rulesync 16.38.0 → 16.39.0

package/dist/{import-DKBaTqsY.cjs → import-DS3OrTAl.cjs}

@@ -444,36 +444,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$351 } = node_path.posix;
+const { join: join$352 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$351(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$352(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$351(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$351(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$352(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$352(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$351(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$352(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -696,6 +696,7 @@ const subagentsProcessorToolTargetTuple = [
 	"kiro-cli",
 	"kiro-ide",
 	"opencode",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"roo",
@@ -777,6 +778,7 @@ const hooksProcessorToolTargetTuple = [
 	"crush",
 	"opencode",
 	"pi",
+	"pool",
 	"factorydroid",
 	"goose",
 	"hermesagent",
@@ -824,6 +826,7 @@ const permissionsProcessorToolTargetTuple = [
 	"kiro-ide",
 	"opencode",
 	"pi",
+	"pool",
 	"qwencode",
 	"reasonix",
 	"roo",
@@ -1380,6 +1383,111 @@ async function resolvedPathEscapesRoot({ rootPath, targetPath }) {
 	}));
 }
 /**
+* How many links {@link writeLandingPath} follows before it treats the chain as
+* a cycle it cannot write through. Linux itself gives up after 40.
+*/
+const MAX_LINK_HOPS = 40;
+/**
+* Whether `error` is the ENOTDIR a lookup through a file raises. On the way to
+* a write it means the same as a missing entry: nothing at or below the path
+* exists, so nothing there can be a link.
+*/
+function isNotADirectoryError(error) {
+	return someErrorInChain(error, (candidate) => "code" in candidate && candidate.code === "ENOTDIR");
+}
+/**
+* Where a write to `targetPath` lands once the OS has followed every link on
+* the way there, or `null` when the links form a cycle no write can get
+* through. The target itself usually does not exist yet, so the walk goes
+* segment by segment from the filesystem root: an existing segment that is a
+* link is replaced by what it resolves to, and a dangling link — one whose
+* target does not exist yet, which is exactly the shape of a link planted at
+* `AGENTS.md` pointing at a `~/.zshenv` that is still to be created — has its
+* target spliced into the walk in its place, so the segments of that target
+* are looked up one by one too. Once a segment is missing, nothing below it
+* exists, and the rest of the path is where the write's `mkdir -p` will put it.
+*
+* Walking segment by segment is what keeps a `..` honest. A link target is a
+* path the OS resolves left to right, so in `sub/../victim` the `..` climbs out
+* of wherever `sub` leads, not out of the directory `sub` is spelled in; a
+* lexical `resolve` folds `sub/..` away before `sub` is ever looked at, which
+* is how a link chain could be spelled to pass the check and still land
+* outside the root.
+*/
+async function writeLandingPath(targetPath) {
+	const start = splitAbsolutePath((0, node_path.isAbsolute)(targetPath) ? targetPath : (0, node_path.resolve)(targetPath));
+	let current = start.root;
+	let pending = start.segments;
+	let exists = true;
+	let linkHops = 0;
+	while (pending.length > 0) {
+		const segment = pending.shift();
+		if (segment === void 0 || segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			current = (0, node_path.dirname)(current);
+			continue;
+		}
+		current = (0, node_path.join)(current, segment);
+		if (!exists) continue;
+		let stats;
+		try {
+			stats = await (0, node_fs_promises.lstat)(current);
+		} catch (error) {
+			if (!isFileNotFoundError(error) && !isNotADirectoryError(error)) throw error;
+			exists = false;
+			continue;
+		}
+		if (!stats.isSymbolicLink()) continue;
+		linkHops += 1;
+		if (linkHops > MAX_LINK_HOPS) return null;
+		try {
+			current = await (0, node_fs_promises.realpath)(current);
+			continue;
+		} catch {}
+		const linkTarget = await (0, node_fs_promises.readlink)(current);
+		if ((0, node_path.isAbsolute)(linkTarget)) {
+			const target = splitAbsolutePath(linkTarget);
+			current = target.root;
+			pending = [...target.segments, ...pending];
+		} else {
+			current = (0, node_path.dirname)(current);
+			pending = [...splitPathSegments(linkTarget), ...pending];
+		}
+	}
+	return current;
+}
+/**
+* Split an absolute path into its root and its raw segments, without folding a
+* `..` away: {@link writeLandingPath} has to see every `..` where it is spelled.
+*/
+function splitAbsolutePath(absolutePath) {
+	const root = (0, node_path.parse)(absolutePath).root;
+	return {
+		root,
+		segments: splitPathSegments(absolutePath.slice(root.length))
+	};
+}
+/**
+* Whether writing `targetPath` would land outside `rootPath` once every link on
+* the way there is resolved. Both sides are taken to where a write to them
+* would land (see {@link writeLandingPath}), so a root that does not fully
+* exist yet is judged the same way as the target below it.
+*
+* A link that stays inside the root passes. That is what sets this apart from
+* the stricter {@link assertWritablePathInsideRoot} the sweep paths use: a
+* dotfiles checkout linked from inside the home directory is a common shape for
+* a global write target, and refusing it would refuse `--global` outright.
+*
+* A link chain that cycles is reported as an escape: the write could not get
+* through it, and refusing it is the answer that never writes somewhere
+* unexpected.
+*/
+async function writablePathEscapesRoot({ rootPath, targetPath }) {
+	const [rootLanding, targetLanding] = await Promise.all([writeLandingPath(rootPath), writeLandingPath(targetPath)]);
+	if (rootLanding === null || targetLanding === null) return true;
+	return pathEscapesRoot((0, node_path.relative)(rootLanding, targetLanding));
+}
+/**
 * How many trailing segments `filePath` and `identity` have in common.
 *
 * A path that walked through no link at all shares all of its own segments with
@@ -4679,6 +4787,34 @@ const VIBE_HOOK_EVENTS = [
 	"stop"
 ];
 /**
+* Hook events supported by Pool.
+*
+* Pool's `hooks` settings block fires six events, spelled the Claude Code
+* way: `PreToolUse`, `PostToolUse`, `UserPromptSubmit` (← `beforeSubmitPrompt`),
+* `PreCompact`, `SessionStart` and `Stop`. Every entry carries a `matcher`
+* (required by Pool's schema; `""`/`*` match any tool, a bare name is an exact
+* match, `a|b` lists names, anything else is a regular expression), which only
+* `PreToolUse`/`PostToolUse` test against the tool name.
+* @see https://docs.poolside.ai/hooks
+*/
+const POOL_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"beforeSubmitPrompt",
+	"preCompact",
+	"sessionStart",
+	"stop"
+];
+const CANONICAL_TO_POOL_EVENT_NAMES = {
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	beforeSubmitPrompt: "UserPromptSubmit",
+	preCompact: "PreCompact",
+	sessionStart: "SessionStart",
+	stop: "Stop"
+};
+const POOL_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_POOL_EVENT_NAMES).map(([k, v]) => [v, k]));
+/**
 * Hook events supported by Crush.
 *
 * Crush's `hooks` config block currently fires a single event, `PreToolUse`
@@ -5273,6 +5409,7 @@ const HooksConfigSchema = zod_mini.z.looseObject({
 	"kimi-code": zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	zcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	crush: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
+	pool: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	bob: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	cortexcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	commandcode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
@@ -8001,6 +8138,7 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	crush: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	pool: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
 	roo: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
@@ -9843,6 +9981,22 @@ allowedMcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })
 		injectAgentsMd: zod_mini.z.optional(zod_mini.z.boolean()),
 		mcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 	})),
+	pool: zod_mini.z.optional(zod_mini.z.looseObject({
+		type: zod_mini.z.optional(zod_mini.z.enum([
+			"in_process",
+			"command",
+			"agent_server"
+		])),
+		description: zod_mini.z.optional(zod_mini.z.string()),
+		instructions: zod_mini.z.optional(zod_mini.z.string()),
+		command: zod_mini.z.optional(zod_mini.z.string()),
+		args: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		env: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
+		agent_server: zod_mini.z.optional(zod_mini.z.string()),
+		session_config_options: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.unknown())),
+		inherit_agent_config: zod_mini.z.optional(zod_mini.z.boolean()),
+		disabled: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
 	vibe: zod_mini.z.optional(zod_mini.z.looseObject({
 		agent_type: zod_mini.z.optional(zod_mini.z.enum(["agent", "subagent"])),
 		display_name: zod_mini.z.optional(zod_mini.z.string()),
@@ -10430,6 +10584,17 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 		this.logger = logger;
 	}
 	/**
+	* Whether `convertRulesyncFilesToToolFiles` still yields tool files for an
+	* empty source list. A processor that aggregates into a shared file it may
+	* never delete (Pool's `settings.yaml` subagents) answers true so a run
+	* whose last source file is gone retracts what an earlier run generated;
+	* the default keeps a run with no source from writing anything. Consulted
+	* after `loadRulesyncFiles`, so the answer may depend on what that load saw.
+	*/
+	emitsToolFilesForEmptySource() {
+		return false;
+	}
+	/**
 	* Return tool targets that this feature supports.
 	*/
 	static getToolTargets(_params = {}) {
@@ -10444,6 +10609,11 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 		const changedPaths = [];
 		for (const aiFile of aiFiles) {
 			const filePath = aiFile.getFilePath();
+			if (await refusesWriteOutsideRoot({
+				logger: this.logger,
+				rootPath: aiFile.getOutputRoot(),
+				targetPath: filePath
+			})) continue;
 			const existingFileContent = await readFileContentOrNull(filePath);
 			if (existingFileContent !== null && aiFile.shouldMergeExistingFileContent()) aiFile.setFileContent(existingFileContent);
 			const contentWithNewline = addTrailingNewline(aiFile.getFileContent());
@@ -10576,6 +10746,37 @@ function mergeByIdentity({ perRoot, identity }) {
 	return order.map((key) => winnerByKey.get(key));
 }
 /**
+* Whether a write to `targetPath` has to be refused because a link on the way
+* there leads out of `rootPath`, warning about the refusal.
+*
+* A checked-out repository can carry a symbolic link at an output path
+* (`AGENTS.md -> ~/.bashrc`, a tool directory linked to `/etc`), and a write
+* through it would land wherever the link points. Every writer that lets the
+* OS follow links — file, directory, and config-rewrite alike — asks this first
+* so that one warning describes the one behavior.
+*/
+async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
+	if (!await writablePathEscapesRoot({
+		rootPath,
+		targetPath
+	})) return false;
+	logger.warn(`Refusing to write ${quoteForLog(targetPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	return true;
+}
+/**
+* {@link refusesWriteOutsideRoot} over every path a single unit of output
+* writes, stopping at the first refusal: a directory written as one unit is
+* held back whole when any one file in it would land outside the root.
+*/
+async function refusesAnyWriteOutsideRoot({ logger, rootPath, targetPaths }) {
+	for (const targetPath of targetPaths) if (await refusesWriteOutsideRoot({
+		logger,
+		rootPath,
+		targetPath
+	})) return true;
+	return false;
+}
+/**
 * The key two spellings share when a case-insensitive filesystem would give
 * them one file. `toLowerCase()` is locale-independent (unlike
 * `toLocaleLowerCase`, it does not turn `I` into the Turkish `ı` under a Turkish
@@ -13040,15 +13241,33 @@ const KIMI_CODE_CONFIG_DECLARATION = {
 * Pool settings (`.poolside/settings.yaml` / `~/.config/poolside/settings.yaml`):
 * the user's primary Pool settings file, so an unparseable root fails closed
 * rather than being replaced with generated output. `mcp_servers` is owned as
-* a whole key because the MCP writer emits the complete server map.
+* a whole key because the MCP writer emits the complete server map. The
+* permissions writer deep-merges: it rewrites the `allow`/`deny` lists of the
+* `tools.<name>` blocks it manages and the `paths` lists, leaving each tool's
+* `disabled` flag, unmanaged tools and every other key in place. `hooks` is
+* owned as a whole key because the hooks writer emits every event list.
+* `subagents` is owned as a whole key too: its writer recomputes the block
+* from the existing file (`default` and the built-in `general` agent carried
+* over, every other agent replaced) before applying the patch.
 */
 const POOL_SETTINGS_DECLARATION = {
 	format: "yaml",
 	invalidRootPolicy: "error",
-	features: { mcp: {
-		kind: "replace-owned-keys",
-		ownedKeys: ["mcp_servers"]
-	} }
+	features: {
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp_servers"]
+		},
+		permissions: { kind: "deep-merge" },
+		hooks: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["hooks"]
+		},
+		subagents: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["subagents"]
+		}
+	}
 };
 /**
 * ZCode's settings file, which also carries model/theme/permission keys
@@ -20443,6 +20662,11 @@ var CommandsProcessor = class extends FeatureProcessor {
 			global: this.global,
 			relativeFilePath: HERMESAGENT_CONFIG_FILE_PATH
 		}));
+		if (await refusesWriteOutsideRoot({
+			logger: this.logger,
+			rootPath: this.outputRoot,
+			targetPath: configPath
+		})) return changedCount;
 		const currentContent = await readFileContentOrNull(configPath);
 		if (currentContent === null) return changedCount;
 		const nextContent = getDisabledHermesCommandsPluginConfigContent({
@@ -20465,6 +20689,11 @@ var CommandsProcessor = class extends FeatureProcessor {
 		if (this.toolTarget !== "goose" || !this.global) return 0;
 		if (generatedFiles.some((file) => file instanceof GooseCommand)) return 0;
 		const configPath = (0, node_path.join)(this.outputRoot, GOOSE_GLOBAL_DIR, GOOSE_MCP_FILE_NAME);
+		if (await refusesWriteOutsideRoot({
+			logger: this.logger,
+			rootPath: this.outputRoot,
+			targetPath: configPath
+		})) return 0;
 		const currentContent = await readFileContentOrNull(configPath);
 		if (currentContent === null || !hasManagedGooseSlashCommands(currentContent)) return 0;
 		const nextContent = getGooseSlashCommandsConfigContent({
@@ -27564,6 +27793,302 @@ var PiHooks = class PiHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/constants/pool-paths.ts
+/**
+* Pool (Poolside's coding agent CLI) configuration-layout conventions.
+*
+* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
+* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
+* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
+* path), the project-root `AGENTS.md`, and nested per-directory
+* `AGENTS.md` files from the repository root down through the working
+* directory, deeper files taking precedence. It skips ignored directories
+* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
+*
+* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
+* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
+* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
+* the skill directories of other Agent Skills tools; rulesync writes only the
+* Pool-specific roots and leaves the shared ones to their own targets.
+*
+* @see https://docs.poolside.ai/agent-instructions
+* @see https://docs.poolside.ai/skills
+* @see https://github.com/poolsideai/pool
+*/
+/** Project-scoped `.poolside/` directory at the project root. */
+const POOL_DIR = ".poolside";
+/** Global config directory for Pool, relative to the home directory. */
+const POOL_GLOBAL_DIR = (0, node_path.join)(".config", "poolside");
+/** Project skills root, relative to the project root. */
+const POOL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_DIR, "skills");
+/** Global skills root, relative to the home directory. */
+const POOL_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_GLOBAL_DIR, "skills");
+/**
+* Pool's settings file name. MCP servers live under the top-level
+* `mcp_servers` key of `.poolside/settings.yaml` (project, committed) and
+* `~/.config/poolside/settings.yaml` (global); the untracked
+* `.poolside/settings.local.yaml` overlay is left to the user.
+*
+* @see https://docs.poolside.ai/mcp-servers
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+const POOL_SETTINGS_FILE_NAME = "settings.yaml";
+/** Pool's untracked per-user overlay next to the settings file; never written. */
+const POOL_SETTINGS_LOCAL_FILE_NAME = "settings.local.yaml";
+/** Top-level key of Pool's settings file that holds the MCP server map. */
+const POOL_MCP_SERVERS_KEY = "mcp_servers";
+/** Top-level key of Pool's settings file that holds per-tool permission rules. */
+const POOL_TOOLS_KEY = "tools";
+/** Top-level key of Pool's settings file that holds file access rules. */
+const POOL_PATHS_KEY = "paths";
+/** Top-level key of Pool's settings file that holds the per-event hook lists. */
+const POOL_HOOKS_KEY = "hooks";
+/**
+* Top-level key of Pool's settings file that holds the subagent registry:
+* `subagents.default` names the agent delegated to by default and
+* `subagents.agents.<name>` defines each agent.
+*
+* @see https://docs.poolside.ai/subagents
+*/
+const POOL_SUBAGENTS_KEY = "subagents";
+/** Key under `subagents` that holds the per-agent definitions. */
+const POOL_SUBAGENTS_AGENTS_KEY = "agents";
+/** Pool's reserved built-in agent, always `in_process` and never generated. */
+const POOL_GENERAL_AGENT_NAME = "general";
+//#endregion
+//#region src/features/hooks/pool-hooks.ts
+/** The matcher Pool reads as "any tool"; `""` means the same. */
+const POOL_MATCH_ALL = "*";
+const SUPPORTED_POOL_EVENTS = new Set(POOL_HOOK_EVENTS);
+/**
+* The Pool events that test `matcher` against a tool name. Pool ignores the
+* field on every other event (it stays required by the schema), so an
+* authored matcher there is dropped with a warning and `*` written instead.
+*/
+const POOL_MATCHER_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse"]);
+/**
+* Single spelling of the settings.yaml codec/policy, matching PoolMcp and
+* PoolPermissions: fail closed on an unparseable root rather than replacing
+* the user's primary Pool settings with generated output.
+*/
+function parsePoolSettings$3(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Build the `hooks` event lists of Pool's settings file from a canonical hooks
+* config. Pool keys a flat list of `{name, matcher, command, timeout}` entries
+* by event name. Only `type: "command"` canonical hooks are emitted, since a
+* Pool hook is a shell command. A shared canonical event Pool does not fire is
+* skipped (the HooksProcessor reports it), while an event under the
+* `pool.hooks` override — such as one an import filed there — is written
+* verbatim so it round-trips.
+*/
+function canonicalToPoolHooks({ config, toolOverride, logger }) {
+	const sharedHooks = {};
+	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_POOL_EVENTS.has(event)) sharedHooks[event] = defs;
+	const effective = {
+		...sharedHooks,
+		...toolOverride
+	};
+	const hooks = {};
+	for (const [event, defs] of Object.entries(effective)) {
+		if (isPrototypePollutionKey(event)) continue;
+		const poolEvent = lookupOwn({
+			record: CANONICAL_TO_POOL_EVENT_NAMES,
+			key: event
+		}) ?? event;
+		const entries = [];
+		for (const def of defs) {
+			const entry = canonicalDefToPoolEntry({
+				def,
+				event,
+				poolEvent,
+				logger
+			});
+			if (entry !== null) entries.push(entry);
+		}
+		if (entries.length > 0) hooks[poolEvent] = entries;
+	}
+	return hooks;
+}
+/** Convert one canonical hook definition to a Pool entry, or null to skip. */
+function canonicalDefToPoolEntry({ def, event, poolEvent, logger }) {
+	if ((def.type ?? "command") !== "command") return null;
+	if (typeof def.command !== "string" || def.command === "") {
+		logger?.warn(`Pool hook ${quoteValueForWarning(def.name ?? "")} under "${event}" has no "command", which Pool would reject, so it was skipped.`);
+		return null;
+	}
+	const authoredMatcher = typeof def.matcher === "string" && def.matcher !== "" ? def.matcher : POOL_MATCH_ALL;
+	let matcher = authoredMatcher;
+	if (!POOL_MATCHER_EVENTS.has(poolEvent) && authoredMatcher !== POOL_MATCH_ALL) {
+		logger?.warn(`Pool ignores "matcher" on "${poolEvent}", so the matcher ${quoteValueForWarning(authoredMatcher)} of the hook ${quoteValueForWarning(def.name ?? def.command)} under "${event}" was dropped.`);
+		matcher = POOL_MATCH_ALL;
+	}
+	const entry = {
+		...typeof def.name === "string" && def.name !== "" ? { name: def.name } : {},
+		matcher,
+		command: def.command
+	};
+	if (typeof def.timeout === "number") entry.timeout = Math.ceil(def.timeout);
+	return entry;
+}
+/** Convert one raw hook entry to a canonical definition, or null to skip. */
+function poolEntryToCanonicalDef({ raw, poolEvent }) {
+	if (!isRecord$1(raw) || typeof raw.command !== "string" || raw.command === "") return null;
+	const def = {
+		type: "command",
+		command: raw.command
+	};
+	if (typeof raw.name === "string" && raw.name !== "") def.name = raw.name;
+	if (POOL_MATCHER_EVENTS.has(poolEvent) && typeof raw.matcher === "string" && raw.matcher !== "" && raw.matcher !== POOL_MATCH_ALL) def.matcher = raw.matcher;
+	if (typeof raw.timeout === "number") def.timeout = raw.timeout;
+	return def;
+}
+/**
+* Reverse {@link canonicalToPoolHooks}: parse the event lists of the `hooks`
+* block back into a canonical event → definition[] record. An event Pool does
+* not document is carried under its own name so `buildImportedHooksConfig`
+* files it under the `pool.hooks` override; a non-list sibling such as
+* `stop_hook_max_continuations` is not a hook and is left alone.
+*/
+function poolHooksToCanonical(hooksBlock) {
+	const canonical = {};
+	if (!isRecord$1(hooksBlock)) return canonical;
+	for (const [poolEvent, rawEntries] of Object.entries(hooksBlock)) {
+		if (isPrototypePollutionKey(poolEvent) || !Array.isArray(rawEntries)) continue;
+		const canonicalEvent = lookupOwn({
+			record: POOL_TO_CANONICAL_EVENT_NAMES,
+			key: poolEvent
+		}) ?? poolEvent;
+		const defs = rawEntries.map((raw) => poolEntryToCanonicalDef({
+			raw,
+			poolEvent
+		})).filter((def) => def !== null);
+		if (defs.length === 0) continue;
+		canonical[canonicalEvent] = [...lookupOwn({
+			record: canonical,
+			key: canonicalEvent
+		}) ?? [], ...defs];
+	}
+	return canonical;
+}
+/**
+* The keys of an existing `hooks` block that are not event lists —
+* `stop_hook_max_continuations` and anything else Pool may add beside the
+* events — which survive a regenerate untouched.
+*/
+function nonEventHookKeys(hooksBlock) {
+	const kept = {};
+	if (!isRecord$1(hooksBlock)) return kept;
+	for (const [key, value] of Object.entries(hooksBlock)) if (!isPrototypePollutionKey(key) && !Array.isArray(value)) kept[key] = value;
+	return kept;
+}
+/**
+* Pool hooks.
+*
+* Pool reads hooks from the `hooks` key of its settings file —
+* `.poolside/settings.yaml` at project scope and
+* `~/.config/poolside/settings.yaml` at user scope — as
+* `hooks.<Event>: [{name?, matcher, command, timeout?}]` for `PreToolUse`,
+* `PostToolUse`, `UserPromptSubmit`, `PreCompact`, `SessionStart` and `Stop`.
+* The event lists are rewritten as a whole; the block's non-list sibling
+* `stop_hook_max_continuations` and every other top-level key of the file
+* (`mcp_servers`, `tools`, `paths`, `pool`, ...) are preserved, and the file
+* is never deleted.
+*
+* @see https://docs.poolside.ai/hooks
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolHooks = class PoolHooks extends ToolHooks {
+	settings;
+	constructor(params) {
+		super(params);
+		this.settings = parsePoolSettings$3(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getSettings() {
+		return this.settings;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new PoolHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parsePoolSettings$3(existingContent, filePath);
+		const config = rulesyncHooks.getJson();
+		const hooks = canonicalToPoolHooks({
+			config,
+			toolOverride: config.pool?.hooks,
+			logger
+		});
+		return new PoolHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "hooks",
+				existingContent,
+				patch: { [POOL_HOOKS_KEY]: {
+					...nonEventHookKeys(existing[POOL_HOOKS_KEY]),
+					...hooks
+				} },
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncHooks() {
+		const hooks = poolHooksToCanonical(this.settings[POOL_HOOKS_KEY]);
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+			hooks,
+			overrideKey: "pool"
+		}), null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new PoolHooks({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/hooks/qwencode-hooks.ts
 /**
 * Build a single Qwen Code hook object from a canonical hook definition.
@@ -28677,14 +29202,15 @@ const HooksProcessorToolTargetSchema = zod_mini.z.enum(hooksProcessorToolTargetT
 /**
 * Event names present in the config that the target's adapter cannot emit.
 *
-* When the factory passes override-block keys through verbatim
-* (`passthroughOverrideEvents`), those keys are excluded from the check so
-* documented passthrough triggers aren't falsely reported as skipped.
+* Shared (`hooks`) keys are always checked. Override-block keys are only
+* checked when the factory declares `dropsUnknownOverrideEvents`; otherwise
+* the adapter either emits them verbatim or reports its own drops, and a
+* generic "not supported" warning would be wrong or duplicated.
 */
 function unsupportedEventNames(params) {
 	const { factory, sharedHooks, effectiveHooks } = params;
 	const supportedEvents = new Set(factory.supportedEvents);
-	const eventNames = factory.passthroughOverrideEvents ? Object.keys(sharedHooks) : Object.keys(effectiveHooks);
+	const eventNames = factory.dropsUnknownOverrideEvents ? Object.keys(effectiveHooks) : Object.keys(sharedHooks);
 	return [...new Set(eventNames)].filter((e) => !supportedEvents.has(e));
 }
 /**
@@ -28777,7 +29303,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedEvents: AMP_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
 		supportsMatcher: true,
-		matcherEvents: ["preToolUse", "postToolUse"]
+		matcherEvents: ["preToolUse", "postToolUse"],
+		dropsUnknownOverrideEvents: true
 	}],
 	["antigravity-cli", {
 		class: AntigravityCliHooks,
@@ -28810,7 +29337,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: ANTIGRAVITY_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["cursor", {
 		class: CursorHooks,
@@ -28855,7 +29383,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			"mcp_tool",
 			"agent"
 		],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["codexcli", {
 		class: CodexcliHooks,
@@ -28916,7 +29445,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedEvents: KILO_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
 		supportsMatcher: true,
-		matcherEvents: ["preToolUse", "postToolUse"]
+		matcherEvents: ["preToolUse", "postToolUse"],
+		dropsUnknownOverrideEvents: true
 	}],
 	["opencode", {
 		class: OpencodeHooks,
@@ -28928,7 +29458,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedEvents: OPENCODE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
 		supportsMatcher: true,
-		matcherEvents: ["preToolUse", "postToolUse"]
+		matcherEvents: ["preToolUse", "postToolUse"],
+		dropsUnknownOverrideEvents: true
 	}],
 	["pi", {
 		class: PiHooks,
@@ -28939,7 +29470,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: PI_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["factorydroid", {
 		class: FactorydroidHooks,
@@ -28961,7 +29493,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: CLINE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: false,
+		dropsUnknownOverrideEvents: true
 	}],
 	["goose", {
 		class: GooseHooks,
@@ -28983,8 +29516,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: HERMESAGENT_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["kimi-code", {
 		class: KimiCodeHooks,
@@ -28995,8 +29527,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIMI_CODE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["deepagents", {
 		class: DeepagentsHooks,
@@ -29007,7 +29538,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: DEEPAGENTS_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["kiro", {
 		class: KiroHooks,
@@ -29018,8 +29550,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["kiro-cli", {
 		class: KiroCliHooks,
@@ -29030,8 +29561,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_IDE_HOOK_EVENTS,
 		supportedHookTypes: ["command", "prompt"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["kiro-ide", {
 		class: KiroIdeHooks,
@@ -29042,8 +29572,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_IDE_HOOK_EVENTS,
 		supportedHookTypes: ["command", "prompt"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["devin", {
 		class: DevinHooks,
@@ -29161,6 +29690,18 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: VIBE_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
+	}],
+	["pool", {
+		class: PoolHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: POOL_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
 		supportsMatcher: true
 	}],
 	["qwencode", {
@@ -29188,7 +29729,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: REASONIX_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		dropsUnknownOverrideEvents: true
 	}],
 	["grokcli", {
 		class: GrokcliHooks,
@@ -29210,8 +29752,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: CRUSH_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true,
-		passthroughOverrideEvents: true
+		supportsMatcher: true
 	}],
 	["zcode", {
 		class: ZcodeHooks,
@@ -37142,49 +37683,6 @@ var OpencodeMcp = class OpencodeMcp extends ToolMcp {
 	}
 };
 //#endregion
-//#region src/constants/pool-paths.ts
-/**
-* Pool (Poolside's coding agent CLI) configuration-layout conventions.
-*
-* Pool reads `AGENTS.md` instruction files the same way the AGENTS.md standard
-* describes them: the personal `~/.config/poolside/AGENTS.md` (Pool itself
-* honours `XDG_CONFIG_HOME` upstream; rulesync writes only the XDG-default
-* path), the project-root `AGENTS.md`, and nested per-directory
-* `AGENTS.md` files from the repository root down through the working
-* directory, deeper files taking precedence. It skips ignored directories
-* (`.git/`, `node_modules/`, cache directories, repository ignore rules).
-*
-* Skills follow the Agent Skills format (`<name>/SKILL.md` bundles). Pool
-* scans `.poolside/skills/` (project) and `~/.config/poolside/skills/`
-* (global) plus the shared `.agents/skills/` / `~/.agents/skills/` roots and
-* the skill directories of other Agent Skills tools; rulesync writes only the
-* Pool-specific roots and leaves the shared ones to their own targets.
-*
-* @see https://docs.poolside.ai/agent-instructions
-* @see https://docs.poolside.ai/skills
-* @see https://github.com/poolsideai/pool
-*/
-/** Project-scoped `.poolside/` directory at the project root. */
-const POOL_DIR = ".poolside";
-/** Global config directory for Pool, relative to the home directory. */
-const POOL_GLOBAL_DIR = (0, node_path.join)(".config", "poolside");
-/** Project skills root, relative to the project root. */
-const POOL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_DIR, "skills");
-/** Global skills root, relative to the home directory. */
-const POOL_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(POOL_GLOBAL_DIR, "skills");
-/**
-* Pool's settings file name. MCP servers live under the top-level
-* `mcp_servers` key of `.poolside/settings.yaml` (project, committed) and
-* `~/.config/poolside/settings.yaml` (global); the untracked
-* `.poolside/settings.local.yaml` overlay is left to the user.
-*
-* @see https://docs.poolside.ai/mcp-servers
-* @see https://docs.poolside.ai/settings-file-reference
-*/
-const POOL_SETTINGS_FILE_NAME = "settings.yaml";
-/** Top-level key of Pool's settings file that holds the MCP server map. */
-const POOL_MCP_SERVERS_KEY = "mcp_servers";
-//#endregion
 //#region src/features/mcp/pool-mcp.ts
 /**
 * Single spelling of the settings.yaml codec/policy, matching the
@@ -37192,7 +37690,7 @@ const POOL_MCP_SERVERS_KEY = "mcp_servers";
 * unparseable root rather than replacing the user's primary Pool settings with
 * generated output.
 */
-function parsePoolSettings(fileContent, filePath) {
+function parsePoolSettings$2(fileContent, filePath) {
 	return parseSharedConfig({
 		format: "yaml",
 		fileContent,
@@ -37424,7 +37922,7 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 	settings;
 	constructor(params) {
 		super(params);
-		this.settings = parsePoolSettings(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+		this.settings = parsePoolSettings$2(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
 	}
 	getSettings() {
 		return this.settings;
@@ -41268,7 +41766,7 @@ const ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES = {
 function toAntigravityCliToolName(canonical) {
 	return CANONICAL_TO_ANTIGRAVITY_CLI_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$8(cliName) {
+function toCanonicalToolName$9(cliName) {
 	return ANTIGRAVITY_CLI_TO_CANONICAL_TOOL_NAMES[cliName] ?? cliName;
 }
 /**
@@ -41484,7 +41982,7 @@ function convertAntigravityCliToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parsePermissionEntry$1(entry);
-			const canonical = toCanonicalToolName$8(toolName);
+			const canonical = toCanonicalToolName$9(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -41763,7 +42261,7 @@ function toLegacyAugmentToolName(augmentName) {
 		key: augmentName
 	}) ?? augmentName;
 }
-function toCanonicalToolName$7(augmentName) {
+function toCanonicalToolName$8(augmentName) {
 	const legacyName = toLegacyAugmentToolName(augmentName);
 	return lookupOwn({
 		record: AUGMENT_TO_CANONICAL_TOOL_NAMES,
@@ -42216,7 +42714,7 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		const type = entry.permission.type;
 		if (!isBasicAugmentType(type)) continue;
 		const legacyToolName = toLegacyAugmentToolName(entry.toolName);
-		const canonical = toCanonicalToolName$7(entry.toolName);
+		const canonical = toCanonicalToolName$8(entry.toolName);
 		if (forbiddenMapKeys.has(canonical)) {
 			logger?.warn(`AugmentCode permissions: skipping entry for tool '${entry.toolName}' because it maps to the reserved object key '${canonical}', which cannot be used as a permission key.`);
 			continue;
@@ -42461,7 +42959,7 @@ const CLAUDE_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONIC
 function toClaudeToolName(canonical) {
 	return CANONICAL_TO_CLAUDE_TOOL_NAMES[canonical] ?? canonical;
 }
-function toCanonicalToolName$6(claudeName) {
+function toCanonicalToolName$7(claudeName) {
 	return CLAUDE_TO_CANONICAL_TOOL_NAMES[claudeName] ?? claudeName;
 }
 /**
@@ -43375,7 +43873,7 @@ function convertClaudeToRulesyncPermissions(params) {
 	const processEntries = (entries, action) => {
 		for (const entry of entries) {
 			const { toolName, pattern } = parseClaudePermissionEntry(entry);
-			const canonical = toCanonicalToolName$6(toolName);
+			const canonical = toCanonicalToolName$7(toolName);
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -44236,8 +44734,8 @@ function mapBashActionToDecision(action) {
 //#region src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$6 = "*";
-const MCP_CANONICAL_PREFIX$5 = "mcp__";
+const CATCH_ALL_PATTERN$7 = "*";
+const MCP_CANONICAL_PREFIX$6 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
 	bash: "Shell",
@@ -44291,10 +44789,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$6 || pattern === "";
-	if (category.startsWith(MCP_CANONICAL_PREFIX$5)) return catchAll ? category : `${category}(${pattern})`;
-	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$5}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$6 : null;
+	const catchAll = pattern === CATCH_ALL_PATTERN$7 || pattern === "";
+	if (category.startsWith(MCP_CANONICAL_PREFIX$6)) return catchAll ? category : `${category}(${pattern})`;
+	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$6}${pattern}`;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$7 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -44330,7 +44828,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$6;
+	return inner === "" || inner === CATCH_ALL_PATTERN$7;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -44364,34 +44862,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: true
 	};
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$5)) {
-		if (server === CATCH_ALL_PATTERN$6) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$6)) return null;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$6)) {
+		if (server === CATCH_ALL_PATTERN$7) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$7)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$6 ? `${MCP_CANONICAL_PREFIX$5}${server}` : `${MCP_CANONICAL_PREFIX$5}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$6,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$7 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$7,
 			notInAllow: false
 		};
 	}
-	const category = `${MCP_CANONICAL_PREFIX$5}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$6);
+	const category = `${MCP_CANONICAL_PREFIX$6}${remainder}`;
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$7);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$6) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$6 && !server.includes(CATCH_ALL_PATTERN$6)) return {
-		category: `${MCP_CANONICAL_PREFIX$5}${server}`,
-		pattern: CATCH_ALL_PATTERN$6,
+	if (remainder === CATCH_ALL_PATTERN$7) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$7 && !server.includes(CATCH_ALL_PATTERN$7)) return {
+		category: `${MCP_CANONICAL_PREFIX$6}${server}`,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: false
 	} : null;
 }
@@ -44415,14 +44913,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$6,
+			pattern: CATCH_ALL_PATTERN$7,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$6,
+			pattern: CATCH_ALL_PATTERN$7,
 			notInAllow: true
 		} : {
 			category,
@@ -44432,7 +44930,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -44451,13 +44949,13 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$6) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$7) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
-	if (lowered.startsWith(MCP_CANONICAL_PREFIX$5)) return parseMcpCommandcodeRule({
+	if (lowered.startsWith(MCP_CANONICAL_PREFIX$6)) return parseMcpCommandcodeRule({
 		tool,
 		inner
 	});
@@ -44475,12 +44973,12 @@ function parseCommandcodeRule(rule) {
 */
 function isFoldedMcpToolNameRule({ rule, category }) {
 	const { tool } = splitCommandcodeRule(rule);
-	return category.startsWith(MCP_CANONICAL_PREFIX$5) && !tool.startsWith(MCP_CANONICAL_PREFIX$5);
+	return category.startsWith(MCP_CANONICAL_PREFIX$6) && !tool.startsWith(MCP_CANONICAL_PREFIX$6);
 }
 /** The `Tool` half of `Tool(specifier)`, when the rule is an exact-prefix MCP rule with a specifier. */
 function scopedMcpRuleTool(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$5) ? tool : null;
+	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$6) ? tool : null;
 }
 /**
 * The string entries of a Command Code permission list. Command Code reads
@@ -44523,7 +45021,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$6})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$7})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -44580,7 +45078,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$6);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$7);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -44649,7 +45147,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 function skippedAllowImportMessage({ rule, category }) {
 	const { tool, inner } = splitCommandcodeRule(rule);
 	if (category === "bash") return `Command Code reads '${rule}' in "allow" as ${PADDED_SHELL_WILDCARD_REASON}, which rulesync cannot import without widening the grant to every command, so it was not imported.`;
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$5) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$6) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
 	return `Command Code globs the specifier of '${rule}' in "allow" against the call's arguments, which rulesync cannot import without widening the grant to the whole tool, so it was not imported.`;
 }
 /**
@@ -44851,7 +45349,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$5 = "*";
+const CATCH_ALL_PATTERN$6 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -44859,7 +45357,7 @@ const CATCH_ALL_PATTERN$5 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$6 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -44888,7 +45386,7 @@ const CONTINUE_PATTERN_RE = /^([^(]+)(?:\(([^)]*)\))?$/;
 function toContinueToolName(canonical) {
 	return Object.hasOwn(CANONICAL_TO_CONTINUE_TOOL_NAMES, canonical) ? CANONICAL_TO_CONTINUE_TOOL_NAMES[canonical] ?? canonical : canonical;
 }
-function toCanonicalToolName$5(continueName) {
+function toCanonicalToolName$6(continueName) {
 	return Object.hasOwn(CONTINUE_TO_CANONICAL_TOOL_NAMES, continueName) ? CONTINUE_TO_CANONICAL_TOOL_NAMES[continueName] ?? continueName : continueName;
 }
 /**
@@ -44896,7 +45394,7 @@ function toCanonicalToolName$5(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$5 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$6 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -44910,7 +45408,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$5 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$6 : pattern
 	};
 }
 /**
@@ -45084,7 +45582,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$5) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$6) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -45109,7 +45607,7 @@ function convertContinuePermissionsToRulesync(lists) {
 			const parsedEntry = parseContinuePermissionEntry(entry);
 			if (parsedEntry === void 0) continue;
 			if (isPrototypePollutionKey(parsedEntry.toolName) || isPrototypePollutionKey(parsedEntry.pattern)) continue;
-			const category = toCanonicalToolName$5(parsedEntry.toolName);
+			const category = toCanonicalToolName$6(parsedEntry.toolName);
 			permission[category] ??= {};
 			permission[category][parsedEntry.pattern] ??= action;
 		}
@@ -45433,14 +45931,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 };
 //#endregion
 //#region src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$4 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$5 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -45452,20 +45950,20 @@ const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	webfetch: "fetch"
 };
 const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
-const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const MCP_CANONICAL_PREFIX$5 = "mcp__";
 const MCP_CRUSH_PREFIX = "mcp_";
 function toCrushToolName(canonical) {
 	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
-	if (canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$5) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
 	return canonical;
 }
-function toCanonicalToolName$4(crushName) {
+function toCanonicalToolName$5(crushName) {
 	return Object.hasOwn(CRUSH_TO_CANONICAL_TOOL_NAMES, crushName) ? CRUSH_TO_CANONICAL_TOOL_NAMES[crushName] ?? crushName : crushName;
 }
 function isMcpToolName(crushName) {
 	return crushName.startsWith(MCP_CRUSH_PREFIX) && crushName.length > 4;
 }
-function uniq$9(values) {
+function uniq$10(values) {
 	return [...new Set(values)];
 }
 /**
@@ -45571,8 +46069,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 		const managedToolNames = managedCrushToolNames(config);
 		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
 		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
-		const allowedList = uniq$9([...preservedAllowed, ...generated.allowed]);
-		const disabledList = uniq$9([...preservedDisabled, ...generated.disabled]);
+		const allowedList = uniq$10([...preservedAllowed, ...generated.allowed]);
+		const disabledList = uniq$10([...preservedDisabled, ...generated.disabled]);
 		const patch = {};
 		if (allowedList.length > 0 || existingPermissions !== void 0) patch[CRUSH_PERMISSIONS_KEY] = { [CRUSH_ALLOWED_TOOLS_KEY]: allowedList.length > 0 ? allowedList : void 0 };
 		if (disabledList.length > 0 || existingOptions !== void 0) patch[CRUSH_OPTIONS_KEY] = { [CRUSH_DISABLED_TOOLS_KEY]: disabledList.length > 0 ? disabledList : void 0 };
@@ -45639,7 +46137,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$4) {
+		if (pattern === CATCH_ALL_PATTERN$5) {
 			catchAllAction = action;
 			continue;
 		}
@@ -45689,8 +46187,8 @@ function convertRulesyncToCrushLists({ config, logger }) {
 		else if (catchAllAction === "deny") lists.disabled.push(toolName);
 	}
 	return {
-		allowed: uniq$9(lists.allowed),
-		disabled: uniq$9(lists.disabled)
+		allowed: uniq$10(lists.allowed),
+		disabled: uniq$10(lists.disabled)
 	};
 }
 /**
@@ -45712,11 +46210,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$5] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$4(entry))[CATCH_ALL_PATTERN$4] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$5] ??= "allow";
 	}
 	return { permission };
 }
@@ -45763,13 +46261,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX$3 = "mcp__";
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX$3) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$4) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -45803,7 +46301,7 @@ function toCanonicalCategory$1(cursorType, pattern) {
 		if (match) {
 			const server = match[1] ?? "*";
 			const tool = match[2] ?? "*";
-			return `${MCP_CANONICAL_PREFIX$3}${server}__${tool}`;
+			return `${MCP_CANONICAL_PREFIX$4}${server}__${tool}`;
 		}
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
@@ -46096,7 +46594,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$3) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$4) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -47615,7 +48113,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 //#region src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$3 = "*";
+const CATCH_ALL_PATTERN$4 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = {
 	bash: "developer__shell",
 	edit: "developer__text_editor",
@@ -47777,7 +48275,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	for (const [category, rules] of orderedEntries) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
-			if (pattern !== CATCH_ALL_PATTERN$3) {
+			if (pattern !== CATCH_ALL_PATTERN$4) {
 				logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 				continue;
 			}
@@ -47806,7 +48304,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		for (const toolName of toolNames) {
 			const category = GOOSE_TO_RULESYNC_TOOL_NAME[toolName] ?? toolName;
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$3] = action;
+			permission[category][CATCH_ALL_PATTERN$4] = action;
 		}
 	}
 	return { permission };
@@ -47817,8 +48315,8 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$2 = "*";
-const MCP_CANONICAL_PREFIX$2 = "mcp__";
+const CATCH_ALL_PATTERN$3 = "*";
+const MCP_CANONICAL_PREFIX$3 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
 	read: "Read",
@@ -47859,14 +48357,14 @@ const GROKCLI_PERMISSION_RULES_KEY = "rules";
 * concrete pattern emits `Tool(pattern)`.
 */
 function buildGrokEntry(category, pattern) {
-	if (category.startsWith(MCP_CANONICAL_PREFIX$2)) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX$3)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$3 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$2 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$3 || pattern === "" ? tool : `${tool}(${pattern})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
@@ -47886,17 +48384,17 @@ function parseGrokEntry(entry) {
 		inner = trimmed.slice(parenIndex + 1, -1).trim();
 	}
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
-		category: `${MCP_CANONICAL_PREFIX$2}${inner}`,
-		pattern: CATCH_ALL_PATTERN$2
+		category: `${MCP_CANONICAL_PREFIX$3}${inner}`,
+		pattern: CATCH_ALL_PATTERN$3
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$2
+		pattern: CATCH_ALL_PATTERN$3
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$2
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$3
 	};
 }
 /**
@@ -47917,15 +48415,15 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$2;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$3;
 	const lowerTool = tool.trim().toLowerCase();
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$2 ? {
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$3 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$2,
+		pattern: CATCH_ALL_PATTERN$3,
 		action
 	} : {
-		category: `${MCP_CANONICAL_PREFIX$2}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$2,
+		category: `${MCP_CANONICAL_PREFIX$3}${resolvedPattern}`,
+		pattern: CATCH_ALL_PATTERN$3,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -48073,7 +48571,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$3]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -49953,6 +50451,567 @@ var PiPermissions = class PiPermissions extends ToolPermissions {
 	}
 };
 //#endregion
+//#region src/features/permissions/pool-permissions.ts
+const POOL_ALLOW_KEY = "allow";
+const POOL_DENY_KEY = "deny";
+const POOL_DISABLED_KEY = "disabled";
+const POOL_PATH_KEY = "path";
+const POOL_WRITE_KEY = "write";
+const CATCH_ALL_PATTERN$2 = "*";
+const PATHS_CATCH_ALL_PATTERN = "**";
+const CANONICAL_TO_POOL_TOOL_NAMES = {
+	bash: "shell",
+	webfetch: "web_fetch",
+	websearch: "web_search"
+};
+const POOL_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_POOL_TOOL_NAMES).map(([k, v]) => [v, k]));
+const READ_CATEGORY = "read";
+const WRITE_CATEGORIES = ["edit", "write"];
+const FILE_CATEGORIES = [READ_CATEGORY, ...WRITE_CATEGORIES];
+const MCP_CANONICAL_PREFIX$2 = "mcp__";
+/**
+* Single spelling of the settings.yaml codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for both scopes: fail closed on an
+* unparseable root rather than replacing the user's primary Pool settings with
+* generated output.
+*/
+function parsePoolSettings$1(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+function toPoolToolName(canonical) {
+	return lookupOwn({
+		record: CANONICAL_TO_POOL_TOOL_NAMES,
+		key: canonical
+	}) ?? canonical;
+}
+function toCanonicalToolName$4(poolName) {
+	return lookupOwn({
+		record: POOL_TO_CANONICAL_TOOL_NAMES,
+		key: poolName
+	}) ?? poolName;
+}
+function isMcpCategory(category) {
+	return category.startsWith(MCP_CANONICAL_PREFIX$2) && category.length > 5;
+}
+function isFileCategory(category) {
+	return FILE_CATEGORIES.includes(category);
+}
+/**
+* Pool's tool rules know one wildcard, `*`, which matches anything including
+* `/` — the same set a canonical `*` names — so a `**` run is collapsed to
+* keep the file in Pool's own spelling. `?`, `[...]` and `{a,b}` are literal
+* characters to Pool, so a pattern that relies on them cannot be written.
+*/
+function toPoolToolPattern(pattern) {
+	if (/[?[{]/.test(pattern)) return void 0;
+	return pattern.replaceAll(/\*{2,}/g, "*");
+}
+/**
+* Pool's path globs know `*` and `**`, so a bare `*` run is written as `**`
+* to keep it matching anything. `?`, `[...]` and `{a,b}` are literal
+* characters to Pool here as well, so a pattern that relies on them cannot be
+* written.
+*/
+function toPoolPathPattern(pattern) {
+	if (/[?[{]/.test(pattern)) return void 0;
+	return /^\*+$/.test(pattern) ? PATHS_CATCH_ALL_PATTERN : pattern;
+}
+function isHomeOrAbsolutePath(pattern) {
+	return (0, node_path.isAbsolute)(pattern) || pattern === "~" || pattern.startsWith("~/");
+}
+function rulesOf(permission, category) {
+	return lookupOwn({
+		record: permission,
+		key: category
+	}) ?? {};
+}
+function patternsWithAction(rules, actions) {
+	return Object.entries(rules).filter(([pattern, action]) => !isPrototypePollutionKey(pattern) && actions.includes(action)).map(([pattern]) => pattern);
+}
+function asRestrictions(patterns) {
+	return (0, es_toolkit.uniq)(patterns).map((pattern) => ({
+		pattern,
+		fromAllToolsCategory: false
+	}));
+}
+function listPatterns(patterns) {
+	return patterns.map((pattern) => quoteValueForWarning(pattern)).join(", ");
+}
+/**
+* Permissions adapter for Pool (Poolside's coding agent CLI).
+*
+* Pool keeps its permission rules in the same YAML settings file as its MCP
+* servers — `.poolside/settings.yaml` (project) / `~/.config/poolside/settings.yaml`
+* (global) — under two top-level keys:
+*   - `tools.<name>`: `allow` and `deny` pattern lists matched against the
+*     tool's argument (the command for `shell`, the URL for `web_fetch`, ...),
+*     plus `disabled: true` to remove the tool. A denied pattern wins over an
+*     allowed one; a call that matches neither prompts. Only `*` is a wildcard.
+*   - `paths`: `allow` entries (`{ path }`, read-only unless `write: true`)
+*     and `deny` entries (`{ path }`) with `*`/`**` globs; deny wins.
+*
+* Mapping (rulesync canonical -> Pool):
+*   - `bash` -> `tools.shell`, `webfetch` -> `tools.web_fetch`,
+*     `websearch` -> `tools.web_search`; any other non-file category passes
+*     through as `tools.<category>`. `allow` -> `allow`, `deny` -> `deny`,
+*     `ask` -> nothing (prompting is Pool's default) — but an `allow` that
+*     overlaps an `ask` of any category landing on the same Pool tool, or a
+*     deny Pool cannot spell, is withheld, since an allowed pattern would
+*     silence the prompt the config asks for.
+*   - `read` / `edit` / `write` -> `paths`: a `read` allow is a read-only
+*     entry, an `edit` or `write` allow adds `write: true`, a `read` deny is a
+*     deny entry. Pool cannot deny writes without denying reads, so an
+*     `edit`/`write` deny that is not also a `read` deny only withholds the
+*     write flag of the entries it overlaps (Pool prompts for those writes).
+*   - `mcp__<server>__<tool>` is skipped: Pool approves MCP tools per server
+*     under `mcp_servers.<server>.allow`, authored as `poolAllow` in
+*     `.rulesync/mcp.json`. The all-tools `*` category is mirrored onto
+*     `bash` by `honorAllToolsOnBash` and otherwise skipped.
+*
+* Project settings take project-relative paths and the user settings absolute
+* or `~` paths, so a path of the other kind is skipped with a warning at each
+* scope. The managed tools' `allow`/`deny` lists and, whenever the canonical
+* config carries a file category, the `paths` lists are rebuilt; every other
+* key (`disabled`, unmanaged tools, `mcp_servers`, `pool`, `sandbox`, ...) is
+* kept, and the file is never deleted.
+*
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolPermissions = class PoolPermissions extends ToolPermissions {
+	settings;
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+		this.settings = parsePoolSettings$1(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getSettings() {
+		return this.settings;
+	}
+	isDeletable() {
+		return false;
+	}
+	/**
+	* settings.yaml is Pool's file: rulesync merges into it when it exists but
+	* does not create one that holds nothing of its own — an absent file and an
+	* absent rule both mean "prompt".
+	*/
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new PoolPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parsePoolSettings$1(existingContent, filePath);
+		const patch = buildPoolPermissionsPatch({
+			config: rulesyncPermissions.getJson(),
+			existing,
+			global,
+			logger
+		});
+		return new PoolPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath,
+				logger
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const rulesyncConfig = convertPoolToRulesync({
+			tools: isRecord$1(this.settings["tools"]) ? this.settings[POOL_TOOLS_KEY] : {},
+			paths: isRecord$1(this.settings["paths"]) ? this.settings[POOL_PATHS_KEY] : {}
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new PoolPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* The deep-merge patch that rewrites the managed `tools.<name>` lists and,
+* when the canonical config carries a file category, the `paths` lists. An
+* empty list retracts its key (`undefined` deletes under deep-merge), and a
+* block is only touched when there is something to write into it or it
+* already exists, so a config without rules does not grow an empty
+* `tools: {}` / `paths: {}`.
+*/
+function buildPoolPermissionsPatch({ config, existing, global, logger }) {
+	const permission = honorAllToolsOnBash(config.permission);
+	const existingTools = isRecord$1(existing["tools"]) ? existing[POOL_TOOLS_KEY] : void 0;
+	const existingPaths = isRecord$1(existing["paths"]) ? existing[POOL_PATHS_KEY] : void 0;
+	const patch = {};
+	const toolsPatch = {};
+	for (const [toolName, lists] of convertRulesyncToPoolTools({
+		permission,
+		logger
+	})) {
+		const existingTool = existingTools === void 0 ? void 0 : lookupOwn({
+			record: existingTools,
+			key: toolName
+		});
+		if (lists.allow.length === 0 && lists.deny.length === 0 && existingTool === void 0) continue;
+		toolsPatch[toolName] = {
+			[POOL_ALLOW_KEY]: lists.allow.length > 0 ? lists.allow : void 0,
+			[POOL_DENY_KEY]: lists.deny.length > 0 ? lists.deny : void 0
+		};
+	}
+	if (Object.keys(toolsPatch).length > 0) patch[POOL_TOOLS_KEY] = toolsPatch;
+	if (FILE_CATEGORIES.some((category) => lookupOwn({
+		record: permission,
+		key: category
+	}))) {
+		const lists = convertRulesyncToPoolPaths({
+			permission,
+			global,
+			logger
+		});
+		if (lists.allow.length > 0 || lists.deny.length > 0 || existingPaths !== void 0) patch[POOL_PATHS_KEY] = {
+			[POOL_ALLOW_KEY]: lists.allow.length > 0 ? lists.allow : void 0,
+			[POOL_DENY_KEY]: lists.deny.length > 0 ? lists.deny : void 0
+		};
+	}
+	return patch;
+}
+/**
+* Convert one non-file category into a Pool tool's `allow`/`deny` lists. A
+* deny Pool can spell needs no withholding (Pool lets it win over an allow),
+* but an `ask` has no list of its own — a call Pool does not match prompts —
+* so an allow that overlaps one is withheld and reported, and the tool keeps
+* prompting. A deny Pool cannot spell (its pattern uses a glob form other
+* than `*`) is skipped, and then withholds the allows it overlaps the same
+* way: written, such an allow would auto-approve the very command the deny
+* was meant to stop. `restrictions` carries the ask patterns and the skipped
+* deny patterns of every category that lands on the same Pool tool, because
+* Pool matches the joined lists as one.
+*/
+function convertToolCategory({ category, toolName, rules, restrictions, logger }) {
+	const lists = {
+		allow: [],
+		deny: []
+	};
+	const shadowingRestrictions = createShadowingRestrictionsTest(asRestrictions(restrictions));
+	for (const [rawPattern, action] of Object.entries(rules)) {
+		if (isPrototypePollutionKey(rawPattern) || action === "ask") continue;
+		const pattern = toPoolToolPattern(rawPattern);
+		if (pattern === void 0) {
+			logger?.warn(`Pool tool rules treat only "*" as a wildcard, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			continue;
+		}
+		if (action === "deny") {
+			lists.deny.push(pattern);
+			continue;
+		}
+		const shadowing = shadowingRestrictions(rawPattern);
+		if (shadowing.length > 0) {
+			logger?.warn(`Pool has no list for an "ask" or for a deny it cannot spell (an unmatched call prompts), so the "allow" rule for "${category}" (pattern ${quoteValueForWarning(rawPattern)}) was withheld because it overlaps the restriction(s) ${listPatterns(shadowing)}; Pool keeps prompting for "${toolName}".`);
+			continue;
+		}
+		lists.allow.push(pattern);
+	}
+	return {
+		allow: (0, es_toolkit.uniq)(lists.allow),
+		deny: (0, es_toolkit.uniq)(lists.deny)
+	};
+}
+function unrepresentableDenies(rules) {
+	return patternsWithAction(rules, ["deny"]).filter((pattern) => toPoolToolPattern(pattern) === void 0);
+}
+/**
+* Group the non-file categories by the Pool tool they land on, reporting the
+* ones Pool has no place for. Two categories can resolve to the same tool
+* (`bash` and a pass-through `shell`).
+*/
+function groupCategoriesByPoolTool({ permission, logger }) {
+	const byTool = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(permission)) {
+		if (isPrototypePollutionKey(category) || isFileCategory(category)) continue;
+		if (category === "*") {
+			for (const [rawPattern, action] of Object.entries(rules)) {
+				if (isPrototypePollutionKey(rawPattern)) continue;
+				logger?.warn(`Pool has no rule that spans every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(rawPattern)}) was skipped.`);
+			}
+			continue;
+		}
+		if (isMcpCategory(category)) {
+			logger?.warn(`Pool approves MCP tools per server under "mcp_servers.<server>.allow", so the rules for "${category}" were skipped; author them as "poolAllow" on the server in .rulesync/mcp.json instead.`);
+			continue;
+		}
+		const toolName = toPoolToolName(category);
+		byTool.set(toolName, [...byTool.get(toolName) ?? [], [category, rules]]);
+	}
+	return byTool;
+}
+/**
+* Convert the non-file categories into Pool tool lists, keyed by Pool tool
+* name. The categories that land on the same tool are converted against the
+* union of their `ask` patterns and their lists are joined, which is safe
+* because a deny wins over an allow in Pool whichever category wrote it.
+*/
+function convertRulesyncToPoolTools({ permission, logger }) {
+	const byTool = /* @__PURE__ */ new Map();
+	for (const [toolName, categories] of groupCategoriesByPoolTool({
+		permission,
+		logger
+	})) {
+		const restrictions = categories.flatMap(([, rules]) => [...patternsWithAction(rules, ["ask"]), ...unrepresentableDenies(rules)]);
+		const lists = {
+			allow: [],
+			deny: []
+		};
+		for (const [category, rules] of categories) {
+			const converted = convertToolCategory({
+				category,
+				toolName,
+				rules,
+				restrictions,
+				logger
+			});
+			lists.allow.push(...converted.allow);
+			lists.deny.push(...converted.deny);
+		}
+		byTool.set(toolName, {
+			allow: (0, es_toolkit.uniq)(lists.allow),
+			deny: (0, es_toolkit.uniq)(lists.deny)
+		});
+	}
+	return byTool;
+}
+/**
+* Convert the file categories into Pool's `paths` lists.
+*
+* An allow entry grants reading, and `write: true` grants writing on top, so
+* a `read` allow is withheld by an overlapping `read` ask and a write allow by
+* an overlapping `edit`/`write` ask — and by a `read` ask, since the write
+* entry would read too. A `read` deny lands in `paths.deny`, which Pool lets
+* win over any allow, and covers an `edit`/`write` deny of the same pattern,
+* so neither withholds anything; an `edit`/`write` deny without a `read` deny
+* cannot be written (Pool's deny blocks reads as well), so it is reported and
+* only withholds the write flags it overlaps. A deny Pool cannot spell is
+* skipped the same way and withholds the allows it overlaps, so it is honored
+* by prompting rather than dropped.
+*/
+function convertRulesyncToPoolPaths({ permission, global, logger }) {
+	const readRules = rulesOf(permission, READ_CATEGORY);
+	const writeRulesByCategory = WRITE_CATEGORIES.map((category) => [category, rulesOf(permission, category)]);
+	const readAsks = patternsWithAction(readRules, ["ask"]);
+	const fitsScope = ({ category, action, pattern }) => {
+		if (isHomeOrAbsolutePath(pattern) === global) return true;
+		logger?.warn(global ? `Pool's user settings take absolute or "~" paths, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped; author it in ${(0, node_path.join)(POOL_DIR, POOL_SETTINGS_FILE_NAME)} (without --global) instead.` : `Pool's project settings take project-relative paths, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped; author it in ~/${(0, node_path.join)(POOL_GLOBAL_DIR, POOL_SETTINGS_FILE_NAME)} (via --global) instead.`);
+		return false;
+	};
+	const deny = [];
+	const readRestrictions = [...readAsks];
+	for (const pattern of patternsWithAction(readRules, ["deny"])) {
+		const path = toPoolPathPattern(pattern);
+		if (path === void 0) {
+			warnSkippedPathPattern({
+				category: READ_CATEGORY,
+				action: "deny",
+				pattern,
+				logger
+			});
+			readRestrictions.push(pattern);
+			continue;
+		}
+		if (!fitsScope({
+			category: READ_CATEGORY,
+			action: "deny",
+			pattern
+		})) continue;
+		if (!deny.some((entry) => entry[POOL_PATH_KEY] === path)) deny.push({ [POOL_PATH_KEY]: path });
+	}
+	const isDeniedForRead = (pattern) => {
+		const path = toPoolPathPattern(pattern);
+		return path !== void 0 && deny.some((entry) => entry[POOL_PATH_KEY] === path);
+	};
+	const writeRestrictions = writeRulesByCategory.flatMap(([, rules]) => [...patternsWithAction(rules, ["ask"]), ...patternsWithAction(rules, ["deny"]).filter((pattern) => !isDeniedForRead(pattern))]);
+	reportUnwrittenWriteDenies({
+		writeRulesByCategory,
+		isDeniedForRead,
+		logger
+	});
+	const shadowingReadRestrictions = createShadowingRestrictionsTest(asRestrictions(readRestrictions));
+	const shadowingWriteRestrictions = createShadowingRestrictionsTest(asRestrictions([...readRestrictions, ...writeRestrictions]));
+	const allowByPath = /* @__PURE__ */ new Map();
+	for (const pattern of patternsWithAction(readRules, ["allow"])) {
+		if (!fitsScope({
+			category: READ_CATEGORY,
+			action: "allow",
+			pattern
+		})) continue;
+		const path = toPoolPathPattern(pattern);
+		if (path === void 0) {
+			warnSkippedPathPattern({
+				category: READ_CATEGORY,
+				action: "allow",
+				pattern,
+				logger
+			});
+			continue;
+		}
+		const shadowing = shadowingReadRestrictions(pattern);
+		if (shadowing.length > 0) {
+			logger?.warn(`Pool has no list for an "ask" or for a deny it cannot spell (an unmatched path prompts), so the "allow" rule for "read" (pattern ${quoteValueForWarning(pattern)}) was withheld because it overlaps the restriction(s) ${listPatterns(shadowing)}.`);
+			continue;
+		}
+		allowByPath.set(path, { [POOL_PATH_KEY]: path });
+	}
+	for (const [category, rules] of writeRulesByCategory) for (const pattern of patternsWithAction(rules, ["allow"])) {
+		if (!fitsScope({
+			category,
+			action: "allow",
+			pattern
+		})) continue;
+		const path = toPoolPathPattern(pattern);
+		if (path === void 0) {
+			warnSkippedPathPattern({
+				category,
+				action: "allow",
+				pattern,
+				logger
+			});
+			continue;
+		}
+		const shadowing = shadowingWriteRestrictions(pattern);
+		if (shadowing.length > 0) {
+			logger?.warn(`A Pool path allowed with "write: true" can be read and written freely, so the "allow" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was withheld because it overlaps the restriction(s) ${listPatterns(shadowing)}; Pool prompts for those writes.`);
+			continue;
+		}
+		allowByPath.set(path, {
+			[POOL_PATH_KEY]: path,
+			[POOL_WRITE_KEY]: true
+		});
+	}
+	return {
+		allow: [...allowByPath.values()],
+		deny
+	};
+}
+function warnSkippedPathPattern({ category, action, pattern, logger }) {
+	logger?.warn(`Pool path rules treat only "*" and "**" as wildcards, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
+}
+function reportUnwrittenWriteDenies({ writeRulesByCategory, isDeniedForRead, logger }) {
+	for (const [category, rules] of writeRulesByCategory) for (const pattern of patternsWithAction(rules, ["deny"])) {
+		if (isDeniedForRead(pattern)) continue;
+		if (toPoolPathPattern(pattern) === void 0) {
+			warnSkippedPathPattern({
+				category,
+				action: "deny",
+				pattern,
+				logger
+			});
+			continue;
+		}
+		logger?.warn(`Pool cannot deny writes without denying reads, so the "deny" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was not written and Pool prompts for those writes instead; deny the pattern under "read" as well to block it entirely.`);
+	}
+}
+function isUsablePattern(pattern) {
+	return typeof pattern === "string" && pattern !== "" && !isPrototypePollutionKey(pattern);
+}
+function pathOfEntry(entry) {
+	return isRecord$1(entry) && isUsablePattern(entry[POOL_PATH_KEY]) ? entry[POOL_PATH_KEY] : void 0;
+}
+/**
+* Convert one `tools.<name>` block into its canonical bucket. A disabled tool
+* never runs, so it reads as a catch-all deny and its own lists are ignored;
+* a denied pattern wins over an allowed one, as it does in Pool.
+*/
+function importPoolTool({ toolConfig, bucket }) {
+	if (toolConfig[POOL_DISABLED_KEY] === true) {
+		bucket[CATCH_ALL_PATTERN$2] = "deny";
+		return;
+	}
+	const denied = isStringArray$2(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
+	const allowed = isStringArray$2(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
+	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
+	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
+}
+/**
+* Convert Pool's `tools` and `paths` blocks back into a rulesync config.
+* `mcp_servers` approvals are the mcp feature's (`poolAllow`) and are not read.
+*/
+function convertPoolToRulesync({ tools, paths }) {
+	const permission = {};
+	const bucketFor = (category) => {
+		const own = lookupOwn({
+			record: permission,
+			key: category
+		});
+		if (own !== void 0) return own;
+		const created = {};
+		permission[category] = created;
+		return created;
+	};
+	for (const [toolName, toolConfig] of Object.entries(tools)) {
+		if (isPrototypePollutionKey(toolName) || !isRecord$1(toolConfig)) continue;
+		importPoolTool({
+			toolConfig,
+			bucket: bucketFor(toCanonicalToolName$4(toolName))
+		});
+	}
+	const denyEntries = Array.isArray(paths[POOL_DENY_KEY]) ? paths[POOL_DENY_KEY] : [];
+	const allowEntries = Array.isArray(paths[POOL_ALLOW_KEY]) ? paths[POOL_ALLOW_KEY] : [];
+	for (const entry of denyEntries) {
+		const path = pathOfEntry(entry);
+		if (path === void 0) continue;
+		for (const category of FILE_CATEGORIES) bucketFor(category)[path] = "deny";
+	}
+	for (const entry of allowEntries) {
+		const path = pathOfEntry(entry);
+		if (path === void 0) continue;
+		bucketFor(READ_CATEGORY)[path] ??= "allow";
+		if (isRecord$1(entry) && entry[POOL_WRITE_KEY] === true) for (const category of WRITE_CATEGORIES) bucketFor(category)[path] ??= "allow";
+	}
+	return { permission };
+}
+//#endregion
 //#region src/features/permissions/qwencode-permissions.ts
 /**
 * Qwen Code uses a settings.json file in `.qwen/` (project) or `~/.qwen/` (global).
@@ -56055,6 +57114,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["pool", {
+		class: PoolPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodePermissions,
 		meta: {
@@ -56718,8 +57785,19 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 		const changedPaths = [];
 		for (const aiDir of aiDirs) {
 			const dirPath = aiDir.getDirPath();
-			let dirHasChanges = false;
 			const mainFile = aiDir.getMainFile();
+			const otherFiles = aiDir.getOtherFiles();
+			const writtenPaths = [
+				dirPath,
+				...mainFile ? [(0, node_path.join)(dirPath, mainFile.name)] : [],
+				...otherFiles.map((file) => (0, node_path.join)(dirPath, file.relativeFilePathToDirPath))
+			];
+			if (await refusesAnyWriteOutsideRoot({
+				logger: this.logger,
+				rootPath: aiDir.getOutputRoot(),
+				targetPaths: writtenPaths
+			})) continue;
+			let dirHasChanges = false;
 			let mainFileContent;
 			if (mainFile) {
 				const mainFilePath = (0, node_path.join)(dirPath, mainFile.name);
@@ -56731,7 +57809,6 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 					existing: existingContent
 				})) dirHasChanges = true;
 			}
-			const otherFiles = aiDir.getOtherFiles();
 			for (const file of otherFiles) {
 				if (dirHasChanges) break;
 				const filePath = (0, node_path.join)(dirPath, file.relativeFilePathToDirPath);
@@ -68850,6 +69927,325 @@ var OpenCodeSubagent = class OpenCodeSubagent extends OpenCodeStyleSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/pool-subagent.ts
+/** How Pool runs an agent; a custom agent defaults to `in_process`. */
+const POOL_AGENT_TYPES = [
+	"in_process",
+	"command",
+	"agent_server"
+];
+const DEFAULT_POOL_AGENT_TYPE = "in_process";
+/**
+* One entry of `subagents.agents.<name>` in Pool's settings file. `type` is
+* required by Pool and `description` by every enabled custom agent; the
+* remaining keys depend on the type (`command`/`args`/`env` for `command`,
+* `agent_server`/`session_config_options` for `agent_server`). Loose so a key
+* Pool adds later survives the round-trip.
+* @see https://docs.poolside.ai/subagents
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+const PoolAgentSchema = zod_mini.z.looseObject({
+	type: zod_mini.z.optional(zod_mini.z.enum(POOL_AGENT_TYPES)),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	instructions: zod_mini.z.optional(zod_mini.z.string()),
+	command: zod_mini.z.optional(zod_mini.z.string()),
+	args: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	env: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
+	agent_server: zod_mini.z.optional(zod_mini.z.string()),
+	session_config_options: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.unknown())),
+	inherit_agent_config: zod_mini.z.optional(zod_mini.z.boolean()),
+	disabled: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* Single spelling of the settings.yaml codec/policy, matching PoolMcp: fail
+* closed on an unparseable root rather than replacing the user's primary Pool
+* settings with generated output.
+*/
+function parsePoolSettings(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "yaml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* The file stem an imported agent lands under in `.rulesync/subagents/`. Pool
+* keys agents by an arbitrary YAML mapping key, so the name is narrowed to a
+* safe file name before it becomes a path (defense in depth on top of the
+* central path-traversal guard); the agent keeps its real name in `name`.
+*/
+function sanitizePoolAgentFileStem(raw) {
+	const stem = raw.replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+	return stem.length > 0 ? stem : "agent";
+}
+/**
+* Read `subagents.agents` out of a parsed settings document. The reserved
+* `general` agent is Pool's built-in and stays the user's to configure, so it
+* is never imported; an entry that is not a mapping is skipped.
+*/
+function agentsOfSettings({ settings, filePath, logger }) {
+	const block = settings[POOL_SUBAGENTS_KEY];
+	const rawAgents = isRecord$1(block) ? block[POOL_SUBAGENTS_AGENTS_KEY] : void 0;
+	const agents = {};
+	if (!isRecord$1(rawAgents)) return agents;
+	for (const [name, raw] of Object.entries(rawAgents)) {
+		if (isPrototypePollutionKey(name) || name === "general") continue;
+		const result = PoolAgentSchema.safeParse(raw);
+		if (!result.success) {
+			logger?.warn(`Skipped Pool subagent ${quoteValueForWarning(name)} in ${filePath}: ${formatError(result.error)}`);
+			continue;
+		}
+		agents[name] = result.data;
+	}
+	return agents;
+}
+/**
+* Pool subagents.
+*
+* Pool defines subagents inside its settings file — `.poolside/settings.yaml`
+* at project scope and `~/.config/poolside/settings.yaml` at user scope —
+* under `subagents.agents.<name>`, so every targeted rulesync subagent is
+* collapsed into that one file: the body becomes `instructions`, the shared
+* `description` is written as-is and the `pool:` frontmatter section supplies
+* `type` (default `in_process`) and the type-specific keys. rulesync owns the
+* `agents` map except for Pool's built-in `general` entry, which is carried
+* over untouched together with `subagents.default` and every other top-level
+* key of the file (`mcp_servers`, `tools`, `pool`, ...); the file is never
+* deleted.
+*
+* @see https://docs.poolside.ai/subagents
+* @see https://docs.poolside.ai/settings-file-reference
+*/
+var PoolSubagent = class extends ToolSubagent {
+	agents;
+	logger;
+	/**
+	* The settings document to write, built lazily: the writer hands over the
+	* existing file through `setFileContent` first, and a file that does not
+	* exist yet gets the block merged into an empty document. Lazy so that a
+	* `forDeletion` instance never consults the gateway.
+	*/
+	mergedContent = null;
+	constructor({ agents, logger, ...rest }) {
+		super({
+			...rest,
+			fileContent: ""
+		});
+		this.agents = agents;
+		this.logger = logger;
+	}
+	getAgents() {
+		return this.agents;
+	}
+	isDeletable() {
+		return false;
+	}
+	shouldMergeExistingFileContent() {
+		return true;
+	}
+	setFileContent(newFileContent) {
+		this.mergedContent = this.mergeInto(newFileContent);
+	}
+	getFileContent() {
+		if (this.mergedContent === null) this.mergedContent = this.mergeInto("");
+		return this.mergedContent;
+	}
+	/**
+	* Rebuild the `subagents` block on top of an existing settings document:
+	* `default` and any other sibling of `agents` are kept, the built-in
+	* `general` agent is carried over, and every other agent is replaced by the
+	* generated set — an agent removed from `.rulesync/subagents/` must not
+	* survive here. A block left empty is retracted rather than written as `{}`.
+	*/
+	mergeInto(existingContent) {
+		const paths = {
+			relativeDirPath: this.getRelativeDirPath(),
+			relativeFilePath: this.getRelativeFilePath()
+		};
+		const filePath = (0, node_path.join)(this.getOutputRoot(), paths.relativeDirPath, paths.relativeFilePath);
+		const existing = parsePoolSettings(existingContent, filePath);
+		const existingBlock = isRecord$1(existing["subagents"]) ? existing[POOL_SUBAGENTS_KEY] : {};
+		const block = {};
+		for (const [key, value] of Object.entries(existingBlock)) if (!isPrototypePollutionKey(key) && key !== "agents") block[key] = value;
+		const existingAgents = isRecord$1(existingBlock["agents"]) ? existingBlock[POOL_SUBAGENTS_AGENTS_KEY] : {};
+		const general = existingAgents[POOL_GENERAL_AGENT_NAME];
+		const agents = {
+			...general !== void 0 ? { [POOL_GENERAL_AGENT_NAME]: general } : {},
+			...this.agents
+		};
+		const dropped = Object.keys(existingAgents).filter((name) => name !== "general" && !Object.hasOwn(agents, name));
+		if (dropped.length > 0) {
+			const advice = this.global ? "hand-written agents belong in .rulesync/subagents/" : `hand-written agents belong in ${POOL_SETTINGS_LOCAL_FILE_NAME}`;
+			this.logger?.warn(`Removed Pool subagent(s) ${dropped.map(quoteValueForWarning).join(", ")} from ${filePath}: rulesync recomputes "${POOL_SUBAGENTS_KEY}.${POOL_SUBAGENTS_AGENTS_KEY}" from its own subagents on every run, so ${advice}.`);
+		}
+		if (Object.keys(agents).length > 0) block[POOL_SUBAGENTS_AGENTS_KEY] = agents;
+		return applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "subagents",
+			existingContent,
+			patch: { [POOL_SUBAGENTS_KEY]: Object.keys(block).length > 0 ? block : void 0 },
+			filePath,
+			logger: this.logger
+		});
+	}
+	/**
+	* Every agent lives in the one settings file, which the MCP feature writes
+	* too: naming the file here keeps the gitignore derivation from claiming the
+	* whole directory and lets the shared-file derivation order the writers.
+	*/
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? POOL_GLOBAL_DIR : POOL_DIR,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME
+		};
+	}
+	/**
+	* Map a single rulesync subagent to a Pool agent entry. The body becomes
+	* `instructions` and the shared `description` is written as-is; the
+	* optional `pool:` section supplies `type` and the type-specific keys and
+	* may override both. Returns `null` for the reserved `general` name, which
+	* Pool defines itself.
+	*/
+	static toPoolAgent({ rulesyncSubagent, logger }) {
+		const frontmatter = rulesyncSubagent.getFrontmatter();
+		const name = frontmatter.name;
+		if (name === "general") {
+			logger?.warn(`Pool subagent ${quoteValueForWarning(name)} was skipped: "${POOL_GENERAL_AGENT_NAME}" is Pool's built-in agent, so configure it in settings.yaml directly.`);
+			return null;
+		}
+		if (isPrototypePollutionKey(name)) {
+			logger?.warn(`Pool subagent ${quoteValueForWarning(name)} was skipped: unsafe name.`);
+			return null;
+		}
+		const rawSection = isRecord$1(frontmatter.pool) ? frontmatter.pool : {};
+		const result = PoolAgentSchema.safeParse(rawSection);
+		if (!result.success) throw new Error(`Invalid "pool" section of subagent ${quoteValueForWarning(name)}: ${formatError(result.error)}`);
+		const { type, description, instructions, ...rest } = result.data;
+		const body = rulesyncSubagent.getBody().trim();
+		const effectiveDescription = description ?? frontmatter.description;
+		const effectiveInstructions = instructions ?? (body !== "" ? body : void 0);
+		if (effectiveDescription === void 0 && rest.disabled !== true) logger?.warn(`Pool subagent ${quoteValueForWarning(name)} has no description; Pool requires one for every enabled custom agent.`);
+		return {
+			name,
+			agent: {
+				type: type ?? DEFAULT_POOL_AGENT_TYPE,
+				...effectiveDescription !== void 0 ? { description: effectiveDescription } : {},
+				...effectiveInstructions !== void 0 ? { instructions: effectiveInstructions } : {},
+				...rest
+			}
+		};
+	}
+	/**
+	* Aggregate every targeted rulesync subagent into the one settings file.
+	* Agents are keyed by their `name`; a repeated name keeps the last one, with
+	* a warning, so the map stays what Pool would read.
+	*/
+	static fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, validate = true, global = false, logger }) {
+		const agents = {};
+		for (const rulesyncSubagent of rulesyncSubagents) {
+			const converted = this.toPoolAgent({
+				rulesyncSubagent,
+				logger
+			});
+			if (converted === null) continue;
+			if (Object.hasOwn(agents, converted.name)) logger?.warn(`Pool subagent ${quoteValueForWarning(converted.name)} is defined more than once; the last definition (${rulesyncSubagent.getRelativePathFromCwd()}) wins.`);
+			agents[converted.name] = converted.agent;
+		}
+		return new this({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: POOL_SETTINGS_FILE_NAME,
+			agents,
+			validate,
+			global,
+			logger
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
+		return this.fromRulesyncSubagents({
+			outputRoot,
+			rulesyncSubagents: [rulesyncSubagent],
+			validate,
+			global,
+			logger
+		});
+	}
+	/**
+	* Convert every custom agent of the settings file back into an individual
+	* rulesync subagent. `instructions` becomes the body, `description` the
+	* shared field, and everything else — `type` only when it is not the
+	* default — rides the `pool:` section so it survives the round-trip.
+	*/
+	toRulesyncSubagents() {
+		return Object.entries(this.agents).map(([name, agent]) => {
+			const { type, description, instructions, ...rest } = agent;
+			const poolSection = {
+				...type !== void 0 && type !== DEFAULT_POOL_AGENT_TYPE ? { type } : {},
+				...rest
+			};
+			const rulesyncFrontmatter = {
+				targets: ["pool"],
+				name,
+				...description !== void 0 ? { description } : {},
+				...Object.keys(poolSection).length > 0 ? { pool: poolSection } : {}
+			};
+			return new RulesyncSubagent({
+				outputRoot: process.cwd(),
+				frontmatter: rulesyncFrontmatter,
+				body: instructions ?? "",
+				relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+				relativeFilePath: `${sanitizePoolAgentFileStem(name)}.md`,
+				validate: true
+			});
+		});
+	}
+	toRulesyncSubagent() {
+		const first = this.toRulesyncSubagents()[0];
+		if (!first) throw new Error(`No custom subagents found in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())} to convert.`);
+		return first;
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "pool"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const settings = parsePoolSettings(await readFileContentOrNull(filePath) ?? "", filePath);
+		return new this({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			agents: agentsOfSettings({
+				settings,
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			agents: {},
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/reasonix-subagent.ts
 const ReasonixSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -70170,6 +71566,16 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.md"
 		}
 	}],
+	["pool", {
+		class: PoolSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			emitsEmptyAggregate: true,
+			filePattern: POOL_SETTINGS_FILE_NAME
+		}
+	}],
 	["qwencode", {
 		class: QwencodeSubagent,
 		meta: {
@@ -70282,6 +71688,12 @@ var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
+	/**
+	* Whether the last `loadRulesyncFiles` found a `subagents/` directory under
+	* any input root. A project without one has not adopted the feature, so the
+	* agents in its Pool settings are its own and must not be retracted.
+	*/
+	rulesyncSourceDirFound = false;
 	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
 		super({
 			outputRoot,
@@ -70295,16 +71707,20 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		this.global = global;
 		this.getFactory = getFactory;
 	}
+	emitsToolFilesForEmptySource() {
+		return this.rulesyncSourceDirFound && this.getFactory(this.toolTarget).meta.emitsEmptyAggregate === true;
+	}
 	async convertRulesyncFilesToToolFiles(rulesyncFiles) {
 		const rulesyncSubagents = rulesyncFiles.filter((file) => file instanceof RulesyncSubagent);
 		const factory = this.getFactory(this.toolTarget);
 		const targeted = rulesyncSubagents.filter((rulesyncSubagent) => factory.class.isTargetedByRulesyncSubagent(rulesyncSubagent));
 		if (factory.class.fromRulesyncSubagents) {
-			if (targeted.length === 0) return [];
+			if (targeted.length === 0 && !this.emitsToolFilesForEmptySource()) return [];
 			const toolSubagents = factory.class.fromRulesyncSubagents({
 				outputRoot: this.outputRoot,
 				rulesyncSubagents: targeted,
-				global: this.global
+				global: this.global,
+				logger: this.logger
 			});
 			return Array.isArray(toolSubagents) ? toolSubagents : [toolSubagents];
 		}
@@ -70360,6 +71776,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			this.logger.debug(`Rulesync subagents directory not found: ${subagentsDir}`);
 			return [];
 		}
+		this.rulesyncSourceDirFound = true;
 		const mdFiles = (await listDirectoryEntryNames(subagentsDir)).filter((file) => file.endsWith(".md"));
 		if (mdFiles.length === 0) {
 			this.logger.debug(`No markdown files found in rulesync subagents directory: ${subagentsDir}`);
@@ -70400,6 +71817,7 @@ var SubagentsProcessor = class extends FeatureProcessor {
 	* earlier root's copy.
 	*/
 	async loadRulesyncFiles() {
+		this.rulesyncSourceDirFound = false;
 		const rulesyncSubagents = mergeByCaseInsensitiveIdentity({
 			perRoot: await Promise.all(this.inputRoots.map((root) => this.loadRulesyncFilesForRoot(root))),
 			identity: (subagent) => subagent.getRelativeFilePath(),
@@ -70462,7 +71880,8 @@ var SubagentsProcessor = class extends FeatureProcessor {
 				outputRoot: rootOutputRoot,
 				relativeDirPath: dirPath,
 				relativeFilePath: toRelativeFilePath(path),
-				global: this.global
+				global: this.global,
+				logger: this.logger
 			})));
 			toolSubagents.push(...this.claimStandaloneSubagents({
 				loaded,
@@ -74384,22 +75803,30 @@ var DevinRule = class DevinRule extends ToolRule {
 	}
 };
 //#endregion
-//#region src/features/rules/dsh-rule.ts
+//#region src/features/rules/nested-agentsmd-rule.ts
 /**
-* DeepSeek Harness (`dsh`) rules.
+* Shared adapter for the targets that read instructions exactly the way the
+* AGENTS.md standard describes them and nothing more: a root `AGENTS.md` at the
+* project root, nested per-directory `AGENTS.md` files loaded only while working
+* under that directory, and a single personal root file under a tool-specific
+* home directory. Such a target has no modular non-root instruction directory,
+* so every other non-root rule folds into the root file.
 *
-* Project scope writes the root `AGENTS.md` plus nested `<dir>/AGENTS.md`
-* files — the project chain `dsh-agent-instructions` loads from the `.git`
-* root down to the session cwd. Global scope writes the user-global
-* `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness reads as a
-* single root file with no local overlay, so non-root rules fold into it.
+* Concrete targets (Pool, Vibe, DeepSeek Harness) only supply the global
+* directory and their tool target through {@link getFamily}; the vendor docs
+* describing each one's discovery walk live on the subclass.
 *
-* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+* The nested-file scan mirrors the AGENTS.md standard's nested discovery —
+* same file name, same exclusions, import-only, project scope — because it
+* discovers literally the same files.
 */
-var DshRule = class DshRule extends ToolRule {
+var NestedAgentsmdRule = class extends ToolRule {
+	static getFamily() {
+		throw new Error("Please implement this method in the subclass.");
+	}
 	static getSettablePaths({ global = false } = {}) {
 		if (global) return { root: {
-			relativeDirPath: DSH_DIR,
+			relativeDirPath: this.getFamily().globalDir,
 			relativeFilePath: AGENTSMD_RULE_FILE_NAME
 		} };
 		return { root: {
@@ -74407,18 +75834,6 @@ var DshRule = class DshRule extends ToolRule {
 			relativeFilePath: AGENTSMD_RULE_FILE_NAME
 		} };
 	}
-	/**
-	* DeepSeek Harness loads the project chain of `AGENTS.md` files from the
-	* project root (the nearest ancestor holding `.git`) down through the session
-	* cwd, broad to specific, so a per-directory file applies only while working
-	* under that directory. Nested files are therefore a real scoping surface,
-	* not just the root file's overflow.
-	*
-	* The scan mirrors the AGENTS.md standard's nested discovery — same file
-	* name, same exclusions, import-only, project scope — because it discovers
-	* literally the same files.
-	* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
-	*/
 	static getNestedFilePatterns() {
 		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
 	}
@@ -74433,7 +75848,7 @@ var DshRule = class DshRule extends ToolRule {
 		const { root } = this.getSettablePaths({ global });
 		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
 			const fileContent = await readFileContent((0, node_path.join)(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
-			return new DshRule({
+			return new this({
 				outputRoot,
 				relativeDirPath: overrideDirPath,
 				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
@@ -74443,7 +75858,7 @@ var DshRule = class DshRule extends ToolRule {
 			});
 		}
 		const fileContent = await readFileContent((0, node_path.join)(outputRoot, root.relativeDirPath, root.relativeFilePath));
-		return new DshRule({
+		return new this({
 			outputRoot,
 			relativeDirPath: root.relativeDirPath,
 			relativeFilePath: root.relativeFilePath,
@@ -74457,7 +75872,7 @@ var DshRule = class DshRule extends ToolRule {
 		const frontmatter = rulesyncRule.getFrontmatter();
 		const isRoot = frontmatter.root ?? false;
 		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
-		if (!global && !isRoot && subprojectPath) return new DshRule({
+		if (!global && !isRoot && subprojectPath) return new this({
 			outputRoot,
 			relativeDirPath: (0, node_path.join)(subprojectPath),
 			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
@@ -74465,7 +75880,7 @@ var DshRule = class DshRule extends ToolRule {
 			validate,
 			root: false
 		});
-		return new DshRule({
+		return new this({
 			outputRoot,
 			relativeDirPath: root.relativeDirPath,
 			relativeFilePath: root.relativeFilePath,
@@ -74486,23 +75901,47 @@ var DshRule = class DshRule extends ToolRule {
 		};
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new DshRule({
+		const isRoot = relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === this.getFamily().globalDir);
+		return new this({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
 			validate: false,
-			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === ".dsh")
+			root: isRoot
 		});
 	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
 		return this.isTargetedByRulesyncRuleDefault({
 			rulesyncRule,
-			toolTarget: "dsh"
+			toolTarget: this.getFamily().toolTarget
 		});
 	}
 };
 //#endregion
+//#region src/features/rules/dsh-rule.ts
+/**
+* DeepSeek Harness (`dsh`) rules.
+*
+* Project scope writes the root `AGENTS.md` plus nested `<dir>/AGENTS.md`
+* files — the project chain `dsh-agent-instructions` loads from the `.git`
+* root down to the session cwd, broad to specific, so a per-directory file
+* applies only while working under that directory. Global scope writes the
+* user-global `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness
+* reads as a single root file with no `.local.md` overlay, so non-root rules
+* fold into it.
+*
+* @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
+*/
+var DshRule = class extends NestedAgentsmdRule {
+	static getFamily() {
+		return {
+			globalDir: DSH_DIR,
+			toolTarget: "dsh"
+		};
+	}
+};
+//#endregion
 //#region src/features/rules/factorydroid-rule.ts
 /**
 * Rule generator for Factory Droid.
@@ -75896,110 +77335,24 @@ var PiRule = class PiRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/pool-rule.ts
-var PoolRule = class PoolRule extends ToolRule {
-	static getSettablePaths({ global = false } = {}) {
-		if (global) return { root: {
-			relativeDirPath: POOL_GLOBAL_DIR,
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-		return { root: {
-			relativeDirPath: ".",
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-	}
-	/**
-	* Pool reads personal, project, and directory-level `AGENTS.md` files: inside
-	* a git repository it loads every `AGENTS.md` from the repository root down
-	* through the working directory (deeper files take precedence), skipping
-	* ignored directories. Nested files are therefore a real scoping surface, not
-	* just the root file's overflow.
-	*
-	* The scan mirrors the AGENTS.md standard's nested discovery — same file
-	* name, same exclusions, import-only, project scope — because it discovers
-	* literally the same files.
-	* @see https://docs.poolside.ai/agent-instructions
-	*/
-	static getNestedFilePatterns() {
-		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	/**
-	* The subproject directory this rule scopes, or `undefined` for the root file
-	* (project or global).
-	*/
-	getSubprojectPath() {
-		return this.getNestedSubprojectPath({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
-			const fileContent = await readFileContent((0, node_path.join)(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
-			return new PoolRule({
-				outputRoot,
-				relativeDirPath: overrideDirPath,
-				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-				fileContent,
-				validate,
-				root: false
-			});
-		}
-		const fileContent = await readFileContent((0, node_path.join)(outputRoot, root.relativeDirPath, root.relativeFilePath));
-		return new PoolRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent,
-			validate,
-			root: true
-		});
-	}
-	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		const frontmatter = rulesyncRule.getFrontmatter();
-		const isRoot = frontmatter.root ?? false;
-		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
-		if (!global && !isRoot && subprojectPath) return new PoolRule({
-			outputRoot,
-			relativeDirPath: (0, node_path.join)(subprojectPath),
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: false
-		});
-		return new PoolRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: isRoot
-		});
-	}
-	toRulesyncRule() {
-		const subprojectPath = this.getSubprojectPath();
-		if (subprojectPath === void 0) return this.toRulesyncRuleDefault();
-		return this.toRulesyncRuleNestedAgentsmd({ subprojectPath });
-	}
-	validate() {
+/**
+* Pool (Poolside) rules.
+*
+* Pool reads personal, project, and directory-level `AGENTS.md` files: inside
+* a git repository it loads every `AGENTS.md` from the repository root down
+* through the working directory (deeper files take precedence), skipping
+* ignored directories. Nested files are therefore a real scoping surface, not
+* just the root file's overflow. The personal file sits below both at
+* `~/.config/poolside/AGENTS.md`.
+*
+* @see https://docs.poolside.ai/agent-instructions
+*/
+var PoolRule = class extends NestedAgentsmdRule {
+	static getFamily() {
 		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new PoolRule({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === POOL_GLOBAL_DIR)
-		});
-	}
-	static isTargetedByRulesyncRule(rulesyncRule) {
-		return this.isTargetedByRulesyncRuleDefault({
-			rulesyncRule,
+			globalDir: POOL_GLOBAL_DIR,
 			toolTarget: "pool"
-		});
+		};
 	}
 };
 //#endregion
@@ -76963,110 +78316,23 @@ var TaktRule = class TaktRule extends ToolRule {
 //#endregion
 //#region src/features/rules/vibe-rule.ts
 const VIBE_GLOBAL_DIR = ".vibe";
-var VibeRule = class VibeRule extends ToolRule {
-	static getSettablePaths({ global = false } = {}) {
-		if (global) return { root: {
-			relativeDirPath: VIBE_GLOBAL_DIR,
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-		return { root: {
-			relativeDirPath: ".",
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME
-		} };
-	}
-	/**
-	* Vibe's harness manager walks the directories between the workspace root and
-	* the file being read and loads every `AGENTS.md` it finds along the way
-	* (`find_subdirectory_agents_md`), injecting the result into the `read_file`
-	* tool's output. Nested files are therefore a real scoping surface, not just
-	* the root file's overflow.
-	*
-	* The scan mirrors the AGENTS.md standard's nested discovery — same file
-	* name, same exclusions, import-only, project scope — because it discovers
-	* literally the same files.
-	* @see https://github.com/mistralai/mistral-vibe/blob/main/vibe/core/config/harness_files/_harness_manager.py
-	*/
-	static getNestedFilePatterns() {
-		return this.buildNestedFilePatterns({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	/**
-	* The subproject directory this rule scopes, or `undefined` for the root file
-	* (project or global).
-	*/
-	getSubprojectPath() {
-		return this.getNestedSubprojectPath({ fileName: AGENTSMD_RULE_FILE_NAME });
-	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, relativeDirPath: overrideDirPath, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		if (overrideDirPath !== void 0 && overrideDirPath !== root.relativeDirPath && overrideDirPath !== ".") {
-			const fileContent = await readFileContent((0, node_path.join)(outputRoot, overrideDirPath, AGENTSMD_RULE_FILE_NAME));
-			return new VibeRule({
-				outputRoot,
-				relativeDirPath: overrideDirPath,
-				relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-				fileContent,
-				validate,
-				root: false
-			});
-		}
-		const fileContent = await readFileContent((0, node_path.join)(outputRoot, root.relativeDirPath, root.relativeFilePath));
-		return new VibeRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent,
-			validate,
-			root: true
-		});
-	}
-	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
-		const { root } = this.getSettablePaths({ global });
-		const frontmatter = rulesyncRule.getFrontmatter();
-		const isRoot = frontmatter.root ?? false;
-		const subprojectPath = frontmatter.agentsmd?.subprojectPath;
-		if (!global && !isRoot && subprojectPath) return new VibeRule({
-			outputRoot,
-			relativeDirPath: (0, node_path.join)(subprojectPath),
-			relativeFilePath: AGENTSMD_RULE_FILE_NAME,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: false
-		});
-		return new VibeRule({
-			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
-			fileContent: rulesyncRule.getBody(),
-			validate,
-			root: isRoot
-		});
-	}
-	toRulesyncRule() {
-		const subprojectPath = this.getSubprojectPath();
-		if (subprojectPath === void 0) return this.toRulesyncRuleDefault();
-		return this.toRulesyncRuleNestedAgentsmd({ subprojectPath });
-	}
-	validate() {
+/**
+* Mistral Vibe rules.
+*
+* Vibe's harness manager walks the directories between the workspace root and
+* the file being read and loads every `AGENTS.md` it finds along the way
+* (`find_subdirectory_agents_md`), injecting the result into the `read_file`
+* tool's output. Nested files are therefore a real scoping surface, not just
+* the root file's overflow. The personal file is `~/.vibe/AGENTS.md`.
+*
+* @see https://github.com/mistralai/mistral-vibe/blob/main/vibe/core/config/harness_files/_harness_manager.py
+*/
+var VibeRule = class extends NestedAgentsmdRule {
+	static getFamily() {
 		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new VibeRule({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: "",
-			validate: false,
-			root: relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === ".vibe")
-		});
-	}
-	static isTargetedByRulesyncRule(rulesyncRule) {
-		return this.isTargetedByRulesyncRuleDefault({
-			rulesyncRule,
+			globalDir: VIBE_GLOBAL_DIR,
 			toolTarget: "vibe"
-		});
+		};
 	}
 };
 //#endregion
@@ -79273,6 +80539,16 @@ async function activateHermesProjectPlugins({ pluginNames, dryRun, logger }) {
 		relativeFilePath: HERMESAGENT_CONFIG_FILE_PATH
 	});
 	const configPath = (0, node_path.join)(configRoot, relativeConfigPath);
+	if (await refusesWriteOutsideRoot({
+		logger,
+		rootPath: configRoot,
+		targetPath: configPath
+	})) return {
+		count: 0,
+		paths: [],
+		hasDiff: false,
+		sourceLoadFailed: false
+	};
 	const expectedConfig = mergeEnabledPlugins({
 		existingContent: await readFileContentOrNull(configPath) ?? "",
 		filePath: configPath,
@@ -79740,7 +81016,8 @@ async function processEmptyFeatureGeneration(params) {
 */
 async function processFeatureWithRulesyncFiles(params) {
 	const { config, processor, rulesyncFiles, sweepPlan, skipFilePaths, onToolFiles } = params;
-	if (rulesyncFiles.length === 0) return processEmptyFeatureGeneration({
+	const retractsForEmptySource = processor.emitsToolFilesForEmptySource() && !processor.hasRulesyncSourceLoadFailure();
+	if (rulesyncFiles.length === 0 && !retractsForEmptySource) return processEmptyFeatureGeneration({
 		config,
 		processor,
 		sweepPlan,