rulesync 16.6.0 → 16.7.0

package/dist/{import-BlwypG9v.js → import-zyfw1Cq_.js}

@@ -614,6 +614,13 @@ async function readFileBuffer(filepath) {
 	return readFile(filepath);
 }
 /**
+* Read file as a buffer if it exists, otherwise return null.
+*/
+async function readFileBufferOrNull(filepath) {
+	if (await fileExists(filepath)) return readFileBuffer(filepath);
+	return null;
+}
+/**
 * Normalizes text to LF line endings and adds exactly one trailing newline.
 * Removes any existing trailing whitespace and appends a single newline.
 */
@@ -625,6 +632,10 @@ async function writeFileContent(filepath, content) {
 	await ensureDir(dirname(filepath));
 	await writeFile(filepath, content, "utf-8");
 }
+async function writeFileBuffer(filepath, buffer) {
+	await ensureDir(dirname(filepath));
+	await writeFile(filepath, buffer);
+}
 async function fileExists(filepath) {
 	try {
 		await stat(filepath);
@@ -2157,6 +2168,7 @@ const HookDefinitionSchema = z.looseObject({
 	name: z.optional(safeString),
 	description: z.optional(safeString),
 	failClosed: z.optional(z.boolean()),
+	commandRegex: z.optional(safeString),
 	sequential: z.optional(z.boolean()),
 	async: z.optional(z.boolean()),
 	env: z.optional(z.record(z.string(), safeString)),
@@ -2173,6 +2185,7 @@ const HookDefinitionSchema = z.looseObject({
 	metadata: z.optional(z.looseObject({})),
 	if: z.optional(safeString),
 	commandWindows: z.optional(safeString),
+	additionalContextLimit: z.optional(z.int().check(nonnegative())),
 	asyncRewake: z.optional(z.boolean()),
 	continueOnBlock: z.optional(z.boolean())
 });
@@ -4220,7 +4233,8 @@ const ReasonixPermissionsOverrideSchema = z.looseObject({
 */
 const FactorydroidPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
-	commandBlocklist: z.optional(z.array(z.string()))
+	commandBlocklist: z.optional(z.array(z.string())),
+	disabledSkills: z.optional(z.array(z.string()))
 });
 /**
 * Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
@@ -4666,13 +4680,22 @@ const CodexBasePermissionProfileSchema = z.enum(CODEX_BASE_PERMISSION_PROFILES);
 *   `base_permission_profile` it is consumed by the profile builder, not
 *   written as a top-level config key.
 *
-* Two surfaces are deliberately NOT authorable here so the override can never
-* clobber a feature-owned key: `mcp_servers.*` per-MCP gating is owned by the
-* MCP feature (`codexcli-mcp.ts` already writes the `mcp_servers` tables in the
-* same `config.toml`), and `permissions` / `default_permissions` are owned by
-* the canonical model. Any such key placed in the override is skipped with a
-* warning. Kept `looseObject` (verbatim passthrough) so future top-level Codex
-* config keys can be authored without Rulesync modeling each one.
+* The keys written to `config.toml` are an **allowlist**, not verbatim
+* passthrough: only `CODEXCLI_OVERRIDE_KEYS`
+* (`src/constants/codexcli-paths.ts` — `approval_policy`, `sandbox_mode`,
+* `sandbox_workspace_write`, `apps`, `approvals_reviewer`) are emitted, and
+* `computeCodexcliOverridePatch` skips anything else with a warning.
+* `base_permission_profile` and `git_write_rules` are consumed by the profile
+* builder rather than written, as described above, and `permission` is the
+* tool-scoped canonical block, which `RulesyncPermissions.forTarget` strips out
+* of the override before it ever reaches the patch. The allowlist is what keeps
+* the override from clobbering a feature-owned key: `mcp_servers.*` per-MCP
+* gating is owned by the MCP feature (`codexcli-mcp.ts` already writes the
+* `mcp_servers` tables in the same `config.toml`), and `permissions` /
+* `default_permissions` are owned by the canonical model. The schema itself is
+* `looseObject` so an unmodeled key parses (and is then reported rather than
+* rejected outright); supporting a new top-level Codex config key means adding
+* it to `CODEXCLI_OVERRIDE_KEYS`.
 *
 * @see https://developers.openai.com/codex/config-reference
 * @see https://developers.openai.com/codex/permissions
@@ -5147,7 +5170,11 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	copilot: z.optional(z.looseObject({
 		license: z.optional(z.string()),
-		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
+		"argument-hint": z.optional(z.string()),
+		"user-invocable": z.optional(z.boolean()),
+		"disable-model-invocation": z.optional(z.boolean()),
+		context: z.optional(z.string())
 	})),
 	copilotcli: z.optional(z.looseObject({
 		license: z.optional(z.string()),
@@ -5205,7 +5232,9 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 	})),
 	factorydroid: z.optional(z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
-		"user-invocable": z.optional(z.boolean())
+		"user-invocable": z.optional(z.boolean()),
+		enabled: z.optional(z.boolean()),
+		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 	})),
 	grokcli: z.optional(z.looseObject({
 		"disable-model-invocation": z.optional(z.boolean()),
@@ -5418,8 +5447,8 @@ async function getLocalSkillDirNames(outputRoot) {
 * Resolve the effective `disable-model-invocation` value for a tool skill.
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
-* default that applies to every tool supporting the flag (claudecode, cursor,
-* zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
+* default that applies to every tool supporting the flag (claudecode, copilot,
+* copilotcli, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -5432,8 +5461,8 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 * Resolve the effective `user-invocable` value for a tool skill.
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
-* that applies to every tool supporting the flag (claudecode, qwencode, vibe,
-* grokcli, factorydroid). Each tool's own section may override that default with a
+* that applies to every tool supporting the flag (claudecode, copilot,
+* copilotcli, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -5646,6 +5675,31 @@ function fileContentsEquivalent({ filePath, expected, existing }) {
 	if (structured !== void 0) return structured;
 	return addTrailingNewline(expected) === addTrailingNewline(existing);
 }
+/**
+* Whether an on-disk companion file is equivalent to the generated one.
+*
+* Companion files (everything beside a skill's `SKILL.md`) are written byte for
+* byte, so byte equality is the whole test for a user asset carried through
+* from the source directory: a CRLF fixture or a deliberately newline-less file
+* must compare equal to itself and unequal to a normalized copy, and a copy
+* that has drifted must be repaired rather than tolerated.
+*
+* A `composed` file is different — Rulesync builds it from frontmatter (Codex
+* CLI's `agents/openai.yaml`), so differing bytes fall back to the structured
+* comparison and a formatter re-indenting it is not reported as a change on
+* every generate. Only the structured verdict counts: there is deliberately no
+* text fallback, since trailing-whitespace-insensitive text equality is exactly
+* the normalization companion files no longer get.
+*/
+function companionFileContentsEquivalent({ filePath, expected, existing, composed = false }) {
+	if (existing === null) return false;
+	if (existing.equals(expected)) return true;
+	if (!composed) return false;
+	const expectedText = expected.toString("utf-8");
+	const existingText = existing.toString("utf-8");
+	if (!Buffer.from(expectedText, "utf-8").equals(expected) || !Buffer.from(existingText, "utf-8").equals(existing)) return false;
+	return tryFileContentsEquivalent(filePath, expectedText, existingText) ?? false;
+}
 //#endregion
 //#region src/types/feature-processor.ts
 var FeatureProcessor = class {
@@ -7046,6 +7100,14 @@ const SHARED_CONFIG_OWNERSHIP = {
 			ownedKeys: ["mcp", "tools"]
 		} }
 	},
+	".config/goose/config.yaml": {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["extensions"]
+		} }
+	},
 	[CODEXCLI_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		features: {
@@ -9284,9 +9346,10 @@ const FACTORYDROID_HOOKS_FILE_NAME = "hooks.json";
 //#region src/features/commands/factorydroid-command.ts
 const FactorydroidCommandFrontmatterSchema = z.looseObject({
 	description: z.optional(z.string()),
-	"argument-hint": z.optional(z.string()),
-	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+	"argument-hint": z.optional(z.string())
 });
+/** Not a Droid command surface; see the schema comment above. */
+const FACTORYDROID_UNSUPPORTED_COMMAND_FIELDS = ["allowed-tools"];
 var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	frontmatter;
 	body;
@@ -9313,6 +9376,7 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	}
 	toRulesyncCommand() {
 		const { description, ...restFields } = this.frontmatter;
+		for (const field of FACTORYDROID_UNSUPPORTED_COMMAND_FIELDS) delete restFields[field];
 		const rulesyncFrontmatter = {
 			targets: ["*"],
 			description,
@@ -9336,6 +9400,7 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 			description: rulesyncFrontmatter.description,
 			...factorydroidFields
 		};
+		for (const field of FACTORYDROID_UNSUPPORTED_COMMAND_FIELDS) delete factorydroidFrontmatter[field];
 		const body = rulesyncCommand.getBody();
 		const paths = this.getSettablePaths({ global });
 		return new FactorydroidCommand({
@@ -13047,16 +13112,28 @@ function buildEffectiveHooks$1({ config, toolOverrideHooks, supportedEvents }) {
 	};
 }
 /**
-* Group a list of hook definitions by their `matcher` (empty string when absent),
-* preserving insertion order of both keys and grouped definitions.
+* Group a list of hook definitions by their `matcher` (empty string when
+* absent), preserving insertion order of both keys and grouped definitions.
+* Definitions that disagree on a `subdividesGroup` passthrough field are split
+* into separate groups, so a restricting field is never inherited by a hook
+* that did not ask for it.
 */
-function groupDefinitionsByMatcher(definitions) {
+function groupDefinitionsByMatcher({ definitions, converterConfig }) {
+	const subdividingFields = (converterConfig.groupPassthroughFields ?? []).filter(({ subdividesGroup }) => subdividesGroup);
 	const byMatcher = /* @__PURE__ */ new Map();
 	for (const def of definitions) {
-		const key = def.matcher ?? "";
-		const list = byMatcher.get(key);
-		if (list) list.push(def);
-		else byMatcher.set(key, [def]);
+		const rawMatcher = def.matcher ?? "";
+		const matcher = converterConfig.wildcardMatcherMeansAll && rawMatcher === "*" ? "" : rawMatcher;
+		const key = [matcher, ...subdividingFields.map(({ canonical, valueType }) => {
+			const value = def[canonical];
+			return isGroupPassthroughValue(value, valueType) ? stableJson(value) : "";
+		})].join("\0");
+		const group = byMatcher.get(key);
+		if (group) group.defs.push(def);
+		else byMatcher.set(key, {
+			matcher,
+			defs: [def]
+		});
 	}
 	return byMatcher;
 }
@@ -13101,6 +13178,24 @@ function importBooleanPassthroughFields({ h, converterConfig }) {
 	return Object.fromEntries((converterConfig.booleanPassthroughFields ?? []).filter(({ tool }) => typeof h[tool] === "boolean").map(({ canonical, tool }) => [canonical, h[tool]]));
 }
 /**
+* Emit the configured number passthrough fields on the tool side, mapping each
+* canonical field name to its (possibly renamed) tool field name. Only finite
+* numbers are carried through.
+*/
+function emitNumberPassthroughFields({ def, hookType, converterConfig }) {
+	return Object.fromEntries((converterConfig.numberPassthroughFields ?? []).filter(({ canonical, commandOnly }) => {
+		if (commandOnly === true && hookType !== "command") return false;
+		return Number.isFinite(def[canonical]);
+	}).map(({ canonical, tool }) => [tool, def[canonical]]));
+}
+/**
+* Import the configured number passthrough fields back into canonical fields,
+* reversing {@link emitNumberPassthroughFields}. Only finite numbers are read.
+*/
+function importNumberPassthroughFields({ h, converterConfig }) {
+	return Object.fromEntries((converterConfig.numberPassthroughFields ?? []).filter(({ tool }) => Number.isFinite(h[tool])).map(({ canonical, tool }) => [canonical, h[tool]]));
+}
+/**
 * Emit the configured string passthrough fields on the tool side, mapping each
 * canonical field name to its (possibly renamed) tool field name. Only non-empty
 * string values are carried through.
@@ -13138,17 +13233,45 @@ function importArrayPassthroughFields({ h, converterConfig, logger }) {
 	return Object.fromEntries(fields.filter(({ tool }) => isSafeStringArray(h[tool])).map(({ canonical, tool }) => [canonical, h[tool]]));
 }
 /**
+* Emit the configured string-map passthrough fields on the tool side. Only maps
+* whose values are all control-character-free strings are carried through.
+*/
+function emitRecordPassthroughFields({ def, hookType, converterConfig }) {
+	return Object.fromEntries((converterConfig.recordPassthroughFields ?? []).filter(({ canonical, commandOnly }) => {
+		if (commandOnly === true && hookType !== "command") return false;
+		return isSafeStringRecord(def[canonical]);
+	}).map(({ canonical, tool }) => [tool, def[canonical]]));
+}
+/**
+* Import the configured string-map passthrough fields, reversing
+* {@link emitRecordPassthroughFields}.
+*/
+function importRecordPassthroughFields({ h, hookType, converterConfig, logger }) {
+	const fields = (converterConfig.recordPassthroughFields ?? []).filter(({ commandOnly }) => commandOnly !== true || hookType === "command");
+	for (const { tool } of fields) if (h[tool] !== void 0 && !isSafeStringRecord(h[tool])) logger?.warn(`Dropping "${tool}" while importing a hook: it must be a map of strings whose keys are non-empty and free of "=", and whose keys and values carry no newline, carriage return or NUL characters.`);
+	return Object.fromEntries(fields.filter(({ tool }) => isSafeStringRecord(h[tool])).map(({ canonical, tool }) => [canonical, h[tool]]));
+}
+/**
+* Check a value against the shape its field documents. A string field also
+* rejects control characters, matching the canonical `safeString` so an
+* imported value cannot fail validation on the next generate.
+*/
+function isGroupPassthroughValue(value, valueType = "object") {
+	if (valueType === "string") return typeof value === "string" && !CONTROL_CHARS.some((char) => value.includes(char));
+	return isPlainObject$1(value);
+}
+/**
 * Emit the configured group-level passthrough fields, taken from the first
 * definition of the group that carries one.
 */
 function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }) {
 	const emitted = {};
-	for (const { canonical, tool } of converterConfig.groupPassthroughFields ?? []) {
+	for (const { canonical, tool, valueType } of converterConfig.groupPassthroughFields ?? []) {
 		const carried = defs.map((def) => def[canonical]);
-		const first = carried.find((value) => isPlainObject$1(value));
+		const first = carried.find((value) => isGroupPassthroughValue(value, valueType));
 		if (first === void 0) continue;
 		const firstStable = stableJson(first);
-		const agrees = (value) => isPlainObject$1(value) && stableJson(value) === firstStable;
+		const agrees = (value) => isGroupPassthroughValue(value, valueType) && stableJson(value) === firstStable;
 		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${JSON.stringify(first)} — including any that asked for something else, or for nothing.`);
 		emitted[tool] = first;
 	}
@@ -13160,7 +13283,7 @@ function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }
 */
 function importGroupPassthroughFields({ rawEntry, converterConfig }) {
 	const entry = rawEntry;
-	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool }) => isPlainObject$1(entry[tool])).map(({ canonical, tool }) => [canonical, entry[tool]]));
+	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool, valueType }) => isGroupPassthroughValue(entry[tool], valueType)).map(({ canonical, tool }) => [canonical, entry[tool]]));
 }
 /**
 * Emit the payload fields specific to a hook type — `url`/`headers`/
@@ -13206,6 +13329,11 @@ function buildToolHooks({ defs, converterConfig }) {
 				hookType,
 				converterConfig
 			}),
+			...emitNumberPassthroughFields({
+				def,
+				hookType,
+				converterConfig
+			}),
 			...emitStringPassthroughFields({
 				def,
 				hookType,
@@ -13216,6 +13344,11 @@ function buildToolHooks({ defs, converterConfig }) {
 				hookType,
 				converterConfig
 			}),
+			...emitRecordPassthroughFields({
+				def,
+				hookType,
+				converterConfig
+			}),
 			type: hookType,
 			...command !== void 0 && command !== null && { command },
 			...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout },
@@ -13246,10 +13379,13 @@ function canonicalToToolHooks({ config, toolOverrideHooks, converterConfig, logg
 	const result = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
 		const toolEventName = converterConfig.canonicalToToolEventNames[eventName] ?? eventName;
-		const byMatcher = groupDefinitionsByMatcher(definitions);
+		const byMatcher = groupDefinitionsByMatcher({
+			definitions,
+			converterConfig
+		});
 		const entries = [];
 		const isNoMatcherEvent = converterConfig.noMatcherEvents?.has(eventName) ?? false;
-		for (const [matcherKey, defs] of byMatcher) {
+		for (const { matcher: matcherKey, defs } of byMatcher.values()) {
 			if (isNoMatcherEvent && matcherKey) logger?.warn(`matcher "${matcherKey}" on "${eventName}" hook will be ignored — this event does not support matchers`);
 			const hooks = buildToolHooks({
 				defs,
@@ -13329,9 +13465,27 @@ function isStringArray(value) {
 }
 /** Compare object values without letting key order decide the answer. */
 function stableJson(value) {
+	if (typeof value === "string") return JSON.stringify(value);
 	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a.localeCompare(b))));
 }
 /**
+* A string map safe to hand a tool as a hook's environment block. On top of
+* {@link isStringRecord} it rejects a non-plain object (a class instance is not
+* data) and applies the control-character rule to the values, as
+* {@link isSafeStringArray} does for `args`.
+*
+* The keys are checked more strictly than the values. A tool builds each entry
+* back into a `KEY=VALUE` string for the spawned process, so a key holding `=`
+* (or a control character, or nothing at all) names a different variable than
+* it appears to — `PATH=/tmp/evil` written as a key would set `PATH`. An
+* authored `.rulesync/hooks.*` can arrive via `rulesync fetch`, so that is not
+* a shape to pass along.
+*/
+function isSafeStringRecord(value) {
+	if (!isPlainObject$1(value) || !isStringRecord(value)) return false;
+	return Object.entries(value).every(([key, entry]) => key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || entry.includes(char)));
+}
+/**
 * Control characters cannot ride from an existing tool config into a canonical
 * field the schema guards with `safeString`, or the next generate fails
 * validation on a file this import itself wrote — and the hooks feature is
@@ -13384,6 +13538,10 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, logger }) {
 			h,
 			converterConfig
 		}),
+		...importNumberPassthroughFields({
+			h,
+			converterConfig
+		}),
 		...importStringPassthroughFields({
 			h,
 			converterConfig
@@ -13393,6 +13551,12 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, logger }) {
 			converterConfig,
 			logger
 		}),
+		...importRecordPassthroughFields({
+			h,
+			hookType,
+			converterConfig,
+			logger
+		}),
 		...importGroupPassthroughFields({
 			rawEntry,
 			converterConfig
@@ -13910,6 +14074,14 @@ var ClaudecodeHooks = class extends ToolHooks {
 	isDeletable() {
 		return false;
 	}
+	/**
+	* The converter config used for both directions. Exposed as a static hook so
+	* plugin-scoped subclasses can swap tool-specific details (e.g. the project
+	* directory variable) without duplicating the rest of the config.
+	*/
+	static getConverterConfig() {
+		return CLAUDE_CONVERTER_CONFIG;
+	}
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: CLAUDECODE_DIR,
@@ -13935,7 +14107,7 @@ var ClaudecodeHooks = class extends ToolHooks {
 		const claudeHooks = canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config.claudecode?.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG,
+			converterConfig: this.getConverterConfig(),
 			logger
 		});
 		const fileContent = applySharedConfigPatch({
@@ -13962,7 +14134,7 @@ var ClaudecodeHooks = class extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: settings.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG
+			converterConfig: this.constructor.getConverterConfig()
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -13991,6 +14163,21 @@ var ClaudecodePluginHooks = class extends ClaudecodeHooks {
 	isDeletable() {
 		return true;
 	}
+	/**
+	* Plugin hook scripts ship inside the plugin, so their commands must resolve
+	* against the plugin install directory rather than the consumer's project
+	* root. Upstream documents `"${CLAUDE_PLUGIN_ROOT}"/scripts/format-code.sh`;
+	* `$CLAUDE_PROJECT_DIR` would expand to a path in the consumer's own repo,
+	* where the bundled script does not exist.
+	*
+	* @see https://code.claude.com/docs/en/plugins-reference
+	*/
+	static getConverterConfig() {
+		return {
+			...super.getConverterConfig(),
+			projectDirVar: "$CLAUDE_PLUGIN_ROOT"
+		};
+	}
 	static getSettablePaths() {
 		return {
 			relativeDirPath: CLAUDECODE_PLUGIN_HOOKS_DIR,
@@ -14013,6 +14200,10 @@ const CODEXCLI_CONVERTER_CONFIG = {
 	}, {
 		canonical: "statusMessage",
 		tool: "statusMessage"
+	}],
+	numberPassthroughFields: [{
+		canonical: "additionalContextLimit",
+		tool: "additionalContextLimit"
 	}]
 };
 /**
@@ -15056,7 +15247,13 @@ const FACTORYDROID_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: FACTORYDROID_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "$FACTORY_PROJECT_DIR",
 	prefixDotRelativeCommandsOnly: true,
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	groupPassthroughFields: [{
+		canonical: "commandRegex",
+		tool: "commandRegex",
+		valueType: "string",
+		subdividesGroup: true
+	}]
 };
 var FactorydroidHooks = class FactorydroidHooks extends ToolHooks {
 	constructor(params) {
@@ -15152,7 +15349,8 @@ const GOOSE_CONVERTER_CONFIG = {
 	canonicalToToolEventNames: CANONICAL_TO_GOOSE_EVENT_NAMES,
 	toolToCanonicalEventNames: GOOSE_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	wildcardMatcherMeansAll: true
 };
 /**
 * Represents a Goose lifecycle hooks file.
@@ -15247,6 +15445,11 @@ const GROKCLI_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: GROKCLI_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	supportedHookTypes: /* @__PURE__ */ new Set(["command", "http"]),
+	recordPassthroughFields: [{
+		canonical: "env",
+		tool: "env",
+		commandOnly: true
+	}],
 	noMatcherEvents: /* @__PURE__ */ new Set([
 		"sessionStart",
 		"sessionEnd",
@@ -21197,6 +21400,27 @@ function resolveGooseType(config, url) {
 	return canonicalTransport(config) === "builtin" ? "builtin" : "stdio";
 }
 /**
+* The Goose extension types that carry an MCP server. Goose also documents
+* `builtin`, `platform`, `frontend` and `inline_python` extensions, which have
+* no canonical MCP counterpart: they name capabilities Goose provides itself
+* rather than a server rulesync could describe.
+*/
+const GOOSE_MCP_EXTENSION_TYPES = /* @__PURE__ */ new Set([
+	"stdio",
+	"streamable_http",
+	"sse"
+]);
+/**
+* Resolves the Goose extension type of an existing `extensions:` entry the way
+* Goose itself reads it: the declared `type`, or the shape of the entry when
+* the key is absent.
+*/
+function existingExtensionType(ext) {
+	if (typeof ext.type === "string") return ext.type;
+	if (typeof ext.cmd === "string") return "stdio";
+	if (typeof ext.uri === "string") return "streamable_http";
+}
+/**
 * Resolves the canonical timeout for a server (`timeout` or `networkTimeout`).
 */
 function resolveGooseTimeout(config) {
@@ -21222,15 +21446,20 @@ function applyGooseStdioFields(ext, config) {
 /**
 * Converts a single rulesync canonical MCP server into a Goose `extensions:` entry.
 */
-function convertServerToGooseExtension(name, config) {
+function convertServerToGooseExtension(name, config, logger) {
 	const url = resolveGooseUrl(config);
 	const gooseType = resolveGooseType(config, url);
 	const ext = {
 		name,
 		type: gooseType
 	};
-	if (gooseType === "stdio") applyGooseStdioFields(ext, config);
-	else if (gooseType === "sse" || gooseType === "streamable_http") {
+	if (gooseType === "stdio") {
+		applyGooseStdioFields(ext, config);
+		if (typeof ext.cmd !== "string" || ext.cmd === "") {
+			warnWithFallback(logger, `Goose extension "${name}" has no command to run; skipping it rather than writing a stdio extension Goose cannot start to ~/.config/goose/config.yaml.`);
+			return;
+		}
+	} else if (gooseType === "sse" || gooseType === "streamable_http") {
 		if (url !== void 0) ext.uri = url;
 		if (isPlainObject$1(config.headers)) ext.headers = omitPrototypePollutionKeys(config.headers);
 	}
@@ -21245,13 +21474,41 @@ function convertServerToGooseExtension(name, config) {
 * Goose uses a non-standard schema: `name`, `type` (`stdio` | `streamable_http`
 * | `sse` | `builtin`), `cmd`/`args`/`envs` for stdio, `uri`/`headers` for
 * remote, plus `enabled` and `timeout`.
-*/
-function convertToGooseFormat(mcpServers) {
-	const extensions = {};
+*
+* `extensions:` is co-owned: alongside the MCP servers rulesync manages it also
+* holds Goose's own `builtin`/`platform`/`frontend`/`inline_python` extensions
+* (`developer`, `memory`, ...), which have no canonical MCP representation.
+* Those entries are carried over from `existingExtensions` untouched — removing
+* `developer` alone costs the agent its shell and text-editor tools. Only an
+* entry rulesync can positively identify as an MCP server is rulesync's to
+* replace, so a server deleted from `.rulesync/.mcp.json` is retracted (with a
+* warning naming it) while an entry of an unrecognized shape or a future
+* extension type is left alone rather than assumed to be ours.
+*/
+function convertToGooseFormat({ mcpServers, existingExtensions, logger }) {
+	const generated = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
-		extensions[name] = convertServerToGooseExtension(name, config);
+		const ext = convertServerToGooseExtension(name, config, logger);
+		if (ext !== void 0) generated[name] = ext;
 	}
+	const extensions = {};
+	const retracted = [];
+	for (const [name, ext] of Object.entries(existingExtensions)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		const type = isRecord(ext) ? existingExtensionType(ext) : void 0;
+		if (type !== void 0 && GOOSE_MCP_EXTENSION_TYPES.has(type)) {
+			if (!Object.hasOwn(generated, name)) retracted.push(name);
+			continue;
+		}
+		if (!Object.hasOwn(generated, name)) {
+			extensions[name] = ext;
+			continue;
+		}
+		if (generated[name]?.type !== type) warnWithFallback(logger, `Goose extension "${name}" already exists in config.yaml as a non-MCP extension; the MCP server of the same name replaces it.`);
+	}
+	if (retracted.length > 0) warnWithFallback(logger, `Removing MCP extension(s) ${retracted.map((name) => `"${name}"`).join(", ")} from ~/.config/goose/config.yaml: they are not in the generated rulesync MCP config. Import them first if they were added with \`goose configure\`.`);
+	Object.assign(extensions, generated);
 	return extensions;
 }
 /**
@@ -21262,16 +21519,27 @@ function convertToGooseFormat(mcpServers) {
 * so both `url` and the Claude-specific `httpUrl` alias come back as `url`; and
 * the `streamable_http` type maps back to canonical `http`. These are the
 * canonical/preferred forms, so re-generating produces an equivalent config.
+*
+* Non-MCP extension types (`builtin`, `platform`, `frontend`, `inline_python`)
+* are skipped: they describe capabilities Goose provides itself, and importing
+* one would strip the type that makes it work — a `builtin` entry came back as
+* a `stdio` extension with no `cmd` that Goose cannot start. They stay in `config.yaml`,
+* which generation preserves.
 */
 function convertFromGooseFormat(extensions) {
 	const result = {};
+	const skipped = [];
 	for (const [name, ext] of Object.entries(extensions)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(ext)) continue;
+		const type = existingExtensionType(ext);
+		if (type === void 0 || !GOOSE_MCP_EXTENSION_TYPES.has(type)) {
+			skipped.push(name);
+			continue;
+		}
 		const server = {};
-		const type = typeof ext.type === "string" ? ext.type : void 0;
 		if (type === "sse") server.type = "sse";
 		else if (type === "streamable_http") server.type = "http";
-		else if (type === "stdio") server.type = "stdio";
+		else server.type = "stdio";
 		if (typeof ext.cmd === "string") server.command = ext.cmd;
 		if (isStringArray$1(ext.args)) server.args = ext.args;
 		if (isPlainObject$1(ext.envs)) server.env = omitPrototypePollutionKeys(ext.envs);
@@ -21281,6 +21549,7 @@ function convertFromGooseFormat(extensions) {
 		if (typeof ext.timeout === "number") server.timeout = ext.timeout;
 		result[name] = server;
 	}
+	if (skipped.length > 0) warnWithFallback(void 0, `Skipping ${skipped.length} non-MCP Goose extension(s) (${skipped.map((name) => `"${name}"`).join(", ")}): they describe capabilities Goose provides itself and have no rulesync representation.`);
 	return result;
 }
 /**
@@ -21402,15 +21671,25 @@ var GooseMcp = class GooseMcp extends ToolMcp {
 				global
 			});
 		}
-		const merged = {
-			...parseGooseConfig(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath),
-			extensions: convertToGooseFormat(rulesyncMcp.getMcpServers())
-		};
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const config = parseGooseConfig(existingContent, paths.relativeDirPath, paths.relativeFilePath);
+		const existingExtensions = isRecord(config.extensions) ? config.extensions : {};
 		return new GooseMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: dump(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { extensions: convertToGooseFormat({
+					mcpServers: rulesyncMcp.getMcpServers(),
+					existingExtensions,
+					logger
+				}) },
+				filePath
+			}),
 			validate,
 			global
 		});
@@ -28119,7 +28398,8 @@ const FACTORYDROID_OVERRIDE_KEYS = [
 	"interactionMode",
 	"extraKnownMarketplaces",
 	"enabledPlugins",
-	"hooksDisabled"
+	"hooksDisabled",
+	"disabledSkills"
 ];
 /**
 * Permissions adapter for Factory Droid.
@@ -32270,6 +32550,30 @@ const CANONICAL_TO_ZED_TOOL_NAMES = {
 	webfetch: "fetch",
 	websearch: "search_web"
 };
+/**
+* Canonical categories whose Zed tool is not permission-gated. Zed's gated list
+* is `terminal`, `edit_file`, `write_file`, `delete_path`, `move_path`,
+* `copy_path`, `create_directory`, `fetch`, `search_web` and `skill`; the
+* read-only tools (`read_file`, `grep`, `find_path`, `list_directory`) sit in
+* Zed's own `EXCLUDED_TOOLS` and never call `decide_permission_from_settings`,
+* so a `tools.<name>` entry for one is config Zed never consults. Zed's real
+* read-denial surface is `private_files`, which the ignore feature owns.
+*
+* @see https://zed.dev/docs/ai/tool-permissions#supported-tools
+*/
+const ZED_EXCLUDED_CANONICAL_CATEGORIES = /* @__PURE__ */ new Set([
+	"read",
+	"grep",
+	"glob"
+]);
+/** The Zed-side spellings of the same tools, for a category that names one directly. */
+const ZED_EXCLUDED_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"read_file",
+	"grep",
+	"find_path",
+	"list_directory"
+]);
+const isZedExcludedCategory = (category) => ZED_EXCLUDED_CANONICAL_CATEGORIES.has(category) || ZED_EXCLUDED_TOOL_NAMES.has(toZedToolName(category));
 const ZED_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_ZED_TOOL_NAMES).map(([k, v]) => [v, k]));
 function toZedToolName(canonical) {
 	return CANONICAL_TO_ZED_TOOL_NAMES[canonical] ?? canonical;
@@ -32391,15 +32695,21 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		const existingTools = asRecord(toolPermissions.tools);
 		let managedDefault;
 		const managedTools = {};
+		const excludedCategories = [];
 		for (const [category, rules] of Object.entries(config.permission)) {
 			if (category === "*") {
 				for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") managedDefault = CANONICAL_TO_ZED_ACTION[action];
 				else logger?.warn(`Zed permissions: dropping the "*" category rule for pattern "${pattern}" — Zed's global tool-permission default takes no patterns; scope the rule to a tool category instead.`);
 				continue;
 			}
+			if (isZedExcludedCategory(category)) {
+				if (Object.values(rules).some((action) => action === "deny" || action === "ask")) excludedCategories.push(category);
+				continue;
+			}
 			const tool = buildZedToolPermission(rules);
 			if (tool) managedTools[toZedToolName(category)] = tool;
 		}
+		if (excludedCategories.length > 0) logger?.warn(`Zed permissions: dropping the ${excludedCategories.map((category) => `"${category}"`).join(", ")} ${excludedCategories.length === 1 ? "category" : "categories"} — Zed does not gate its read-only tools, so the entries would never be consulted. Zed's read-denial surface is \`private_files\`, which the ignore feature writes from \`.rulesync/.aiignore\`.`);
 		const managedToolNames = new Set(Object.keys(managedTools));
 		if ("*" in config.permission) managedToolNames.add("*");
 		const preservedTools = Object.fromEntries(Object.entries(existingTools).filter(([toolName]) => !managedToolNames.has(toolName)));
@@ -33191,18 +33501,16 @@ var DirFeatureProcessor = class {
 				})) dirHasChanges = true;
 			}
 			const otherFiles = aiDir.getOtherFiles();
-			const otherFileContents = [];
 			for (const file of otherFiles) {
-				const contentWithNewline = addTrailingNewline(file.fileBuffer.toString("utf-8"));
-				otherFileContents.push(contentWithNewline);
-				if (!dirHasChanges) {
-					const filePath = join(dirPath, file.relativeFilePathToDirPath);
-					if (!fileContentsEquivalent({
-						filePath,
-						expected: contentWithNewline,
-						existing: await readFileContentOrNull(filePath)
-					})) dirHasChanges = true;
-				}
+				if (dirHasChanges) break;
+				const filePath = join(dirPath, file.relativeFilePathToDirPath);
+				const existingBuffer = await readFileBufferOrNull(filePath);
+				if (!companionFileContentsEquivalent({
+					filePath,
+					expected: file.fileBuffer,
+					existing: existingBuffer,
+					composed: file.composed
+				})) dirHasChanges = true;
 			}
 			if (!dirHasChanges) continue;
 			const relativeDir = aiDir.getRelativePathFromCwd();
@@ -33222,11 +33530,8 @@ var DirFeatureProcessor = class {
 					await writeFileContent(join(dirPath, mainFile.name), mainFileContent);
 					changedPaths.push(join(relativeDir, mainFile.name));
 				}
-				for (const [i, file] of otherFiles.entries()) {
-					const filePath = join(dirPath, file.relativeFilePathToDirPath);
-					const content = otherFileContents[i];
-					if (content === void 0) throw new Error(`Internal error: content for file ${file.relativeFilePathToDirPath} is undefined. This indicates a synchronization issue between otherFiles and otherFileContents arrays.`);
-					await writeFileContent(filePath, content);
+				for (const file of otherFiles) {
+					await writeFileBuffer(join(dirPath, file.relativeFilePathToDirPath), file.fileBuffer);
 					changedPaths.push(join(relativeDir, file.relativeFilePathToDirPath));
 				}
 			}
@@ -33952,6 +34257,39 @@ function buildClaudecodeSkillFrontmatter({ rulesyncFrontmatter, resolvedDisableM
 	return frontmatter;
 }
 /**
+* Escapes the glob metacharacters in a directory path so it matches literally.
+* A real directory name may contain them — `app/[slug]` in a Next.js tree is
+* the common case, and unescaped `[slug]` reads as a bracket expression that
+* matches a different subtree (or nothing at all).
+*
+* @see https://code.claude.com/docs/en/memory
+*/
+function escapeGlobLiteral(dirPath) {
+	return dirPath.replaceAll(/[\\*?[\]{}()!]/g, "\\$&");
+}
+/**
+* Claude Code scopes a nested skill by its location: a skill living in
+* `apps/web/.claude/skills/deploy` only activates while working under
+* `apps/web`. rulesync generates every imported skill into the project-root
+* `.claude/skills/`, so on import that location-based scoping has to be
+* re-expressed as an explicit `paths` glob — otherwise the round-trip silently
+* promotes a subtree skill to global activation.
+*
+* Returns the derived glob for a nested discovery root, or `undefined` for the
+* project-root `.claude/skills` (and for any root whose subtree cannot be
+* determined), where no scoping is implied.
+*
+* @see https://code.claude.com/docs/en/skills
+*/
+function deriveNestedSkillPaths(relativeDirPath) {
+	const posixDirPath = toPosixPath(relativeDirPath);
+	const skillsDirSuffix = `/${toPosixPath(CLAUDECODE_SKILLS_DIR_PATH)}`;
+	if (!posixDirPath.endsWith(skillsDirSuffix)) return;
+	const subtree = posixDirPath.slice(0, -skillsDirSuffix.length);
+	if (subtree === "" || subtree === ".") return;
+	return [`${escapeGlobLiteral(subtree)}/**`];
+}
+/**
 * Represents a Claude Code skill directory.
 * Unlike subagents and commands, skills are directories containing SKILL.md and other files.
 * Extends ToolSkill to inherit directory management and security features from AiDir.
@@ -34039,6 +34377,7 @@ var ClaudecodeSkill = class extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
+		const resolvedPaths = frontmatter.paths !== void 0 ? frontmatter.paths : deriveNestedSkillPaths(this.relativeDirPath);
 		const claudecodeSection = {
 			...frontmatter.when_to_use && { when_to_use: frontmatter.when_to_use },
 			...frontmatter["allowed-tools"] && { "allowed-tools": frontmatter["allowed-tools"] },
@@ -34055,7 +34394,7 @@ var ClaudecodeSkill = class extends ToolSkill {
 			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
 			...this.relativeDirPath === CLAUDECODE_SCHEDULED_TASKS_DIR_PATH && { "scheduled-task": true },
-			...frontmatter.paths !== void 0 && { paths: frontmatter.paths }
+			...resolvedPaths !== void 0 && { paths: resolvedPaths }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -34453,7 +34792,8 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 			fileBuffer: Buffer.from(dump(openaiObject, {
 				lineWidth: -1,
 				noRefs: true
-			}))
+			})),
+			composed: true
 		}] : baseOtherFiles;
 		return new CodexCliSkill({
 			outputRoot,
@@ -34513,7 +34853,11 @@ const CopilotSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	license: z.optional(z.string()),
-	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
+	"argument-hint": z.optional(z.string()),
+	"user-invocable": z.optional(z.boolean()),
+	"disable-model-invocation": z.optional(z.boolean()),
+	context: z.optional(z.string())
 });
 /**
 * Represents a GitHub Copilot skill directory.
@@ -34571,7 +34915,11 @@ var CopilotSkill = class CopilotSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const copilotSection = {
 			...frontmatter.license !== void 0 && { license: frontmatter.license },
-			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] }
+			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] },
+			...frontmatter["argument-hint"] !== void 0 && { "argument-hint": frontmatter["argument-hint"] },
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
+			...frontmatter.context !== void 0 && { context: frontmatter.context }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -34593,11 +34941,24 @@ var CopilotSkill = class CopilotSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = CopilotSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const copilotSection = rulesyncFrontmatter.copilot;
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotSection
+		});
+		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotSection
+		});
 		const copilotFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...rulesyncFrontmatter.copilot?.license !== void 0 && { license: rulesyncFrontmatter.copilot.license },
-			...rulesyncFrontmatter.copilot?.["allowed-tools"] !== void 0 && { "allowed-tools": rulesyncFrontmatter.copilot["allowed-tools"] }
+			...copilotSection?.license !== void 0 && { license: copilotSection.license },
+			...copilotSection?.["allowed-tools"] !== void 0 && { "allowed-tools": copilotSection["allowed-tools"] },
+			...copilotSection?.["argument-hint"] !== void 0 && { "argument-hint": copilotSection["argument-hint"] },
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
+			...copilotSection?.context !== void 0 && { context: copilotSection.context }
 		};
 		return new CopilotSkill({
 			outputRoot,
@@ -34744,14 +35105,23 @@ var CopilotcliSkill = class CopilotcliSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = CopilotcliSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const copilotcliSection = rulesyncFrontmatter.copilotcli;
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotcliSection
+		});
+		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotcliSection
+		});
 		const copilotcliFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...rulesyncFrontmatter.copilotcli?.license !== void 0 && { license: rulesyncFrontmatter.copilotcli.license },
-			...rulesyncFrontmatter.copilotcli?.["allowed-tools"] !== void 0 && { "allowed-tools": rulesyncFrontmatter.copilotcli["allowed-tools"] },
-			...rulesyncFrontmatter.copilotcli?.["argument-hint"] !== void 0 && { "argument-hint": rulesyncFrontmatter.copilotcli["argument-hint"] },
-			...rulesyncFrontmatter.copilotcli?.["user-invocable"] !== void 0 && { "user-invocable": rulesyncFrontmatter.copilotcli["user-invocable"] },
-			...rulesyncFrontmatter.copilotcli?.["disable-model-invocation"] !== void 0 && { "disable-model-invocation": rulesyncFrontmatter.copilotcli["disable-model-invocation"] }
+			...copilotcliSection?.license !== void 0 && { license: copilotcliSection.license },
+			...copilotcliSection?.["allowed-tools"] !== void 0 && { "allowed-tools": copilotcliSection["allowed-tools"] },
+			...copilotcliSection?.["argument-hint"] !== void 0 && { "argument-hint": copilotcliSection["argument-hint"] },
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
 		return new CopilotcliSkill({
 			outputRoot,
@@ -35309,7 +35679,9 @@ const FactorydroidSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
 	"user-invocable": z.optional(z.boolean()),
-	"disable-model-invocation": z.optional(z.boolean())
+	"disable-model-invocation": z.optional(z.boolean()),
+	enabled: z.optional(z.boolean()),
+	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
 });
 /**
 * Represents a Factory Droid skill directory.
@@ -35365,7 +35737,9 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const factorydroidBlock = {
 			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
-			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] }
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
+			...frontmatter.enabled !== void 0 && { enabled: frontmatter.enabled },
+			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -35387,19 +35761,22 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = FactorydroidSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const factorydroidSection = rulesyncFrontmatter.factorydroid;
 		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
 			rootFrontmatter: rulesyncFrontmatter,
-			section: rulesyncFrontmatter.factorydroid
+			section: factorydroidSection
 		});
 		const resolvedUserInvocable = resolveUserInvocable({
 			rootFrontmatter: rulesyncFrontmatter,
-			section: rulesyncFrontmatter.factorydroid
+			section: factorydroidSection
 		});
 		const factorydroidFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
-			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable }
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...factorydroidSection?.enabled !== void 0 && { enabled: factorydroidSection.enabled },
+			...factorydroidSection?.["allowed-tools"] !== void 0 && { "allowed-tools": factorydroidSection["allowed-tools"] }
 		};
 		return new FactorydroidSkill({
 			outputRoot,
@@ -39420,7 +39797,17 @@ var ClaudecodeSubagent = class ClaudecodeSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	/**
+	* Last chance to adjust the tool frontmatter before it is written. The base
+	* implementation only warns about names Claude Code rejects; plugin-scoped
+	* subclasses extend it to drop fields Claude Code refuses to honor for
+	* plugin-shipped agents.
+	*/
+	static sanitizeFrontmatter({ frontmatter, relativeFilePath, logger }) {
+		if (frontmatter.name.includes(":")) logger?.warn(`Claude Code will reject the subagent in ${relativeFilePath}: the name "${frontmatter.name}" contains ":", which is reserved for plugin namespacing.`);
+		return frontmatter;
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const claudecodeSection = this.filterToolSpecificSection(rulesyncFrontmatter.claudecode ?? {}, ["name", "description"]);
 		const rawClaudecodeFrontmatter = {
@@ -39430,7 +39817,11 @@ var ClaudecodeSubagent = class ClaudecodeSubagent extends ToolSubagent {
 		};
 		const result = ClaudecodeSubagentFrontmatterSchema.safeParse(rawClaudecodeFrontmatter);
 		if (!result.success) throw new Error(`Invalid claudecode subagent frontmatter in ${rulesyncSubagent.getRelativeFilePath()}: ${formatError(result.error)}`);
-		const claudecodeFrontmatter = result.data;
+		const claudecodeFrontmatter = this.sanitizeFrontmatter({
+			frontmatter: result.data,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			logger
+		});
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, claudecodeFrontmatter);
 		const paths = this.getSettablePaths({ global });
@@ -39499,6 +39890,21 @@ var ClaudecodeSubagent = class ClaudecodeSubagent extends ToolSubagent {
 };
 //#endregion
 //#region src/features/subagents/claudecode-plugin-subagent.ts
+/**
+* Claude Code refuses these for plugin-shipped agents "for security reasons",
+* so emitting them leaves the author believing the agent is constrained when it
+* is not. Only these three are dropped: the other fields upstream does not list
+* (e.g. `color`) are merely ignored, with no misleading security posture.
+*
+* @see https://code.claude.com/docs/en/plugins-reference
+*/
+const PLUGIN_FORBIDDEN_FIELDS = [
+	"hooks",
+	"mcpServers",
+	"permissionMode"
+];
+/** The only `isolation` value plugin agents accept. */
+const PLUGIN_ISOLATION_VALUE = "worktree";
 var ClaudecodePluginSubagent = class extends ClaudecodeSubagent {
 	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
 		const targets = rulesyncSubagent.getFrontmatter().targets;
@@ -39507,6 +39913,21 @@ var ClaudecodePluginSubagent = class extends ClaudecodeSubagent {
 	static getSettablePaths() {
 		return { relativeDirPath: CLAUDECODE_PLUGIN_AGENTS_DIR };
 	}
+	static sanitizeFrontmatter({ frontmatter, relativeFilePath, logger }) {
+		const sanitized = { ...super.sanitizeFrontmatter({
+			frontmatter,
+			relativeFilePath,
+			logger
+		}) };
+		const dropped = PLUGIN_FORBIDDEN_FIELDS.filter((field) => sanitized[field] !== void 0);
+		for (const field of PLUGIN_FORBIDDEN_FIELDS) delete sanitized[field];
+		if (dropped.length > 0) logger?.warn(`Dropping ${dropped.join(", ")} from claudecode-plugin subagent ${relativeFilePath}: Claude Code does not support these fields for plugin-shipped agents.`);
+		if (sanitized.isolation !== void 0 && sanitized.isolation !== PLUGIN_ISOLATION_VALUE) {
+			logger?.warn(`Dropping isolation "${sanitized.isolation}" from claudecode-plugin subagent ${relativeFilePath}: "${PLUGIN_ISOLATION_VALUE}" is the only value Claude Code accepts for plugin-shipped agents.`);
+			delete sanitized.isolation;
+		}
+		return sanitized;
+	}
 };
 //#endregion
 //#region src/features/subagents/cline-subagent.ts
@@ -43160,7 +43581,8 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			outputRoot: this.outputRoot,
 			relativeDirPath: RulesyncSubagent.getSettablePaths().relativeDirPath,
 			rulesyncSubagent,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		}));
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
@@ -45113,7 +45535,7 @@ var CodexcliRule = class CodexcliRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/copilot-rule.ts
-const CopilotRuleFrontmatterSchema = z.object({
+const CopilotRuleFrontmatterSchema = z.looseObject({
 	description: z.optional(z.string()),
 	applyTo: z.optional(z.string()),
 	name: z.optional(z.string()),
@@ -45169,15 +45591,13 @@ var CopilotRule = class CopilotRule extends ToolRule {
 	toRulesyncRule() {
 		let globs;
 		if (this.frontmatter.applyTo) globs = this.frontmatter.applyTo.split(",").map((g) => g.trim());
+		const { description, applyTo: _applyTo, ...copilotFields } = this.frontmatter;
 		const rulesyncFrontmatter = {
 			targets: ["*"],
 			root: this.isRoot(),
-			description: this.frontmatter.description,
+			description,
 			globs,
-			...(this.frontmatter.excludeAgent || this.frontmatter.name) && { copilot: {
-				...this.frontmatter.excludeAgent && { excludeAgent: this.frontmatter.excludeAgent },
-				...this.frontmatter.name && { name: this.frontmatter.name }
-			} }
+			...Object.keys(copilotFields).length > 0 && { copilot: copilotFields }
 		};
 		const relativeFilePath = this.getRelativeFilePath().replace(/\.instructions\.md$/, ".md");
 		return new RulesyncRule({
@@ -45194,10 +45614,9 @@ var CopilotRule = class CopilotRule extends ToolRule {
 		const root = rulesyncFrontmatter.root;
 		const paths = this.getSettablePaths({ global });
 		const copilotFrontmatter = {
+			...rulesyncFrontmatter.copilot,
 			description: rulesyncFrontmatter.description,
-			applyTo: rulesyncFrontmatter.globs?.length ? rulesyncFrontmatter.globs.join(",") : void 0,
-			excludeAgent: rulesyncFrontmatter.copilot?.excludeAgent,
-			name: rulesyncFrontmatter.copilot?.name
+			applyTo: rulesyncFrontmatter.globs?.length ? rulesyncFrontmatter.globs.join(",") : void 0
 		};
 		const body = rulesyncRule.getBody();
 		if (root) return new CopilotRule({
@@ -50894,6 +51313,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { JsonLogger as $, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as $t, RulesyncRuleFrontmatterSchema as A, PACKAGING_TOOL_TARGETS as At, RulesyncCheck as B, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Bt, CODEXCLI_DIR as C, removeTempDirectory as Ct, RulesyncSkill as D, writeFileContent as Dt, RulesyncSubagentFrontmatterSchema as E, toPosixPath as Et, getRulesyncSourceCandidates as F, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Ft, SKILL_FILE_NAME as G, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Gt, stringifyFrontmatter as H, RULESYNC_HOOKS_LEGACY_FILE_NAME as Ht, resolveRulesyncSourceWritePath as I, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as It, ConfigFileSchema as J, RULESYNC_MCP_RELATIVE_FILE_PATH as Jt, ConfigResolver as K, RULESYNC_MCP_FILE_NAME as Kt, parseJsonc as L, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Lt, RulesyncMcp as M, MAX_FILE_SIZE as Mt, RulesyncIgnore as N, RULESYNC_AIIGNORE_FILE_NAME as Nt, RulesyncSkillFrontmatterSchema as O, ALL_TOOL_TARGETS as Ot, RulesyncHooks as P, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Pt, ConsoleLogger as Q, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as Qt, RulesyncCommand as R, RULESYNC_CONFIG_SCHEMA_URL as Rt, CODEXCLI_BASH_RULES_FILE_NAME as S, removeFileStrict as St, RulesyncSubagent as T, runWithDirectoryRollback as Tt, loadYaml as U, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Ut, RulesyncCheckFrontmatterSchema as V, RULESYNC_HOOKS_FILE_NAME as Vt, SHARED_USER_MANAGED_CONFIG_PATHS as W, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Wt, SourceEntrySchema as X, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Xt, GITIGNORE_DESTINATION_KEY as Y, RULESYNC_MCP_SCHEMA_URL as Yt, findControlCharacter as Z, RULESYNC_PERMISSIONS_FILE_NAME as Zt, CLAUDECODE_LOCAL_RULE_FILE_NAME as _, readFileContent as _t, convertFromTool as a, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as an, assertTreeContainsNoSymlinks as at, CLAUDECODE_SKILLS_DIR_PATH as b, removeDirectoryStrict as bt, SubagentsProcessor as c, DEPRECATED_FEATURE_REPLACEMENTS as cn, createTempDirectory as ct, IgnoreProcessor as d, fileExists as dt, RULESYNC_PERMISSIONS_SCHEMA_URL as en, fallbackLogger as et, HooksProcessor as f, findFilesByGlobs as ft, CLAUDECODE_DIR as g, listDirectoryFiles as gt, QWENCODE_LOCAL_RULE_FILE_NAME as h, isSymlink as ht, getProcessorRegistryEntry as i, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as in, assertDirectoryIfExists as it, RulesyncPermissions as j, ToolTargetSchema as jt, RulesyncRule as k, ALL_TOOL_TARGETS_WITH_WILDCARD as kt, SkillsProcessor as l, formatError as ln, directoryExists as lt, QWENCODE_DIR as m, getHomeDirectory as mt, checkRulesyncDirExists as n, RULESYNC_RULES_RELATIVE_DIR_PATH as nn, CLIError as nt, isPackagingToolTarget as o, ALL_FEATURES as on, assertWritablePathInsideRoot as ot, CommandsProcessor as p, getFileSize as pt, CONFLICTING_TARGET_PAIRS as q, RULESYNC_MCP_LEGACY_FILE_NAME as qt, generate as r, RULESYNC_SKILLS_RELATIVE_DIR_PATH as rn, ErrorCodes as rt, RulesProcessor as s, ALL_FEATURES_WITH_WILDCARD as sn, checkPathTraversal as st, importFromTool as t, RULESYNC_RELATIVE_DIR_PATH as tn, warnOnConflictingFlags as tt, McpProcessor as u, ensureDir as ut, CLAUDECODE_MEMORIES_DIR_NAME as v, readFileContentOrNull as vt, getLocalSkillDirNames as w, resolvePath as wt, ChecksProcessor as x, removeFile as xt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as y, removeDirectory as yt, RulesyncCommandFrontmatterSchema as z, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as zt };
+export { JsonLogger as $, RULESYNC_PERMISSIONS_LEGACY_FILE_NAME as $t, RulesyncRuleFrontmatterSchema as A, ALL_TOOL_TARGETS_WITH_WILDCARD as At, RulesyncCheck as B, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Bt, CODEXCLI_DIR as C, removeTempDirectory as Ct, RulesyncSkill as D, writeFileBuffer as Dt, RulesyncSubagentFrontmatterSchema as E, toPosixPath as Et, getRulesyncSourceCandidates as F, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as Ft, SKILL_FILE_NAME as G, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Gt, stringifyFrontmatter as H, RULESYNC_HOOKS_FILE_NAME as Ht, resolveRulesyncSourceWritePath as I, RULESYNC_CHECKS_RELATIVE_DIR_PATH as It, ConfigFileSchema as J, RULESYNC_MCP_LEGACY_FILE_NAME as Jt, ConfigResolver as K, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Kt, parseJsonc as L, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Lt, RulesyncMcp as M, ToolTargetSchema as Mt, RulesyncIgnore as N, MAX_FILE_SIZE as Nt, RulesyncSkillFrontmatterSchema as O, writeFileContent as Ot, RulesyncHooks as P, RULESYNC_AIIGNORE_FILE_NAME as Pt, ConsoleLogger as Q, RULESYNC_PERMISSIONS_FILE_NAME as Qt, RulesyncCommand as R, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Rt, CODEXCLI_BASH_RULES_FILE_NAME as S, removeFileStrict as St, RulesyncSubagent as T, runWithDirectoryRollback as Tt, loadYaml as U, RULESYNC_HOOKS_LEGACY_FILE_NAME as Ut, RulesyncCheckFrontmatterSchema as V, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Vt, SHARED_USER_MANAGED_CONFIG_PATHS as W, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Wt, SourceEntrySchema as X, RULESYNC_MCP_SCHEMA_URL as Xt, GITIGNORE_DESTINATION_KEY as Y, RULESYNC_MCP_RELATIVE_FILE_PATH as Yt, findControlCharacter as Z, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Zt, CLAUDECODE_LOCAL_RULE_FILE_NAME as _, readFileContent as _t, convertFromTool as a, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as an, assertTreeContainsNoSymlinks as at, CLAUDECODE_SKILLS_DIR_PATH as b, removeDirectoryStrict as bt, SubagentsProcessor as c, ALL_FEATURES_WITH_WILDCARD as cn, createTempDirectory as ct, IgnoreProcessor as d, fileExists as dt, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as en, fallbackLogger as et, HooksProcessor as f, findFilesByGlobs as ft, CLAUDECODE_DIR as g, listDirectoryFiles as gt, QWENCODE_LOCAL_RULE_FILE_NAME as h, isSymlink as ht, getProcessorRegistryEntry as i, RULESYNC_SKILLS_RELATIVE_DIR_PATH as in, assertDirectoryIfExists as it, RulesyncPermissions as j, PACKAGING_TOOL_TARGETS as jt, RulesyncRule as k, ALL_TOOL_TARGETS as kt, SkillsProcessor as l, DEPRECATED_FEATURE_REPLACEMENTS as ln, directoryExists as lt, QWENCODE_DIR as m, getHomeDirectory as mt, checkRulesyncDirExists as n, RULESYNC_RELATIVE_DIR_PATH as nn, CLIError as nt, isPackagingToolTarget as o, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as on, assertWritablePathInsideRoot as ot, CommandsProcessor as p, getFileSize as pt, CONFLICTING_TARGET_PAIRS as q, RULESYNC_MCP_FILE_NAME as qt, generate as r, RULESYNC_RULES_RELATIVE_DIR_PATH as rn, ErrorCodes as rt, RulesProcessor as s, ALL_FEATURES as sn, checkPathTraversal as st, importFromTool as t, RULESYNC_PERMISSIONS_SCHEMA_URL as tn, warnOnConflictingFlags as tt, McpProcessor as u, formatError as un, ensureDir as ut, CLAUDECODE_MEMORIES_DIR_NAME as v, readFileContentOrNull as vt, getLocalSkillDirNames as w, resolvePath as wt, ChecksProcessor as x, removeFile as xt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as y, removeDirectory as yt, RulesyncCommandFrontmatterSchema as z, RULESYNC_CONFIG_SCHEMA_URL as zt };
 
-//# sourceMappingURL=import-BlwypG9v.js.map
+//# sourceMappingURL=import-zyfw1Cq_.js.map