `{a,{b,c}}`. */
+const INNERMOST_BRACE_GROUP_REGEX = /\{([^{},]*(?:,[^{},]*)+)\}/;
+/**
+* Expands the comma alternations of a glob (`a.{ts,tsx}` → `a.ts`, `a.tsx`)
+* into one pattern per combination, innermost group first, so the result can
+* be handed to a consumer that splits its pattern list on bare commas. A glob
+* without a brace alternation is returned as is; a brace group without a
+* comma (e.g. `{a}`) is left untouched. A glob whose expansion would exceed
+* `MAX_BRACE_EXPANSIONS` patterns is returned as is as well.
+*
+* The cap is enforced on the work list itself rather than by counting the
+* groups up front: a nested group such as `{{a,b},c}` is rewritten into one
+* new group per inner alternative, so the number of patterns in flight is the
+* only bound that holds for arbitrary nesting.
+*
+* @example
+* expandBraceAlternations("src/**\/*.{ts,tsx}")
+* // => ["src/**\/*.ts", "src/**\/*.tsx"]
+*/
+const expandBraceAlternations = (glob) => {
+	let pending = [glob];
+	for (;;) {
+		const next = [];
+		let expanded = false;
+		for (const pattern of pending) {
+			const match = INNERMOST_BRACE_GROUP_REGEX.exec(pattern);
+			if (match === null) {
+				next.push(pattern);
+				continue;
+			}
+			expanded = true;
+			const prefix = pattern.slice(0, match.index);
+			const suffix = pattern.slice(match.index + match[0].length);
+			for (const alternative of (match[1] ?? "").split(",")) next.push(`${prefix}${alternative}${suffix}`);
+			if (next.length > MAX_BRACE_EXPANSIONS) return [glob];
+		}
+		if (!expanded) return [...new Set(next)];
+		pending = next;
+	}
+};
+//#endregion
 //#region src/features/rules/aiassistant-rule.ts
 /**
+* Rule types AI Assistant recognizes on the `apply:` metadata line. The values
+* are matched case-sensitively by the plugin, so they are emitted verbatim.
+* Any other value is carried through untouched (the plugin treats it as Off
+* today; a future build may recognize it).
+*/
+const AIASSISTANT_APPLY_VALUES = [
+	"always",
+	"manually",
+	"by model decision",
+	"by file patterns",
+	"off"
+];
+const isAiassistantApply = (value) => AIASSISTANT_APPLY_VALUES.includes(value);
+/**
+* Globs that match the whole project and so say nothing beyond "always".
+*/
+const UNIVERSAL_GLOBS$2 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const METADATA_DELIMITER = "---";
+/**
+* Splits text into lines that keep their own line terminator, so the body can
+* be sliced back out of the file byte-for-byte. Lone `\r` counts as a break,
+* matching Kotlin's `lines()`, which the plugin uses on the block.
+*/
+const LINE_SPLIT_REGEX = /(?<=\r\n|\r(?!\n)|(?<!\r)\n)/;
+/**
+* The block is line-based, so a value must not carry a line break: one would
+* start a new `<field>: <value>` line and could override `apply:`.
+*/
+const flattenValue = (value) => value.split(/\r\n|\r|\n/).map((part) => part.trim()).filter((part) => part.length > 0).join(" ");
+/**
 * Rule generator for JetBrains AI Assistant.
 *
 * AI Assistant reads project rules as flat Markdown files in
-* `.aiassistant/rules/*.md` (one file per rule, identified by filename). The rule
-* type (Always / Manually / By model decision / By file patterns) is configured
-* in the IDE, not in the file, so the generated files are plain Markdown with no
-* frontmatter. There is no special root file (unlike Junie's `guidelines.md`), so
-* every rule — root or non-root — is written as its own file under `rules/`.
+* `.aiassistant/rules/*.md` (one file per rule, identified by filename). There
+* is no special root file (unlike Junie's `guidelines.md`), so every rule —
+* root or non-root — is written as its own file under `rules/`.
+*
+* The rule type (Always / Manually / By model decision / By file patterns /
+* Off) is stored in the file itself as a leading `---` metadata block that the
+* IDE's "Rule type" selector edits in place. The block is not YAML: each line
+* is `<field>: <value>` split on the first colon, and `patterns` is a
+* comma-separated glob list, so it is written and parsed by hand here. A file
+* without an `apply:` line is treated as Off at retrieval time (it is never
+* attached automatically), which is why every generated file carries one.
+*
+* Field names and values come from the plugin (`AiRulesService`,
+* `AiRulesLLMBundle.properties`; verified on build 262.10968.75) — the docs
+* page describes the rule type only as an IDE setting.
 *
 * AI Assistant and Junie are different JetBrains products (real-time assistance
 * vs. autonomous agent) with different layouts, so this is a separate target.
@@ -69865,18 +70637,154 @@ var AgentsMdRule = class AgentsMdRule extends ToolRule {
 * @see https://www.jetbrains.com/help/ai-assistant/configure-project-rules.html
 */
 var AiassistantRule = class AiassistantRule extends ToolRule {
+	body;
+	metadata;
+	constructor({ body, metadata, ...rest }) {
+		super({
+			...rest,
+			fileContent: AiassistantRule.buildFileContent({
+				body,
+				metadata
+			})
+		});
+		this.body = body;
+		this.metadata = metadata;
+	}
 	static getSettablePaths(_options = {}) {
 		return { nonRoot: { relativeDirPath: AIASSISTANT_RULES_DIR_PATH } };
 	}
+	getBody() {
+		return this.body;
+	}
+	getMetadata() {
+		return this.metadata;
+	}
+	/**
+	* Serialize the metadata block the way the IDE writes it
+	* (`---\n<field>: <value>\n---`), followed by the body.
+	*/
+	static buildFileContent({ body, metadata }) {
+		if (metadata === void 0) return body;
+		const lines = [`apply: ${metadata.apply}`];
+		if (metadata.apply === "by model decision" && metadata.instructions) lines.push(`instructions: ${flattenValue(metadata.instructions)}`);
+		if (metadata.apply === "by file patterns" && metadata.patterns && metadata.patterns.length > 0) lines.push(`patterns: ${metadata.patterns.map(flattenValue).join(", ")}`);
+		return `${METADATA_DELIMITER}\n${lines.join("\n")}\n${METADATA_DELIMITER}\n\n${body}`;
+	}
+	/**
+	* Split a rule file into its metadata block and body. The plugin locates the
+	* block with `^---\s*([\s\S]*?)---\s*` (anchored at the very start of the
+	* file); this reads it line by line instead — a delimiter is a line that is
+	* exactly `---` — which is linear on any input and tolerates a BOM or blank
+	* lines before the block. Each line is split on its first colon and trimmed;
+	* unknown fields are ignored; a missing block or `apply:` line yields no
+	* metadata, while an unrecognized `apply:` value is kept verbatim.
+	*/
+	static parseFileContent(fileContent) {
+		const content = fileContent.replace(/^\uFEFF/, "").trimStart();
+		const lines = content.split(LINE_SPLIT_REGEX);
+		const closingIndex = lines[0]?.trim() === METADATA_DELIMITER ? lines.findIndex((line, index) => index > 0 && line.trim() === METADATA_DELIMITER) : -1;
+		if (closingIndex === -1) return {
+			metadata: void 0,
+			body: content.trim()
+		};
+		const body = lines.slice(closingIndex + 1).join("").trim();
+		const fields = /* @__PURE__ */ new Map();
+		for (const line of lines.slice(1, closingIndex)) {
+			const separatorIndex = line.indexOf(":");
+			if (separatorIndex === -1) continue;
+			fields.set(line.slice(0, separatorIndex).trim(), line.slice(separatorIndex + 1).trim());
+		}
+		const apply = fields.get("apply");
+		if (apply === void 0 || apply.length === 0) return {
+			metadata: void 0,
+			body
+		};
+		const instructions = fields.get("instructions");
+		const patterns = fields.get("patterns");
+		return {
+			metadata: {
+				apply,
+				...apply === "by model decision" && instructions && { instructions },
+				...apply === "by file patterns" && patterns && { patterns: splitBraceAwareList(patterns) }
+			},
+			body
+		};
+	}
+	/**
+	* Derive the metadata block from the canonical frontmatter, mirroring the
+	* Cursor mapping: an explicit `aiassistant.apply` wins; otherwise specific
+	* `globs` become `by file patterns`, a `description` on a rule with no
+	* `globs` at all becomes the `by model decision` condition, and everything
+	* else — the root rule, universal globs (which already say "every file",
+	* whatever the description), bare rules — is `always`.
+	*
+	* The plugin splits `patterns` on every comma, so a brace alternation such
+	* as `*.{ts,tsx}` is expanded into one glob per branch before it is written.
+	*/
+	static buildMetadata(frontmatter) {
+		const globs = (frontmatter.globs ?? []).map((glob) => flattenValue(glob)).filter((glob) => glob.length > 0).flatMap((glob) => expandBraceAlternations(glob));
+		const hasUniversalGlob = globs.some((glob) => UNIVERSAL_GLOBS$2.has(glob));
+		const instructions = frontmatter.description && flattenValue(frontmatter.description);
+		const explicitApply = frontmatter.aiassistant?.apply && flattenValue(frontmatter.aiassistant.apply);
+		const apply = explicitApply ? explicitApply : frontmatter.root !== true && globs.length > 0 && !hasUniversalGlob ? "by file patterns" : frontmatter.root !== true && globs.length === 0 && instructions ? "by model decision" : "always";
+		const patterns = globs;
+		return {
+			apply,
+			...apply === "by model decision" && instructions && { instructions },
+			...apply === "by file patterns" && patterns.length > 0 && { patterns }
+		};
+	}
+	/**
+	* Warn, at generate time, about a block the plugin cannot act on as the
+	* author presumably intended.
+	*/
+	static warnAboutMetadata({ metadata, relativeFilePath }) {
+		const { apply, instructions, patterns = [] } = metadata;
+		if (!isAiassistantApply(apply)) warnWithFallback(void 0, `${relativeFilePath}: aiassistant.apply "${apply}" is not one of ${AIASSISTANT_APPLY_VALUES.join(", ")}; it is written as is, and the current AI Assistant treats such a rule as Off.`);
+		if (apply === "by file patterns" && patterns.length === 0) warnWithFallback(void 0, `${relativeFilePath}: aiassistant.apply is "by file patterns" but the rule has no globs, so AI Assistant will never attach it.`);
+		if (apply === "by model decision" && !instructions) warnWithFallback(void 0, `${relativeFilePath}: aiassistant.apply is "by model decision" but the rule has no description, so AI Assistant has no condition to decide on.`);
+		const commaGlob = patterns.find((glob) => glob.includes(","));
+		if (commaGlob !== void 0) warnWithFallback(void 0, `${relativeFilePath}: the glob "${commaGlob}" contains a comma, which AI Assistant reads as a pattern separator.`);
+		if ([
+			apply,
+			instructions ?? "",
+			...patterns
+		].some((value) => value.includes("---"))) warnWithFallback(void 0, `${relativeFilePath}: a metadata value contains "---", which AI Assistant reads as the end of the metadata block.`);
+	}
 	toRulesyncRule() {
-		return this.toRulesyncRuleDefault();
+		const metadata = this.metadata;
+		const globs = metadata?.apply === "by file patterns" ? metadata.patterns ?? [] : metadata?.apply === "always" ? ["**/*"] : [];
+		const frontmatter = {
+			root: false,
+			targets: ["*"],
+			description: metadata?.apply === "by model decision" ? metadata.instructions : void 0,
+			globs
+		};
+		const derivedApply = metadata === void 0 ? void 0 : AiassistantRule.buildMetadata(frontmatter).apply;
+		const apply = metadata !== void 0 && derivedApply !== metadata.apply ? metadata.apply : void 0;
+		return new RulesyncRule({
+			outputRoot: process.cwd(),
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			frontmatter: {
+				...frontmatter,
+				...apply !== void 0 && { aiassistant: { apply } }
+			},
+			body: this.body
+		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
+		const metadata = this.buildMetadata(rulesyncRule.getFrontmatter());
+		this.warnAboutMetadata({
+			metadata,
+			relativeFilePath: rulesyncRule.getRelativeFilePath()
+		});
 		return new AiassistantRule({
 			outputRoot,
 			relativeDirPath: this.getSettablePaths().nonRoot.relativeDirPath,
 			relativeFilePath: rulesyncRule.getRelativeFilePath(),
-			fileContent: rulesyncRule.getBody(),
+			body: rulesyncRule.getBody(),
+			metadata,
 			validate,
 			root: false
 		});
@@ -69884,11 +70792,13 @@ var AiassistantRule = class AiassistantRule extends ToolRule {
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
 		const relativeDirPath = this.getSettablePaths().nonRoot.relativeDirPath;
 		const fileContent = await readFileContent(join(outputRoot, relativeDirPath, relativeFilePath));
+		const { metadata, body } = this.parseFileContent(fileContent);
 		return new AiassistantRule({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
-			fileContent: fileContent.trim(),
+			body,
+			metadata,
 			validate,
 			root: false
 		});
@@ -69898,7 +70808,7 @@ var AiassistantRule = class AiassistantRule extends ToolRule {
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
-			fileContent: "",
+			body: "",
 			validate: false,
 			root: false
 		});
@@ -71455,40 +72365,14 @@ const CodebuddyRuleFrontmatterSchema = z.object({
 	enabled: z.optional(z.boolean())
 });
 /**
-* Splits a scalar `paths` value on the commas that separate patterns, leaving
-* the commas inside a brace group alone: CodeBuddy's memory docs say "You can
-* also combine multiple patterns with commas" and give
-* `paths: {src,lib}/**\/*.ts, tests/**\/*.test.ts` as the example, where the
-* first comma belongs to the brace expansion and the second separates the two
-* globs. Only a scalar is split — the docs describe the comma form for the
-* string shape, and a list already separates its patterns.
-*/
-function splitCodebuddyPathsScalar(paths) {
-	const patterns = [];
-	let current = "";
-	let braceDepth = 0;
-	for (const char of paths) {
-		if (char === "{") braceDepth += 1;
-		else if (char === "}" && braceDepth > 0) braceDepth -= 1;
-		else if (char === "," && braceDepth === 0) {
-			patterns.push(current);
-			current = "";
-			continue;
-		}
-		current += char;
-	}
-	patterns.push(current);
-	return patterns.map((pattern) => pattern.trim());
-}
-/**
 * Normalizes the documented `string` / `string[]` shapes of `paths` to the
 * list form the rest of the adapter works with, splitting a comma-separated
-* scalar into its patterns (see `splitCodebuddyPathsScalar`). An empty list
+* scalar into its patterns (see `splitBraceAwareList`). An empty list
 * and an empty string both mean "no paths".
 */
 function normalizeCodebuddyPaths(paths) {
 	if (paths === void 0) return;
-	const list = (typeof paths === "string" ? splitCodebuddyPathsScalar(paths) : paths).filter((path) => path.trim() !== "");
+	const list = (typeof paths === "string" ? splitBraceAwareList(paths) : paths).filter((path) => path.trim() !== "");
 	return list.length > 0 ? list : void 0;
 }
 /**
@@ -79705,4 +80589,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
 
-//# sourceMappingURL=import-DxRza3o_.js.map
+//# sourceMappingURL=import-BnF2J75x.js.map