rulesync 16.37.0 → 16.39.0

package/dist/{import-BnF2J75x.js → import-B2ANxi1V.js}

@@ -1,8 +1,8 @@
 import { ZodError } from "zod";
 import { meta, minLength, nonnegative, optional, refine, z } from "zod/mini";
 import { cp, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
-import path, { basename, dirname, extname, isAbsolute, join, normalize, posix, relative, resolve, sep, win32 } from "node:path";
-import { applyEdits, findNodeAtLocation, getNodeValue, modify, parse, parseTree, printParseErrorCode } from "jsonc-parser";
+import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path";
+import { applyEdits, findNodeAtLocation, getNodeValue, modify, parse as parse$1, parseTree, printParseErrorCode } from "jsonc-parser";
 import { constants } from "node:fs";
 import os from "node:os";
 import { intersection, kebabCase, uniq } from "es-toolkit";
@@ -14,7 +14,7 @@ import { YAMLException, dump, load } from "js-yaml";
 import { omit } from "es-toolkit/object";
 import { createHash } from "node:crypto";
 import * as smolToml from "smol-toml";
-import { parse as parse$1, stringify } from "smol-toml";
+import { parse as parse$2, stringify } from "smol-toml";
 import { encode } from "@toon-format/toon";
 //#region src/utils/control-characters.ts
 /**
@@ -591,6 +591,7 @@ const mcpProcessorToolTargetTuple = [
 	"junie",
 	"musecode",
 	"opencode",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"roo",
@@ -670,6 +671,7 @@ const subagentsProcessorToolTargetTuple = [
 	"kiro-cli",
 	"kiro-ide",
 	"opencode",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"roo",
@@ -751,6 +753,7 @@ const hooksProcessorToolTargetTuple = [
 	"crush",
 	"opencode",
 	"pi",
+	"pool",
 	"factorydroid",
 	"goose",
 	"hermesagent",
@@ -798,6 +801,7 @@ const permissionsProcessorToolTargetTuple = [
 	"kiro-ide",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"roo",
@@ -1354,6 +1358,111 @@ async function resolvedPathEscapesRoot({ rootPath, targetPath }) {
 	}));
 }
 /**
+* How many links {@link writeLandingPath} follows before it treats the chain as
+* a cycle it cannot write through. Linux itself gives up after 40.
+*/
+const MAX_LINK_HOPS = 40;
+/**
+* Whether `error` is the ENOTDIR a lookup through a file raises. On the way to
+* a write it means the same as a missing entry: nothing at or below the path
+* exists, so nothing there can be a link.
+*/
+function isNotADirectoryError(error) {
+	return someErrorInChain(error, (candidate) => "code" in candidate && candidate.code === "ENOTDIR");
+}
+/**
+* Where a write to `targetPath` lands once the OS has followed every link on
+* the way there, or `null` when the links form a cycle no write can get
+* through. The target itself usually does not exist yet, so the walk goes
+* segment by segment from the filesystem root: an existing segment that is a
+* link is replaced by what it resolves to, and a dangling link — one whose
+* target does not exist yet, which is exactly the shape of a link planted at
+* `AGENTS.md` pointing at a `~/.zshenv` that is still to be created — has its
+* target spliced into the walk in its place, so the segments of that target
+* are looked up one by one too. Once a segment is missing, nothing below it
+* exists, and the rest of the path is where the write's `mkdir -p` will put it.
+*
+* Walking segment by segment is what keeps a `..` honest. A link target is a
+* path the OS resolves left to right, so in `sub/../victim` the `..` climbs out
+* of wherever `sub` leads, not out of the directory `sub` is spelled in; a
+* lexical `resolve` folds `sub/..` away before `sub` is ever looked at, which
+* is how a link chain could be spelled to pass the check and still land
+* outside the root.
+*/
+async function writeLandingPath(targetPath) {
+	const start = splitAbsolutePath(isAbsolute(targetPath) ? targetPath : resolve(targetPath));
+	let current = start.root;
+	let pending = start.segments;
+	let exists = true;
+	let linkHops = 0;
+	while (pending.length > 0) {
+		const segment = pending.shift();
+		if (segment === void 0 || segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			current = dirname(current);
+			continue;
+		}
+		current = join(current, segment);
+		if (!exists) continue;
+		let stats;
+		try {
+			stats = await lstat(current);
+		} catch (error) {
+			if (!isFileNotFoundError(error) && !isNotADirectoryError(error)) throw error;
+			exists = false;
+			continue;
+		}
+		if (!stats.isSymbolicLink()) continue;
+		linkHops += 1;
+		if (linkHops > MAX_LINK_HOPS) return null;
+		try {
+			current = await realpath(current);
+			continue;
+		} catch {}
+		const linkTarget = await readlink(current);
+		if (isAbsolute(linkTarget)) {
+			const target = splitAbsolutePath(linkTarget);
+			current = target.root;
+			pending = [...target.segments, ...pending];
+		} else {
+			current = dirname(current);
+			pending = [...splitPathSegments(linkTarget), ...pending];
+		}
+	}
+	return current;
+}
+/**
+* Split an absolute path into its root and its raw segments, without folding a
+* `..` away: {@link writeLandingPath} has to see every `..` where it is spelled.
+*/
+function splitAbsolutePath(absolutePath) {
+	const root = parse(absolutePath).root;
+	return {
+		root,
+		segments: splitPathSegments(absolutePath.slice(root.length))
+	};
+}
+/**
+* Whether writing `targetPath` would land outside `rootPath` once every link on
+* the way there is resolved. Both sides are taken to where a write to them
+* would land (see {@link writeLandingPath}), so a root that does not fully
+* exist yet is judged the same way as the target below it.
+*
+* A link that stays inside the root passes. That is what sets this apart from
+* the stricter {@link assertWritablePathInsideRoot} the sweep paths use: a
+* dotfiles checkout linked from inside the home directory is a common shape for
+* a global write target, and refusing it would refuse `--global` outright.
+*
+* A link chain that cycles is reported as an escape: the write could not get
+* through it, and refusing it is the answer that never writes somewhere
+* unexpected.
+*/
+async function writablePathEscapesRoot({ rootPath, targetPath }) {
+	const [rootLanding, targetLanding] = await Promise.all([writeLandingPath(rootPath), writeLandingPath(targetPath)]);
+	if (rootLanding === null || targetLanding === null) return true;
+	return pathEscapesRoot(relative(rootLanding, targetLanding));
+}
+/**
 * How many trailing segments `filePath` and `identity` have in common.
 *
 * A path that walked through no link at all shares all of its own segments with
@@ -2935,7 +3044,7 @@ const getDefaults = () => ({
 const loadConfigFromFile = async (filePath) => {
 	if (!await fileExists(filePath)) return {};
 	const fileContent = await readFileContent(filePath);
-	const jsonData = parse(fileContent);
+	const jsonData = parse$1(fileContent);
 	const { $schema: _schema, ...configParams } = ConfigFileSchema.parse(jsonData);
 	assertTargetsFeaturesExclusive({
 		targets: configParams.targets,
@@ -3304,6 +3413,8 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".grok/config.toml",
 	".rovodev/config.yml",
 	".rovodev/mcp.json",
+	".poolside/settings.yaml",
+	".config/poolside/settings.yaml",
 	".tabnine/agent/settings.json",
 	".vibe/config.toml",
 	".zcode/config.json",
@@ -4353,7 +4464,7 @@ const PI_HOOK_EVENTS = [
 * adapter. Amp's `agent.start` / `agent.end` events describe the main agent
 * turn, not a subagent lifecycle, so they map to `beforeSubmitPrompt` / `stop`.
 *
-* @see https://ampcode.com/manual/plugin-api
+* @see https://ampcode.com/docs/plugin-api
 */
 const AMP_HOOK_EVENTS = [
 	"sessionStart",
@@ -4651,6 +4762,34 @@ const VIBE_HOOK_EVENTS = [
 	"stop"
 ];
 /**
+* Hook events supported by Pool.
+*
+* Pool's `hooks` settings block fires six events, spelled the Claude Code
+* way: `PreToolUse`, `PostToolUse`, `UserPromptSubmit` (← `beforeSubmitPrompt`),
+* `PreCompact`, `SessionStart` and `Stop`. Every entry carries a `matcher`
+* (required by Pool's schema; `""`/`*` match any tool, a bare name is an exact
+* match, `a|b` lists names, anything else is a regular expression), which only
+* `PreToolUse`/`PostToolUse` test against the tool name.
+* @see https://docs.poolside.ai/hooks
+*/
+const POOL_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"beforeSubmitPrompt",
+	"preCompact",
+	"sessionStart",
+	"stop"
+];
+const CANONICAL_TO_POOL_EVENT_NAMES = {
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	beforeSubmitPrompt: "UserPromptSubmit",
+	preCompact: "PreCompact",
+	sessionStart: "SessionStart",
+	stop: "Stop"
+};
+const POOL_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_POOL_EVENT_NAMES).map(([k, v]) => [v, k]));
+/**
 * Hook events supported by Crush.
 *
 * Crush's `hooks` config block currently fires a single event, `PreToolUse`
@@ -5245,6 +5384,7 @@ const HooksConfigSchema = z.looseObject({
 	"kimi-code": z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	zcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	crush: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
+	pool: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	bob: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	cortexcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	commandcode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
@@ -5919,7 +6059,7 @@ function parseJsonc(content) {
 */
 function parseStrict(content) {
 	const errors = [];
-	const result = parse(content, errors, {
+	const result = parse$1(content, errors, {
 		allowTrailingComma: true,
 		disallowComments: false
 	});
@@ -6198,6 +6338,7 @@ const McpServerSchema = z.looseObject({
 	crushOauthClientSecret: z.optional(z.string()),
 	crushOauthCallbackPort: z.optional(z.int()),
 	crushSessionless: z.optional(z.boolean()),
+	poolAllow: z.optional(z.array(z.string())),
 	headers: z.optional(z.record(z.string(), z.string())),
 	/**
 	* The canonical per-server tool allowlist.
@@ -6629,6 +6770,7 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 				"crushOauthClientSecret",
 				"crushOauthCallbackPort",
 				"crushSessionless",
+				"poolAllow",
 				"oauth_client_id",
 				"oauth_client_secret",
 				"oauth_callback_port",
@@ -7971,6 +8113,7 @@ const PermissionsConfigSchema = z.looseObject({
 	copilotcli: z.optional(CanonicalPermissionsOverrideSchema),
 	crush: z.optional(CanonicalPermissionsOverrideSchema),
 	goose: z.optional(CanonicalPermissionsOverrideSchema),
+	pool: z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": z.optional(KimiCodePermissionsOverrideSchema),
 	roo: z.optional(CanonicalPermissionsOverrideSchema),
@@ -8316,7 +8459,7 @@ const PERMISSION_OVERRIDE_KEY_ALIASES = {
 * them; treating a segment that carries one as static could name a directory
 * that no matched file actually lives under.
 */
-const GLOB_METACHARACTERS = /[*?[\]{}()!]/;
+const GLOB_METACHARACTERS$1 = /[*?[\]{}()!]/;
 /**
 * The directory every file matched by `glob` lives under, or `undefined` when
 * the pattern pins down no such directory.
@@ -8349,7 +8492,7 @@ function getGlobStaticPrefix(glob) {
 	const lastIndex = segments.length - 1;
 	const prefix = [];
 	for (const [index, segment] of segments.entries()) {
-		if (segment === "" || GLOB_METACHARACTERS.test(segment)) break;
+		if (segment === "" || GLOB_METACHARACTERS$1.test(segment)) break;
 		if (segment === ".") continue;
 		if (index === lastIndex) break;
 		prefix.push(segment);
@@ -9813,6 +9956,22 @@ allowedMcpServers: z.optional(z.array(z.string())) })),
 		injectAgentsMd: z.optional(z.boolean()),
 		mcpServers: z.optional(z.array(z.string()))
 	})),
+	pool: z.optional(z.looseObject({
+		type: z.optional(z.enum([
+			"in_process",
+			"command",
+			"agent_server"
+		])),
+		description: z.optional(z.string()),
+		instructions: z.optional(z.string()),
+		command: z.optional(z.string()),
+		args: z.optional(z.array(z.string())),
+		env: z.optional(z.record(z.string(), z.string())),
+		agent_server: z.optional(z.string()),
+		session_config_options: z.optional(z.record(z.string(), z.unknown())),
+		inherit_agent_config: z.optional(z.boolean()),
+		disabled: z.optional(z.boolean())
+	})),
 	vibe: z.optional(z.looseObject({
 		agent_type: z.optional(z.enum(["agent", "subagent"])),
 		display_name: z.optional(z.string()),
@@ -10174,7 +10333,7 @@ function tryParseStructured({ filePath, content }) {
 		case ".json":
 		case ".jsonc": {
 			const errors = [];
-			const value = parse(content, errors);
+			const value = parse$1(content, errors);
 			return errors.length > 0 ? PARSE_FAILED : {
 				ok: true,
 				value
@@ -10400,6 +10559,17 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 		this.logger = logger;
 	}
 	/**
+	* Whether `convertRulesyncFilesToToolFiles` still yields tool files for an
+	* empty source list. A processor that aggregates into a shared file it may
+	* never delete (Pool's `settings.yaml` subagents) answers true so a run
+	* whose last source file is gone retracts what an earlier run generated;
+	* the default keeps a run with no source from writing anything. Consulted
+	* after `loadRulesyncFiles`, so the answer may depend on what that load saw.
+	*/
+	emitsToolFilesForEmptySource() {
+		return false;
+	}
+	/**
 	* Return tool targets that this feature supports.
 	*/
 	static getToolTargets(_params = {}) {
@@ -10414,6 +10584,11 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 		const changedPaths = [];
 		for (const aiFile of aiFiles) {
 			const filePath = aiFile.getFilePath();
+			if (await refusesWriteOutsideRoot({
+				logger: this.logger,
+				rootPath: aiFile.getOutputRoot(),
+				targetPath: filePath
+			})) continue;
 			const existingFileContent = await readFileContentOrNull(filePath);
 			if (existingFileContent !== null && aiFile.shouldMergeExistingFileContent()) aiFile.setFileContent(existingFileContent);
 			const contentWithNewline = addTrailingNewline(aiFile.getFileContent());
@@ -10546,6 +10721,37 @@ function mergeByIdentity({ perRoot, identity }) {
 	return order.map((key) => winnerByKey.get(key));
 }
 /**
+* Whether a write to `targetPath` has to be refused because a link on the way
+* there leads out of `rootPath`, warning about the refusal.
+*
+* A checked-out repository can carry a symbolic link at an output path
+* (`AGENTS.md -> ~/.bashrc`, a tool directory linked to `/etc`), and a write
+* through it would land wherever the link points. Every writer that lets the
+* OS follow links — file, directory, and config-rewrite alike — asks this first
+* so that one warning describes the one behavior.
+*/
+async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
+	if (!await writablePathEscapesRoot({
+		rootPath,
+		targetPath
+	})) return false;
+	logger.warn(`Refusing to write ${quoteForLog(targetPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	return true;
+}
+/**
+* {@link refusesWriteOutsideRoot} over every path a single unit of output
+* writes, stopping at the first refusal: a directory written as one unit is
+* held back whole when any one file in it would land outside the root.
+*/
+async function refusesAnyWriteOutsideRoot({ logger, rootPath, targetPaths }) {
+	for (const targetPath of targetPaths) if (await refusesWriteOutsideRoot({
+		logger,
+		rootPath,
+		targetPath
+	})) return true;
+	return false;
+}
+/**
 * The key two spellings share when a case-insensitive filesystem would give
 * them one file. `toLowerCase()` is locale-independent (unlike
 * `toLocaleLowerCase`, it does not turn `I` into the Turkish `ı` under a Turkish
@@ -12219,16 +12425,16 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 	let parsed;
 	try {
 		if (format === "yaml") parsed = loadYaml(fileContent);
-		else if (format === "toml") parsed = parse$1(fileContent);
+		else if (format === "toml") parsed = parse$2(fileContent);
 		else if (format === "json") parsed = JSON.parse(fileContent);
 		else if (jsoncParseErrors === "error") {
 			const errors = [];
-			parsed = parse(fileContent, errors, { allowTrailingComma: true });
+			parsed = parse$1(fileContent, errors, { allowTrailingComma: true });
 			if (errors.length > 0) {
 				const details = errors.map((error) => `${printParseErrorCode(error.error)} at offset ${error.offset}`).join(", ");
 				throw new Error(details);
 			}
-		} else parsed = parse(fileContent);
+		} else parsed = parse$1(fileContent);
 	} catch (error) {
 		throw new Error(`Failed to parse shared config${at}: ${formatError(error)}`, { cause: error });
 	}
@@ -12924,6 +13130,8 @@ const KIMI_CODE_HOME_CONFIG_SHARED_FILE_KEY = "config.toml";
 const REASONIX_PROJECT_CONFIG_SHARED_FILE_KEY = "reasonix.toml";
 const REASONIX_GLOBAL_CONFIG_SHARED_FILE_KEY = ".reasonix/config.toml";
 const ROVODEV_CONFIG_SHARED_FILE_KEY = ".rovodev/config.yml";
+const POOL_PROJECT_SETTINGS_SHARED_FILE_KEY = ".poolside/settings.yaml";
+const POOL_GLOBAL_SETTINGS_SHARED_FILE_KEY = ".config/poolside/settings.yaml";
 /**
 * Build the `SHARED_CONFIG_OWNERSHIP` lookup key from a tool's settable paths.
 * Mirrors `sharedFileKey` in `src/lib/shared-file-derive.ts` (kept separate so
@@ -13005,6 +13213,38 @@ const KIMI_CODE_CONFIG_DECLARATION = {
 	}
 };
 /**
+* Pool settings (`.poolside/settings.yaml` / `~/.config/poolside/settings.yaml`):
+* the user's primary Pool settings file, so an unparseable root fails closed
+* rather than being replaced with generated output. `mcp_servers` is owned as
+* a whole key because the MCP writer emits the complete server map. The
+* permissions writer deep-merges: it rewrites the `allow`/`deny` lists of the
+* `tools.<name>` blocks it manages and the `paths` lists, leaving each tool's
+* `disabled` flag, unmanaged tools and every other key in place. `hooks` is
+* owned as a whole key because the hooks writer emits every event list.
+* `subagents` is owned as a whole key too: its writer recomputes the block
+* from the existing file (`default` and the built-in `general` agent carried
+* over, every other agent replaced) before applying the patch.
+*/
+const POOL_SETTINGS_DECLARATION = {
+	format: "yaml",
+	invalidRootPolicy: "error",
+	features: {
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp_servers"]
+		},
+		permissions: { kind: "deep-merge" },
+		hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		},
+		subagents: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["subagents"]
+		}
+	}
+};
+/**
 * ZCode's settings file, which also carries model/theme/permission keys
 * rulesync does not own. Both copies are the user's primary ZCode config, so
 * every writer refuses to read-modify-write a file it could not parse rather
@@ -13109,6 +13349,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 	[HERMES_CONFIG_SHARED_FILE_KEY]: HERMES_CONFIG_DECLARATION,
 	[HERMES_WIN32_CONFIG_SHARED_FILE_KEY]: HERMES_CONFIG_DECLARATION,
 	[HERMES_HOME_CONFIG_SHARED_FILE_KEY]: HERMES_CONFIG_DECLARATION,
+	[POOL_PROJECT_SETTINGS_SHARED_FILE_KEY]: POOL_SETTINGS_DECLARATION,
+	[POOL_GLOBAL_SETTINGS_SHARED_FILE_KEY]: POOL_SETTINGS_DECLARATION,
 	[TAKT_CONFIG_SHARED_FILE_KEY]: {
 		format: "yaml",
 		invalidRootPolicy: "error",
@@ -19278,7 +19520,7 @@ var TabnineCommand = class TabnineCommand extends ToolCommand {
 	}
 	parseTomlContent(content) {
 		try {
-			const parsed = parse$1(content);
+			const parsed = parse$2(content);
 			const result = TabnineCommandFrontmatterSchema.safeParse(parsed);
 			if (!result.success) throw new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`);
 			return {
@@ -20395,6 +20637,11 @@ var CommandsProcessor = class extends FeatureProcessor {
 			global: this.global,
 			relativeFilePath: HERMESAGENT_CONFIG_FILE_PATH
 		}));
+		if (await refusesWriteOutsideRoot({
+			logger: this.logger,
+			rootPath: this.outputRoot,
+			targetPath: configPath
+		})) return changedCount;
 		const currentContent = await readFileContentOrNull(configPath);
 		if (currentContent === null) return changedCount;
 		const nextContent = getDisabledHermesCommandsPluginConfigContent({
@@ -20417,6 +20664,11 @@ var CommandsProcessor = class extends FeatureProcessor {
 		if (this.toolTarget !== "goose" || !this.global) return 0;
 		if (generatedFiles.some((file) => file instanceof GooseCommand)) return 0;
 		const configPath = join(this.outputRoot, GOOSE_GLOBAL_DIR, GOOSE_MCP_FILE_NAME);
+		if (await refusesWriteOutsideRoot({
+			logger: this.logger,
+			rootPath: this.outputRoot,
+			targetPath: configPath
+		})) return 0;
 		const currentContent = await readFileContentOrNull(configPath);
 		if (currentContent === null || !hasManagedGooseSlashCommands(currentContent)) return 0;
 		const nextContent = getGooseSlashCommandsConfigContent({
@@ -27516,6 +27768,302 @@ var PiHooks = class PiHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/constants/pool-paths.ts
+/**
+* Pool (Poolside's coding agent CLI) configuration-layout conventions.
+*
+* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
+* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
+* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
+* path), the project-root `AGENTS.md`, and nested per-directory
+* `AGENTS.md` files from the repository root down through the working
+* directory, deeper files taking precedence. It skips ignored directories
+* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
+*
+* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
+* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
+* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
+* the skill directories of other Agent Skills tools; rulesync writes only the
+* Pool-specific roots and leaves the shared ones to their own targets.
+*
+* @see https://docs.poolside.ai/agent-instructions
+* @see https://docs.poolside.ai/skills
+* @see https://github.com/poolsideai/pool
+*/
+/** Project-scoped `.poolside/` directory at the project root. */
+const POOL_DIR = ".poolside";
+/** Global config directory for Pool, relative to the home directory. */
+const POOL_GLOBAL_DIR = join(".config", "poolside");
+/** Project skills root, relative to the project root. */
+const POOL_SKILLS_DIR_PATH = join(POOL_DIR, "skills");
+/** Global skills root, relative to the home directory. */
+const POOL_GLOBAL_SKILLS_DIR_PATH = join(POOL_GLOBAL_DIR, "skills");
+/**
+* Pool's settings file name. MCP servers live under the top-level
+* `mcp_servers` key of `.poolside/settings.yaml` (project, committed) and
+* `~/.config/poolside/settings.yaml` (global); the untracked
+* `.poolside/settings.local.yaml` overlay is left to the user.
+*
+* @see https://docs.poolside.ai/mcp-servers
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+const POOL_SETTINGS_FILE_NAME = "settings.yaml";
+/** Pool's untracked per-user overlay next to the settings file; never written. */
+const POOL_SETTINGS_LOCAL_FILE_NAME = "settings.local.yaml";
+/** Top-level key of Pool's settings file that holds the MCP server map. */
+const POOL_MCP_SERVERS_KEY = "mcp_servers";
+/** Top-level key of Pool's settings file that holds per-tool permission rules. */
+const POOL_TOOLS_KEY = "tools";
+/** Top-level key of Pool's settings file that holds file access rules. */
+const POOL_PATHS_KEY = "paths";
+/** Top-level key of Pool's settings file that holds the per-event hook lists. */
+const POOL_HOOKS_KEY = "hooks";
+/**
+* Top-level key of Pool's settings file that holds the subagent registry:
+* `subagents.default` names the agent delegated to by default and
+* `subagents.agents.<name>` defines each agent.
+*
+* @see https://docs.poolside.ai/subagents
+*/
+const POOL_SUBAGENTS_KEY = "subagents";
+/** Key under `subagents` that holds the per-agent definitions. */
+const POOL_SUBAGENTS_AGENTS_KEY = "agents";
+/** Pool's reserved built-in agent, always `in_process` and never generated. */
+const POOL_GENERAL_AGENT_NAME = "general";
+//#endregion
+//#region src/features/hooks/pool-hooks.ts
+/** The matcher Pool reads as "any tool"; `""` means the same. */
+const POOL_MATCH_ALL = "*";
+const SUPPORTED_POOL_EVENTS = new Set(POOL_HOOK_EVENTS);
+/**
+* The Pool events that test `matcher` against a tool name. Pool ignores the
+* field on every other event (it stays required by the schema), so an
+* authored matcher there is dropped with a warning and `*` written instead.
+*/
+const POOL_MATCHER_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+/**
+* Single spelling of the settings.yaml codec/policy, matching PoolMcp and
+* PoolPermissions: fail closed on an unparseable root rather than replacing
+* the user's primary Pool settings with generated output.
+*/
+function parsePoolSettings$3(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Build the `hooks` event lists of Pool's settings file from a canonical hooks
+* config. Pool keys a flat list of `{name, matcher, command, timeout}` entries
+* by event name. Only `type: "command"` canonical hooks are emitted, since a
+* Pool hook is a shell command. A shared canonical event Pool does not fire is
+* skipped (the HooksProcessor reports it), while an event under the
+* `pool.hooks` override — such as one an import filed there — is written
+* verbatim so it round-trips.
+*/
+function canonicalToPoolHooks({ config, toolOverride, logger }) {
+	const sharedHooks = {};
+	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_POOL_EVENTS.has(event)) sharedHooks[event] = defs;
+	const effective = {
+		...sharedHooks,
+		...toolOverride
+	};
+	const hooks = {};
+	for (const [event, defs] of Object.entries(effective)) {
+		if (isPrototypePollutionKey(event)) continue;
+		const poolEvent = lookupOwn({
+			record: CANONICAL_TO_POOL_EVENT_NAMES,
+			key: event
+		}) ?? event;
+		const entries = [];
+		for (const def of defs) {
+			const entry = canonicalDefToPoolEntry({
+				def,
+				event,
+				poolEvent,
+				logger
+			});
+			if (entry !== null) entries.push(entry);
+		}
+		if (entries.length > 0) hooks[poolEvent] = entries;
+	}
+	return hooks;
+}
+/** Convert one canonical hook definition to a Pool entry, or null to skip. */
+function canonicalDefToPoolEntry({ def, event, poolEvent, logger }) {
+	if ((def.type ?? "command") !== "command") return null;
+	if (typeof def.command !== "string" || def.command === "") {
+		logger?.warn(`Pool hook ${quoteValueForWarning(def.name ?? "")} under "${event}" has no "command", which Pool would reject, so it was skipped.`);
+		return null;
+	}
+	const authoredMatcher = typeof def.matcher === "string" && def.matcher !== "" ? def.matcher : POOL_MATCH_ALL;
+	let matcher = authoredMatcher;
+	if (!POOL_MATCHER_EVENTS.has(poolEvent) && authoredMatcher !== POOL_MATCH_ALL) {
+		logger?.warn(`Pool ignores "matcher" on "${poolEvent}", so the matcher ${quoteValueForWarning(authoredMatcher)} of the hook ${quoteValueForWarning(def.name ?? def.command)} under "${event}" was dropped.`);
+		matcher = POOL_MATCH_ALL;
+	}
+	const entry = {
+		...typeof def.name === "string" && def.name !== "" ? { name: def.name } : {},
+		matcher,
+		command: def.command
+	};
+	if (typeof def.timeout === "number") entry.timeout = Math.ceil(def.timeout);
+	return entry;
+}
+/** Convert one raw hook entry to a canonical definition, or null to skip. */
+function poolEntryToCanonicalDef({ raw, poolEvent }) {
+	if (!isRecord$1(raw) || typeof raw.command !== "string" || raw.command === "") return null;
+	const def = {
+		type: "command",
+		command: raw.command
+	};
+	if (typeof raw.name === "string" && raw.name !== "") def.name = raw.name;
+	if (POOL_MATCHER_EVENTS.has(poolEvent) && typeof raw.matcher === "string" && raw.matcher !== "" && raw.matcher !== POOL_MATCH_ALL) def.matcher = raw.matcher;
+	if (typeof raw.timeout === "number") def.timeout = raw.timeout;
+	return def;
+}
+/**
+* Reverse {@link canonicalToPoolHooks}: parse the event lists of the `hooks`
+* block back into a canonical event → definition[] record. An event Pool does
+* not document is carried under its own name so `buildImportedHooksConfig`
+* files it under the `pool.hooks` override; a non-list sibling such as
+* `stop_hook_max_continuations` is not a hook and is left alone.
+*/
+function poolHooksToCanonical(hooksBlock) {
+	const canonical = {};
+	if (!isRecord$1(hooksBlock)) return canonical;
+	for (const [poolEvent, rawEntries] of Object.entries(hooksBlock)) {
+		if (isPrototypePollutionKey(poolEvent) || !Array.isArray(rawEntries)) continue;
+		const canonicalEvent = lookupOwn({
+			record: POOL_TO_CANONICAL_EVENT_NAMES,
+			key: poolEvent
+		}) ?? poolEvent;
+		const defs = rawEntries.map((raw) => poolEntryToCanonicalDef({
+			raw,
+			poolEvent
+		})).filter((def) => def !== null);
+		if (defs.length === 0) continue;
+		canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
+	}
+	return canonical;
+}
+/**
+* The keys of an existing `hooks` block that are not event lists —
+* `stop_hook_max_continuations` and anything else Pool may add beside the
+* events — which survive a regenerate untouched.
+*/
+function nonEventHookKeys(hooksBlock) {
+	const kept = {};
+	if (!isRecord$1(hooksBlock)) return kept;
+	for (const [key, value] of Object.entries(hooksBlock)) if (!isPrototypePollutionKey(key) && !Array.isArray(value)) kept[key] = value;
+	return kept;
+}
+/**
+* Pool hooks.
+*
+* Pool reads hooks from the `hooks` key of its settings file —
+* `.poolside/settings.yaml` at project scope and
+* `~/.config/poolside/settings.yaml` at user scope — as
+* `hooks.<Event>: [{name?, matcher, command, timeout?}]` for `PreToolUse`,
+* `PostToolUse`, `UserPromptSubmit`, `PreCompact`, `SessionStart` and `Stop`.
+* The event lists are rewritten as a whole; the block's non-list sibling
+* `stop_hook_max_continuations` and every other top-level key of the file
+* (`mcp_servers`, `tools`, `paths`, `pool`, ...) are preserved, and the file
+* is never deleted.
+*
+* @see https://docs.poolside.ai/hooks
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolHooks = class PoolHooks extends ToolHooks {
+	settings;
+	constructor(params) {
+		super(params);
+		this.settings = parsePoolSettings$3(this.fileContent ?? "", join(this.relativeDirPath, this.relativeFilePath));
+	}
+	getSettings() {
+		return this.settings;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new PoolHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parsePoolSettings$3(existingContent, filePath);
+		const config = rulesyncHooks.getJson();
+		const hooks = canonicalToPoolHooks({
+			config,
+			toolOverride: config.pool?.hooks,
+			logger
+		});
+		return new PoolHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "hooks",
+				existingContent,
+				patch: { [POOL_HOOKS_KEY]: {
+					...nonEventHookKeys(existing[POOL_HOOKS_KEY]),
+					...hooks
+				} },
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncHooks() {
+		const hooks = poolHooksToCanonical(this.settings[POOL_HOOKS_KEY]);
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+			hooks,
+			overrideKey: "pool"
+		}), null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new PoolHooks({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/hooks/qwencode-hooks.ts
 /**
 * Build a single Qwen Code hook object from a canonical hook definition.
@@ -28629,14 +29177,15 @@ const HooksProcessorToolTargetSchema = z.enum(hooksProcessorToolTargetTuple);
 /**
 * Event names present in the config that the target's adapter cannot emit.
 *
-* When the factory passes override-block keys through verbatim
-* (`passthroughOverrideEvents`), those keys are excluded from the check so
-* documented passthrough triggers aren't falsely reported as skipped.
+* Shared (`hooks`) keys are always checked. Override-block keys are only
+* checked when the factory declares `dropsUnknownOverrideEvents`; otherwise
+* the adapter either emits them verbatim or reports its own drops, and a
+* generic "not supported" warning would be wrong or duplicated.
 */
 function unsupportedEventNames(params) {
 	const { factory, sharedHooks, effectiveHooks } = params;
 	const supportedEvents = new Set(factory.supportedEvents);
-	const eventNames = factory.passthroughOverrideEvents ? Object.keys(sharedHooks) : Object.keys(effectiveHooks);
+	const eventNames = factory.dropsUnknownOverrideEvents ? Object.keys(effectiveHooks) : Object.keys(sharedHooks);
 	return [...new Set(eventNames)].filter((e) => !supportedEvents.has(e));
 }
 /**
@@ -28729,7 +29278,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedEvents: AMP_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
 		supportsMatcher: true,
-		matcherEvents: ["preToolUse", "postToolUse"]
+		matcherEvents: ["preToolUse", "postToolUse"],
+		dropsUnknownOverrideEvents: true
 	}],
 	["antigravity-cli", {
 		class: AntigravityCliHooks,
@@ -28762,7 +29312,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: ANTIGRAVITY_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["cursor", {
 		class: CursorHooks,
@@ -28807,7 +29358,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			"mcp_tool",
 			"agent"
 		],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["codexcli", {
 		class: CodexcliHooks,
@@ -28868,7 +29420,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedEvents: KILO_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
 		supportsMatcher: true,
-		matcherEvents: ["preToolUse", "postToolUse"]
+		matcherEvents: ["preToolUse", "postToolUse"],
+		dropsUnknownOverrideEvents: true
 	}],
 	["opencode", {
 		class: OpencodeHooks,
@@ -28880,7 +29433,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedEvents: OPENCODE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
 		supportsMatcher: true,
-		matcherEvents: ["preToolUse", "postToolUse"]
+		matcherEvents: ["preToolUse", "postToolUse"],
+		dropsUnknownOverrideEvents: true
 	}],
 	["pi", {
 		class: PiHooks,
@@ -28891,7 +29445,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: PI_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["factorydroid", {
 		class: FactorydroidHooks,
@@ -28913,7 +29468,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: CLINE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: false,
+		dropsUnknownOverrideEvents: true
 	}],
 	["goose", {
 		class: GooseHooks,
@@ -28935,8 +29491,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: HERMESAGENT_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["kimi-code", {
 		class: KimiCodeHooks,
@@ -28947,8 +29502,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIMI_CODE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["deepagents", {
 		class: DeepagentsHooks,
@@ -28959,7 +29513,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: DEEPAGENTS_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["kiro", {
 		class: KiroHooks,
@@ -28970,8 +29525,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["kiro-cli", {
 		class: KiroCliHooks,
@@ -28982,8 +29536,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_IDE_HOOK_EVENTS,
 		supportedHookTypes: ["command", "prompt"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["kiro-ide", {
 		class: KiroIdeHooks,
@@ -28994,8 +29547,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_IDE_HOOK_EVENTS,
 		supportedHookTypes: ["command", "prompt"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["devin", {
 		class: DevinHooks,
@@ -29113,6 +29665,18 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: VIBE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
+	}],
+	["pool", {
+		class: PoolHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: POOL_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
 		supportsMatcher: true
 	}],
 	["qwencode", {
@@ -29140,7 +29704,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: REASONIX_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["grokcli", {
 		class: GrokcliHooks,
@@ -29162,8 +29727,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: CRUSH_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["zcode", {
 		class: ZcodeHooks,
@@ -35797,7 +36361,7 @@ function convertServerToKiloFormat(serverName, serverConfig, existingEntry, logg
 * that is not an object at all costs nothing.
 */
 function readExistingKiloMcpEntries(fileContent) {
-	const mcp = parse(fileContent || "{}")?.mcp;
+	const mcp = parse$1(fileContent || "{}")?.mcp;
 	if (!isRecord$1(mcp)) return {};
 	const entries = {};
 	for (const [serverName, entry] of Object.entries(mcp)) {
@@ -35821,7 +36385,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = KiloConfigSchema.parse(parse(this.fileContent || "{}"));
+		this.json = KiloConfigSchema.parse(parse$1(this.fileContent || "{}"));
 	}
 	getJson() {
 		return this.json;
@@ -35889,7 +36453,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 			outputRoot,
 			global
 		});
-		const json = parse(fileContent ?? "{\"mcp\":{}}");
+		const json = parse$1(fileContent ?? "{\"mcp\":{}}");
 		const newJson = {
 			...json,
 			mcp: json.mcp ?? {}
@@ -35960,7 +36524,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 			if (fileContent) relativeFilePath = KILO_JSON_FILE_NAME;
 		}
 		if (instructions.length === 0 && fileContent === null) return null;
-		const json = fileContent ? parse(fileContent) : {};
+		const json = fileContent ? parse$1(fileContent) : {};
 		const existingInstructions = Array.isArray(json.instructions) ? json.instructions.filter((entry) => typeof entry === "string") : [];
 		const managedPrefix = `${toPosixPath(join(KILO_DIR, KILO_RULES_DIR_NAME))}/`;
 		const preservedInstructions = existingInstructions.filter((entry) => !toPosixPath(entry).replace(/^\.\//, "").startsWith(managedPrefix));
@@ -36924,7 +37488,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = OpencodeConfigSchema.parse(parse(this.fileContent || "{}"));
+		this.json = OpencodeConfigSchema.parse(parse$1(this.fileContent || "{}"));
 	}
 	getJson() {
 		return this.json;
@@ -36957,7 +37521,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
-		const json = parse(fileContent ?? "{\"mcp\":{}}");
+		const json = parse$1(fileContent ?? "{\"mcp\":{}}");
 		const newJson = {
 			...json,
 			mcp: json.mcp ?? {}
@@ -36986,7 +37550,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 			mcpServers: rulesyncMcp.getMcpServers(),
 			replacement: "{env:$1}"
 		});
-		const existingMcp = OpencodeConfigSchema.safeParse(parse(fileContent || "{}"));
+		const existingMcp = OpencodeConfigSchema.safeParse(parse$1(fileContent || "{}"));
 		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(transformedServers, (existingMcp.success ? existingMcp.data.mcp : void 0) ?? {}, logger);
 		return new OpencodeMcp({
 			outputRoot,
@@ -37037,7 +37601,7 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
 		if (instructions.length === 0 && fileContent === null) return null;
-		const json = fileContent ? parse(fileContent) : {};
+		const json = fileContent ? parse$1(fileContent) : {};
 		const existingInstructions = Array.isArray(json.instructions) ? json.instructions.filter((entry) => typeof entry === "string") : [];
 		const managedPrefixes = global ? ["memories/", `${configDirPrefix}memories/`] : [`${toPosixPath(OPENCODE_DIR)}/memories/`];
 		const preservedInstructions = existingInstructions.filter((entry) => {
@@ -37094,6 +37658,320 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/pool-mcp.ts
+/**
+* Single spelling of the settings.yaml codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for both scopes: fail closed on an
+* unparseable root rather than replacing the user's primary Pool settings with
+* generated output.
+*/
+function parsePoolSettings$2(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* The remote transports Pool's `transport.type` accepts. `streamable-http` is
+* the canonical rulesync name for what Pool calls `http`; everything else is
+* left to the caller to reject.
+*
+* @see https://docs.poolside.ai/mcp-servers
+*/
+function asPoolRemoteType(stated, url) {
+	if (stated === "sse") return "sse";
+	if (stated === "http" || stated === "streamable-http") return "http";
+	if (stated === void 0) return /^wss?:\/\//i.test(url) ? void 0 : "http";
+}
+/**
+* Pool spells remote headers as a list of `"Name: value"` strings rather than
+* a map, so the canonical record is flattened at generate time and split back
+* at the first `:` on import. A list entry without a `:` names no header and
+* is dropped with a warning — silently losing what may be a mistyped auth
+* header would leave the canonical file short of one without a trace.
+*/
+function headersRecordToPoolList(headers) {
+	return Object.entries(headers).map(([name, value]) => `${name}: ${value}`);
+}
+function poolHeadersListToRecord(serverName, headers) {
+	if (!isStringArray$2(headers)) return void 0;
+	const result = {};
+	for (const entry of headers) {
+		const separator = entry.indexOf(":");
+		const name = separator > 0 ? entry.slice(0, separator).trim() : "";
+		if (name === "" || PROTOTYPE_POLLUTION_KEYS.has(name)) {
+			warnWithFallback(void 0, `Ignored malformed header ${quoteValueForWarning(entry)} in Pool MCP server ${quoteValueForWarning(serverName)}: expected "Name: value"`);
+			continue;
+		}
+		result[name] = entry.slice(separator + 1).trim();
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+/**
+* Pool's `deny`/`enabled_tools` entries are glob patterns, while the canonical
+* `enabledTools`/`disabledTools` lists are literal tool names that the other
+* targets match verbatim. A pattern therefore imports as a name that matches
+* nothing elsewhere — a `deny` that quietly stops denying is the case worth
+* calling out — so it is copied as-is but warned about. `allow` is exempt: it
+* imports to the Pool-only `poolAllow`, where globs are exactly what Pool
+* expects and no other tool ever reads them.
+*/
+const GLOB_METACHARACTERS = /[*?[]/;
+/** Patterns named in the glob warning before the rest collapse to `(+N more)`. */
+const MAX_LISTED_GLOB_PATTERNS = 10;
+function importPoolToolList({ serverName, poolKey, value, warnOnGlobs }) {
+	if (!isStringArray$2(value)) {
+		warnWithFallback(void 0, `Ignored malformed value for ${poolKey} in Pool MCP server ${quoteValueForWarning(serverName)}: expected a list of strings`);
+		return;
+	}
+	if (!warnOnGlobs) return value;
+	const patterns = value.filter((entry) => GLOB_METACHARACTERS.test(entry));
+	if (patterns.length > 0) {
+		const listed = patterns.slice(0, MAX_LISTED_GLOB_PATTERNS).map(quoteValueForWarning);
+		const overflow = patterns.length - listed.length;
+		const shown = overflow > 0 ? `${listed.join(", ")} (+${overflow} more)` : listed.join(", ");
+		warnWithFallback(void 0, `${poolKey} in Pool MCP server ${quoteValueForWarning(serverName)} contains glob patterns (${shown}); other tools match the imported tool names literally`);
+	}
+	return value;
+}
+/**
+* Pool's `transport` block for a remote server, or `null` (after a warning)
+* when the server has no url or names a transport Pool cannot reach.
+*/
+function toPoolTransport(name, config, logger) {
+	const url = resolveRemoteMcpUrl(config);
+	if (!url) return warnAndSkipMcpServer({
+		toolName: "Pool",
+		serverName: name,
+		reason: "a remote transport without a url",
+		logger
+	});
+	const stated = config.type ?? config.transport;
+	const type = asPoolRemoteType(stated, url);
+	if (type === void 0) return warnAndSkipMcpServer({
+		toolName: "Pool",
+		serverName: name,
+		reason: stated === void 0 ? "a WebSocket url, which Pool's remote transports (http and sse) cannot reach" : `the "${stated}" transport, which Pool does not offer for remote servers (only http and sse)`,
+		logger
+	});
+	const transport = {
+		type,
+		url
+	};
+	if (config.headers && Object.keys(config.headers).length > 0) transport.headers = headersRecordToPoolList(config.headers);
+	return transport;
+}
+/**
+* The transport-specific part of a Pool server entry: a `transport` block for
+* remote servers, `command`/`args`/`cwd` for stdio ones. `null` (after a
+* warning) when the server cannot be written.
+*/
+function toPoolTransportFields(name, config, logger) {
+	if (isRemoteMcpServer(config)) {
+		const transport = toPoolTransport(name, config, logger);
+		return transport === null ? null : { transport };
+	}
+	const [command, ...args] = resolveLocalMcpCommand(config);
+	if (!command) return warnAndSkipMcpServer({
+		toolName: "Pool",
+		serverName: name,
+		reason: "a stdio transport without a command",
+		logger
+	});
+	const fields = {
+		command,
+		args
+	};
+	if (config.cwd) fields.cwd = config.cwd;
+	return fields;
+}
+/**
+* The fields shared by stdio and remote entries. Tool filters map onto Pool's
+* own switches — `enabledTools` becomes `enabled_tools` (the tools Pool
+* exposes at all) and `disabledTools` becomes `deny` (patterns agents may
+* never use); the Pool-only approval allowlist is authored as `poolAllow` and
+* written as `allow`. `disabled: true` is spelled the same on both sides.
+*/
+function toPoolCommonFields(config) {
+	const fields = {};
+	if (config.env && Object.keys(config.env).length > 0) fields.env = config.env;
+	if (config.enabledTools && config.enabledTools.length > 0) fields.enabled_tools = config.enabledTools;
+	if (config.poolAllow && config.poolAllow.length > 0) fields.allow = config.poolAllow;
+	if (config.disabledTools && config.disabledTools.length > 0) fields.deny = config.disabledTools;
+	if (config.disabled === true) fields.disabled = true;
+	return fields;
+}
+/**
+* Convert canonical rulesync servers to Pool's native `mcp_servers` shape:
+* stdio servers carry `command`/`args`/`cwd`/`env`, remote servers carry a
+* `transport` block (`type` of `http` or `sse`, `url`, optional `headers`
+* list) plus optional `env`; see `toPoolCommonFields` for the tool filters.
+*
+* @see https://docs.poolside.ai/mcp-servers
+*/
+function convertToPoolFormat(mcpServers, logger) {
+	const result = {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!isRecord$1(config)) continue;
+		if (declaresNoTransport(config)) {
+			warnAndSkipMcpServer({
+				toolName: "Pool",
+				serverName: name,
+				reason: "no transport",
+				logger
+			});
+			continue;
+		}
+		const transportFields = toPoolTransportFields(name, config, logger);
+		if (transportFields === null) continue;
+		result[name] = {
+			...transportFields,
+			...toPoolCommonFields(config)
+		};
+	}
+	return result;
+}
+const POOL_TO_CANONICAL_TOOL_LIST_KEYS = {
+	enabled_tools: "enabledTools",
+	deny: "disabledTools",
+	allow: "poolAllow"
+};
+/**
+* Convert Pool's native `mcp_servers` shape back to canonical rulesync
+* servers: the `transport` block is flattened to `type`/`url`/`headers`,
+* `enabled_tools` maps back to `enabledTools`, `deny` to `disabledTools` and
+* `allow` to the namespaced `poolAllow` (see `McpServerSchema`). Unknown keys
+* pass through untouched so an import keeps whatever a hand-authored entry
+* declared; generation back out is a whitelist, so only the keys
+* `convertToPoolFormat` writes are re-emitted.
+*/
+function convertFromPoolFormat(poolServers) {
+	const result = {};
+	for (const [name, config] of Object.entries(poolServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const converted = {};
+		for (const [key, value] of Object.entries(config)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (key === "transport") {
+				if (!isRecord$1(value)) continue;
+				if (typeof value.type === "string") converted.type = value.type;
+				if (typeof value.url === "string") converted.url = value.url;
+				const headers = poolHeadersListToRecord(name, value.headers);
+				if (headers) converted.headers = headers;
+				continue;
+			}
+			const canonicalKey = Object.hasOwn(POOL_TO_CANONICAL_TOOL_LIST_KEYS, key) ? POOL_TO_CANONICAL_TOOL_LIST_KEYS[key] : void 0;
+			if (canonicalKey) {
+				const list = importPoolToolList({
+					serverName: name,
+					poolKey: key,
+					value,
+					warnOnGlobs: canonicalKey !== "poolAllow"
+				});
+				if (list) converted[canonicalKey] = list;
+				continue;
+			}
+			converted[key] = value;
+		}
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Pool MCP servers.
+*
+* Pool reads MCP servers from the `mcp_servers` block of its settings file:
+* `<project>/.poolside/settings.yaml` at project scope (shared and committed)
+* and `~/.config/poolside/settings.yaml` at user scope. The untracked
+* `.poolside/settings.local.yaml` overlay, which Pool layers on top of both,
+* is left to the user. Every other top-level settings key is preserved and
+* the file is never deleted.
+*
+* @see https://docs.poolside.ai/mcp-servers
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolMcp = class PoolMcp extends ToolMcp {
+	settings;
+	constructor(params) {
+		super(params);
+		this.settings = parsePoolSettings$2(this.fileContent ?? "", join(this.relativeDirPath, this.relativeFilePath));
+	}
+	getSettings() {
+		return this.settings;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new PoolMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const converted = convertToPoolFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => {
+			const rawServer = rulesyncMcp.getRawMcpServer(serverName);
+			const poolAllow = isRecord$1(rawServer) ? rawServer.poolAllow : void 0;
+			return [serverName, {
+				...serverConfig,
+				...isStringArray$2(poolAllow) && { poolAllow }
+			}];
+		})), logger);
+		return new PoolMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { [POOL_MCP_SERVERS_KEY]: converted },
+				filePath
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const converted = convertFromPoolFormat(isRecord$1(this.settings["mcp_servers"]) ? this.settings[POOL_MCP_SERVERS_KEY] : {});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: converted }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new PoolMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/qwencode-mcp.ts
 /**
 * Map rulesync's canonical per-server tool filters to Qwen Code's field names.
@@ -39541,6 +40419,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: true
 		}
 	}],
+	["pool", {
+		class: PoolMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodeMcp,
 		meta: {
@@ -40854,7 +41741,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 function toAntigravityCliToolName(canonical) {
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$8(cliName) {
+function toCanonicalToolName$9(cliName) {
 	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
 }
 /**
@@ -41070,7 +41957,7 @@ function convertAntigravityCliToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parsePermissionEntry$1(entry);
-			const canonical = toCanonicalToolName$8(toolName);
+			const canonical = toCanonicalToolName$9(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -41349,7 +42236,7 @@ function toLegacyAugmentToolName(augmentName) {
 		key: augmentName
 	}) ?? augmentName;
 }
-function toCanonicalToolName$7(augmentName) {
+function toCanonicalToolName$8(augmentName) {
 	const legacyName = toLegacyAugmentToolName(augmentName);
 	return lookupOwn({
 		record: AUGMENT_TO_CANONICAL_TOOL_NAMES,
@@ -41802,7 +42689,7 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		const type = entry.permission.type;
 		if (!isBasicAugmentType(type)) continue;
 		const legacyToolName = toLegacyAugmentToolName(entry.toolName);
-		const canonical = toCanonicalToolName$7(entry.toolName);
+		const canonical = toCanonicalToolName$8(entry.toolName);
 		if (forbiddenMapKeys.has(canonical)) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because it maps to the reserved object key '${canonical}', which cannot be used as a permission key.`);
 			continue;
@@ -42047,7 +42934,7 @@ const CLAUDE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONIC
 function toClaudeToolName(canonical) {
 	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$6(claudeName) {
+function toCanonicalToolName$7(claudeName) {
 	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
 }
 /**
@@ -42961,7 +43848,7 @@ function convertClaudeToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseClaudePermissionEntry(entry);
-			const canonical = toCanonicalToolName$6(toolName);
+			const canonical = toCanonicalToolName$7(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -43822,8 +44709,8 @@ function mapBashActionToDecision(action) {
 //#region src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$6 = "*";
-const MCP_CANONICAL_PREFIX$5 = "mcp__";
+const CATCH_ALL_PATTERN$7 = "*";
+const MCP_CANONICAL_PREFIX$6 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
 	bash: "Shell",
@@ -43877,10 +44764,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$6 || pattern === "";
-	if (category.startsWith(MCP_CANONICAL_PREFIX$5)) return catchAll ? category : `${category}(${pattern})`;
-	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$5}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$6 : null;
+	const catchAll = pattern === CATCH_ALL_PATTERN$7 || pattern === "";
+	if (category.startsWith(MCP_CANONICAL_PREFIX$6)) return catchAll ? category : `${category}(${pattern})`;
+	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$6}${pattern}`;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$7 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -43916,7 +44803,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$6;
+	return inner === "" || inner === CATCH_ALL_PATTERN$7;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -43950,34 +44837,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: true
 	};
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$5)) {
-		if (server === CATCH_ALL_PATTERN$6) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$6)) return null;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$6)) {
+		if (server === CATCH_ALL_PATTERN$7) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$7)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$6 ? `${MCP_CANONICAL_PREFIX$5}${server}` : `${MCP_CANONICAL_PREFIX$5}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$6,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$7 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$7,
 			notInAllow: false
 		};
 	}
-	const category = `${MCP_CANONICAL_PREFIX$5}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$6);
+	const category = `${MCP_CANONICAL_PREFIX$6}${remainder}`;
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$7);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$6) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$6 && !server.includes(CATCH_ALL_PATTERN$6)) return {
-		category: `${MCP_CANONICAL_PREFIX$5}${server}`,
-		pattern: CATCH_ALL_PATTERN$6,
+	if (remainder === CATCH_ALL_PATTERN$7) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$7 && !server.includes(CATCH_ALL_PATTERN$7)) return {
+		category: `${MCP_CANONICAL_PREFIX$6}${server}`,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: false
 	} : null;
 }
@@ -44001,14 +44888,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$6,
+			pattern: CATCH_ALL_PATTERN$7,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$6,
+			pattern: CATCH_ALL_PATTERN$7,
 			notInAllow: true
 		} : {
 			category,
@@ -44018,7 +44905,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -44037,13 +44924,13 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$6) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$7) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
-	if (lowered.startsWith(MCP_CANONICAL_PREFIX$5)) return parseMcpCommandcodeRule({
+	if (lowered.startsWith(MCP_CANONICAL_PREFIX$6)) return parseMcpCommandcodeRule({
 		tool,
 		inner
 	});
@@ -44061,12 +44948,12 @@ function parseCommandcodeRule(rule) {
 */
 function isFoldedMcpToolNameRule({ rule, category }) {
 	const { tool } = splitCommandcodeRule(rule);
-	return category.startsWith(MCP_CANONICAL_PREFIX$5) && !tool.startsWith(MCP_CANONICAL_PREFIX$5);
+	return category.startsWith(MCP_CANONICAL_PREFIX$6) && !tool.startsWith(MCP_CANONICAL_PREFIX$6);
 }
 /** The `Tool` half of `Tool(specifier)`, when the rule is an exact-prefix MCP rule with a specifier. */
 function scopedMcpRuleTool(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$5) ? tool : null;
+	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$6) ? tool : null;
 }
 /**
 * The string entries of a Command Code permission list. Command Code reads
@@ -44109,7 +44996,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$6})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$7})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -44166,7 +45053,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$6);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$7);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -44235,7 +45122,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 function skippedAllowImportMessage({ rule, category }) {
 	const { tool, inner } = splitCommandcodeRule(rule);
 	if (category === "bash") return `Command Code reads '${rule}' in "allow" as ${PADDED_SHELL_WILDCARD_REASON}, which rulesync cannot import without widening the grant to every command, so it was not imported.`;
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$5) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$6) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
 	return `Command Code globs the specifier of '${rule}' in "allow" against the call's arguments, which rulesync cannot import without widening the grant to the whole tool, so it was not imported.`;
 }
 /**
@@ -44437,7 +45324,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$5 = "*";
+const CATCH_ALL_PATTERN$6 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -44445,7 +45332,7 @@ const CATCH_ALL_PATTERN$5 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$6 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -44474,7 +45361,7 @@ const CONTINUE_PATTERN_RE = /^([^(]+)(?:\(([^)]*)\))?$/;
 function toContinueToolName(canonical) {
 	return Object.hasOwn(CANONICAL_TO_CONTINUE_TOOL_NAMES, canonical) ? CANONICAL_TO_CONTINUE_TOOL_NAMES[canonical] ?? canonical : canonical;
 }
-function toCanonicalToolName$5(continueName) {
+function toCanonicalToolName$6(continueName) {
 	return Object.hasOwn(CONTINUE_TO_CANONICAL_TOOL_NAMES, continueName) ? CONTINUE_TO_CANONICAL_TOOL_NAMES[continueName] ?? continueName : continueName;
 }
 /**
@@ -44482,7 +45369,7 @@ function toCanonicalToolName$5(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$5 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$6 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -44496,7 +45383,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$5 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$6 : pattern
 	};
 }
 /**
@@ -44670,7 +45557,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$5) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$6) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -44695,7 +45582,7 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$5(parsedEntry.toolName);
+			const category = toCanonicalToolName$6(parsedEntry.toolName);
 			permission[category] ??= {};
 			permission[category][parsedEntry.pattern] ??= action;
 		}
@@ -45019,14 +45906,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 };
 //#endregion
 //#region src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$4 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -45038,14 +45925,14 @@ const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	webfetch: "fetch"
 };
 const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
-const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const MCP_CANONICAL_PREFIX$5 = "mcp__";
 const MCP_CRUSH_PREFIX = "mcp_";
 function toCrushToolName(canonical) {
 	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
-	if (canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$5) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
 	return canonical;
 }
-function toCanonicalToolName$4(crushName) {
+function toCanonicalToolName$5(crushName) {
 	return Object.hasOwn(CRUSH_TO_CANONICAL_TOOL_NAMES, crushName) ? CRUSH_TO_CANONICAL_TOOL_NAMES[crushName] ?? crushName : crushName;
 }
 function isMcpToolName(crushName) {
@@ -45225,7 +46112,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$4) {
+		if (pattern === CATCH_ALL_PATTERN$5) {
 			catchAllAction = action;
 			continue;
 		}
@@ -45298,11 +46185,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$5] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$5] ??= "allow";
 	}
 	return { permission };
 }
@@ -45349,13 +46236,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX$3 = "mcp__";
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX$3) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -45389,7 +46276,7 @@ function toCanonicalCategory$1(cursorType, pattern) {
 		if (match) {
 			const server = match[1] ?? "*";
 			const tool = match[2] ?? "*";
-			return `${MCP_CANONICAL_PREFIX$3}${server}__${tool}`;
+			return `${MCP_CANONICAL_PREFIX$4}${server}__${tool}`;
 		}
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
@@ -45682,7 +46569,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$3) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$4) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -47201,7 +48088,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 //#region src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$3 = "*";
+const CATCH_ALL_PATTERN$4 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = {
 	bash: "developer__shell",
 	edit: "developer__text_editor",
@@ -47363,7 +48250,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	for (const [category, rules] of orderedEntries) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
-			if (pattern !== CATCH_ALL_PATTERN$3) {
+			if (pattern !== CATCH_ALL_PATTERN$4) {
 				logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 				continue;
 			}
@@ -47392,7 +48279,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		for (const toolName of toolNames) {
 			const category = GOOSE_TO_RULESYNC_TOOL_NAME[toolName] ?? toolName;
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$3] = action;
+			permission[category][CATCH_ALL_PATTERN$4] = action;
 		}
 	}
 	return { permission };
@@ -47403,8 +48290,8 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$2 = "*";
-const MCP_CANONICAL_PREFIX$2 = "mcp__";
+const CATCH_ALL_PATTERN$3 = "*";
+const MCP_CANONICAL_PREFIX$3 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
 	read: "Read",
@@ -47445,14 +48332,14 @@ const GROKCLI_PERMISSION_RULES_KEY = "rules";
 * concrete pattern emits `Tool(pattern)`.
 */
 function buildGrokEntry(category, pattern) {
-	if (category.startsWith(MCP_CANONICAL_PREFIX$2)) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX$3)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$3 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$3 || pattern === "" ? tool : `${tool}(${pattern})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
@@ -47472,17 +48359,17 @@ function parseGrokEntry(entry) {
 		inner = trimmed.slice(parenIndex + 1, -1).trim();
 	}
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
-		category: `${MCP_CANONICAL_PREFIX$2}${inner}`,
-		pattern: CATCH_ALL_PATTERN$2
+		category: `${MCP_CANONICAL_PREFIX$3}${inner}`,
+		pattern: CATCH_ALL_PATTERN$3
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$2
+		pattern: CATCH_ALL_PATTERN$3
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$2
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$3
 	};
 }
 /**
@@ -47503,15 +48390,15 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$2;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$3;
 	const lowerTool = tool.trim().toLowerCase();
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$2 ? {
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$3 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$2,
+		pattern: CATCH_ALL_PATTERN$3,
 		action
 	} : {
-		category: `${MCP_CANONICAL_PREFIX$2}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$2,
+		category: `${MCP_CANONICAL_PREFIX$3}${resolvedPattern}`,
+		pattern: CATCH_ALL_PATTERN$3,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -47659,7 +48546,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$3]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -48395,7 +49282,7 @@ function isSharedKiloCategory(key) {
 */
 function parseKiloJsoncStrict(content, filePath) {
 	const errors = [];
-	const parsed = parse(content, errors, { allowTrailingComma: true });
+	const parsed = parse$1(content, errors, { allowTrailingComma: true });
 	const first = errors[0];
 	if (first) throw new Error(`Failed to parse Kilo Code config at ${filePath}: ${printParseErrorCode(first.error)} at offset ${first.offset}`);
 	if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
@@ -48439,7 +49326,7 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 	json;
 	constructor(params) {
 		super(params);
-		const parsed = parse(this.fileContent || "{}");
+		const parsed = parse$1(this.fileContent || "{}");
 		if (params.validate !== false) this.json = KiloPermissionsConfigSchema.parse(parsed);
 		else {
 			const result = KiloPermissionsConfigSchema.safeParse(parsed);
@@ -48579,7 +49466,7 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 	}
 	validate() {
 		try {
-			const json = parse(this.fileContent || "{}");
+			const json = parse$1(this.fileContent || "{}");
 			const result = KiloPermissionsConfigSchema.safeParse(json);
 			if (!result.success) return {
 				success: false,
@@ -49290,7 +50177,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 	json;
 	constructor(params) {
 		super(params);
-		this.json = OpencodePermissionsConfigSchema.parse(parse(this.fileContent || "{}"));
+		this.json = OpencodePermissionsConfigSchema.parse(parse$1(this.fileContent || "{}"));
 	}
 	getJson() {
 		return this.json;
@@ -49318,7 +50205,7 @@ var OpencodePermissions = class OpencodePermissions extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = OPENCODE_JSON_FILE_NAME;
 		}
-		const parsed = parse(fileContent ?? "{}");
+		const parsed = parse$1(fileContent ?? "{}");
 		const record = isRecord$1(parsed) ? parsed : {};
 		const nextJson = {
 			...record,
@@ -49539,6 +50426,567 @@ var PiPermissions = class PiPermissions extends ToolPermissions {
 	}
 };
 //#endregion
+//#region src/features/permissions/pool-permissions.ts
+const POOL_ALLOW_KEY = "allow";
+const POOL_DENY_KEY = "deny";
+const POOL_DISABLED_KEY = "disabled";
+const POOL_PATH_KEY = "path";
+const POOL_WRITE_KEY = "write";
+const CATCH_ALL_PATTERN$2 = "*";
+const PATHS_CATCH_ALL_PATTERN = "**";
+const CANONICAL_TO_POOL_TOOL_NAMES = {
+	bash: "shell",
+	webfetch: "web_fetch",
+	websearch: "web_search"
+};
+const POOL_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_POOL_TOOL_NAMES).map(([k, v]) => [v, k]));
+const READ_CATEGORY = "read";
+const WRITE_CATEGORIES = ["edit", "write"];
+const FILE_CATEGORIES = [READ_CATEGORY, ...WRITE_CATEGORIES];
+const MCP_CANONICAL_PREFIX$2 = "mcp__";
+/**
+* Single spelling of the settings.yaml codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for both scopes: fail closed on an
+* unparseable root rather than replacing the user's primary Pool settings with
+* generated output.
+*/
+function parsePoolSettings$1(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+function toPoolToolName(canonical) {
+	return lookupOwn({
+		record: CANONICAL_TO_POOL_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
+}
+function toCanonicalToolName$4(poolName) {
+	return lookupOwn({
+		record: POOL_TO_CANONICAL_TOOL_NAMES,
+		key: poolName
+	}) ?? poolName;
+}
+function isMcpCategory(category) {
+	return category.startsWith(MCP_CANONICAL_PREFIX$2) && category.length > 5;
+}
+function isFileCategory(category) {
+	return FILE_CATEGORIES.includes(category);
+}
+/**
+* Pool's tool rules know one wildcard, `*`, which matches anything including
+* `/` — the same set a canonical `*` names — so a `**` run is collapsed to
+* keep the file in Pool's own spelling. `?`, `[...]` and `{a,b}` are literal
+* characters to Pool, so a pattern that relies on them cannot be written.
+*/
+function toPoolToolPattern(pattern) {
+	if (/[?[{]/.test(pattern)) return void 0;
+	return pattern.replaceAll(/\*{2,}/g, "*");
+}
+/**
+* Pool's path globs know `*` and `**`, so a bare `*` run is written as `**`
+* to keep it matching anything. `?`, `[...]` and `{a,b}` are literal
+* characters to Pool here as well, so a pattern that relies on them cannot be
+* written.
+*/
+function toPoolPathPattern(pattern) {
+	if (/[?[{]/.test(pattern)) return void 0;
+	return /^\*+$/.test(pattern) ? PATHS_CATCH_ALL_PATTERN : pattern;
+}
+function isHomeOrAbsolutePath(pattern) {
+	return isAbsolute(pattern) || pattern === "~" || pattern.startsWith("~/");
+}
+function rulesOf(permission, category) {
+	return lookupOwn({
+		record: permission,
+		key: category
+	}) ?? {};
+}
+function patternsWithAction(rules, actions) {
+	return Object.entries(rules).filter(([pattern, action]) => !isPrototypePollutionKey(pattern) && actions.includes(action)).map(([pattern]) => pattern);
+}
+function asRestrictions(patterns) {
+	return uniq(patterns).map((pattern) => ({
+		pattern,
+		fromAllToolsCategory: false
+	}));
+}
+function listPatterns(patterns) {
+	return patterns.map((pattern) => quoteValueForWarning(pattern)).join(", ");
+}
+/**
+* Permissions adapter for Pool (Poolside's coding agent CLI).
+*
+* Pool keeps its permission rules in the same YAML settings file as its MCP
+* servers — `.poolside/settings.yaml` (project) / `~/.config/poolside/settings.yaml`
+* (global) — under two top-level keys:
+*   - `tools.<name>`: `allow` and `deny` pattern lists matched against the
+*     tool's argument (the command for `shell`, the URL for `web_fetch`, ...),
+*     plus `disabled: true` to remove the tool. A denied pattern wins over an
+*     allowed one; a call that matches neither prompts. Only `*` is a wildcard.
+*   - `paths`: `allow` entries (`{ path }`, read-only unless `write: true`)
+*     and `deny` entries (`{ path }`) with `*`/`**` globs; deny wins.
+*
+* Mapping (rulesync canonical -> Pool):
+*   - `bash` -> `tools.shell`, `webfetch` -> `tools.web_fetch`,
+*     `websearch` -> `tools.web_search`; any other non-file category passes
+*     through as `tools.<category>`. `allow` -> `allow`, `deny` -> `deny`,
+*     `ask` -> nothing (prompting is Pool's default) — but an `allow` that
+*     overlaps an `ask` of any category landing on the same Pool tool, or a
+*     deny Pool cannot spell, is withheld, since an allowed pattern would
+*     silence the prompt the config asks for.
+*   - `read` / `edit` / `write` -> `paths`: a `read` allow is a read-only
+*     entry, an `edit` or `write` allow adds `write: true`, a `read` deny is a
+*     deny entry. Pool cannot deny writes without denying reads, so an
+*     `edit`/`write` deny that is not also a `read` deny only withholds the
+*     write flag of the entries it overlaps (Pool prompts for those writes).
+*   - `mcp__<server>__<tool>` is skipped: Pool approves MCP tools per server
+*     under `mcp_servers.<server>.allow`, authored as `poolAllow` in
+*     `.rulesync/mcp.json`. The all-tools `*` category is mirrored onto
+*     `bash` by `honorAllToolsOnBash` and otherwise skipped.
+*
+* Project settings take project-relative paths and the user settings absolute
+* or `~` paths, so a path of the other kind is skipped with a warning at each
+* scope. The managed tools' `allow`/`deny` lists and, whenever the canonical
+* config carries a file category, the `paths` lists are rebuilt; every other
+* key (`disabled`, unmanaged tools, `mcp_servers`, `pool`, `sandbox`, ...) is
+* kept, and the file is never deleted.
+*
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolPermissions = class PoolPermissions extends ToolPermissions {
+	settings;
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+		this.settings = parsePoolSettings$1(this.fileContent ?? "", join(this.relativeDirPath, this.relativeFilePath));
+	}
+	getSettings() {
+		return this.settings;
+	}
+	isDeletable() {
+		return false;
+	}
+	/**
+	* settings.yaml is Pool's file: rulesync merges into it when it exists but
+	* does not create one that holds nothing of its own — an absent file and an
+	* absent rule both mean "prompt".
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new PoolPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parsePoolSettings$1(existingContent, filePath);
+		const patch = buildPoolPermissionsPatch({
+			config: rulesyncPermissions.getJson(),
+			existing,
+			global,
+			logger
+		});
+		return new PoolPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath,
+				logger
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const rulesyncConfig = convertPoolToRulesync({
+			tools: isRecord$1(this.settings["tools"]) ? this.settings[POOL_TOOLS_KEY] : {},
+			paths: isRecord$1(this.settings["paths"]) ? this.settings[POOL_PATHS_KEY] : {}
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new PoolPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* The deep-merge patch that rewrites the managed `tools.<name>` lists and,
+* when the canonical config carries a file category, the `paths` lists. An
+* empty list retracts its key (`undefined` deletes under deep-merge), and a
+* block is only touched when there is something to write into it or it
+* already exists, so a config without rules does not grow an empty
+* `tools: {}` / `paths: {}`.
+*/
+function buildPoolPermissionsPatch({ config, existing, global, logger }) {
+	const permission = honorAllToolsOnBash(config.permission);
+	const existingTools = isRecord$1(existing["tools"]) ? existing[POOL_TOOLS_KEY] : void 0;
+	const existingPaths = isRecord$1(existing["paths"]) ? existing[POOL_PATHS_KEY] : void 0;
+	const patch = {};
+	const toolsPatch = {};
+	for (const [toolName, lists] of convertRulesyncToPoolTools({
+		permission,
+		logger
+	})) {
+		const existingTool = existingTools === void 0 ? void 0 : lookupOwn({
+			record: existingTools,
+			key: toolName
+		});
+		if (lists.allow.length === 0 && lists.deny.length === 0 && existingTool === void 0) continue;
+		toolsPatch[toolName] = {
+			[POOL_ALLOW_KEY]: lists.allow.length > 0 ? lists.allow : void 0,
+			[POOL_DENY_KEY]: lists.deny.length > 0 ? lists.deny : void 0
+		};
+	}
+	if (Object.keys(toolsPatch).length > 0) patch[POOL_TOOLS_KEY] = toolsPatch;
+	if (FILE_CATEGORIES.some((category) => lookupOwn({
+		record: permission,
+		key: category
+	}))) {
+		const lists = convertRulesyncToPoolPaths({
+			permission,
+			global,
+			logger
+		});
+		if (lists.allow.length > 0 || lists.deny.length > 0 || existingPaths !== void 0) patch[POOL_PATHS_KEY] = {
+			[POOL_ALLOW_KEY]: lists.allow.length > 0 ? lists.allow : void 0,
+			[POOL_DENY_KEY]: lists.deny.length > 0 ? lists.deny : void 0
+		};
+	}
+	return patch;
+}
+/**
+* Convert one non-file category into a Pool tool's `allow`/`deny` lists. A
+* deny Pool can spell needs no withholding (Pool lets it win over an allow),
+* but an `ask` has no list of its own — a call Pool does not match prompts —
+* so an allow that overlaps one is withheld and reported, and the tool keeps
+* prompting. A deny Pool cannot spell (its pattern uses a glob form other
+* than `*`) is skipped, and then withholds the allows it overlaps the same
+* way: written, such an allow would auto-approve the very command the deny
+* was meant to stop. `restrictions` carries the ask patterns and the skipped
+* deny patterns of every category that lands on the same Pool tool, because
+* Pool matches the joined lists as one.
+*/
+function convertToolCategory({ category, toolName, rules, restrictions, logger }) {
+	const lists = {
+		allow: [],
+		deny: []
+	};
+	const shadowingRestrictions = createShadowingRestrictionsTest(asRestrictions(restrictions));
+	for (const [rawPattern, action] of Object.entries(rules)) {
+		if (isPrototypePollutionKey(rawPattern) || action === "ask") continue;
+		const pattern = toPoolToolPattern(rawPattern);
+		if (pattern === void 0) {
+			logger?.warn(`Pool tool rules treat only "*" as a wildcard, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			continue;
+		}
+		if (action === "deny") {
+			lists.deny.push(pattern);
+			continue;
+		}
+		const shadowing = shadowingRestrictions(rawPattern);
+		if (shadowing.length > 0) {
+			logger?.warn(`Pool has no list for an "ask" or for a deny it cannot spell (an unmatched call prompts), so the "allow" rule for "${category}" (pattern ${quoteValueForWarning(rawPattern)}) was withheld because it overlaps the restriction(s) ${listPatterns(shadowing)}; Pool keeps prompting for "${toolName}".`);
+			continue;
+		}
+		lists.allow.push(pattern);
+	}
+	return {
+		allow: uniq(lists.allow),
+		deny: uniq(lists.deny)
+	};
+}
+function unrepresentableDenies(rules) {
+	return patternsWithAction(rules, ["deny"]).filter((pattern) => toPoolToolPattern(pattern) === void 0);
+}
+/**
+* Group the non-file categories by the Pool tool they land on, reporting the
+* ones Pool has no place for. Two categories can resolve to the same tool
+* (`bash` and a pass-through `shell`).
+*/
+function groupCategoriesByPoolTool({ permission, logger }) {
+	const byTool = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(permission)) {
+		if (isPrototypePollutionKey(category) || isFileCategory(category)) continue;
+		if (category === "*") {
+			for (const [rawPattern, action] of Object.entries(rules)) {
+				if (isPrototypePollutionKey(rawPattern)) continue;
+				logger?.warn(`Pool has no rule that spans every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			}
+			continue;
+		}
+		if (isMcpCategory(category)) {
+			logger?.warn(`Pool approves MCP tools per server under "mcp_servers.<server>.allow", so the rules for "${category}" were skipped; author them as "poolAllow" on the server in .rulesync/mcp.json instead.`);
+			continue;
+		}
+		const toolName = toPoolToolName(category);
+		byTool.set(toolName, [...byTool.get(toolName) ?? [], [category, rules]]);
+	}
+	return byTool;
+}
+/**
+* Convert the non-file categories into Pool tool lists, keyed by Pool tool
+* name. The categories that land on the same tool are converted against the
+* union of their `ask` patterns and their lists are joined, which is safe
+* because a deny wins over an allow in Pool whichever category wrote it.
+*/
+function convertRulesyncToPoolTools({ permission, logger }) {
+	const byTool = /* @__PURE__ */ new Map();
+	for (const [toolName, categories] of groupCategoriesByPoolTool({
+		permission,
+		logger
+	})) {
+		const restrictions = categories.flatMap(([, rules]) => [...patternsWithAction(rules, ["ask"]), ...unrepresentableDenies(rules)]);
+		const lists = {
+			allow: [],
+			deny: []
+		};
+		for (const [category, rules] of categories) {
+			const converted = convertToolCategory({
+				category,
+				toolName,
+				rules,
+				restrictions,
+				logger
+			});
+			lists.allow.push(...converted.allow);
+			lists.deny.push(...converted.deny);
+		}
+		byTool.set(toolName, {
+			allow: uniq(lists.allow),
+			deny: uniq(lists.deny)
+		});
+	}
+	return byTool;
+}
+/**
+* Convert the file categories into Pool's `paths` lists.
+*
+* An allow entry grants reading, and `write: true` grants writing on top, so
+* a `read` allow is withheld by an overlapping `read` ask and a write allow by
+* an overlapping `edit`/`write` ask — and by a `read` ask, since the write
+* entry would read too. A `read` deny lands in `paths.deny`, which Pool lets
+* win over any allow, and covers an `edit`/`write` deny of the same pattern,
+* so neither withholds anything; an `edit`/`write` deny without a `read` deny
+* cannot be written (Pool's deny blocks reads as well), so it is reported and
+* only withholds the write flags it overlaps. A deny Pool cannot spell is
+* skipped the same way and withholds the allows it overlaps, so it is honored
+* by prompting rather than dropped.
+*/
+function convertRulesyncToPoolPaths({ permission, global, logger }) {
+	const readRules = rulesOf(permission, READ_CATEGORY);
+	const writeRulesByCategory = WRITE_CATEGORIES.map((category) => [category, rulesOf(permission, category)]);
+	const readAsks = patternsWithAction(readRules, ["ask"]);
+	const fitsScope = ({ category, action, pattern }) => {
+		if (isHomeOrAbsolutePath(pattern) === global) return true;
+		logger?.warn(global ? `Pool's user settings take absolute or "~" paths, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped; author it in ${join(POOL_DIR, POOL_SETTINGS_FILE_NAME)} (without --global) instead.` : `Pool's project settings take project-relative paths, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped; author it in ~/${join(POOL_GLOBAL_DIR, POOL_SETTINGS_FILE_NAME)} (via --global) instead.`);
+		return false;
+	};
+	const deny = [];
+	const readRestrictions = [...readAsks];
+	for (const pattern of patternsWithAction(readRules, ["deny"])) {
+		const path = toPoolPathPattern(pattern);
+		if (path === void 0) {
+			warnSkippedPathPattern({
+				category: READ_CATEGORY,
+				action: "deny",
+				pattern,
+				logger
+			});
+			readRestrictions.push(pattern);
+			continue;
+		}
+		if (!fitsScope({
+			category: READ_CATEGORY,
+			action: "deny",
+			pattern
+		})) continue;
+		if (!deny.some((entry) => entry[POOL_PATH_KEY] === path)) deny.push({ [POOL_PATH_KEY]: path });
+	}
+	const isDeniedForRead = (pattern) => {
+		const path = toPoolPathPattern(pattern);
+		return path !== void 0 && deny.some((entry) => entry[POOL_PATH_KEY] === path);
+	};
+	const writeRestrictions = writeRulesByCategory.flatMap(([, rules]) => [...patternsWithAction(rules, ["ask"]), ...patternsWithAction(rules, ["deny"]).filter((pattern) => !isDeniedForRead(pattern))]);
+	reportUnwrittenWriteDenies({
+		writeRulesByCategory,
+		isDeniedForRead,
+		logger
+	});
+	const shadowingReadRestrictions = createShadowingRestrictionsTest(asRestrictions(readRestrictions));
+	const shadowingWriteRestrictions = createShadowingRestrictionsTest(asRestrictions([...readRestrictions, ...writeRestrictions]));
+	const allowByPath = /* @__PURE__ */ new Map();
+	for (const pattern of patternsWithAction(readRules, ["allow"])) {
+		if (!fitsScope({
+			category: READ_CATEGORY,
+			action: "allow",
+			pattern
+		})) continue;
+		const path = toPoolPathPattern(pattern);
+		if (path === void 0) {
+			warnSkippedPathPattern({
+				category: READ_CATEGORY,
+				action: "allow",
+				pattern,
+				logger
+			});
+			continue;
+		}
+		const shadowing = shadowingReadRestrictions(pattern);
+		if (shadowing.length > 0) {
+			logger?.warn(`Pool has no list for an "ask" or for a deny it cannot spell (an unmatched path prompts), so the "allow" rule for "read" (pattern ${quoteValueForWarning(pattern)}) was withheld because it overlaps the restriction(s) ${listPatterns(shadowing)}.`);
+			continue;
+		}
+		allowByPath.set(path, { [POOL_PATH_KEY]: path });
+	}
+	for (const [category, rules] of writeRulesByCategory) for (const pattern of patternsWithAction(rules, ["allow"])) {
+		if (!fitsScope({
+			category,
+			action: "allow",
+			pattern
+		})) continue;
+		const path = toPoolPathPattern(pattern);
+		if (path === void 0) {
+			warnSkippedPathPattern({
+				category,
+				action: "allow",
+				pattern,
+				logger
+			});
+			continue;
+		}
+		const shadowing = shadowingWriteRestrictions(pattern);
+		if (shadowing.length > 0) {
+			logger?.warn(`A Pool path allowed with "write: true" can be read and written freely, so the "allow" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was withheld because it overlaps the restriction(s) ${listPatterns(shadowing)}; Pool prompts for those writes.`);
+			continue;
+		}
+		allowByPath.set(path, {
+			[POOL_PATH_KEY]: path,
+			[POOL_WRITE_KEY]: true
+		});
+	}
+	return {
+		allow: [...allowByPath.values()],
+		deny
+	};
+}
+function warnSkippedPathPattern({ category, action, pattern, logger }) {
+	logger?.warn(`Pool path rules treat only "*" and "**" as wildcards, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+}
+function reportUnwrittenWriteDenies({ writeRulesByCategory, isDeniedForRead, logger }) {
+	for (const [category, rules] of writeRulesByCategory) for (const pattern of patternsWithAction(rules, ["deny"])) {
+		if (isDeniedForRead(pattern)) continue;
+		if (toPoolPathPattern(pattern) === void 0) {
+			warnSkippedPathPattern({
+				category,
+				action: "deny",
+				pattern,
+				logger
+			});
+			continue;
+		}
+		logger?.warn(`Pool cannot deny writes without denying reads, so the "deny" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was not written and Pool prompts for those writes instead; deny the pattern under "read" as well to block it entirely.`);
+	}
+}
+function isUsablePattern(pattern) {
+	return typeof pattern === "string" && pattern !== "" && !isPrototypePollutionKey(pattern);
+}
+function pathOfEntry(entry) {
+	return isRecord$1(entry) && isUsablePattern(entry[POOL_PATH_KEY]) ? entry[POOL_PATH_KEY] : void 0;
+}
+/**
+* Convert one `tools.<name>` block into its canonical bucket. A disabled tool
+* never runs, so it reads as a catch-all deny and its own lists are ignored;
+* a denied pattern wins over an allowed one, as it does in Pool.
+*/
+function importPoolTool({ toolConfig, bucket }) {
+	if (toolConfig[POOL_DISABLED_KEY] === true) {
+		bucket[CATCH_ALL_PATTERN$2] = "deny";
+		return;
+	}
+	const denied = isStringArray$2(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
+	const allowed = isStringArray$2(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
+	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
+	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
+}
+/**
+* Convert Pool's `tools` and `paths` blocks back into a rulesync config.
+* `mcp_servers` approvals are the mcp feature's (`poolAllow`) and are not read.
+*/
+function convertPoolToRulesync({ tools, paths }) {
+	const permission = {};
+	const bucketFor = (category) => {
+		const own = lookupOwn({
+			record: permission,
+			key: category
+		});
+		if (own !== void 0) return own;
+		const created = {};
+		permission[category] = created;
+		return created;
+	};
+	for (const [toolName, toolConfig] of Object.entries(tools)) {
+		if (isPrototypePollutionKey(toolName) || !isRecord$1(toolConfig)) continue;
+		importPoolTool({
+			toolConfig,
+			bucket: bucketFor(toCanonicalToolName$4(toolName))
+		});
+	}
+	const denyEntries = Array.isArray(paths[POOL_DENY_KEY]) ? paths[POOL_DENY_KEY] : [];
+	const allowEntries = Array.isArray(paths[POOL_ALLOW_KEY]) ? paths[POOL_ALLOW_KEY] : [];
+	for (const entry of denyEntries) {
+		const path = pathOfEntry(entry);
+		if (path === void 0) continue;
+		for (const category of FILE_CATEGORIES) bucketFor(category)[path] = "deny";
+	}
+	for (const entry of allowEntries) {
+		const path = pathOfEntry(entry);
+		if (path === void 0) continue;
+		bucketFor(READ_CATEGORY)[path] ??= "allow";
+		if (isRecord$1(entry) && entry[POOL_WRITE_KEY] === true) for (const category of WRITE_CATEGORIES) bucketFor(category)[path] ??= "allow";
+	}
+	return { permission };
+}
+//#endregion
 //#region src/features/permissions/qwencode-permissions.ts
 /**
 * Qwen Code uses a settings.json file in `.qwen/` (project) or `~/.qwen/` (global).
@@ -55641,6 +57089,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["pool", {
+		class: PoolPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodePermissions,
 		meta: {
@@ -56304,8 +57760,19 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 		const changedPaths = [];
 		for (const aiDir of aiDirs) {
 			const dirPath = aiDir.getDirPath();
-			let dirHasChanges = false;
 			const mainFile = aiDir.getMainFile();
+			const otherFiles = aiDir.getOtherFiles();
+			const writtenPaths = [
+				dirPath,
+				...mainFile ? [join(dirPath, mainFile.name)] : [],
+				...otherFiles.map((file) => join(dirPath, file.relativeFilePathToDirPath))
+			];
+			if (await refusesAnyWriteOutsideRoot({
+				logger: this.logger,
+				rootPath: aiDir.getOutputRoot(),
+				targetPaths: writtenPaths
+			})) continue;
+			let dirHasChanges = false;
 			let mainFileContent;
 			if (mainFile) {
 				const mainFilePath = join(dirPath, mainFile.name);
@@ -56317,7 +57784,6 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 					existing: existingContent
 				})) dirHasChanges = true;
 			}
-			const otherFiles = aiDir.getOtherFiles();
 			for (const file of otherFiles) {
 				if (dirHasChanges) break;
 				const filePath = join(dirPath, file.relativeFilePathToDirPath);
@@ -56762,7 +58228,7 @@ const AmpSkillFrontmatterSchema = z.looseObject({
 * Amp natively reads Agent Skills following the open standard: a directory with a
 * `SKILL.md` carrying `name`/`description` frontmatter, scoped to the project
 * (`.agents/skills/`) and user-wide (`~/.config/agents/skills/`).
-* @see https://ampcode.com/manual
+* @see https://ampcode.com/docs/customize/skills
 */
 var AmpSkill = class AmpSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = AMP_SKILLS_PROJECT_DIR, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -61731,37 +63197,6 @@ var PiSkill = class PiSkill extends ToolSkill {
 	}
 };
 //#endregion
-//#region src/constants/pool-paths.ts
-/**
-* Pool (Poolside's coding agent CLI) configuration-layout conventions.
-*
-* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
-* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
-* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
-* path), the project-root `AGENTS.md`, and nested per-directory
-* `AGENTS.md` files from the repository root down through the working
-* directory, deeper files taking precedence. It skips ignored directories
-* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
-*
-* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
-* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
-* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
-* the skill directories of other Agent Skills tools; rulesync writes only the
-* Pool-specific roots and leaves the shared ones to their own targets.
-*
-* @see https://docs.poolside.ai/agent-instructions
-* @see https://docs.poolside.ai/skills
-* @see https://github.com/poolsideai/pool
-*/
-/** Project-scoped `.poolside/` directory at the project root. */
-const POOL_DIR = ".poolside";
-/** Global config directory for Pool, relative to the home directory. */
-const POOL_GLOBAL_DIR = join(".config", "poolside");
-/** Project skills root, relative to the project root. */
-const POOL_SKILLS_DIR_PATH = join(POOL_DIR, "skills");
-/** Global skills root, relative to the home directory. */
-const POOL_GLOBAL_SKILLS_DIR_PATH = join(POOL_GLOBAL_DIR, "skills");
-//#endregion
 //#region src/features/skills/pool-skill.ts
 const PoolSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -68467,6 +69902,325 @@ var OpenCodeSubagent = class OpenCodeSubagent extends OpenCodeStyleSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/pool-subagent.ts
+/** How Pool runs an agent; a custom agent defaults to `in_process`. */
+const POOL_AGENT_TYPES = [
+	"in_process",
+	"command",
+	"agent_server"
+];
+const DEFAULT_POOL_AGENT_TYPE = "in_process";
+/**
+* One entry of `subagents.agents.<name>` in Pool's settings file. `type` is
+* required by Pool and `description` by every enabled custom agent; the
+* remaining keys depend on the type (`command`/`args`/`env` for `command`,
+* `agent_server`/`session_config_options` for `agent_server`). Loose so a key
+* Pool adds later survives the round-trip.
+* @see https://docs.poolside.ai/subagents
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+const PoolAgentSchema = z.looseObject({
+	type: z.optional(z.enum(POOL_AGENT_TYPES)),
+	description: z.optional(z.string()),
+	instructions: z.optional(z.string()),
+	command: z.optional(z.string()),
+	args: z.optional(z.array(z.string())),
+	env: z.optional(z.record(z.string(), z.string())),
+	agent_server: z.optional(z.string()),
+	session_config_options: z.optional(z.record(z.string(), z.unknown())),
+	inherit_agent_config: z.optional(z.boolean()),
+	disabled: z.optional(z.boolean())
+});
+/**
+* Single spelling of the settings.yaml codec/policy, matching PoolMcp: fail
+* closed on an unparseable root rather than replacing the user's primary Pool
+* settings with generated output.
+*/
+function parsePoolSettings(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* The file stem an imported agent lands under in `.rulesync/subagents/`. Pool
+* keys agents by an arbitrary YAML mapping key, so the name is narrowed to a
+* safe file name before it becomes a path (defense in depth on top of the
+* central path-traversal guard); the agent keeps its real name in `name`.
+*/
+function sanitizePoolAgentFileStem(raw) {
+	const stem = raw.replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+	return stem.length > 0 ? stem : "agent";
+}
+/**
+* Read `subagents.agents` out of a parsed settings document. The reserved
+* `general` agent is Pool's built-in and stays the user's to configure, so it
+* is never imported; an entry that is not a mapping is skipped.
+*/
+function agentsOfSettings({ settings, filePath, logger }) {
+	const block = settings[POOL_SUBAGENTS_KEY];
+	const rawAgents = isRecord$1(block) ? block[POOL_SUBAGENTS_AGENTS_KEY] : void 0;
+	const agents = {};
+	if (!isRecord$1(rawAgents)) return agents;
+	for (const [name, raw] of Object.entries(rawAgents)) {
+		if (isPrototypePollutionKey(name) || name === "general") continue;
+		const result = PoolAgentSchema.safeParse(raw);
+		if (!result.success) {
+			logger?.warn(`Skipped Pool subagent ${quoteValueForWarning(name)} in ${filePath}: ${formatError(result.error)}`);
+			continue;
+		}
+		agents[name] = result.data;
+	}
+	return agents;
+}
+/**
+* Pool subagents.
+*
+* Pool defines subagents inside its settings file — `.poolside/settings.yaml`
+* at project scope and `~/.config/poolside/settings.yaml` at user scope —
+* under `subagents.agents.<name>`, so every targeted rulesync subagent is
+* collapsed into that one file: the body becomes `instructions`, the shared
+* `description` is written as-is and the `pool:` frontmatter section supplies
+* `type` (default `in_process`) and the type-specific keys. rulesync owns the
+* `agents` map except for Pool's built-in `general` entry, which is carried
+* over untouched together with `subagents.default` and every other top-level
+* key of the file (`mcp_servers`, `tools`, `pool`, ...); the file is never
+* deleted.
+*
+* @see https://docs.poolside.ai/subagents
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolSubagent = class extends ToolSubagent {
+	agents;
+	logger;
+	/**
+	* The settings document to write, built lazily: the writer hands over the
+	* existing file through `setFileContent` first, and a file that does not
+	* exist yet gets the block merged into an empty document. Lazy so that a
+	* `forDeletion` instance never consults the gateway.
+	*/
+	mergedContent = null;
+	constructor({ agents, logger, ...rest }) {
+		super({
+			...rest,
+			fileContent: ""
+		});
+		this.agents = agents;
+		this.logger = logger;
+	}
+	getAgents() {
+		return this.agents;
+	}
+	isDeletable() {
+		return false;
+	}
+	shouldMergeExistingFileContent() {
+		return true;
+	}
+	setFileContent(newFileContent) {
+		this.mergedContent = this.mergeInto(newFileContent);
+	}
+	getFileContent() {
+		if (this.mergedContent === null) this.mergedContent = this.mergeInto("");
+		return this.mergedContent;
+	}
+	/**
+	* Rebuild the `subagents` block on top of an existing settings document:
+	* `default` and any other sibling of `agents` are kept, the built-in
+	* `general` agent is carried over, and every other agent is replaced by the
+	* generated set — an agent removed from `.rulesync/subagents/` must not
+	* survive here. A block left empty is retracted rather than written as `{}`.
+	*/
+	mergeInto(existingContent) {
+		const paths = {
+			relativeDirPath: this.getRelativeDirPath(),
+			relativeFilePath: this.getRelativeFilePath()
+		};
+		const filePath = join(this.getOutputRoot(), paths.relativeDirPath, paths.relativeFilePath);
+		const existing = parsePoolSettings(existingContent, filePath);
+		const existingBlock = isRecord$1(existing["subagents"]) ? existing[POOL_SUBAGENTS_KEY] : {};
+		const block = {};
+		for (const [key, value] of Object.entries(existingBlock)) if (!isPrototypePollutionKey(key) && key !== "agents") block[key] = value;
+		const existingAgents = isRecord$1(existingBlock["agents"]) ? existingBlock[POOL_SUBAGENTS_AGENTS_KEY] : {};
+		const general = existingAgents[POOL_GENERAL_AGENT_NAME];
+		const agents = {
+			...general !== void 0 ? { [POOL_GENERAL_AGENT_NAME]: general } : {},
+			...this.agents
+		};
+		const dropped = Object.keys(existingAgents).filter((name) => name !== "general" && !Object.hasOwn(agents, name));
+		if (dropped.length > 0) {
+			const advice = this.global ? "hand-written agents belong in .rulesync/subagents/" : `hand-written agents belong in ${POOL_SETTINGS_LOCAL_FILE_NAME}`;
+			this.logger?.warn(`Removed Pool subagent(s) ${dropped.map(quoteValueForWarning).join(", ")} from ${filePath}: rulesync recomputes "${POOL_SUBAGENTS_KEY}.${POOL_SUBAGENTS_AGENTS_KEY}" from its own subagents on every run, so ${advice}.`);
+		}
+		if (Object.keys(agents).length > 0) block[POOL_SUBAGENTS_AGENTS_KEY] = agents;
+		return applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "subagents",
+			existingContent,
+			patch: { [POOL_SUBAGENTS_KEY]: Object.keys(block).length > 0 ? block : void 0 },
+			filePath,
+			logger: this.logger
+		});
+	}
+	/**
+	* Every agent lives in the one settings file, which the MCP feature writes
+	* too: naming the file here keeps the gitignore derivation from claiming the
+	* whole directory and lets the shared-file derivation order the writers.
+	*/
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	/**
+	* Map a single rulesync subagent to a Pool agent entry. The body becomes
+	* `instructions` and the shared `description` is written as-is; the
+	* optional `pool:` section supplies `type` and the type-specific keys and
+	* may override both. Returns `null` for the reserved `general` name, which
+	* Pool defines itself.
+	*/
+	static toPoolAgent({ rulesyncSubagent, logger }) {
+		const frontmatter = rulesyncSubagent.getFrontmatter();
+		const name = frontmatter.name;
+		if (name === "general") {
+			logger?.warn(`Pool subagent ${quoteValueForWarning(name)} was skipped: "${POOL_GENERAL_AGENT_NAME}" is Pool's built-in agent, so configure it in settings.yaml directly.`);
+			return null;
+		}
+		if (isPrototypePollutionKey(name)) {
+			logger?.warn(`Pool subagent ${quoteValueForWarning(name)} was skipped: unsafe name.`);
+			return null;
+		}
+		const rawSection = isRecord$1(frontmatter.pool) ? frontmatter.pool : {};
+		const result = PoolAgentSchema.safeParse(rawSection);
+		if (!result.success) throw new Error(`Invalid "pool" section of subagent ${quoteValueForWarning(name)}: ${formatError(result.error)}`);
+		const { type, description, instructions, ...rest } = result.data;
+		const body = rulesyncSubagent.getBody().trim();
+		const effectiveDescription = description ?? frontmatter.description;
+		const effectiveInstructions = instructions ?? (body !== "" ? body : void 0);
+		if (effectiveDescription === void 0 && rest.disabled !== true) logger?.warn(`Pool subagent ${quoteValueForWarning(name)} has no description; Pool requires one for every enabled custom agent.`);
+		return {
+			name,
+			agent: {
+				type: type ?? DEFAULT_POOL_AGENT_TYPE,
+				...effectiveDescription !== void 0 ? { description: effectiveDescription } : {},
+				...effectiveInstructions !== void 0 ? { instructions: effectiveInstructions } : {},
+				...rest
+			}
+		};
+	}
+	/**
+	* Aggregate every targeted rulesync subagent into the one settings file.
+	* Agents are keyed by their `name`; a repeated name keeps the last one, with
+	* a warning, so the map stays what Pool would read.
+	*/
+	static fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, validate = true, global = false, logger }) {
+		const agents = {};
+		for (const rulesyncSubagent of rulesyncSubagents) {
+			const converted = this.toPoolAgent({
+				rulesyncSubagent,
+				logger
+			});
+			if (converted === null) continue;
+			if (Object.hasOwn(agents, converted.name)) logger?.warn(`Pool subagent ${quoteValueForWarning(converted.name)} is defined more than once; the last definition (${rulesyncSubagent.getRelativePathFromCwd()}) wins.`);
+			agents[converted.name] = converted.agent;
+		}
+		return new this({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME,
+			agents,
+			validate,
+			global,
+			logger
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
+		return this.fromRulesyncSubagents({
+			outputRoot,
+			rulesyncSubagents: [rulesyncSubagent],
+			validate,
+			global,
+			logger
+		});
+	}
+	/**
+	* Convert every custom agent of the settings file back into an individual
+	* rulesync subagent. `instructions` becomes the body, `description` the
+	* shared field, and everything else — `type` only when it is not the
+	* default — rides the `pool:` section so it survives the round-trip.
+	*/
+	toRulesyncSubagents() {
+		return Object.entries(this.agents).map(([name, agent]) => {
+			const { type, description, instructions, ...rest } = agent;
+			const poolSection = {
+				...type !== void 0 && type !== DEFAULT_POOL_AGENT_TYPE ? { type } : {},
+				...rest
+			};
+			const rulesyncFrontmatter = {
+				targets: ["pool"],
+				name,
+				...description !== void 0 ? { description } : {},
+				...Object.keys(poolSection).length > 0 ? { pool: poolSection } : {}
+			};
+			return new RulesyncSubagent({
+				outputRoot: process.cwd(),
+				frontmatter: rulesyncFrontmatter,
+				body: instructions ?? "",
+				relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+				relativeFilePath: `${sanitizePoolAgentFileStem(name)}.md`,
+				validate: true
+			});
+		});
+	}
+	toRulesyncSubagent() {
+		const first = this.toRulesyncSubagents()[0];
+		if (!first) throw new Error(`No custom subagents found in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())} to convert.`);
+		return first;
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "pool"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const settings = parsePoolSettings(await readFileContentOrNull(filePath) ?? "", filePath);
+		return new this({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			agents: agentsOfSettings({
+				settings,
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			agents: {},
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/reasonix-subagent.ts
 const ReasonixSubagentFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -69787,6 +71541,16 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.md"
 		}
 	}],
+	["pool", {
+		class: PoolSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			emitsEmptyAggregate: true,
+			filePattern: POOL_SETTINGS_FILE_NAME
+		}
+	}],
 	["qwencode", {
 		class: QwencodeSubagent,
 		meta: {
@@ -69899,6 +71663,12 @@ var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
+	/**
+	* Whether the last `loadRulesyncFiles` found a `subagents/` directory under
+	* any input root. A project without one has not adopted the feature, so the
+	* agents in its Pool settings are its own and must not be retracted.
+	*/
+	rulesyncSourceDirFound = false;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
 		super({
 			outputRoot,
@@ -69912,16 +71682,20 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		this.global = global;
 		this.getFactory = getFactory;
 	}
+	emitsToolFilesForEmptySource() {
+		return this.rulesyncSourceDirFound && this.getFactory(this.toolTarget).meta.emitsEmptyAggregate === true;
+	}
 	async convertRulesyncFilesToToolFiles(rulesyncFiles) {
 		const rulesyncSubagents = rulesyncFiles.filter((file) => file instanceof RulesyncSubagent);
 		const factory = this.getFactory(this.toolTarget);
 		const targeted = rulesyncSubagents.filter((rulesyncSubagent) => factory.class.isTargetedByRulesyncSubagent(rulesyncSubagent));
 		if (factory.class.fromRulesyncSubagents) {
-			if (targeted.length === 0) return [];
+			if (targeted.length === 0 && !this.emitsToolFilesForEmptySource()) return [];
 			const toolSubagents = factory.class.fromRulesyncSubagents({
 				outputRoot: this.outputRoot,
 				rulesyncSubagents: targeted,
-				global: this.global
+				global: this.global,
+				logger: this.logger
 			});
 			return Array.isArray(toolSubagents) ? toolSubagents : [toolSubagents];
 		}
@@ -69977,6 +71751,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			this.logger.debug(`Rulesync subagents directory not found: ${subagentsDir}`);
 			return [];
 		}
+		this.rulesyncSourceDirFound = true;
 		const mdFiles = (await listDirectoryEntryNames(subagentsDir)).filter((file) => file.endsWith(".md"));
 		if (mdFiles.length === 0) {
 			this.logger.debug(`No markdown files found in rulesync subagents directory: ${subagentsDir}`);
@@ -70017,6 +71792,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 	* earlier root's copy.
 	*/
 	async loadRulesyncFiles() {
+		this.rulesyncSourceDirFound = false;
 		const rulesyncSubagents = mergeByCaseInsensitiveIdentity({
 			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
 			identity: (subagent) => subagent.getRelativeFilePath(),
@@ -70079,7 +71855,8 @@ var SubagentsProcessor = class extends FeatureProcessor {
 				outputRoot: rootOutputRoot,
 				relativeDirPath: dirPath,
 				relativeFilePath: toRelativeFilePath(path),
-				global: this.global
+				global: this.global,
+				logger: this.logger
 			})));
 			toolSubagents.push(...this.claimStandaloneSubagents({
 				loaded,
@@ -74001,22 +75778,30 @@ var DevinRule = class DevinRule extends ToolRule {
 	}
 };
 //#endregion
-//#region src/features/rules/dsh-rule.ts
+//#region src/features/rules/nested-agentsmd-rule.ts
 /**
-* DeepSeek Harness (`dsh`) rules.
+* Shared adapter for the targets that read instructions exactly the way the
+* AGENTS.md standard describes them and nothing more: a root `AGENTS.md` at the
+* project root, nested per-directory `AGENTS.md` files loaded only while working
+* under that directory, and a single personal root file under a tool-specific
+* home directory. Such a target has no modular non-root instruction directory,
+* so every other non-root rule folds into the root file.
 *
-* Project scope writes the root `AGENTS.md` plus nested `<dir>/AGENTS.md`
-* files — the project chain `dsh-agent-instructions` loads from the `.git`
-* root down to the session cwd. Global scope writes the user-global
-* `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness reads as a
-* single root file with no local overlay, so non-root rules fold into it.
+* Concrete targets (Pool, Vibe, DeepSeek Harness) only supply the global
+* directory and their tool target through {@link getFamily}; the vendor docs
+* describing each one's discovery walk live on the subclass.
 *
-* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+* The nested-file scan mirrors the AGENTS.md standard's nested discovery —
+* same file name, same exclusions, import-only, project scope — because it
+* discovers literally the same files.
 */
-var DshRule = class DshRule extends ToolRule {
+var NestedAgentsmdRule = class extends ToolRule {
+	static getFamily() {
+		throw new Error("Please implement this method in the subclass.");
+	}
 	static getSettablePaths({ global = false } = {}) {
 		if (global) return { root: {
-			relativeDirPath: DSH_DIR,
+			relativeDirPath: this.getFamily().globalDir,
 			relativeFilePath: AGENTSMD_RULE_FILE_NAME
 		} };
 		return { root: {
@@ -74024,18 +75809,6 @@ var DshRule = class DshRule extends ToolRule {
 			relativeFilePath: AGENTSMD_RULE_FILE_NAME
 		} };
 	}
-	/**
-	* DeepSeek Harness loads the project chain of `AGENTS.md` files from the
-	* project root (the nearest ancestor holding `.git`) down through the session
-	* cwd, broad to specific, so a per-directory file applies only while working
-	* under that directory. Nested files are therefore a real scoping surface,
-	* not just the root file's overflow.
-	*
-	* The scan mirrors the AGENTS.md standard's nested discovery — same file
-	* name, same exclusions, import-only, project scope — because it discovers
-	* literally the same files.
-	* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
-	*/
 	static getNestedFilePatterns() {
 		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
 	}
@@ -74050,7 +75823,7 @@ var DshRule = class DshRule extends ToolRule {
 		const { root } = this.getSettablePaths({ global });
 		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
 			const fileContent = await readFileContent(join(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
-			return new DshRule({
+			return new this({
 				outputRoot,
 				relativeDirPath: overrideDirPath,
 				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
@@ -74060,7 +75833,7 @@ var DshRule = class DshRule extends ToolRule {
 			});
 		}
 		const fileContent = await readFileContent(join(outputRoot, root.relativeDirPath, root.relativeFilePath));
-		return new DshRule({
+		return new this({
 			outputRoot,
 			relativeDirPath: root.relativeDirPath,
 			relativeFilePath: root.relativeFilePath,
@@ -74074,7 +75847,7 @@ var DshRule = class DshRule extends ToolRule {
 		const frontmatter = rulesyncRule.getFrontmatter();
 		const isRoot = frontmatter.root ?? false;
 		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
-		if (!global && !isRoot && subprojectPath) return new DshRule({
+		if (!global && !isRoot && subprojectPath) return new this({
 			outputRoot,
 			relativeDirPath: join(subprojectPath),
 			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
@@ -74082,7 +75855,7 @@ var DshRule = class DshRule extends ToolRule {
 			validate,
 			root: false
 		});
-		return new DshRule({
+		return new this({
 			outputRoot,
 			relativeDirPath: root.relativeDirPath,
 			relativeFilePath: root.relativeFilePath,
@@ -74103,23 +75876,47 @@ var DshRule = class DshRule extends ToolRule {
 		};
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new DshRule({
+		const isRoot = relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === this.getFamily().globalDir);
+		return new this({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
 			validate: false,
-			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === ".dsh")
+			root: isRoot
 		});
 	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
 		return this.isTargetedByRulesyncRuleDefault({
 			rulesyncRule,
-			toolTarget: "dsh"
+			toolTarget: this.getFamily().toolTarget
 		});
 	}
 };
 //#endregion
+//#region src/features/rules/dsh-rule.ts
+/**
+* DeepSeek Harness (`dsh`) rules.
+*
+* Project scope writes the root `AGENTS.md` plus nested `<dir>/AGENTS.md`
+* files — the project chain `dsh-agent-instructions` loads from the `.git`
+* root down to the session cwd, broad to specific, so a per-directory file
+* applies only while working under that directory. Global scope writes the
+* user-global `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness
+* reads as a single root file with no `.local.md` overlay, so non-root rules
+* fold into it.
+*
+* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+*/
+var DshRule = class extends NestedAgentsmdRule {
+	static getFamily() {
+		return {
+			globalDir: DSH_DIR,
+			toolTarget: "dsh"
+		};
+	}
+};
+//#endregion
 //#region src/features/rules/factorydroid-rule.ts
 /**
 * Rule generator for Factory Droid.
@@ -75513,110 +77310,24 @@ var PiRule = class PiRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/pool-rule.ts
-var PoolRule = class PoolRule extends ToolRule {
-	static getSettablePaths({ global = false } = {}) {
-		if (global) return { root: {
-			relativeDirPath: POOL_GLOBAL_DIR,
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-		return { root: {
-			relativeDirPath: ".",
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-	}
-	/**
-	* Pool reads personal, project, and directory-level `AGENTS.md` files: inside
-	* a git repository it loads every `AGENTS.md` from the repository root down
-	* through the working directory (deeper files take precedence), skipping
-	* ignored directories. Nested files are therefore a real scoping surface, not
-	* just the root file's overflow.
-	*
-	* The scan mirrors the AGENTS.md standard's nested discovery — same file
-	* name, same exclusions, import-only, project scope — because it discovers
-	* literally the same files.
-	* @see https://docs.poolside.ai/agent-instructions
-	*/
-	static getNestedFilePatterns() {
-		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	/**
-	* The subproject directory this rule scopes, or `undefined` for the root file
-	* (project or global).
-	*/
-	getSubprojectPath() {
-		return this.getNestedSubprojectPath({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
-			const fileContent = await readFileContent(join(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
-			return new PoolRule({
-				outputRoot,
-				relativeDirPath: overrideDirPath,
-				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-				fileContent,
-				validate,
-				root: false
-			});
-		}
-		const fileContent = await readFileContent(join(outputRoot, root.relativeDirPath, root.relativeFilePath));
-		return new PoolRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent,
-			validate,
-			root: true
-		});
-	}
-	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		const frontmatter = rulesyncRule.getFrontmatter();
-		const isRoot = frontmatter.root ?? false;
-		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
-		if (!global && !isRoot && subprojectPath) return new PoolRule({
-			outputRoot,
-			relativeDirPath: join(subprojectPath),
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: false
-		});
-		return new PoolRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: isRoot
-		});
-	}
-	toRulesyncRule() {
-		const subprojectPath = this.getSubprojectPath();
-		if (subprojectPath === void 0) return this.toRulesyncRuleDefault();
-		return this.toRulesyncRuleNestedAgentsmd({ subprojectPath });
-	}
-	validate() {
+/**
+* Pool (Poolside) rules.
+*
+* Pool reads personal, project, and directory-level `AGENTS.md` files: inside
+* a git repository it loads every `AGENTS.md` from the repository root down
+* through the working directory (deeper files take precedence), skipping
+* ignored directories. Nested files are therefore a real scoping surface, not
+* just the root file's overflow. The personal file sits below both at
+* `~/.config/poolside/AGENTS.md`.
+*
+* @see https://docs.poolside.ai/agent-instructions
+*/
+var PoolRule = class extends NestedAgentsmdRule {
+	static getFamily() {
 		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new PoolRule({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === POOL_GLOBAL_DIR)
-		});
-	}
-	static isTargetedByRulesyncRule(rulesyncRule) {
-		return this.isTargetedByRulesyncRuleDefault({
-			rulesyncRule,
+			globalDir: POOL_GLOBAL_DIR,
 			toolTarget: "pool"
-		});
+		};
 	}
 };
 //#endregion
@@ -76580,110 +78291,23 @@ var TaktRule = class TaktRule extends ToolRule {
 //#endregion
 //#region src/features/rules/vibe-rule.ts
 const VIBE_GLOBAL_DIR = ".vibe";
-var VibeRule = class VibeRule extends ToolRule {
-	static getSettablePaths({ global = false } = {}) {
-		if (global) return { root: {
-			relativeDirPath: VIBE_GLOBAL_DIR,
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-		return { root: {
-			relativeDirPath: ".",
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-	}
-	/**
-	* Vibe's harness manager walks the directories between the workspace root and
-	* the file being read and loads every `AGENTS.md` it finds along the way
-	* (`find_subdirectory_agents_md`), injecting the result into the `read_file`
-	* tool's output. Nested files are therefore a real scoping surface, not just
-	* the root file's overflow.
-	*
-	* The scan mirrors the AGENTS.md standard's nested discovery — same file
-	* name, same exclusions, import-only, project scope — because it discovers
-	* literally the same files.
-	* @see https://github.com/mistralai/mistral-vibe/blob/main/vibe/core/config/harness_files/_harness_manager.py
-	*/
-	static getNestedFilePatterns() {
-		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	/**
-	* The subproject directory this rule scopes, or `undefined` for the root file
-	* (project or global).
-	*/
-	getSubprojectPath() {
-		return this.getNestedSubprojectPath({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
-			const fileContent = await readFileContent(join(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
-			return new VibeRule({
-				outputRoot,
-				relativeDirPath: overrideDirPath,
-				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-				fileContent,
-				validate,
-				root: false
-			});
-		}
-		const fileContent = await readFileContent(join(outputRoot, root.relativeDirPath, root.relativeFilePath));
-		return new VibeRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent,
-			validate,
-			root: true
-		});
-	}
-	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		const frontmatter = rulesyncRule.getFrontmatter();
-		const isRoot = frontmatter.root ?? false;
-		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
-		if (!global && !isRoot && subprojectPath) return new VibeRule({
-			outputRoot,
-			relativeDirPath: join(subprojectPath),
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: false
-		});
-		return new VibeRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: isRoot
-		});
-	}
-	toRulesyncRule() {
-		const subprojectPath = this.getSubprojectPath();
-		if (subprojectPath === void 0) return this.toRulesyncRuleDefault();
-		return this.toRulesyncRuleNestedAgentsmd({ subprojectPath });
-	}
-	validate() {
+/**
+* Mistral Vibe rules.
+*
+* Vibe's harness manager walks the directories between the workspace root and
+* the file being read and loads every `AGENTS.md` it finds along the way
+* (`find_subdirectory_agents_md`), injecting the result into the `read_file`
+* tool's output. Nested files are therefore a real scoping surface, not just
+* the root file's overflow. The personal file is `~/.vibe/AGENTS.md`.
+*
+* @see https://github.com/mistralai/mistral-vibe/blob/main/vibe/core/config/harness_files/_harness_manager.py
+*/
+var VibeRule = class extends NestedAgentsmdRule {
+	static getFamily() {
 		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new VibeRule({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === ".vibe")
-		});
-	}
-	static isTargetedByRulesyncRule(rulesyncRule) {
-		return this.isTargetedByRulesyncRuleDefault({
-			rulesyncRule,
+			globalDir: VIBE_GLOBAL_DIR,
 			toolTarget: "vibe"
-		});
+		};
 	}
 };
 //#endregion
@@ -78890,6 +80514,16 @@ async function activateHermesProjectPlugins({ pluginNames, dryRun, logger }) {
 		relativeFilePath: HERMESAGENT_CONFIG_FILE_PATH
 	});
 	const configPath = join(configRoot, relativeConfigPath);
+	if (await refusesWriteOutsideRoot({
+		logger,
+		rootPath: configRoot,
+		targetPath: configPath
+	})) return {
+		count: 0,
+		paths: [],
+		hasDiff: false,
+		sourceLoadFailed: false
+	};
 	const expectedConfig = mergeEnabledPlugins({
 		existingContent: await readFileContentOrNull(configPath) ?? "",
 		filePath: configPath,
@@ -79357,7 +80991,8 @@ async function processEmptyFeatureGeneration(params) {
 */
 async function processFeatureWithRulesyncFiles(params) {
 	const { config, processor, rulesyncFiles, sweepPlan, skipFilePaths, onToolFiles } = params;
-	if (rulesyncFiles.length === 0) return processEmptyFeatureGeneration({
+	const retractsForEmptySource = processor.emitsToolFilesForEmptySource() && !processor.hasRulesyncSourceLoadFailure();
+	if (rulesyncFiles.length === 0 && !retractsForEmptySource) return processEmptyFeatureGeneration({
 		config,
 		processor,
 		sweepPlan,
@@ -80589,4 +82224,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
 
-//# sourceMappingURL=import-BnF2J75x.js.map
+//# sourceMappingURL=import-B2ANxi1V.js.map