rulesync 16.6.0 → 16.8.0

package/dist/{import-D87qlRUj.cjs → import-DEK1TMmW.cjs}

@@ -639,6 +639,13 @@ async function readFileBuffer(filepath) {
 	return (0, node_fs_promises.readFile)(filepath);
 }
 /**
+* Read file as a buffer if it exists, otherwise return null.
+*/
+async function readFileBufferOrNull(filepath) {
+	if (await fileExists(filepath)) return readFileBuffer(filepath);
+	return null;
+}
+/**
 * Normalizes text to LF line endings and adds exactly one trailing newline.
 * Removes any existing trailing whitespace and appends a single newline.
 */
@@ -650,6 +657,10 @@ async function writeFileContent(filepath, content) {
 	await ensureDir((0, node_path.dirname)(filepath));
 	await (0, node_fs_promises.writeFile)(filepath, content, "utf-8");
 }
+async function writeFileBuffer(filepath, buffer) {
+	await ensureDir((0, node_path.dirname)(filepath));
+	await (0, node_fs_promises.writeFile)(filepath, buffer);
+}
 async function fileExists(filepath) {
 	try {
 		await (0, node_fs_promises.stat)(filepath);
@@ -1856,7 +1867,7 @@ var RulesyncFile = class extends AiFile {
 * Type guard to check if a value is a plain object (Record<string, unknown>).
 * This excludes arrays and null values.
 */
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
@@ -1871,7 +1882,7 @@ function isRecord(value) {
 * malicious accessor descriptors.
 */
 function isPlainObject$1(value) {
-	if (!isRecord(value)) return false;
+	if (!isRecord$1(value)) return false;
 	const proto = Object.getPrototypeOf(value);
 	return proto === null || proto === Object.prototype;
 }
@@ -2177,11 +2188,13 @@ const HookDefinitionSchema = zod_mini.z.looseObject({
 	timeout: zod_mini.z.optional(zod_mini.z.number()),
 	cacheTtl: zod_mini.z.optional(zod_mini.z.number().check((0, zod_mini.nonnegative)())),
 	matcher: zod_mini.z.optional(safeString),
+	enabled: zod_mini.z.optional(zod_mini.z.boolean()),
 	prompt: zod_mini.z.optional(safeString),
 	loop_limit: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.number())),
 	name: zod_mini.z.optional(safeString),
 	description: zod_mini.z.optional(safeString),
 	failClosed: zod_mini.z.optional(zod_mini.z.boolean()),
+	commandRegex: zod_mini.z.optional(safeString),
 	sequential: zod_mini.z.optional(zod_mini.z.boolean()),
 	async: zod_mini.z.optional(zod_mini.z.boolean()),
 	env: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), safeString)),
@@ -2198,6 +2211,7 @@ const HookDefinitionSchema = zod_mini.z.looseObject({
 	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	if: zod_mini.z.optional(safeString),
 	commandWindows: zod_mini.z.optional(safeString),
+	additionalContextLimit: zod_mini.z.optional(zod_mini.z.int().check((0, zod_mini.nonnegative)())),
 	asyncRewake: zod_mini.z.optional(zod_mini.z.boolean()),
 	continueOnBlock: zod_mini.z.optional(zod_mini.z.boolean())
 });
@@ -2493,8 +2507,9 @@ const FACTORYDROID_HOOK_EVENTS = [
 /**
 * Hook events supported by deepagents-cli (`deepagents-code` / `dcode`).
 *
-* The canonical `notification` event maps to dcode's `input.required`
-* (human-in-the-loop interrupt) — the closest documented equivalent.
+* These are the twelve Hooks v2 `HookEvent` members, GA since deepagents-code
+* 0.1.52. Canonical `contextOffload` is deliberately absent — see
+* {@link CANONICAL_TO_DEEPAGENTS_EVENT_NAMES}.
 * https://docs.langchain.com/oss/python/deepagents/cli/configuration
 */
 const DEEPAGENTS_HOOK_EVENTS = [
@@ -2507,8 +2522,9 @@ const DEEPAGENTS_HOOK_EVENTS = [
 	"postToolUseFailure",
 	"stop",
 	"preCompact",
-	"contextOffload",
-	"notification"
+	"notification",
+	"subagentStart",
+	"subagentStop"
 ];
 /** Hook events supported by Codex CLI. */
 const CODEXCLI_HOOK_EVENTS = [
@@ -3196,26 +3212,59 @@ const CANONICAL_TO_GOOSE_EVENT_NAMES = {
 */
 const GOOSE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_GOOSE_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
-* Map canonical camelCase event names to deepagents-cli dot-notation.
+* Map canonical camelCase event names to the deepagents-cli Hooks v2
+* `HookEvent` values.
+*
+* Hooks v2 went GA in deepagents-code 0.1.52 (2026-08-04) and replaced the
+* legacy dot-notation names (`session.start`, `tool.use`, …) with these twelve
+* PascalCase members. The legacy list format is still read, but is scheduled for
+* removal on 2026-09-01 (`_LEGACY_HOOKS_REMOVAL_DATE` in `hooks/loading.py`).
+*
+* Canonical `contextOffload` has no v2 counterpart. Its legacy event
+* (`context.offload`) is gone, and folding it onto `PreCompact` would silently
+* merge two distinct canonical events into one — so it is dropped for
+* deepagents instead, and reported by the hooks processor as an unsupported
+* event like any other.
+*
+* @see https://github.com/langchain-ai/deepagents `libs/code/deepagents_code/hooks/models/domain.py`
 */
 const CANONICAL_TO_DEEPAGENTS_EVENT_NAMES = {
-	sessionStart: "session.start",
-	sessionEnd: "session.end",
-	beforeSubmitPrompt: "user.prompt",
-	permissionRequest: "permission.request",
-	preToolUse: "tool.use",
-	postToolUse: "tool.result",
-	postToolUseFailure: "tool.error",
-	stop: "task.complete",
-	preCompact: "context.compact",
-	contextOffload: "context.offload",
-	notification: "input.required"
+	sessionStart: "SessionStart",
+	beforeSubmitPrompt: "UserPromptSubmit",
+	sessionEnd: "SessionEnd",
+	permissionRequest: "PermissionRequest",
+	notification: "Notification",
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	postToolUseFailure: "PostToolUseFailure",
+	preCompact: "PreCompact",
+	stop: "Stop",
+	subagentStart: "SubagentStart",
+	subagentStop: "SubagentStop"
 };
 /**
-* Map deepagents-cli dot-notation event names to canonical camelCase.
+* Map deepagents-cli `HookEvent` values to canonical camelCase.
 */
 const DEEPAGENTS_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_DEEPAGENTS_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
+* The legacy dot-notation event names deepagents-cli used before Hooks v2.
+* Kept for the read-only import path so a `hooks.json` still in the old format
+* round-trips into canonical events instead of being silently discarded.
+*/
+const DEEPAGENTS_LEGACY_TO_CANONICAL_EVENT_NAMES = {
+	"session.start": "sessionStart",
+	"session.end": "sessionEnd",
+	"user.prompt": "beforeSubmitPrompt",
+	"permission.request": "permissionRequest",
+	"tool.use": "preToolUse",
+	"tool.result": "postToolUse",
+	"tool.error": "postToolUseFailure",
+	"task.complete": "stop",
+	"context.compact": "preCompact",
+	"context.offload": "contextOffload",
+	"input.required": "notification"
+};
+/**
 * Map canonical camelCase event names to Kiro CLI camelCase.
 * Kiro CLI uses its own event naming: agentSpawn, userPromptSubmit, preToolUse,
 * postToolUse, stop. Both `sessionEnd` and `stop` canonical events map to
@@ -3833,7 +3882,7 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 			logger
 		});
 		for (const ignoredKey of MCP_IGNORED_ALIAS_SOURCE_KEYS) {
-			if (!isRecord(json[ignoredKey])) continue;
+			if (!isRecord$1(json[ignoredKey])) continue;
 			this.warnOncePerFile(`alias:${ignoredKey}`, `The "${ignoredKey}" block in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)} is ignored. Author it under the "${MCP_BLOCK_KEY_ALIASES[ignoredKey]}" key instead.`, logger);
 		}
 		const toolBlockKeys = Object.keys(json).filter((key) => MCP_TOOL_BLOCK_KEYS.has(key));
@@ -3845,7 +3894,7 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 		}));
 		for (const blockKey of blockKeys) {
 			const toolBlock = json[blockKey];
-			const toolServers = isRecord(toolBlock) && isRecord(toolBlock.mcpServers) ? toolBlock.mcpServers : void 0;
+			const toolServers = isRecord$1(toolBlock) && isRecord$1(toolBlock.mcpServers) ? toolBlock.mcpServers : void 0;
 			for (const [serverName, serverConfig] of Object.entries(toolServers ?? {})) {
 				if (isPrototypePollutionKey(serverName)) continue;
 				if (serverConfig === null) delete effectiveServers[serverName];
@@ -4245,7 +4294,8 @@ const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 */
 const FactorydroidPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	commandBlocklist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	commandBlocklist: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	disabledSkills: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 /**
 * Tool-scoped override block for Warp. Warp's `[agents.profiles]` table exposes
@@ -4691,13 +4741,22 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 *   `base_permission_profile` it is consumed by the profile builder, not
 *   written as a top-level config key.
 *
-* Two surfaces are deliberately NOT authorable here so the override can never
-* clobber a feature-owned key: `mcp_servers.*` per-MCP gating is owned by the
-* MCP feature (`codexcli-mcp.ts` already writes the `mcp_servers` tables in the
-* same `config.toml`), and `permissions` / `default_permissions` are owned by
-* the canonical model. Any such key placed in the override is skipped with a
-* warning. Kept `looseObject` (verbatim passthrough) so future top-level Codex
-* config keys can be authored without Rulesync modeling each one.
+* The keys written to `config.toml` are an **allowlist**, not verbatim
+* passthrough: only `CODEXCLI_OVERRIDE_KEYS`
+* (`src/constants/codexcli-paths.ts` — `approval_policy`, `sandbox_mode`,
+* `sandbox_workspace_write`, `apps`, `approvals_reviewer`) are emitted, and
+* `computeCodexcliOverridePatch` skips anything else with a warning.
+* `base_permission_profile` and `git_write_rules` are consumed by the profile
+* builder rather than written, as described above, and `permission` is the
+* tool-scoped canonical block, which `RulesyncPermissions.forTarget` strips out
+* of the override before it ever reaches the patch. The allowlist is what keeps
+* the override from clobbering a feature-owned key: `mcp_servers.*` per-MCP
+* gating is owned by the MCP feature (`codexcli-mcp.ts` already writes the
+* `mcp_servers` tables in the same `config.toml`), and `permissions` /
+* `default_permissions` are owned by the canonical model. The schema itself is
+* `looseObject` so an unmodeled key parses (and is then reported rather than
+* rejected outright); supporting a new top-level Codex config key means adding
+* it to `CODEXCLI_OVERRIDE_KEYS`.
 *
 * @see https://developers.openai.com/codex/config-reference
 * @see https://developers.openai.com/codex/permissions
@@ -4852,9 +4911,9 @@ var RulesyncPermissions = class RulesyncPermissions extends RulesyncFile {
 		if (NATIVE_PERMISSION_OVERRIDE_TARGETS.has(toolTarget)) return this;
 		const overrideKey = PERMISSION_OVERRIDE_KEY_ALIASES[toolTarget] ?? toolTarget;
 		const json = this.json;
-		if (overrideKey !== toolTarget && isRecord(json[toolTarget])) logger?.warn(`The "${toolTarget}" block in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)} is ignored. Author it under the "${overrideKey}" key instead (the ${toolTarget} target reads that block).`);
+		if (overrideKey !== toolTarget && isRecord$1(json[toolTarget])) logger?.warn(`The "${toolTarget}" block in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)} is ignored. Author it under the "${overrideKey}" key instead (the ${toolTarget} target reads that block).`);
 		const overrideBlock = json[overrideKey];
-		if (!isRecord(overrideBlock) || !isRecord(overrideBlock.permission)) return this;
+		if (!isRecord$1(overrideBlock) || !isRecord$1(overrideBlock.permission)) return this;
 		const { permission: toolScopedPermission, ...restOverride } = overrideBlock;
 		const merged = {
 			...json,
@@ -5164,6 +5223,11 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		compatibility: zod_mini.z.optional(zod_mini.z.looseObject({})),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	})),
+	kiro: zod_mini.z.optional(zod_mini.z.looseObject({
+		license: zod_mini.z.optional(zod_mini.z.string()),
+		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+	})),
 	deepagents: zod_mini.z.optional(zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -5172,7 +5236,11 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	})),
 	copilot: zod_mini.z.optional(zod_mini.z.looseObject({
 		license: zod_mini.z.optional(zod_mini.z.string()),
-		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+		"argument-hint": zod_mini.z.optional(zod_mini.z.string()),
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+		context: zod_mini.z.optional(zod_mini.z.string())
 	})),
 	copilotcli: zod_mini.z.optional(zod_mini.z.looseObject({
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -5230,7 +5298,9 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 	})),
 	factorydroid: zod_mini.z.optional(zod_mini.z.looseObject({
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
-		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean())
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+		enabled: zod_mini.z.optional(zod_mini.z.boolean()),
+		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 	})),
 	grokcli: zod_mini.z.optional(zod_mini.z.looseObject({
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
@@ -5443,8 +5513,8 @@ async function getLocalSkillDirNames(outputRoot) {
 * Resolve the effective `disable-model-invocation` value for a tool skill.
 *
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
-* default that applies to every tool supporting the flag (claudecode, cursor,
-* zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
+* default that applies to every tool supporting the flag (claudecode, copilot,
+* copilotcli, cursor, zed, pi, qwencode, grokcli, factorydroid). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -5457,8 +5527,8 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 * Resolve the effective `user-invocable` value for a tool skill.
 *
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
-* that applies to every tool supporting the flag (claudecode, qwencode, vibe,
-* grokcli, factorydroid). Each tool's own section may override that default with a
+* that applies to every tool supporting the flag (claudecode, copilot,
+* copilotcli, qwencode, vibe, grokcli, factorydroid). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -5671,6 +5741,31 @@ function fileContentsEquivalent({ filePath, expected, existing }) {
 	if (structured !== void 0) return structured;
 	return addTrailingNewline(expected) === addTrailingNewline(existing);
 }
+/**
+* Whether an on-disk companion file is equivalent to the generated one.
+*
+* Companion files (everything beside a skill's `SKILL.md`) are written byte for
+* byte, so byte equality is the whole test for a user asset carried through
+* from the source directory: a CRLF fixture or a deliberately newline-less file
+* must compare equal to itself and unequal to a normalized copy, and a copy
+* that has drifted must be repaired rather than tolerated.
+*
+* A `composed` file is different — Rulesync builds it from frontmatter (Codex
+* CLI's `agents/openai.yaml`), so differing bytes fall back to the structured
+* comparison and a formatter re-indenting it is not reported as a change on
+* every generate. Only the structured verdict counts: there is deliberately no
+* text fallback, since trailing-whitespace-insensitive text equality is exactly
+* the normalization companion files no longer get.
+*/
+function companionFileContentsEquivalent({ filePath, expected, existing, composed = false }) {
+	if (existing === null) return false;
+	if (existing.equals(expected)) return true;
+	if (!composed) return false;
+	const expectedText = expected.toString("utf-8");
+	const existingText = existing.toString("utf-8");
+	if (!Buffer.from(expectedText, "utf-8").equals(expected) || !Buffer.from(existingText, "utf-8").equals(existing)) return false;
+	return tryFileContentsEquivalent(filePath, expectedText, existingText) ?? false;
+}
 //#endregion
 //#region src/types/feature-processor.ts
 var FeatureProcessor = class {
@@ -7071,6 +7166,14 @@ const SHARED_CONFIG_OWNERSHIP = {
 			ownedKeys: ["mcp", "tools"]
 		} }
 	},
+	".config/goose/config.yaml": {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["extensions"]
+		} }
+	},
 	[CODEXCLI_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		features: {
@@ -8219,7 +8322,7 @@ var AntigravitySharedCommand = class extends ToolCommand {
 	}
 	static extractAntigravityConfig(rulesyncCommand) {
 		const antigravity = rulesyncCommand.getFrontmatter().antigravity;
-		return isRecord(antigravity) ? antigravity : void 0;
+		return isRecord$1(antigravity) ? antigravity : void 0;
 	}
 	static resolveTrigger(rulesyncCommand, antigravityConfig) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
@@ -9309,9 +9412,10 @@ const FACTORYDROID_HOOKS_FILE_NAME = "hooks.json";
 //#region src/features/commands/factorydroid-command.ts
 const FactorydroidCommandFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.optional(zod_mini.z.string()),
-	"argument-hint": zod_mini.z.optional(zod_mini.z.string()),
-	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	"argument-hint": zod_mini.z.optional(zod_mini.z.string())
 });
+/** Not a Droid command surface; see the schema comment above. */
+const FACTORYDROID_UNSUPPORTED_COMMAND_FIELDS = ["allowed-tools"];
 var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	frontmatter;
 	body;
@@ -9338,6 +9442,7 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	}
 	toRulesyncCommand() {
 		const { description, ...restFields } = this.frontmatter;
+		for (const field of FACTORYDROID_UNSUPPORTED_COMMAND_FIELDS) delete restFields[field];
 		const rulesyncFrontmatter = {
 			targets: ["*"],
 			description,
@@ -9361,6 +9466,7 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 			description: rulesyncFrontmatter.description,
 			...factorydroidFields
 		};
+		for (const field of FACTORYDROID_UNSUPPORTED_COMMAND_FIELDS) delete factorydroidFrontmatter[field];
 		const body = rulesyncCommand.getBody();
 		const paths = this.getSettablePaths({ global });
 		return new FactorydroidCommand({
@@ -12006,8 +12112,8 @@ async function lookupPromptDescription({ outputRoot, relativeFilePath, name }) {
 	}
 	if (!isPlainObject$1(parsed) || !Array.isArray(parsed.prompts)) return "";
 	const expectedContentFile = toPosixPath((0, node_path.join)("prompts", relativeFilePath));
-	const entry = parsed.prompts.find((candidate) => isRecord(candidate) && (candidate.content_file === expectedContentFile || candidate.name === name));
-	return isRecord(entry) && typeof entry.description === "string" ? entry.description : "";
+	const entry = parsed.prompts.find((candidate) => isRecord$1(candidate) && (candidate.content_file === expectedContentFile || candidate.name === name));
+	return isRecord$1(entry) && typeof entry.description === "string" ? entry.description : "";
 }
 /**
 * The shared `.rovodev/prompts.yml` manifest that indexes every saved prompt.
@@ -13072,16 +13178,28 @@ function buildEffectiveHooks$1({ config, toolOverrideHooks, supportedEvents }) {
 	};
 }
 /**
-* Group a list of hook definitions by their `matcher` (empty string when absent),
-* preserving insertion order of both keys and grouped definitions.
+* Group a list of hook definitions by their `matcher` (empty string when
+* absent), preserving insertion order of both keys and grouped definitions.
+* Definitions that disagree on a `subdividesGroup` passthrough field are split
+* into separate groups, so a restricting field is never inherited by a hook
+* that did not ask for it.
 */
-function groupDefinitionsByMatcher(definitions) {
+function groupDefinitionsByMatcher({ definitions, converterConfig }) {
+	const subdividingFields = (converterConfig.groupPassthroughFields ?? []).filter(({ subdividesGroup }) => subdividesGroup);
 	const byMatcher = /* @__PURE__ */ new Map();
 	for (const def of definitions) {
-		const key = def.matcher ?? "";
-		const list = byMatcher.get(key);
-		if (list) list.push(def);
-		else byMatcher.set(key, [def]);
+		const rawMatcher = def.matcher ?? "";
+		const matcher = converterConfig.wildcardMatcherMeansAll && rawMatcher === "*" ? "" : rawMatcher;
+		const key = [matcher, ...subdividingFields.map(({ canonical, valueType }) => {
+			const value = def[canonical];
+			return isGroupPassthroughValue(value, valueType) ? stableJson(value) : "";
+		})].join("\0");
+		const group = byMatcher.get(key);
+		if (group) group.defs.push(def);
+		else byMatcher.set(key, {
+			matcher,
+			defs: [def]
+		});
 	}
 	return byMatcher;
 }
@@ -13108,59 +13226,148 @@ function applyCommandPrefix({ def, converterConfig }) {
 	return `"${converterConfig.projectDirVar}"/${relativeCommand}`;
 }
 /**
-* Emit the configured boolean passthrough fields on the tool side, mapping each
-* canonical field name to its (possibly renamed) tool field name. Only boolean
-* values are carried through.
+* Whether a field registered for `command` hooks only applies to this hook.
+* Applied on both export and import: a value imported into a canonical field
+* the exporter would then drop is silently deleted on the next generate.
 */
-function emitBooleanPassthroughFields({ def, hookType, converterConfig }) {
-	return Object.fromEntries((converterConfig.booleanPassthroughFields ?? []).filter(({ canonical, commandOnly }) => {
-		if (commandOnly === true && hookType !== "command") return false;
-		return typeof def[canonical] === "boolean";
-	}).map(({ canonical, tool }) => [tool, def[canonical]]));
+function isFieldApplicable({ commandOnly, hookType }) {
+	return commandOnly !== true || hookType === "command";
 }
 /**
-* Import the configured boolean passthrough fields back into canonical fields,
-* reversing {@link emitBooleanPassthroughFields}. Only boolean values are read.
-*/
-function importBooleanPassthroughFields({ h, converterConfig }) {
-	return Object.fromEntries((converterConfig.booleanPassthroughFields ?? []).filter(({ tool }) => typeof h[tool] === "boolean").map(({ canonical, tool }) => [canonical, h[tool]]));
-}
-/**
-* Emit the configured string passthrough fields on the tool side, mapping each
-* canonical field name to its (possibly renamed) tool field name. Only non-empty
-* string values are carried through.
-*/
-function emitStringPassthroughFields({ def, hookType, converterConfig }) {
-	return Object.fromEntries((converterConfig.stringPassthroughFields ?? []).filter(({ canonical, commandOnly }) => {
-		if (commandOnly === true && hookType !== "command") return false;
-		return typeof def[canonical] === "string" && def[canonical] !== "";
-	}).map(({ canonical, tool }) => [tool, def[canonical]]));
-}
-/**
-* Import the configured string passthrough fields back into canonical fields,
-* reversing {@link emitStringPassthroughFields}. Only non-empty string values
-* are read.
-*/
-function importStringPassthroughFields({ h, converterConfig }) {
-	return Object.fromEntries((converterConfig.stringPassthroughFields ?? []).filter(({ tool }) => typeof h[tool] === "string" && h[tool] !== "").map(({ canonical, tool }) => [canonical, h[tool]]));
-}
-/**
-* Emit the configured string-array passthrough fields on the tool side.
-*/
-function emitArrayPassthroughFields({ def, hookType, converterConfig }) {
-	return Object.fromEntries((converterConfig.arrayPassthroughFields ?? []).filter(({ canonical, commandOnly }) => {
-		if (commandOnly === true && hookType !== "command") return false;
-		return isStringArray(def[canonical]);
-	}).map(({ canonical, tool }) => [tool, def[canonical]]));
-}
-/**
-* Import the configured string-array passthrough fields, reversing
-* {@link emitArrayPassthroughFields}.
+* Emit the configured passthrough fields on the tool side, mapping each
+* canonical field name to its (possibly renamed) tool field name. Only values
+* accepted by `isValid` are carried through, so a malformed field can't leak
+* into a config the tool would reject.
+*
+* A field the tool documents on `command` hooks only is dropped when authored
+* on another hook type. That is a value the user hand-wrote in
+* `.rulesync/hooks.*` and the canonical schema does not cross-validate it
+* against the hook's type, so it is warned about rather than deleted in
+* silence — the mirror of the import side.
 */
-function importArrayPassthroughFields({ h, converterConfig, logger }) {
-	const fields = converterConfig.arrayPassthroughFields ?? [];
-	for (const { tool } of fields) if (h[tool] !== void 0 && !isSafeStringArray(h[tool])) logger?.warn(`Dropping "${tool}" while importing a hook: it must be a list of strings without newline, carriage return or NUL characters.`);
-	return Object.fromEntries(fields.filter(({ tool }) => isSafeStringArray(h[tool])).map(({ canonical, tool }) => [canonical, h[tool]]));
+function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn }) {
+	for (const { canonical, tool, commandOnly } of fields) {
+		const value = def[canonical];
+		if (value === void 0) continue;
+		if (!isFieldApplicable({
+			commandOnly,
+			hookType
+		})) {
+			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not generated.`);
+			continue;
+		}
+		if (!isValid({
+			value,
+			canonical
+		})) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${JSON.stringify(value)} is not a value this tool can express as "${tool}".`);
+	}
+	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
+		commandOnly,
+		hookType
+	}) && isValid({
+		value: def[canonical],
+		canonical
+	})).map(({ canonical, tool }) => [tool, def[canonical]]));
+}
+/**
+* Import the configured passthrough fields back into canonical fields,
+* reversing {@link emitPassthroughFields}. A field the tool documents on
+* `command` hooks only is skipped here too, and `describeInvalid` — when the
+* kind has a rule an authored file can plausibly violate — turns a rejected
+* value into a warning instead of a silent drop.
+*/
+function importPassthroughFields({ h, hookType, fields, isValid, describeInvalid, warn }) {
+	const applicable = fields.filter(({ commandOnly }) => isFieldApplicable({
+		commandOnly,
+		hookType
+	}));
+	const skipped = fields.filter(({ commandOnly }) => !isFieldApplicable({
+		commandOnly,
+		hookType
+	}));
+	for (const { tool } of skipped) if (h[tool] !== void 0) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook: this tool documents it on "command" hooks only, so it is not imported.`);
+	for (const { tool, canonical } of applicable) if (describeInvalid !== void 0 && h[tool] !== void 0 && !isValid({
+		value: h[tool],
+		canonical
+	})) warn?.(describeInvalid({
+		tool,
+		canonical,
+		value: h[tool]
+	}));
+	return Object.fromEntries(applicable.filter(({ tool, canonical }) => isValid({
+		value: h[tool],
+		canonical
+	})).map(({ canonical, tool }) => [canonical, h[tool]]));
+}
+const isBooleanValue = ({ value }) => typeof value === "boolean";
+const isFiniteNumber = ({ value }) => Number.isFinite(value);
+const isNonEmptyString = (value) => typeof value === "string" && value !== "";
+const isEmittableString = ({ value }) => isNonEmptyString(value);
+const isEmittableArray = ({ value }) => isStringArray(value);
+const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
+const isImportableArray = ({ value }) => isSafeStringArray(value);
+/**
+* The canonical schema of one hook field, looked up by name. Read off the
+* schema's own shape rather than by parsing a one-field object, so a `canonical`
+* name that no longer exists resolves to `undefined` (a `looseObject` would
+* accept an unknown key and silently validate nothing) and a typo is caught by
+* the tests instead of quietly disabling the check.
+*/
+const CANONICAL_FIELD_SCHEMAS = HookDefinitionSchema.def.shape;
+/**
+* Whether a value satisfies the constraints the canonical schema puts on the
+* field it would be imported into.
+*
+* Import needs this on top of the kind's shape check: a hand-written tool
+* settings file can hold `"shell": "zsh"`, which is a non-empty string but not
+* a member of the canonical `z.enum(["bash", "powershell"])`. Letting it in
+* would write a `.rulesync/hooks.jsonc` that fails validation on the *next*
+* run, taking the whole hooks feature down with it.
+*/
+function satisfiesCanonicalField({ value, canonical }) {
+	const schema = canonicalFieldSchema(canonical);
+	return schema !== void 0 && zod_mini.z.safeParse(schema, value).success;
+}
+/** Own properties only, so a name like `toString` resolves to nothing. */
+function canonicalFieldSchema(canonical) {
+	return Object.hasOwn(CANONICAL_FIELD_SCHEMAS, canonical) ? CANONICAL_FIELD_SCHEMAS[canonical] : void 0;
+}
+const isImportableString = ({ value, canonical }) => isNonEmptyString(value) && satisfiesCanonicalField({
+	value,
+	canonical
+});
+const isImportableNumber = ({ value, canonical }) => Number.isFinite(value) && satisfiesCanonicalField({
+	value,
+	canonical
+});
+/**
+* Say which rule the value broke, so the warning names the actual constraint
+* rather than asserting a canonical rejection that may not be the reason. A
+* closed enum lists its members; a rule carrying its own message (the
+* control-character check behind `safeString`) reuses it.
+*/
+function describeScalarConstraint({ canonical, value }) {
+	const schema = canonicalFieldSchema(canonical);
+	const result = schema === void 0 ? void 0 : zod_mini.z.safeParse(schema, value);
+	if (result === void 0 || result.success) return `it is not a value this field carries through.`;
+	const issue = result.error.issues[0];
+	if (issue === void 0) return `it is not a value the canonical "${canonical}" field accepts.`;
+	return `it does not satisfy the canonical "${canonical}" field: ${issue.message}.`;
+}
+const describeInvalidScalar = ({ tool, canonical, value }) => `Dropping "${tool}" (${JSON.stringify(value)}) while importing a hook: ${describeScalarConstraint({
+	canonical,
+	value
+})} Importing it would fail validation on the next run.`;
+const describeInvalidArray = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a list of strings without newline, carriage return or NUL characters.`;
+const describeInvalidRecord = ({ tool }) => `Dropping "${tool}" while importing a hook: it must be a map of strings whose keys are non-empty and free of "=", and whose keys and values carry no newline, carriage return or NUL characters.`;
+/**
+* Check a value against the shape its field documents. A string field also
+* rejects control characters, matching the canonical `safeString` so an
+* imported value cannot fail validation on the next generate.
+*/
+function isGroupPassthroughValue(value, valueType = "object") {
+	if (valueType === "string") return typeof value === "string" && !CONTROL_CHARS.some((char) => value.includes(char));
+	return isPlainObject$1(value);
 }
 /**
 * Emit the configured group-level passthrough fields, taken from the first
@@ -13168,12 +13375,12 @@ function importArrayPassthroughFields({ h, converterConfig, logger }) {
 */
 function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }) {
 	const emitted = {};
-	for (const { canonical, tool } of converterConfig.groupPassthroughFields ?? []) {
+	for (const { canonical, tool, valueType } of converterConfig.groupPassthroughFields ?? []) {
 		const carried = defs.map((def) => def[canonical]);
-		const first = carried.find((value) => isPlainObject$1(value));
+		const first = carried.find((value) => isGroupPassthroughValue(value, valueType));
 		if (first === void 0) continue;
 		const firstStable = stableJson(first);
-		const agrees = (value) => isPlainObject$1(value) && stableJson(value) === firstStable;
+		const agrees = (value) => isGroupPassthroughValue(value, valueType) && stableJson(value) === firstStable;
 		if (!carried.every(agrees)) logger?.warn(`"${tool}" belongs to the whole matcher group on "${eventName}" hooks, so every hook in this group gets ${JSON.stringify(first)} — including any that asked for something else, or for nothing.`);
 		emitted[tool] = first;
 	}
@@ -13185,7 +13392,7 @@ function emitGroupPassthroughFields({ defs, eventName, converterConfig, logger }
 */
 function importGroupPassthroughFields({ rawEntry, converterConfig }) {
 	const entry = rawEntry;
-	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool }) => isPlainObject$1(entry[tool])).map(({ canonical, tool }) => [canonical, entry[tool]]));
+	return Object.fromEntries((converterConfig.groupPassthroughFields ?? []).filter(({ tool, valueType }) => isGroupPassthroughValue(entry[tool], valueType)).map(({ canonical, tool }) => [canonical, entry[tool]]));
 }
 /**
 * Emit the payload fields specific to a hook type — `url`/`headers`/
@@ -13213,7 +13420,54 @@ function emitTypePayloadFields({ def, hookType, converterConfig }) {
 function isSupportedHookType({ type, converterConfig }) {
 	return converterConfig.supportedHookTypes?.has(type ?? "command") ?? true;
 }
-function buildToolHooks({ defs, converterConfig }) {
+/**
+* Emit every per-hook passthrough kind for one canonical definition.
+*/
+function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, warn }) {
+	return {
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.booleanPassthroughFields ?? [],
+			isValid: isBooleanValue,
+			warn
+		}),
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.numberPassthroughFields ?? [],
+			isValid: isFiniteNumber,
+			warn
+		}),
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.stringPassthroughFields ?? [],
+			isValid: isEmittableString,
+			warn
+		}),
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.arrayPassthroughFields ?? [],
+			isValid: isEmittableArray,
+			warn
+		}),
+		...emitPassthroughFields({
+			def,
+			hookType,
+			eventName,
+			fields: converterConfig.recordPassthroughFields ?? [],
+			isValid: isEmittableRecord,
+			warn
+		})
+	};
+}
+function buildToolHooks({ defs, eventName, converterConfig, warn }) {
 	const hooks = [];
 	for (const def of defs) {
 		const hookType = def.type ?? "command";
@@ -13226,20 +13480,12 @@ function buildToolHooks({ defs, converterConfig }) {
 			converterConfig
 		});
 		hooks.push({
-			...emitBooleanPassthroughFields({
+			...emitAllPassthroughFields({
 				def,
 				hookType,
-				converterConfig
-			}),
-			...emitStringPassthroughFields({
-				def,
-				hookType,
-				converterConfig
-			}),
-			...emitArrayPassthroughFields({
-				def,
-				hookType,
-				converterConfig
+				eventName,
+				converterConfig,
+				warn
 			}),
 			type: hookType,
 			...command !== void 0 && command !== null && { command },
@@ -13257,6 +13503,17 @@ function buildToolHooks({ defs, converterConfig }) {
 	return hooks;
 }
 /**
+* A `warn` that says each distinct thing once per conversion.
+*/
+function warnOnce(logger) {
+	const seen = /* @__PURE__ */ new Set();
+	return (message) => {
+		if (seen.has(message)) return;
+		seen.add(message);
+		logger?.warn(message);
+	};
+}
+/**
 * Convert canonical hooks config to tool-specific format (shared by Claude and Factory Droid).
 * Uses explicit event name mapping tables rather than algorithmic case conversion,
 * since tool event names may differ entirely from canonical names
@@ -13268,17 +13525,23 @@ function canonicalToToolHooks({ config, toolOverrideHooks, converterConfig, logg
 		toolOverrideHooks,
 		supportedEvents: converterConfig.supportedEvents
 	});
+	const warn = warnOnce(logger);
 	const result = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
 		const toolEventName = converterConfig.canonicalToToolEventNames[eventName] ?? eventName;
-		const byMatcher = groupDefinitionsByMatcher(definitions);
+		const byMatcher = groupDefinitionsByMatcher({
+			definitions,
+			converterConfig
+		});
 		const entries = [];
 		const isNoMatcherEvent = converterConfig.noMatcherEvents?.has(eventName) ?? false;
-		for (const [matcherKey, defs] of byMatcher) {
+		for (const { matcher: matcherKey, defs } of byMatcher.values()) {
 			if (isNoMatcherEvent && matcherKey) logger?.warn(`matcher "${matcherKey}" on "${eventName}" hook will be ignored — this event does not support matchers`);
 			const hooks = buildToolHooks({
 				defs,
-				converterConfig
+				eventName,
+				converterConfig,
+				warn
 			});
 			if (hooks.length === 0) continue;
 			const includeMatcher = matcherKey && !isNoMatcherEvent;
@@ -13354,9 +13617,27 @@ function isStringArray(value) {
 }
 /** Compare object values without letting key order decide the answer. */
 function stableJson(value) {
+	if (typeof value === "string") return JSON.stringify(value);
 	return JSON.stringify(Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a.localeCompare(b))));
 }
 /**
+* A string map safe to hand a tool as a hook's environment block. On top of
+* {@link isStringRecord} it rejects a non-plain object (a class instance is not
+* data) and applies the control-character rule to the values, as
+* {@link isSafeStringArray} does for `args`.
+*
+* The keys are checked more strictly than the values. A tool builds each entry
+* back into a `KEY=VALUE` string for the spawned process, so a key holding `=`
+* (or a control character, or nothing at all) names a different variable than
+* it appears to — `PATH=/tmp/evil` written as a key would set `PATH`. An
+* authored `.rulesync/hooks.*` can arrive via `rulesync fetch`, so that is not
+* a shape to pass along.
+*/
+function isSafeStringRecord(value) {
+	if (!isPlainObject$1(value) || !isStringRecord(value)) return false;
+	return Object.entries(value).every(([key, entry]) => key !== "" && !key.includes("=") && !CONTROL_CHARS.some((char) => key.includes(char) || entry.includes(char)));
+}
+/**
 * Control characters cannot ride from an existing tool config into a canonical
 * field the schema guards with `safeString`, or the next generate fails
 * validation on a file this import itself wrote — and the hooks feature is
@@ -13366,34 +13647,152 @@ function isSafeStringArray(value) {
 	return isStringArray(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
 }
 /**
+* A raw string kept only if the canonical field it would land in accepts it,
+* warning when it does not. The canonical string fields are guarded by
+* `safeString`, so an existing tool config carrying a control character would
+* otherwise be imported into a file the next generate refuses to read.
+*/
+function importCanonicalString({ value, canonical, warn }) {
+	if (typeof value !== "string") return;
+	if (satisfiesCanonicalField({
+		value,
+		canonical
+	})) return value;
+	warn?.(describeInvalidScalar({
+		tool: canonical,
+		canonical,
+		value
+	}));
+}
+/**
 * Import the payload fields specific to a hook type, type-checking each raw
 * value before it enters the canonical definition.
 */
-function importTypePayloadFields({ h, hookType }) {
-	if (hookType === "http") return {
-		...typeof h.url === "string" && { url: h.url },
-		...isStringRecord(h.headers) && { headers: h.headers },
-		...isStringArray(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
-	};
-	if (hookType === "mcp_tool") return {
-		...typeof h.server === "string" && { server: h.server },
-		...typeof h.tool === "string" && { tool: h.tool },
-		...h.input !== null && typeof h.input === "object" && !Array.isArray(h.input) && { input: h.input }
-	};
-	if (hookType === "prompt" || hookType === "agent") return typeof h.model === "string" ? { model: h.model } : {};
+function importTypePayloadFields({ h, hookType, warn }) {
+	if (hookType === "http") {
+		const url = importCanonicalString({
+			value: h.url,
+			canonical: "url",
+			warn
+		});
+		const headers = isStringRecord(h.headers) && !satisfiesCanonicalField({
+			value: h.headers,
+			canonical: "headers"
+		}) ? (warn?.(describeInvalidScalar({
+			tool: "headers",
+			canonical: "headers",
+			value: h.headers
+		})), void 0) : h.headers;
+		return {
+			...url !== void 0 && { url },
+			...isStringRecord(headers) && { headers },
+			...isStringArray(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
+		};
+	}
+	if (hookType === "mcp_tool") {
+		const server = importCanonicalString({
+			value: h.server,
+			canonical: "server",
+			warn
+		});
+		const tool = importCanonicalString({
+			value: h.tool,
+			canonical: "tool",
+			warn
+		});
+		return {
+			...server !== void 0 && { server },
+			...tool !== void 0 && { tool },
+			...h.input !== null && typeof h.input === "object" && !Array.isArray(h.input) && { input: h.input }
+		};
+	}
+	if (hookType === "prompt" || hookType === "agent") {
+		const model = importCanonicalString({
+			value: h.model,
+			canonical: "model",
+			warn
+		});
+		return model !== void 0 ? { model } : {};
+	}
 	return {};
 }
 /**
+* Import every per-hook passthrough kind for one tool hook record, reversing
+* the emit side in {@link buildToolHooks}.
+*/
+function importAllPassthroughFields({ h, hookType, converterConfig, warn }) {
+	return {
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.booleanPassthroughFields ?? [],
+			isValid: isBooleanValue,
+			warn
+		}),
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.numberPassthroughFields ?? [],
+			isValid: isImportableNumber,
+			describeInvalid: describeInvalidScalar,
+			warn
+		}),
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.stringPassthroughFields ?? [],
+			isValid: isImportableString,
+			describeInvalid: describeInvalidScalar,
+			warn
+		}),
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.arrayPassthroughFields ?? [],
+			isValid: isImportableArray,
+			describeInvalid: describeInvalidArray,
+			warn
+		}),
+		...importPassthroughFields({
+			h,
+			hookType,
+			fields: converterConfig.recordPassthroughFields ?? [],
+			isValid: isEmittableRecord,
+			describeInvalid: describeInvalidRecord,
+			warn
+		})
+	};
+}
+/**
 * Convert a single tool hook record into a canonical hook definition.
 */
-function toolHookToCanonical({ h, rawEntry, converterConfig, logger }) {
-	const command = stripCommandPrefix({
-		command: h.command,
-		converterConfig
-	});
+function toolHookToCanonical({ h, rawEntry, converterConfig, warn }) {
 	const hookType = isImportedHookType(h.type) ? h.type : "command";
+	const command = importCanonicalString({
+		value: stripCommandPrefix({
+			command: h.command,
+			converterConfig
+		}),
+		canonical: "command",
+		warn
+	});
 	const timeout = typeof h.timeout === "number" ? h.timeout : void 0;
-	const prompt = typeof h.prompt === "string" ? h.prompt : void 0;
+	const prompt = importCanonicalString({
+		value: h.prompt,
+		canonical: "prompt",
+		warn
+	});
+	const name = importCanonicalString({
+		value: h.name,
+		canonical: "name",
+		warn
+	});
+	const description = importCanonicalString({
+		value: h.description,
+		canonical: "description",
+		warn
+	});
+	const matcher = rawEntry.matcher;
 	return {
 		type: hookType,
 		...command !== void 0 && command !== null && { command },
@@ -13401,40 +13800,130 @@ function toolHookToCanonical({ h, rawEntry, converterConfig, logger }) {
 		...prompt !== void 0 && prompt !== null && { prompt },
 		...importTypePayloadFields({
 			h,
-			hookType
+			hookType,
+			warn
 		}),
-		...converterConfig.passthroughFields?.includes("name") && typeof h.name === "string" && { name: h.name },
-		...converterConfig.passthroughFields?.includes("description") && typeof h.description === "string" && { description: h.description },
-		...importBooleanPassthroughFields({
-			h,
-			converterConfig
-		}),
-		...importStringPassthroughFields({
-			h,
-			converterConfig
-		}),
-		...importArrayPassthroughFields({
+		...converterConfig.passthroughFields?.includes("name") && name !== void 0 && { name },
+		...converterConfig.passthroughFields?.includes("description") && description !== void 0 && { description },
+		...importAllPassthroughFields({
 			h,
+			hookType,
 			converterConfig,
-			logger
+			warn
 		}),
 		...importGroupPassthroughFields({
 			rawEntry,
 			converterConfig
 		}),
-		...rawEntry.matcher !== void 0 && rawEntry.matcher !== null && rawEntry.matcher !== "" && { matcher: rawEntry.matcher }
+		...matcher !== void 0 && matcher !== null && matcher !== "" && { matcher }
 	};
 }
 /**
-* Convert a single tool matcher entry into canonical hook definitions.
+* The fields whose value decides what a hook *is*, listed per hook type. When
+* one of them cannot be imported, dropping just the field would leave
+* something worse than nothing: a hook that loses its body runs nothing, and
+* one that loses its `matcher` fires on *everything* — a silent widening of
+* what the imported rule does. So the whole definition is skipped instead,
+* with the reason named. A field that does not define *this* type (a `prompt`
+* left on a command hook) is not one of them: it is dropped on its own, the
+* way any other unusable field is.
+*/
+function definingFields({ h, rawEntry, hookType, converterConfig }) {
+	const fields = [{
+		field: "matcher",
+		value: rawEntry.matcher
+	}];
+	if (hookType === "command") fields.push({
+		field: "command",
+		value: typeof h.command === "string" ? stripCommandPrefix({
+			command: h.command,
+			converterConfig
+		}) : h.command
+	});
+	if (hookType === "prompt" || hookType === "agent") fields.push({
+		field: "prompt",
+		value: h.prompt
+	});
+	if (hookType === "http") fields.push({
+		field: "url",
+		value: h.url
+	});
+	if (hookType === "mcp_tool") fields.push({
+		field: "server",
+		value: h.server
+	}, {
+		field: "tool",
+		value: h.tool
+	});
+	return fields;
+}
+/**
+* Why no hook of this matcher group can be imported, or `undefined` when they
+* can. A group field that *restricts* when its hooks run (`subdividesGroup`)
+* is the group-level twin of `matcher`: importing the group without it would
+* widen every hook in it, so the group is skipped instead.
 */
-function toolMatcherEntryToCanonical({ rawEntry, converterConfig, logger }) {
-	return (rawEntry.hooks ?? []).map((h) => toolHookToCanonical({
+function describeGroupSkipReason({ rawEntry, converterConfig }) {
+	const entry = rawEntry;
+	for (const { tool, valueType, subdividesGroup } of converterConfig.groupPassthroughFields ?? []) {
+		const value = entry[tool];
+		if (subdividesGroup !== true || value === void 0) continue;
+		if (!isGroupPassthroughValue(value, valueType)) return `Skipping the hooks of a matcher group while importing: its "${tool}" (${JSON.stringify(value)}) is unusable, and these hooks run only where it matches. Importing them without it would widen when they fire, so they are skipped.`;
+	}
+}
+/**
+* Why this hook cannot be imported, or `undefined` when it can.
+*/
+function describeHookSkipReason({ h, rawEntry, hookType, converterConfig }) {
+	for (const { field, value } of definingFields({
 		h,
 		rawEntry,
-		converterConfig,
-		logger
-	}));
+		hookType,
+		converterConfig
+	})) {
+		if (value === void 0 || satisfiesCanonicalField({
+			value,
+			canonical: field
+		})) continue;
+		return `Skipping a hook while importing: its "${field}" (${JSON.stringify(value)}) is unusable — ${describeScalarConstraint({
+			canonical: field,
+			value
+		})} Keeping the hook without it would change what it does, so the whole hook is skipped.`;
+	}
+}
+/**
+* Convert a single tool matcher entry into canonical hook definitions.
+*/
+function toolMatcherEntryToCanonical({ rawEntry, converterConfig, warn }) {
+	const hookDefs = rawEntry.hooks ?? [];
+	const groupSkipReason = describeGroupSkipReason({
+		rawEntry,
+		converterConfig
+	});
+	if (groupSkipReason !== void 0) {
+		warn?.(groupSkipReason);
+		return [];
+	}
+	const definitions = [];
+	for (const h of hookDefs) {
+		const skipReason = describeHookSkipReason({
+			h,
+			rawEntry,
+			hookType: isImportedHookType(h.type) ? h.type : "command",
+			converterConfig
+		});
+		if (skipReason !== void 0) {
+			warn?.(skipReason);
+			continue;
+		}
+		definitions.push(toolHookToCanonical({
+			h,
+			rawEntry,
+			converterConfig,
+			warn
+		}));
+	}
+	return definitions;
 }
 /**
 * Assemble the canonical hooks config a tool importer writes to
@@ -13464,6 +13953,7 @@ function buildImportedHooksConfig({ hooks, overrideKey, version = 1, extraOverri
 }
 function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 	if (hooks === null || hooks === void 0 || typeof hooks !== "object") return {};
+	const warn = warnOnce(logger);
 	const canonical = {};
 	for (const [toolEventName, matcherEntries] of Object.entries(hooks)) {
 		const eventName = converterConfig.toolToCanonicalEventNames[toolEventName] ?? toolEventName;
@@ -13474,7 +13964,7 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 			defs.push(...toolMatcherEntryToCanonical({
 				rawEntry,
 				converterConfig,
-				logger
+				warn
 			}));
 		}
 		if (defs.length > 0) canonical[eventName] = defs;
@@ -13513,7 +14003,9 @@ const ANTIGRAVITY_HOOK_NAME = "rulesync";
 * map for import. Accepts both the documented named-hook shape
 * (`{ "<name>": { "<Event>": [...], "enabled"?: bool } }`) and a legacy flat
 * shape (`{ "<Event>": [...] }`) so older or hand-written files still import.
-* The per-hook `enabled` flag is ignored (canonical hooks have no equivalent).
+* The per-hook `enabled` flag is ignored. The canonical `enabled` field is a
+* property of a single hook definition, whereas Antigravity's flag gates a whole
+* named group, so the two do not map onto each other.
 */
 function flattenAntigravityHooks(parsed) {
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -13595,7 +14087,7 @@ var AntigravityHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let parsed;
 		try {
 			parsed = JSON.parse(this.getFileContent());
@@ -13604,7 +14096,8 @@ var AntigravityHooks = class extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: flattenAntigravityHooks(parsed),
-			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG
+			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
+			logger
 		});
 		const overrideKey = this.constructor.getOverrideKey();
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
@@ -13935,6 +14428,14 @@ var ClaudecodeHooks = class extends ToolHooks {
 	isDeletable() {
 		return false;
 	}
+	/**
+	* The converter config used for both directions. Exposed as a static hook so
+	* plugin-scoped subclasses can swap tool-specific details (e.g. the project
+	* directory variable) without duplicating the rest of the config.
+	*/
+	static getConverterConfig() {
+		return CLAUDE_CONVERTER_CONFIG;
+	}
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: CLAUDECODE_DIR,
@@ -13960,7 +14461,7 @@ var ClaudecodeHooks = class extends ToolHooks {
 		const claudeHooks = canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config.claudecode?.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG,
+			converterConfig: this.getConverterConfig(),
 			logger
 		});
 		const fileContent = applySharedConfigPatch({
@@ -13978,7 +14479,7 @@ var ClaudecodeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let settings;
 		try {
 			settings = JSON.parse(this.getFileContent());
@@ -13987,7 +14488,8 @@ var ClaudecodeHooks = class extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: settings.hooks,
-			converterConfig: CLAUDE_CONVERTER_CONFIG
+			converterConfig: this.constructor.getConverterConfig(),
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -14016,6 +14518,21 @@ var ClaudecodePluginHooks = class extends ClaudecodeHooks {
 	isDeletable() {
 		return true;
 	}
+	/**
+	* Plugin hook scripts ship inside the plugin, so their commands must resolve
+	* against the plugin install directory rather than the consumer's project
+	* root. Upstream documents `"${CLAUDE_PLUGIN_ROOT}"/scripts/format-code.sh`;
+	* `$CLAUDE_PROJECT_DIR` would expand to a path in the consumer's own repo,
+	* where the bundled script does not exist.
+	*
+	* @see https://code.claude.com/docs/en/plugins-reference
+	*/
+	static getConverterConfig() {
+		return {
+			...super.getConverterConfig(),
+			projectDirVar: "$CLAUDE_PLUGIN_ROOT"
+		};
+	}
 	static getSettablePaths() {
 		return {
 			relativeDirPath: CLAUDECODE_PLUGIN_HOOKS_DIR,
@@ -14038,6 +14555,10 @@ const CODEXCLI_CONVERTER_CONFIG = {
 	}, {
 		canonical: "statusMessage",
 		tool: "statusMessage"
+	}],
+	numberPassthroughFields: [{
+		canonical: "additionalContextLimit",
+		tool: "additionalContextLimit"
 	}]
 };
 /**
@@ -14127,13 +14648,14 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = CodexcliHooks.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
 		const codexHooks = canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config.codexcli?.hooks,
-			converterConfig: CODEXCLI_CONVERTER_CONFIG
+			converterConfig: CODEXCLI_CONVERTER_CONFIG,
+			logger
 		});
 		const fileContent = JSON.stringify({ hooks: codexHooks }, null, 2);
 		return new CodexcliHooks({
@@ -14144,7 +14666,7 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let parsed;
 		try {
 			parsed = JSON.parse(this.getFileContent());
@@ -14153,7 +14675,8 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: parsed.hooks,
-			converterConfig: CODEXCLI_CONVERTER_CONFIG
+			converterConfig: CODEXCLI_CONVERTER_CONFIG,
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -14392,13 +14915,13 @@ var CopilotHooks = class CopilotHooks extends ToolHooks {
 *   under `.github/hooks/` is picked up automatically when the CLI is
 *   invoked from the project root.
 *
-* - **Global scope**: `~/.copilot/hooks/copilot-hooks.json` — chosen for
-*   consistency with the existing global Copilot CLI config layout (e.g.
-*   `~/.copilot/mcp-config.json` produced by `copilotcli-mcp.ts`). The
-*   official docs do not currently document a global hooks location, so
-*   this is a rulesync convention pending official documentation; we keep
-*   all rulesync-managed Copilot CLI files under the single `~/.copilot/`
-*   root and will revisit if the spec later mandates an alternate layout.
+* - **Global scope**: `~/.copilot/hooks/copilot-hooks.json` — the directory is
+*   the documented user-level hooks location ("`*.json` files in the
+*   user-level hooks directory. By default this is `~/.copilot/hooks/` on
+*   macOS and Linux, or `%USERPROFILE%\.copilot\hooks\` on Windows"). Every
+*   `*.json` in it is loaded, so the filename remains rulesync's choice, as it
+*   is for project scope. `COPILOT_HOME` relocates the directory upstream
+*   (`$COPILOT_HOME/hooks/`); rulesync does not read that variable yet.
 *
 * Hook entries on the six matcher-aware events (see
 * {@link COPILOTCLI_MATCHER_EVENTS}) may carry an optional `matcher` regex; it
@@ -14809,17 +15332,18 @@ const DEEPAGENTS_MCP_FILE_NAME = ".mcp.json";
 const DEEPAGENTS_HOOKS_FILE_NAME = "hooks.json";
 //#endregion
 //#region src/features/hooks/deepagents-hooks.ts
-function isDeepagentsHooksFile(val) {
-	if (typeof val !== "object" || val === null || !("hooks" in val)) return false;
-	return Array.isArray(val.hooks);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
-* Convert canonical hooks config to deepagents flat array format.
+* Convert the canonical hooks config to the deepagents Hooks v2 document.
 *
-* deepagents format:
-* { "hooks": [{ "command": ["bash", "-c", "..."], "events": ["session.start"] }] }
+* ```json
+* { "hooks": { "PreToolUse": [{ "matcher": "Bash", "hooks": [{ "type": "command", "command": "…" }] }] } }
+* ```
 *
-* Each canonical hook definition becomes one deepagents hook entry.
+* Definitions sharing an event and matcher land in one group, preserving their
+* authored order — upstream runs a group's handlers in sequence.
 */
 function canonicalToDeepagentsHooks(config) {
 	const supported = new Set(DEEPAGENTS_HOOK_EVENTS);
@@ -14827,7 +15351,7 @@ function canonicalToDeepagentsHooks(config) {
 		...config.hooks,
 		...config.deepagents?.hooks
 	};
-	const entries = [];
+	const hooks = {};
 	for (const [canonicalEvent, definitions] of Object.entries(effectiveHooks)) {
 		if (!supported.has(canonicalEvent)) continue;
 		const deepagentsEvent = CANONICAL_TO_DEEPAGENTS_EVENT_NAMES[canonicalEvent];
@@ -14835,43 +15359,69 @@ function canonicalToDeepagentsHooks(config) {
 		for (const def of definitions) {
 			if ((def.type ?? "command") !== "command") continue;
 			if (!def.command) continue;
-			if (def.matcher) continue;
-			entries.push({
-				command: [
-					"bash",
-					"-c",
-					def.command
-				],
-				events: [deepagentsEvent]
+			const handler = {
+				type: "command",
+				command: def.command
+			};
+			if (def.timeout !== void 0 && def.timeout !== null && def.timeout > 0) handler.timeout = def.timeout;
+			if (def.statusMessage !== void 0 && def.statusMessage !== null) handler.statusMessage = def.statusMessage;
+			const matcher = def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" ? def.matcher : void 0;
+			const groups = hooks[deepagentsEvent] ??= [];
+			const group = groups.find((candidate) => candidate.matcher === matcher);
+			if (group) group.hooks.push(handler);
+			else groups.push({
+				...matcher !== void 0 && { matcher },
+				hooks: [handler]
 			});
 		}
 	}
-	return entries;
+	return hooks;
+}
+/**
+* Convert the Hooks v2 document back to the canonical hooks record.
+*/
+function deepagentsToCanonicalHooks(hooks) {
+	const canonical = {};
+	for (const [deepagentsEvent, groups] of Object.entries(hooks)) {
+		const canonicalEvent = DEEPAGENTS_TO_CANONICAL_EVENT_NAMES[deepagentsEvent];
+		if (!canonicalEvent || !Array.isArray(groups)) continue;
+		for (const group of groups) {
+			if (!isRecord(group) || !Array.isArray(group.hooks)) continue;
+			for (const handler of group.hooks) {
+				if (!isRecord(handler) || typeof handler.command !== "string") continue;
+				const def = {
+					type: "command",
+					command: handler.command
+				};
+				if (typeof group.matcher === "string" && group.matcher !== "") def.matcher = group.matcher;
+				if (typeof handler.timeout === "number") def.timeout = handler.timeout;
+				if (typeof handler.statusMessage === "string") def.statusMessage = handler.statusMessage;
+				(canonical[canonicalEvent] ??= []).push(def);
+			}
+		}
+	}
+	return canonical;
 }
 /**
-* Convert deepagents flat array format back to canonical hooks record.
+* Read the pre-v2 flat list. deepagents still loads it until 2026-09-01, so a
+* `hooks.json` a user has not migrated yet is imported rather than discarded —
+* but rulesync only ever writes the v2 shape, so regenerating migrates it.
 */
-function deepagentsToCanonicalHooks(hooksEntries) {
+function deepagentsLegacyToCanonicalHooks(entries) {
 	const canonical = {};
-	for (const entry of hooksEntries) {
-		if (typeof entry !== "object" || entry === null) continue;
-		if (!Array.isArray(entry.command) || entry.command.length === 0) continue;
-		let command;
-		if (entry.command.length === 3 && entry.command[0] === "bash" && entry.command[1] === "-c") command = entry.command[2] ?? "";
-		else command = entry.command.join(" ");
-		const events = entry.events ?? [];
-		for (const deepagentsEvent of events) {
-			const canonicalEvent = DEEPAGENTS_TO_CANONICAL_EVENT_NAMES[deepagentsEvent];
+	for (const entry of entries) {
+		if (!isRecord(entry)) continue;
+		const argv = entry.command;
+		if (!Array.isArray(argv) || argv.length === 0) continue;
+		const command = argv.length === 3 && argv[0] === "bash" && argv[1] === "-c" ? String(argv[2] ?? "") : argv.join(" ");
+		const events = Array.isArray(entry.events) ? entry.events : [];
+		for (const legacyEvent of events) {
+			const canonicalEvent = typeof legacyEvent === "string" ? DEEPAGENTS_LEGACY_TO_CANONICAL_EVENT_NAMES[legacyEvent] : void 0;
 			if (!canonicalEvent) continue;
-			const existing = canonical[canonicalEvent];
-			if (existing) existing.push({
+			(canonical[canonicalEvent] ??= []).push({
 				type: "command",
 				command
 			});
-			else canonical[canonicalEvent] = [{
-				type: "command",
-				command
-			}];
 		}
 	}
 	return canonical;
@@ -14880,7 +15430,7 @@ var DeepagentsHooks = class DeepagentsHooks extends ToolHooks {
 	constructor(params) {
 		super({
 			...params,
-			fileContent: params.fileContent ?? JSON.stringify({ hooks: [] }, null, 2)
+			fileContent: params.fileContent ?? JSON.stringify({ hooks: {} }, null, 2)
 		});
 	}
 	isDeletable() {
@@ -14894,7 +15444,7 @@ var DeepagentsHooks = class DeepagentsHooks extends ToolHooks {
 	}
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		const paths = DeepagentsHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ hooks: [] }, null, 2);
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ hooks: {} }, null, 2);
 		return new DeepagentsHooks({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -14922,7 +15472,8 @@ var DeepagentsHooks = class DeepagentsHooks extends ToolHooks {
 		} catch (error) {
 			throw new Error(`Failed to parse deepagents hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const hooks = deepagentsToCanonicalHooks(isDeepagentsHooksFile(parsed) ? parsed.hooks : []);
+		const rawHooks = isRecord(parsed) ? parsed.hooks : void 0;
+		const hooks = Array.isArray(rawHooks) ? deepagentsLegacyToCanonicalHooks(rawHooks) : isRecord(rawHooks) ? deepagentsToCanonicalHooks(rawHooks) : {};
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
 			overrideKey: "deepagents"
@@ -14939,7 +15490,7 @@ var DeepagentsHooks = class DeepagentsHooks extends ToolHooks {
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
-			fileContent: JSON.stringify({ hooks: [] }, null, 2),
+			fileContent: JSON.stringify({ hooks: {} }, null, 2),
 			validate: false
 		});
 	}
@@ -15041,7 +15592,7 @@ var DevinHooks = class DevinHooks extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let parsed;
 		try {
 			parsed = JSON.parse(this.getFileContent());
@@ -15049,8 +15600,9 @@ var DevinHooks = class DevinHooks extends ToolHooks {
 			throw new Error(`Failed to parse Devin hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: this.getRelativeFilePath() === "config.json" ? isRecord(parsed) && isRecord(parsed.hooks) ? parsed.hooks : {} : parsed,
-			converterConfig: DEVIN_CONVERTER_CONFIG
+			hooks: this.getRelativeFilePath() === "config.json" ? isRecord$1(parsed) && isRecord$1(parsed.hooks) ? parsed.hooks : {} : parsed,
+			converterConfig: DEVIN_CONVERTER_CONFIG,
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -15081,7 +15633,13 @@ const FACTORYDROID_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: FACTORYDROID_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "$FACTORY_PROJECT_DIR",
 	prefixDotRelativeCommandsOnly: true,
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	groupPassthroughFields: [{
+		canonical: "commandRegex",
+		tool: "commandRegex",
+		valueType: "string",
+		subdividesGroup: true
+	}]
 };
 var FactorydroidHooks = class FactorydroidHooks extends ToolHooks {
 	constructor(params) {
@@ -15138,7 +15696,7 @@ var FactorydroidHooks = class FactorydroidHooks extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let settings;
 		try {
 			settings = JSON.parse(this.getFileContent());
@@ -15147,7 +15705,8 @@ var FactorydroidHooks = class FactorydroidHooks extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: settings.hooks,
-			converterConfig: FACTORYDROID_CONVERTER_CONFIG
+			converterConfig: FACTORYDROID_CONVERTER_CONFIG,
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -15177,7 +15736,8 @@ const GOOSE_CONVERTER_CONFIG = {
 	canonicalToToolEventNames: CANONICAL_TO_GOOSE_EVENT_NAMES,
 	toolToCanonicalEventNames: GOOSE_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
+	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	wildcardMatcherMeansAll: true
 };
 /**
 * Represents a Goose lifecycle hooks file.
@@ -15215,13 +15775,14 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = GooseHooks.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
 		const gooseHooks = canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config.goose?.hooks,
-			converterConfig: GOOSE_CONVERTER_CONFIG
+			converterConfig: GOOSE_CONVERTER_CONFIG,
+			logger
 		});
 		const fileContent = JSON.stringify({ hooks: gooseHooks }, null, 2);
 		return new GooseHooks({
@@ -15232,7 +15793,7 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let parsed;
 		try {
 			parsed = JSON.parse(this.getFileContent());
@@ -15241,7 +15802,8 @@ var GooseHooks = class GooseHooks extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: parsed.hooks && typeof parsed.hooks === "object" && !Array.isArray(parsed.hooks) ? Object.fromEntries(Object.entries(parsed.hooks).filter(([eventName]) => Object.hasOwn(GOOSE_TO_CANONICAL_EVENT_NAMES, eventName))) : parsed.hooks,
-			converterConfig: GOOSE_CONVERTER_CONFIG
+			converterConfig: GOOSE_CONVERTER_CONFIG,
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -15272,6 +15834,11 @@ const GROKCLI_CONVERTER_CONFIG = {
 	toolToCanonicalEventNames: GROKCLI_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
 	supportedHookTypes: /* @__PURE__ */ new Set(["command", "http"]),
+	recordPassthroughFields: [{
+		canonical: "env",
+		tool: "env",
+		commandOnly: true
+	}],
 	noMatcherEvents: /* @__PURE__ */ new Set([
 		"sessionStart",
 		"sessionEnd",
@@ -15340,7 +15907,7 @@ var GrokcliHooks = class GrokcliHooks extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let parsed;
 		try {
 			parsed = JSON.parse(this.getFileContent());
@@ -15348,8 +15915,9 @@ var GrokcliHooks = class GrokcliHooks extends ToolHooks {
 			throw new Error(`Failed to parse Grok hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: isRecord(parsed) && isRecord(parsed.hooks) ? parsed.hooks : {},
-			converterConfig: GROKCLI_CONVERTER_CONFIG
+			hooks: isRecord$1(parsed) && isRecord$1(parsed.hooks) ? parsed.hooks : {},
+			converterConfig: GROKCLI_CONVERTER_CONFIG,
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -15670,7 +16238,7 @@ var JunieHooks = class JunieHooks extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks({ logger } = {}) {
 		let settings;
 		try {
 			settings = JSON.parse(this.getFileContent());
@@ -15679,7 +16247,8 @@ var JunieHooks = class JunieHooks extends ToolHooks {
 		}
 		const hooks = toolHooksToCanonical({
 			hooks: settings.hooks,
-			converterConfig: JUNIE_CONVERTER_CONFIG
+			converterConfig: JUNIE_CONVERTER_CONFIG,
+			logger
 		});
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
@@ -16417,7 +16986,7 @@ function buildKiroIdeEntriesForEvent(trigger, definitions) {
 			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
 			action,
 			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
-			enabled: true
+			enabled: def.enabled ?? true
 		});
 	}
 	return entries;
@@ -16457,6 +17026,7 @@ function kiroIdeHooksToCanonical(entries) {
 		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
 		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
 		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
+		if (entry.enabled === false) def.enabled = false;
 		(canonical[eventName] ??= []).push(def);
 	}
 	return canonical;
@@ -17401,6 +17971,37 @@ function unsupportedEventNames(params) {
 	const eventNames = factory.passthroughOverrideEvents ? Object.keys(sharedHooks) : Object.keys(effectiveHooks);
 	return [...new Set(eventNames)].filter((e) => !supportedEvents.has(e));
 }
+/**
+* A logger whose warnings name the tool being converted, matching the rest of
+* this processor's warnings: the shared hooks converter says what is wrong but
+* not which tool's file it is reading or writing, and one run walks them all.
+*
+* Every method delegates explicitly rather than through a prototype, so the
+* real logger keeps owning its state — a wrapper that inherited it would
+* absorb the writes `configure` and `outputJson` make.
+*/
+function withToolTargetPrefix({ logger, toolTarget }) {
+	return {
+		configure: (options) => logger.configure(options),
+		get verbose() {
+			return logger.verbose;
+		},
+		get silent() {
+			return logger.silent;
+		},
+		get jsonMode() {
+			return logger.jsonMode;
+		},
+		captureData: (key, value) => logger.captureData(key, value),
+		getJsonData: () => logger.getJsonData(),
+		outputJson: (success, error) => logger.outputJson(success, error),
+		info: (message, ...args) => logger.info(message, ...args),
+		success: (message, ...args) => logger.success(message, ...args),
+		warn: (message, ...args) => logger.warn(`For ${toolTarget}: ${message}`, ...args),
+		error: (message, code, ...args) => logger.error(message, code, ...args),
+		debug: (message, ...args) => logger.debug(message, ...args)
+	};
+}
 function unsupportedMatcherEventNames({ factory, effectiveHooks }) {
 	if (factory.supportsMatcher && !factory.matcherEvents) return [];
 	const matcherEvents = factory.matcherEvents ? new Set(factory.matcherEvents) : void 0;
@@ -17623,13 +18224,13 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 	["deepagents", {
 		class: DeepagentsHooks,
 		meta: {
-			supportsProject: false,
+			supportsProject: true,
 			supportsGlobal: true,
 			supportsImport: true
 		},
 		supportedEvents: DEEPAGENTS_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: true
 	}],
 	["kiro", {
 		class: KiroHooks,
@@ -17841,6 +18442,15 @@ var HooksProcessor = class extends FeatureProcessor {
 			}
 			for (const [hookType, events] of unsupportedTypeToEvents) this.logger.warn(`Skipped ${hookType}-type hook(s) for ${this.toolTarget} (not supported): ${Array.from(events).join(", ")}`);
 		}
+		if (this.toolTarget !== "kiro-ide") {
+			const skippedEvents = new Set(unsupportedEventNames({
+				factory,
+				sharedHooks,
+				effectiveHooks
+			}));
+			const eventsWithDisabledHooks = Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => def.enabled === false)).map(([event]) => event);
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only kiro-ide supports the flag): ${eventsWithDisabledHooks.join(", ")}`);
+		}
 		const eventsWithUnsupportedMatcher = unsupportedMatcherEventNames({
 			factory,
 			effectiveHooks
@@ -17851,7 +18461,10 @@ var HooksProcessor = class extends FeatureProcessor {
 			rulesyncHooks,
 			validate: true,
 			global: this.global,
-			logger: this.logger
+			logger: withToolTargetPrefix({
+				logger: this.logger,
+				toolTarget: this.toolTarget
+			})
 		})];
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
 			outputRoot: this.outputRoot,
@@ -17861,7 +18474,12 @@ var HooksProcessor = class extends FeatureProcessor {
 		return result;
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
-		return toolFiles.filter((f) => f instanceof ToolHooks).map((h) => h.toRulesyncHooks({ logger: this.logger }));
+		const hooks = toolFiles.filter((f) => f instanceof ToolHooks);
+		const logger = withToolTargetPrefix({
+			logger: this.logger,
+			toolTarget: this.toolTarget
+		});
+		return hooks.map((h) => h.toRulesyncHooks({ logger }));
 	}
 	static getToolTargets({ global = false, importOnly = false } = {}) {
 		if (global) return importOnly ? hooksProcessorToolTargetsGlobalImportable : hooksProcessorToolTargetsGlobal;
@@ -19504,9 +20122,9 @@ function parseAmpSettingsJsonc(fileContent) {
 }
 function filterMcpServers(mcpServers) {
 	const filtered = {};
-	if (!isRecord(mcpServers)) return filtered;
+	if (!isRecord$1(mcpServers)) return filtered;
 	for (const [name, config] of Object.entries(mcpServers)) {
-		if (isPrototypePollutionKey(name) || !isRecord(config)) continue;
+		if (isPrototypePollutionKey(name) || !isRecord$1(config)) continue;
 		const filteredConfig = {};
 		for (const [key, value] of Object.entries(config)) {
 			if (isPrototypePollutionKey(key)) continue;
@@ -19621,7 +20239,7 @@ var AmpMcp = class AmpMcp extends ToolMcp {
 			success: true,
 			error: null
 		};
-		if (!isRecord(mcpServers)) return {
+		if (!isRecord$1(mcpServers)) return {
 			success: false,
 			error: /* @__PURE__ */ new Error(`${AMP_MCP_SERVERS_KEY} must be a JSON object`)
 		};
@@ -19630,7 +20248,7 @@ var AmpMcp = class AmpMcp extends ToolMcp {
 				success: false,
 				error: /* @__PURE__ */ new Error(`Server name "${serverName}" is a prototype pollution key and is not allowed`)
 			};
-			if (!isRecord(serverConfig)) return {
+			if (!isRecord$1(serverConfig)) return {
 				success: false,
 				error: /* @__PURE__ */ new Error(`MCP server "${serverName}" must be a JSON object`)
 			};
@@ -20230,13 +20848,13 @@ function normalizeCodexMcpServerName(name) {
 function convertFromCodexFormat(codexMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(codexMcp)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const converted = {};
 		for (const [key, value] of Object.entries(config)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "enabled") {
 				if (value === false) converted["disabled"] = true;
-			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthFromCodex(value);
+			} else if (key === "oauth" && isRecord$1(value)) converted[key] = mapOauthFromCodex(value);
 			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
 				const mappedKey = CODEX_TO_RULESYNC_FIELD_MAP[key];
 				if (mappedKey) if (isValidRenamedArray(key, value)) converted[mappedKey] = value;
@@ -20255,7 +20873,7 @@ function convertToCodexFormat(mcpServers) {
 	const result = {};
 	const originalNames = /* @__PURE__ */ new Map();
 	for (const [name, config] of Object.entries(mcpServers)) {
-		if (!isRecord(config)) continue;
+		if (!isRecord$1(config)) continue;
 		const { codexName, usedFallback } = normalizeCodexMcpServerName(name);
 		if (usedFallback) warnWithFallback(void 0, `MCP server "${name}" cannot be represented as a Codex MCP server name (ASCII [a-zA-Z0-9_-] only), so the stable fallback name "${codexName}" was used. Rename the server in .rulesync/mcp.jsonc to choose a readable Codex name.`);
 		const converted = {};
@@ -20263,7 +20881,7 @@ function convertToCodexFormat(mcpServers) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 			if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
-			} else if (key === "oauth" && isRecord(value)) converted[key] = mapOauthToCodex(value);
+			} else if (key === "oauth" && isRecord$1(value)) converted[key] = mapOauthToCodex(value);
 			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
 				const mappedKey = RULESYNC_TO_CODEX_FIELD_MAP[key];
 				if (mappedKey) if (isValidRenamedArray(key, value)) converted[mappedKey] = value;
@@ -20339,21 +20957,21 @@ var CodexcliMcp = class CodexcliMcp extends ToolMcp {
 		const strippedMcpServers = rulesyncMcp.getMcpServers();
 		const rawMcpServers = rulesyncMcp.getJson().mcpServers;
 		const converted = convertToCodexFormat(Object.fromEntries(Object.entries(strippedMcpServers).map(([serverName, serverConfig]) => {
-			const rawServer = isRecord(rawMcpServers) ? rawMcpServers[serverName] : void 0;
+			const rawServer = isRecord$1(rawMcpServers) ? rawMcpServers[serverName] : void 0;
 			return [serverName, {
 				...serverConfig,
-				...isRecord(rawServer) && isEnvVarEntryArray(rawServer.envVars) ? { envVars: rawServer.envVars } : {},
-				...isRecord(rawServer) && typeof rawServer.experimental_environment === "string" ? { experimentalEnvironment: rawServer.experimental_environment } : {},
-				...isRecord(rawServer) && typeof rawServer.experimentalEnvironment === "string" ? { experimentalEnvironment: rawServer.experimentalEnvironment } : {}
+				...isRecord$1(rawServer) && isEnvVarEntryArray(rawServer.envVars) ? { envVars: rawServer.envVars } : {},
+				...isRecord$1(rawServer) && typeof rawServer.experimental_environment === "string" ? { experimentalEnvironment: rawServer.experimental_environment } : {},
+				...isRecord$1(rawServer) && typeof rawServer.experimentalEnvironment === "string" ? { experimentalEnvironment: rawServer.experimentalEnvironment } : {}
 			}];
 		})));
 		const filteredMcpServers = this.removeEmptyEntries(converted);
 		for (const name of Object.keys(converted)) if (!Object.hasOwn(filteredMcpServers, name)) warnWithFallback(void 0, `MCP server "${name}" had no non-empty configuration and was dropped from the codex CLI config`);
-		const existingMcpServers = isRecord(configToml["mcp_servers"]) ? configToml["mcp_servers"] : {};
+		const existingMcpServers = isRecord$1(configToml["mcp_servers"]) ? configToml["mcp_servers"] : {};
 		const mergedMcpServers = Object.fromEntries(Object.entries(filteredMcpServers).map(([name, serverConfig]) => {
-			const existingServer = isRecord(existingMcpServers[name]) ? existingMcpServers[name] : void 0;
+			const existingServer = isRecord$1(existingMcpServers[name]) ? existingMcpServers[name] : void 0;
 			const serverRecord = serverConfig;
-			if (existingServer && isRecord(existingServer["tools"]) && !("tools" in serverRecord)) return [name, {
+			if (existingServer && isRecord$1(existingServer["tools"]) && !("tools" in serverRecord)) return [name, {
 				...serverRecord,
 				tools: existingServer["tools"]
 			}];
@@ -21222,6 +21840,27 @@ function resolveGooseType(config, url) {
 	return canonicalTransport(config) === "builtin" ? "builtin" : "stdio";
 }
 /**
+* The Goose extension types that carry an MCP server. Goose also documents
+* `builtin`, `platform`, `frontend` and `inline_python` extensions, which have
+* no canonical MCP counterpart: they name capabilities Goose provides itself
+* rather than a server rulesync could describe.
+*/
+const GOOSE_MCP_EXTENSION_TYPES = /* @__PURE__ */ new Set([
+	"stdio",
+	"streamable_http",
+	"sse"
+]);
+/**
+* Resolves the Goose extension type of an existing `extensions:` entry the way
+* Goose itself reads it: the declared `type`, or the shape of the entry when
+* the key is absent.
+*/
+function existingExtensionType(ext) {
+	if (typeof ext.type === "string") return ext.type;
+	if (typeof ext.cmd === "string") return "stdio";
+	if (typeof ext.uri === "string") return "streamable_http";
+}
+/**
 * Resolves the canonical timeout for a server (`timeout` or `networkTimeout`).
 */
 function resolveGooseTimeout(config) {
@@ -21247,15 +21886,20 @@ function applyGooseStdioFields(ext, config) {
 /**
 * Converts a single rulesync canonical MCP server into a Goose `extensions:` entry.
 */
-function convertServerToGooseExtension(name, config) {
+function convertServerToGooseExtension(name, config, logger) {
 	const url = resolveGooseUrl(config);
 	const gooseType = resolveGooseType(config, url);
 	const ext = {
 		name,
 		type: gooseType
 	};
-	if (gooseType === "stdio") applyGooseStdioFields(ext, config);
-	else if (gooseType === "sse" || gooseType === "streamable_http") {
+	if (gooseType === "stdio") {
+		applyGooseStdioFields(ext, config);
+		if (typeof ext.cmd !== "string" || ext.cmd === "") {
+			warnWithFallback(logger, `Goose extension "${name}" has no command to run; skipping it rather than writing a stdio extension Goose cannot start to ~/.config/goose/config.yaml.`);
+			return;
+		}
+	} else if (gooseType === "sse" || gooseType === "streamable_http") {
 		if (url !== void 0) ext.uri = url;
 		if (isPlainObject$1(config.headers)) ext.headers = omitPrototypePollutionKeys(config.headers);
 	}
@@ -21270,13 +21914,41 @@ function convertServerToGooseExtension(name, config) {
 * Goose uses a non-standard schema: `name`, `type` (`stdio` | `streamable_http`
 * | `sse` | `builtin`), `cmd`/`args`/`envs` for stdio, `uri`/`headers` for
 * remote, plus `enabled` and `timeout`.
-*/
-function convertToGooseFormat(mcpServers) {
-	const extensions = {};
+*
+* `extensions:` is co-owned: alongside the MCP servers rulesync manages it also
+* holds Goose's own `builtin`/`platform`/`frontend`/`inline_python` extensions
+* (`developer`, `memory`, ...), which have no canonical MCP representation.
+* Those entries are carried over from `existingExtensions` untouched — removing
+* `developer` alone costs the agent its shell and text-editor tools. Only an
+* entry rulesync can positively identify as an MCP server is rulesync's to
+* replace, so a server deleted from `.rulesync/.mcp.json` is retracted (with a
+* warning naming it) while an entry of an unrecognized shape or a future
+* extension type is left alone rather than assumed to be ours.
+*/
+function convertToGooseFormat({ mcpServers, existingExtensions, logger }) {
+	const generated = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
-		extensions[name] = convertServerToGooseExtension(name, config);
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const ext = convertServerToGooseExtension(name, config, logger);
+		if (ext !== void 0) generated[name] = ext;
 	}
+	const extensions = {};
+	const retracted = [];
+	for (const [name, ext] of Object.entries(existingExtensions)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		const type = isRecord$1(ext) ? existingExtensionType(ext) : void 0;
+		if (type !== void 0 && GOOSE_MCP_EXTENSION_TYPES.has(type)) {
+			if (!Object.hasOwn(generated, name)) retracted.push(name);
+			continue;
+		}
+		if (!Object.hasOwn(generated, name)) {
+			extensions[name] = ext;
+			continue;
+		}
+		if (generated[name]?.type !== type) warnWithFallback(logger, `Goose extension "${name}" already exists in config.yaml as a non-MCP extension; the MCP server of the same name replaces it.`);
+	}
+	if (retracted.length > 0) warnWithFallback(logger, `Removing MCP extension(s) ${retracted.map((name) => `"${name}"`).join(", ")} from ~/.config/goose/config.yaml: they are not in the generated rulesync MCP config. Import them first if they were added with \`goose configure\`.`);
+	Object.assign(extensions, generated);
 	return extensions;
 }
 /**
@@ -21287,16 +21959,27 @@ function convertToGooseFormat(mcpServers) {
 * so both `url` and the Claude-specific `httpUrl` alias come back as `url`; and
 * the `streamable_http` type maps back to canonical `http`. These are the
 * canonical/preferred forms, so re-generating produces an equivalent config.
+*
+* Non-MCP extension types (`builtin`, `platform`, `frontend`, `inline_python`)
+* are skipped: they describe capabilities Goose provides itself, and importing
+* one would strip the type that makes it work — a `builtin` entry came back as
+* a `stdio` extension with no `cmd` that Goose cannot start. They stay in `config.yaml`,
+* which generation preserves.
 */
 function convertFromGooseFormat(extensions) {
 	const result = {};
+	const skipped = [];
 	for (const [name, ext] of Object.entries(extensions)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(ext)) continue;
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(ext)) continue;
+		const type = existingExtensionType(ext);
+		if (type === void 0 || !GOOSE_MCP_EXTENSION_TYPES.has(type)) {
+			skipped.push(name);
+			continue;
+		}
 		const server = {};
-		const type = typeof ext.type === "string" ? ext.type : void 0;
 		if (type === "sse") server.type = "sse";
 		else if (type === "streamable_http") server.type = "http";
-		else if (type === "stdio") server.type = "stdio";
+		else server.type = "stdio";
 		if (typeof ext.cmd === "string") server.command = ext.cmd;
 		if (isStringArray$1(ext.args)) server.args = ext.args;
 		if (isPlainObject$1(ext.envs)) server.env = omitPrototypePollutionKeys(ext.envs);
@@ -21306,6 +21989,7 @@ function convertFromGooseFormat(extensions) {
 		if (typeof ext.timeout === "number") server.timeout = ext.timeout;
 		result[name] = server;
 	}
+	if (skipped.length > 0) warnWithFallback(void 0, `Skipping ${skipped.length} non-MCP Goose extension(s) (${skipped.map((name) => `"${name}"`).join(", ")}): they describe capabilities Goose provides itself and have no rulesync representation.`);
 	return result;
 }
 /**
@@ -21340,7 +22024,7 @@ function buildGoosePluginStdioServer(config) {
 function convertToGoosePluginMcpServers(mcpServers, logger) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const gooseType = resolveGooseType(config, resolveGooseUrl(config));
 		if (gooseType !== "stdio") {
 			warnWithFallback(logger, `Goose open-plugin MCP manifest (${GOOSE_PLUGIN_MCP_RELATIVE_PATH}) is stdio-only; skipping "${name}" (${gooseType}). Sync it with --global to ~/.config/goose/config.yaml instead.`);
@@ -21381,7 +22065,7 @@ var GooseMcp = class GooseMcp extends ToolMcp {
 	parsePluginManifest(fileContent) {
 		try {
 			const parsed = JSON.parse(fileContent);
-			return isRecord(parsed) ? parsed : {};
+			return isRecord$1(parsed) ? parsed : {};
 		} catch (error) {
 			throw new Error(`Failed to parse Goose MCP manifest at ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(error)}`, { cause: error });
 		}
@@ -21427,25 +22111,35 @@ var GooseMcp = class GooseMcp extends ToolMcp {
 				global
 			});
 		}
-		const merged = {
-			...parseGooseConfig(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "", paths.relativeDirPath, paths.relativeFilePath),
-			extensions: convertToGooseFormat(rulesyncMcp.getMcpServers())
-		};
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const config = parseGooseConfig(existingContent, paths.relativeDirPath, paths.relativeFilePath);
+		const existingExtensions = isRecord$1(config.extensions) ? config.extensions : {};
 		return new GooseMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
-			fileContent: (0, js_yaml.dump)(merged),
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { extensions: convertToGooseFormat({
+					mcpServers: rulesyncMcp.getMcpServers(),
+					existingExtensions,
+					logger
+				}) },
+				filePath
+			}),
 			validate,
 			global
 		});
 	}
 	toRulesyncMcp() {
 		if (!this.global) {
-			const mcpServers = isRecord(this.config.mcpServers) ? this.config.mcpServers : {};
+			const mcpServers = isRecord$1(this.config.mcpServers) ? this.config.mcpServers : {};
 			return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
 		}
-		const mcpServers = convertFromGooseFormat(isRecord(this.config.extensions) ? this.config.extensions : {});
+		const mcpServers = convertFromGooseFormat(isRecord$1(this.config.extensions) ? this.config.extensions : {});
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
 	}
 	validate() {
@@ -21481,7 +22175,7 @@ function convertToGrokFormat(mcpServers) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
-		if (!isRecord(config)) continue;
+		if (!isRecord$1(config)) continue;
 		const converted = {};
 		for (const [key, value] of Object.entries(config)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
@@ -21496,7 +22190,7 @@ function convertToGrokFormat(mcpServers) {
 function convertFromGrokFormat(grokMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(grokMcp)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const converted = {};
 		for (const [key, value] of Object.entries(config)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
@@ -21634,7 +22328,7 @@ function resolveHermesTimeout(config) {
 * import alike. See the Hermes mcp-config-reference.
 */
 function copyHermesOauth(source) {
-	if (!isRecord(source)) return;
+	if (!isRecord$1(source)) return;
 	const oauth = {};
 	for (const key of [
 		"redirect_uri",
@@ -21768,13 +22462,13 @@ function convertServerToHermes(config) {
 function convertToHermesFormat(mcpServers) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		result[name] = convertServerToHermes(config);
 	}
 	return result;
 }
 function mergeHermesMcpServers(config, mcpServers) {
-	const existingMcpServers = isRecord(config.mcp_servers) ? config.mcp_servers : {};
+	const existingMcpServers = isRecord$1(config.mcp_servers) ? config.mcp_servers : {};
 	return {
 		...config,
 		mcp_servers: {
@@ -21793,7 +22487,7 @@ function convertFromHermesFormat(mcpServers) {
 	const result = {};
 	const hermesOverrides = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
-		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord(config)) continue;
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const server = {};
 		if (typeof config.command === "string") server.command = config.command;
 		if (isStringArray$1(config.args)) server.args = config.args;
@@ -21802,7 +22496,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (isPlainObject$1(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
 		if (config.enabled === false) server.disabled = true;
 		if (typeof config.timeout === "number") server.networkTimeout = config.timeout;
-		if (isRecord(config.tools)) applyHermesToolsBlock(config.tools, server);
+		if (isRecord$1(config.tools)) applyHermesToolsBlock(config.tools, server);
 		result[name] = server;
 		const hermesServer = { ...server };
 		if (copyHermesAdvancedFields(config, hermesServer)) hermesOverrides[name] = hermesServer;
@@ -21841,7 +22535,7 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 		const merged = mergeHermesMcpServers(parseSharedConfig({
 			format: "yaml",
 			fileContent
-		}), isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		}), isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {});
 		this.config = merged;
 		super.setFileContent(applySharedConfigPatch({
 			fileKey: getHermesagentConfigSharedFileKey({ global: this.global }),
@@ -21905,7 +22599,7 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 		});
 	}
 	toRulesyncMcp() {
-		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {});
 		return this.toRulesyncMcpDefault({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
@@ -22217,7 +22911,7 @@ function convertServerToKiloFormat(serverName, serverConfig, existingEntry, logg
 */
 function readExistingKiloMcpEntries(fileContent) {
 	const mcp = (0, jsonc_parser.parse)(fileContent || "{}")?.mcp;
-	if (!isRecord(mcp)) return {};
+	if (!isRecord$1(mcp)) return {};
 	const entries = {};
 	for (const [serverName, entry] of Object.entries(mcp)) {
 		const result = KiloMcpServerSchema.safeParse(entry);
@@ -22521,7 +23215,7 @@ async function readKimiCodeConfig({ outputRoot }) {
 		return {
 			parsed: true,
 			content,
-			mcp: isRecord(mcp) ? mcp : {}
+			mcp: isRecord$1(mcp) ? mcp : {}
 		};
 	} catch {
 		return {
@@ -22675,7 +23369,7 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
 		if (!global) return [];
 		const block = rulesyncMcp.getJson()["kimi-code"];
-		if (!isRecord(block)) return [];
+		if (!isRecord$1(block)) return [];
 		const startupTimeoutMs = typeof block.startupTimeoutMs === "number" ? block.startupTimeoutMs : void 0;
 		const toolTimeoutMs = typeof block.toolTimeoutMs === "number" ? block.toolTimeoutMs : void 0;
 		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0) return [];
@@ -22728,6 +23422,68 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 };
 //#endregion
 //#region src/features/mcp/kiro-mcp.ts
+/**
+* Union of two optional string lists, preserving order and dropping duplicates.
+* Returns `undefined` only when neither side was authored at all, so the caller
+* omits the key entirely rather than writing an empty array — but an explicitly
+* authored `[]` is kept, which keeps import → generate idempotent.
+*/
+function mergeToolLists(...lists) {
+	if (lists.every((list) => list === void 0)) return void 0;
+	const merged = [];
+	for (const list of lists) for (const tool of list ?? []) if (!merged.includes(tool)) merged.push(tool);
+	return merged;
+}
+/**
+* Translate rulesync's Kiro-only authoring keys onto the field names Kiro
+* actually reads in `mcp.json`.
+*
+* - `kiroAutoApprove` → `autoApprove` (tools run without a confirmation prompt)
+* - `kiroAutoBlock` → `disabledTools` (tools hidden from the agent)
+*
+* `disabledTools` is the only block list Kiro reads, and it is also a canonical
+* rulesync field, so `kiroAutoBlock` is a redundant spelling of it. Prefer the
+* canonical field; see the note on `kiroAutoBlock` in `src/types/mcp.ts`.
+*
+* Both native names are documented per-server fields, so a config that already
+* spells them natively keeps working: the two lists are merged rather than
+* one overwriting the other.
+* @see https://kiro.dev/docs/mcp/configuration/
+*/
+function toKiroMcpServers(servers) {
+	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
+		const { kiroAutoApprove, kiroAutoBlock, disabledTools, ...rest } = server;
+		const autoApprove = mergeToolLists(isStringArray$1(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
+		const disabled = mergeToolLists(disabledTools, kiroAutoBlock);
+		return [name, {
+			...rest,
+			...autoApprove !== void 0 && { autoApprove },
+			...disabled !== void 0 && { disabledTools: disabled }
+		}];
+	}));
+}
+/**
+* Import direction of {@link toKiroMcpServers}: Kiro's `autoApprove` becomes the
+* rulesync-only `kiroAutoApprove` so a regenerate reproduces it. `disabledTools`
+* is left alone — it is already a canonical rulesync key with the same meaning,
+* so `kiroAutoBlock` deliberately has no import counterpart.
+*
+* Only a genuine string array is renamed. `kiroAutoApprove` is typed as one, so
+* moving a hand-written `"autoApprove": "all"` there would produce a
+* `.rulesync/mcp.jsonc` the next generate refuses to parse; such a value stays
+* under its original key and passes through untouched instead.
+*/
+function fromKiroMcpServers(servers) {
+	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
+		if (server === null || typeof server !== "object" || Array.isArray(server)) return [name, server];
+		const { autoApprove, ...rest } = server;
+		if (!isStringArray$1(autoApprove)) return [name, server];
+		return [name, {
+			...rest,
+			kiroAutoApprove: autoApprove
+		}];
+	}));
+}
 var KiroMcp = class KiroMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -22756,7 +23512,7 @@ var KiroMcp = class KiroMcp extends ToolMcp {
 	}
 	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true }) {
 		const paths = this.getSettablePaths();
-		const fileContent = JSON.stringify({ mcpServers: rulesyncMcp.getMcpServers() }, null, 2);
+		const fileContent = JSON.stringify({ mcpServers: toKiroMcpServers(rulesyncMcp.getMcpServers()) }, null, 2);
 		return new KiroMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -22766,7 +23522,9 @@ var KiroMcp = class KiroMcp extends ToolMcp {
 		});
 	}
 	toRulesyncMcp() {
-		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: this.json.mcpServers ?? {} }, null, 2) });
+		const mcpServers = this.json.mcpServers;
+		const translated = isMcpServers(mcpServers) ? fromKiroMcpServers(mcpServers) : {};
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: translated }, null, 2) });
 	}
 	validate() {
 		return {
@@ -23652,7 +24410,7 @@ async function readRovodevConfigYaml({ outputRoot }) {
 	});
 }
 function disabledNamesOf(config) {
-	const mcpBlock = config && isRecord(config.mcp) ? config.mcp : {};
+	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
 	return isStringArray$1(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
@@ -23771,7 +24529,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 		const managedNames = Object.keys(servers).filter((name) => toRovodevServer(name, servers[name]) !== null);
 		const disabledNames = managedNames.filter((name) => {
 			const server = servers[name];
-			return isRecord(server) && server.disabled === true;
+			return isRecord$1(server) && server.disabled === true;
 		});
 		const existingContent = await readFileContentOrNull((0, node_path.join)(outputRoot, ROVODEV_DIR, ROVODEV_CONFIG_FILE_NAME)) ?? "";
 		let existingParsed;
@@ -23785,7 +24543,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			logger?.warn(`Skipping the Rovo Dev mcp.disabledMcpServers update: ${formatError(error)}`);
 			return [];
 		}
-		const existingMcp = isRecord(existingParsed.mcp) ? { ...existingParsed.mcp } : {};
+		const existingMcp = isRecord$1(existingParsed.mcp) ? { ...existingParsed.mcp } : {};
 		const existingDisabled = isStringArray$1(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
@@ -23977,7 +24735,7 @@ function deriveTransportAllowlist(servers) {
 		http: false
 	};
 	for (const server of Object.values(servers)) {
-		if (!isRecord(server)) continue;
+		if (!isRecord$1(server)) continue;
 		const transport = transportOf(server);
 		if (transport) allowlist[transport] = true;
 	}
@@ -27612,13 +28370,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX$1 = "mcp__";
+const MCP_CANONICAL_PREFIX$2 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX$1) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$2) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -27652,7 +28410,7 @@ function toCanonicalCategory$1(cursorType, pattern) {
 		if (match) {
 			const server = match[1] ?? "*";
 			const tool = match[2] ?? "*";
-			return `${MCP_CANONICAL_PREFIX$1}${server}__${tool}`;
+			return `${MCP_CANONICAL_PREFIX$2}${server}__${tool}`;
 		}
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
@@ -27881,7 +28639,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { type, pattern } = parseCursorPermissionEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$1) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$2) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -28016,14 +28774,14 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 		let settings;
 		try {
 			const parsed = JSON.parse(existingContent);
-			settings = isRecord(parsed) ? parsed : {};
+			settings = isRecord$1(parsed) ? parsed : {};
 		} catch (error) {
 			throw new Error(`Failed to parse existing Devin config at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToDevinPermissions(config);
 		const managedScopes = new Set(Object.keys(config.permission).map((category) => toDevinScope(category)));
-		const existingPermissions = isRecord(settings.permissions) ? settings.permissions : {};
+		const existingPermissions = isRecord$1(settings.permissions) ? settings.permissions : {};
 		const preserve = (entries) => (entries ?? []).filter((entry) => !managedScopes.has(parseDevinPermissionEntry(entry).scope));
 		const mergedAllow = (0, es_toolkit.uniq)([...preserve(existingPermissions.allow), ...allow].toSorted());
 		const mergedAsk = (0, es_toolkit.uniq)([...preserve(existingPermissions.ask), ...ask].toSorted());
@@ -28053,11 +28811,11 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 		let settings;
 		try {
 			const parsed = JSON.parse(this.getFileContent());
-			settings = isRecord(parsed) ? parsed : {};
+			settings = isRecord$1(parsed) ? parsed : {};
 		} catch (error) {
 			throw new Error(`Failed to parse Devin permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const permissions = isRecord(settings.permissions) ? settings.permissions : {};
+		const permissions = isRecord$1(settings.permissions) ? settings.permissions : {};
 		const config = convertDevinToRulesyncPermissions({
 			allow: Array.isArray(permissions.allow) ? permissions.allow : [],
 			ask: Array.isArray(permissions.ask) ? permissions.ask : [],
@@ -28144,7 +28902,8 @@ const FACTORYDROID_OVERRIDE_KEYS = [
 	"interactionMode",
 	"extraKnownMarketplaces",
 	"enabledPlugins",
-	"hooksDisabled"
+	"hooksDisabled",
+	"disabledSkills"
 ];
 /**
 * Permissions adapter for Factory Droid.
@@ -28405,7 +29164,7 @@ var GoosePermissions = class GoosePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Goose permission.yaml at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const config = isRecord(parsed) ? { ...parsed } : {};
+		const config = isRecord$1(parsed) ? { ...parsed } : {};
 		const userPermission = convertRulesyncToGoosePermissionConfig({
 			config: rulesyncPermissions.getJson(),
 			logger
@@ -28428,8 +29187,8 @@ var GoosePermissions = class GoosePermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Goose permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const config = isRecord(parsed) ? parsed : {};
-		const rulesyncConfig = convertGoosePermissionConfigToRulesync(isRecord(config[GOOSE_USER_KEY]) ? config[GOOSE_USER_KEY] : {});
+		const config = isRecord$1(parsed) ? parsed : {};
+		const rulesyncConfig = convertGoosePermissionConfigToRulesync(isRecord$1(config[GOOSE_USER_KEY]) ? config[GOOSE_USER_KEY] : {});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -28503,7 +29262,7 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const CATCH_ALL_PATTERN$2 = "*";
-const MCP_CANONICAL_PREFIX = "mcp__";
+const MCP_CANONICAL_PREFIX$1 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
 	read: "Read",
@@ -28531,7 +29290,7 @@ const GROK_MCP_TOOL = "MCPTool";
 * concrete pattern emits `Tool(pattern)`.
 */
 function buildGrokEntry(category, pattern) {
-	if (category.startsWith(MCP_CANONICAL_PREFIX)) {
+	if (category.startsWith(MCP_CANONICAL_PREFIX$1)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
@@ -28558,7 +29317,7 @@ function parseGrokEntry(entry) {
 		inner = trimmed.slice(parenIndex + 1, -1).trim();
 	}
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
-		category: `${MCP_CANONICAL_PREFIX}${inner}`,
+		category: `${MCP_CANONICAL_PREFIX$1}${inner}`,
 		pattern: CATCH_ALL_PATTERN$2
 	} : {
 		category: "mcp",
@@ -28656,7 +29415,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse existing Grok config.toml at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
 		const config = rulesyncPermissions.getJson();
-		const existingPermission = isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
+		const existingPermission = isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {};
 		const buckets = buildGrokPermissionArrays(config, existingPermission, logger);
 		const permission = {
 			...existingPermission,
@@ -28665,7 +29424,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			ask: buckets.ask
 		};
 		const uiPatch = global ? { [GROKCLI_UI_KEY]: {
-			...isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {},
+			...isRecord$1(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {},
 			[GROKCLI_PERMISSION_MODE_KEY]: deriveGrokPermissionMode(config)
 		} } : {};
 		return new GrokcliPermissions({
@@ -28694,7 +29453,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
+		const fineGrained = parseGrokPermissionArrays(isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
 		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$2]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
@@ -28791,7 +29550,7 @@ function parseGrokPermissionArrays(permission) {
 * `always-approve` ⇒ `allow`; anything else (including a missing mode) ⇒ `ask`.
 */
 function legacyModeAction(parsed) {
-	return (isRecord(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
+	return (isRecord$1(parsed[GROKCLI_UI_KEY]) ? parsed[GROKCLI_UI_KEY] : {})[GROKCLI_PERMISSION_MODE_KEY] === "always-approve" ? "allow" : "ask";
 }
 /**
 * Collapse a rulesync permissions config into Grok's single coarse mode.
@@ -28847,12 +29606,12 @@ function withoutKey(record, key) {
 	return Object.fromEntries(Object.entries(record).filter(([entryKey]) => entryKey !== key));
 }
 function buildHermesOverride(config, provenance) {
-	const base = isRecord(provenance.hermes) ? { ...provenance.hermes } : {};
-	const approvalsOverride = withoutKey(isRecord(config.approvals) ? config.approvals : {}, "deny");
+	const base = isRecord$1(provenance.hermes) ? { ...provenance.hermes } : {};
+	const approvalsOverride = withoutKey(isRecord$1(config.approvals) ? config.approvals : {}, "deny");
 	if (Object.keys(approvalsOverride).length > 0) base.approvals = approvalsOverride;
 	else delete base.approvals;
-	const security = isRecord(config.security) ? { ...config.security } : {};
-	const blocklist = isRecord(security.website_blocklist) ? { ...security.website_blocklist } : void 0;
+	const security = isRecord$1(config.security) ? { ...config.security } : {};
+	const blocklist = isRecord$1(security.website_blocklist) ? { ...security.website_blocklist } : void 0;
 	if (blocklist?.enabled === true) {
 		delete blocklist.domains;
 		delete blocklist.enabled;
@@ -28861,7 +29620,7 @@ function buildHermesOverride(config, provenance) {
 	else delete security.website_blocklist;
 	if (Object.keys(security).length > 0) base.security = security;
 	else delete base.security;
-	for (const key of ["skills", "memory"]) if (isRecord(config[key])) base[key] = config[key];
+	for (const key of ["skills", "memory"]) if (isRecord$1(config[key])) base[key] = config[key];
 	else delete base[key];
 	return base;
 }
@@ -28933,7 +29692,7 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			format: "yaml",
 			fileContent: this.getFileContent()
 		});
-		const permissionsRoot = isRecord(config.permissions) ? config.permissions : {};
+		const permissionsRoot = isRecord$1(config.permissions) ? config.permissions : {};
 		const parsedProvenance = RulesyncPermissionsFileSchema.safeParse(permissionsRoot.rulesync);
 		const provenance = parsedProvenance.success ? parsedProvenance.data : { permission: {} };
 		const permission = clonePermissionBlock(provenance.permission);
@@ -28941,14 +29700,14 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			permission,
 			commandAllowlist: isStringArray$1(config.command_allowlist) ? config.command_allowlist : []
 		});
-		const approvals = isRecord(config.approvals) ? config.approvals : {};
+		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
 			category: "bash",
 			patterns: isStringArray$1(approvals.deny) ? approvals.deny : []
 		});
-		const security = isRecord(config.security) ? config.security : {};
-		const websiteBlocklist = isRecord(security.website_blocklist) ? security.website_blocklist : {};
+		const security = isRecord$1(config.security) ? config.security : {};
+		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
 			category: "webfetch",
@@ -29623,8 +30382,8 @@ function mergeKimiCodeToolsSection({ existingContent, patch }) {
 		existing = void 0;
 	}
 	const merged = {
-		...isRecord(existing) ? existing : {},
-		...isRecord(patch.tools) ? patch.tools : {}
+		...isRecord$1(existing) ? existing : {},
+		...isRecord$1(patch.tools) ? patch.tools : {}
 	};
 	if (Object.keys(merged).length === 0) return;
 	warnAboutMistypedToolLists(merged);
@@ -29648,7 +30407,7 @@ function mergeKimiCodeToolsSection({ existingContent, patch }) {
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#tools
 */
 function buildKimiCodeToolsSection(tools) {
-	if (!isRecord(tools)) return;
+	if (!isRecord$1(tools)) return;
 	const section = Object.fromEntries(Object.entries(tools).filter(([key, value]) => key === "enabled" || key === "disabled" ? isStringList(value) : true));
 	return Object.keys(section).length > 0 ? section : void 0;
 }
@@ -29747,7 +30506,7 @@ function preserveKimiCodeRules(rules) {
 		nativeRules
 	};
 	for (const raw of rules) {
-		if (!isRecord(raw)) continue;
+		if (!isRecord$1(raw)) continue;
 		const decision = raw.decision;
 		const pattern = raw.pattern;
 		if (decision !== "allow" && decision !== "ask" && decision !== "deny" || typeof pattern !== "string") continue;
@@ -29862,7 +30621,7 @@ var KimiCodePermissions = class KimiCodePermissions extends ToolPermissions {
 			format: "toml",
 			fileContent: this.getFileContent()
 		});
-		const { permission, nativeRules } = preserveKimiCodeRules((isRecord(config.permission) ? config.permission : {}).rules);
+		const { permission, nativeRules } = preserveKimiCodeRules((isRecord$1(config.permission) ? config.permission : {}).rules);
 		const defaultPermissionMode = config.default_permission_mode;
 		const tools = buildKimiCodeToolsSection(config.tools);
 		const toolOverride = {
@@ -31139,7 +31898,7 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse existing Rovodev config at ${filePath}: ${formatError(error)}`, { cause: error });
 		}
-		const config = isRecord(parsed) ? { ...parsed } : {};
+		const config = isRecord$1(parsed) ? { ...parsed } : {};
 		const rulesyncConfig = rulesyncPermissions.getJson();
 		const toolPermissions = convertRulesyncToRovodevToolPermissions({
 			config: rulesyncConfig,
@@ -31176,8 +31935,8 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Rovodev permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const config = isRecord(parsed) ? parsed : {};
-		const rulesyncConfig = convertRovodevToolPermissionsToRulesync(isRecord(config.toolPermissions) ? config.toolPermissions : {});
+		const config = isRecord$1(parsed) ? parsed : {};
+		const rulesyncConfig = convertRovodevToolPermissionsToRulesync(isRecord$1(config.toolPermissions) ? config.toolPermissions : {});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -31204,14 +31963,14 @@ var RovodevPermissions = class RovodevPermissions extends ToolPermissions {
 * keys it does not are kept as-is.
 */
 function resolveToolPermissionsBlock({ existing, generated, sourceStatesRules, filePath, logger }) {
-	const existingToolPermissions = isRecord(existing) ? { ...existing } : {};
+	const existingToolPermissions = isRecord$1(existing) ? { ...existing } : {};
 	if (Object.keys(generated).length === 0 && sourceStatesRules) {
-		if (!isRecord(existing)) return;
+		if (!isRecord$1(existing)) return;
 		const strippedKeys = stripPermissiveOwnedValues(existingToolPermissions);
 		logger?.warn(`Rovo Dev permissions: the rulesync source produced no rule Rovo Dev can express, so the toolPermissions block in ${filePath} keeps its current levels` + (strippedKeys.length > 0 ? `, minus the grants ${strippedKeys.map((key) => `"${key}"`).join(", ")}.` : `.`));
 		return existingToolPermissions;
 	}
-	const hasExistingToolsRecord = isRecord(existingToolPermissions.tools);
+	const hasExistingToolsRecord = isRecord$1(existingToolPermissions.tools);
 	const existingTools = hasExistingToolsRecord ? { ...existingToolPermissions.tools } : {};
 	warnAboutDroppedOwnedKeys({
 		existingToolPermissions,
@@ -31255,7 +32014,7 @@ function warnAboutDroppedOwnedKeys({ existingToolPermissions, existingTools, gen
 */
 function stripPermissiveOwnedValues(toolPermissions) {
 	const strippedKeys = [];
-	if (isRecord(toolPermissions.tools)) {
+	if (isRecord$1(toolPermissions.tools)) {
 		const tools = { ...toolPermissions.tools };
 		for (const toolKey of MANAGED_TOOL_KEYS) if (tools[toolKey] === "allow") {
 			delete tools[toolKey];
@@ -31277,14 +32036,14 @@ function stripPermissiveOwnedValues(toolPermissions) {
 		strippedKeys.push("default");
 	}
 	const bash = toolPermissions.bash;
-	if (isRecord(bash)) {
+	if (isRecord$1(bash)) {
 		const stripped = { ...bash };
 		if (stripped.default === "allow") {
 			delete stripped.default;
 			strippedKeys.push("bash.default");
 		}
 		if (Array.isArray(stripped.commands)) {
-			const kept = stripped.commands.filter((entry) => !(isRecord(entry) && entry.permission === "allow"));
+			const kept = stripped.commands.filter((entry) => !(isRecord$1(entry) && entry.permission === "allow"));
 			if (kept.length !== stripped.commands.length) strippedKeys.push("bash.commands");
 			if (kept.length > 0) stripped.commands = kept;
 			else delete stripped.commands;
@@ -31392,15 +32151,15 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 	const permission = {};
 	if (isPermissionAction(toolPermissions.default)) permission[CATCH_ALL_PATTERN$1] = { [CATCH_ALL_PATTERN$1]: toolPermissions.default };
 	const bash = toolPermissions.bash;
-	if (isRecord(bash)) {
+	if (isRecord$1(bash)) {
 		const bashRules = {};
 		if (isPermissionAction(bash.default)) bashRules[CATCH_ALL_PATTERN$1] = bash.default;
 		if (Array.isArray(bash.commands)) {
-			for (const entry of bash.commands) if (isRecord(entry) && typeof entry.command === "string" && isPermissionAction(entry.permission)) bashRules[entry.command] = entry.permission;
+			for (const entry of bash.commands) if (isRecord$1(entry) && typeof entry.command === "string" && isPermissionAction(entry.permission)) bashRules[entry.command] = entry.permission;
 		}
 		if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
 	}
-	const nestedTools = isRecord(toolPermissions.tools) ? toolPermissions.tools : {};
+	const nestedTools = isRecord$1(toolPermissions.tools) ? toolPermissions.tools : {};
 	const implicitLevel = isPermissionAction(toolPermissions.default) ? toolPermissions.default : "ask";
 	for (const category of new Set(Object.values(TOOL_KEY_TO_CATEGORY))) {
 		const levels = Object.entries(TOOL_KEY_TO_CATEGORY).filter(([, mapped]) => mapped === category).map(([toolKey]) => {
@@ -32115,11 +32874,11 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 			config,
 			logger
 		});
-		const agents = isRecord(settings.agents) ? { ...settings.agents } : {};
-		const profiles = isRecord(agents.profiles) ? { ...agents.profiles } : {};
+		const agents = isRecord$1(settings.agents) ? { ...settings.agents } : {};
+		const profiles = isRecord$1(agents.profiles) ? { ...agents.profiles } : {};
 		const override = config.warp;
-		const executionProfileOverride = isRecord(override) && isRecord(override[WARP_EXECUTION_PROFILE_OVERRIDE_KEY]) ? override[WARP_EXECUTION_PROFILE_OVERRIDE_KEY] : void 0;
-		if (isRecord(override)) {
+		const executionProfileOverride = isRecord$1(override) && isRecord$1(override[WARP_EXECUTION_PROFILE_OVERRIDE_KEY]) ? override[WARP_EXECUTION_PROFILE_OVERRIDE_KEY] : void 0;
+		if (isRecord$1(override)) {
 			const { [WARP_EXECUTION_PROFILE_OVERRIDE_KEY]: _executionProfile, ...legacyOverride } = override;
 			Object.assign(profiles, legacyOverride);
 		}
@@ -32154,10 +32913,10 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Warp permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const agents = isRecord(settings.agents) ? settings.agents : {};
-		const profiles = isRecord(agents.profiles) ? agents.profiles : {};
-		const executionProfiles = isRecord(agents[EXECUTION_PROFILES_KEY]) ? agents[EXECUTION_PROFILES_KEY] : void 0;
-		const defaultProfile = executionProfiles && isRecord(executionProfiles[DEFAULT_PROFILE_KEY]) ? executionProfiles[DEFAULT_PROFILE_KEY] : void 0;
+		const agents = isRecord$1(settings.agents) ? settings.agents : {};
+		const profiles = isRecord$1(agents.profiles) ? agents.profiles : {};
+		const executionProfiles = isRecord$1(agents[EXECUTION_PROFILES_KEY]) ? agents[EXECUTION_PROFILES_KEY] : void 0;
+		const defaultProfile = executionProfiles && isRecord$1(executionProfiles[DEFAULT_PROFILE_KEY]) ? executionProfiles[DEFAULT_PROFILE_KEY] : void 0;
 		const config = convertWarpToRulesyncPermissions({
 			allow: defaultProfile ? isStringArray$1(defaultProfile[PROFILE_ALLOWLIST_KEY]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$1(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
 			deny: defaultProfile ? isStringArray$1(defaultProfile[PROFILE_DENYLIST_KEY]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$1(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
@@ -32204,12 +32963,12 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 */
 function mergeIntoDefaultExecutionProfile({ agents, mergedAllow, mergedDeny, executionProfileOverride, logger }) {
 	const hasOverrideKeys = executionProfileOverride !== void 0 && Object.keys(executionProfileOverride).length > 0;
-	if (!isRecord(agents[EXECUTION_PROFILES_KEY])) {
+	if (!isRecord$1(agents[EXECUTION_PROFILES_KEY])) {
 		if (hasOverrideKeys && logger) logger.warn("The warp.execution_profile permissions override was skipped: settings.toml has no [agents.execution_profiles] collection yet (un-migrated install). Open Warp once to run its settings migration, then re-run rulesync generate.");
 		return;
 	}
 	const executionProfiles = { ...agents[EXECUTION_PROFILES_KEY] };
-	const defaultProfile = isRecord(executionProfiles[DEFAULT_PROFILE_KEY]) ? { ...executionProfiles[DEFAULT_PROFILE_KEY] } : {};
+	const defaultProfile = isRecord$1(executionProfiles[DEFAULT_PROFILE_KEY]) ? { ...executionProfiles[DEFAULT_PROFILE_KEY] } : {};
 	if (executionProfileOverride) Object.assign(defaultProfile, executionProfileOverride);
 	if (mergedAllow.length > 0) defaultProfile[PROFILE_ALLOWLIST_KEY] = mergedAllow;
 	else delete defaultProfile[PROFILE_ALLOWLIST_KEY];
@@ -32283,9 +33042,13 @@ const ZedToolPermissionsSchema = zod_mini.z.looseObject({
 	default: zod_mini.z.optional(ZedPermissionActionSchema),
 	tools: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), ZedToolPermissionSchema))
 });
+/** Canonical per-tool MCP category prefix: `mcp__<server>__<tool>`. */
+const MCP_CANONICAL_PREFIX = "mcp__";
+/** Zed's per-tool MCP name prefix: `mcp:<server>:<tool>`. */
+const MCP_ZED_PREFIX = "mcp:";
 /**
 * Mapping from rulesync canonical tool category names to Zed agent tool names.
-* Unknown names are passed through as-is (e.g. `mcp:<server>:<tool>` keys).
+* Unknown names are passed through as-is.
 */
 const CANONICAL_TO_ZED_TOOL_NAMES = {
 	bash: "terminal",
@@ -32295,13 +33058,93 @@ const CANONICAL_TO_ZED_TOOL_NAMES = {
 	webfetch: "fetch",
 	websearch: "search_web"
 };
+/**
+* Canonical categories whose Zed tool is not permission-gated. Zed's gated list
+* is `terminal`, `edit_file`, `write_file`, `delete_path`, `move_path`,
+* `copy_path`, `create_directory`, `fetch`, `search_web` and `skill`; the
+* read-only tools (`read_file`, `grep`, `find_path`, `list_directory`) sit in
+* Zed's own `EXCLUDED_TOOLS` and never call `decide_permission_from_settings`,
+* so a `tools.<name>` entry for one is config Zed never consults. Zed's real
+* read-denial surface is `private_files`, which the ignore feature owns.
+*
+* @see https://zed.dev/docs/ai/tool-permissions#supported-tools
+*/
+const ZED_EXCLUDED_CANONICAL_CATEGORIES = /* @__PURE__ */ new Set([
+	"read",
+	"grep",
+	"glob"
+]);
+/** The Zed-side spellings of the same tools, for a category that names one directly. */
+const ZED_EXCLUDED_TOOL_NAMES = /* @__PURE__ */ new Set([
+	"read_file",
+	"grep",
+	"find_path",
+	"list_directory"
+]);
+const isZedExcludedCategory = (category) => ZED_EXCLUDED_CANONICAL_CATEGORIES.has(category) || ZED_EXCLUDED_TOOL_NAMES.has(toZedToolName(category));
 const ZED_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_ZED_TOOL_NAMES).map(([k, v]) => [v, k]));
+/**
+* Zed addresses an MCP tool as `mcp:<server>:<tool>`, where rulesync's canonical
+* category is `mcp__<server>__<tool>`. Without this translation the canonical
+* spelling lands under a key Zed never looks up.
+*
+* Only the FIRST separator is split, matching the `cursor-permissions.ts`
+* precedent: upstream's `mcp_tool_id` concatenates the two names without
+* escaping either, so a tool called `create__issue` is legitimately
+* `mcp:github:create__issue`. Splitting every separator would rewrite that into
+* a third key on the next generate.
+*
+* @see https://zed.dev/docs/ai/tool-permissions
+*/
 function toZedToolName(canonical) {
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX)) {
+		const [server, ...toolParts] = canonical.slice(5).split("__");
+		const address = toolParts.length > 0 ? `${server}:${toolParts.join("__")}` : server ?? "";
+		return `${MCP_ZED_PREFIX}${address}`;
+	}
 	return CANONICAL_TO_ZED_TOOL_NAMES[canonical] ?? canonical;
 }
 function toCanonicalToolName(zedName) {
+	if (zedName.startsWith(MCP_ZED_PREFIX)) {
+		const [server, ...toolParts] = zedName.slice(4).split(":");
+		const address = toolParts.length > 0 ? `${server}__${toolParts.join(":")}` : server ?? "";
+		return `${MCP_CANONICAL_PREFIX}${address}`;
+	}
 	return ZED_TO_CANONICAL_TOOL_NAMES[zedName] ?? zedName;
 }
+/**
+* Zed matches `always_allow`/`always_deny`/`always_confirm` regexes against the
+* tool's text input, and it dispatches every MCP tool with a single empty input
+* (`&[String::new()]`, commented upstream as "MCP tools are gated only by tool
+* id (no per-input pattern matching)"). The regexes still run, but against `""`,
+* so a pattern-scoped rule silently does something other than what its author
+* meant — and a non-matching `always_allow` downgrades the outcome to confirm.
+* Only the category's `*` rule (Zed's per-tool `default`) is therefore emitted.
+*/
+const isMcpZedToolName = (zedName) => zedName.startsWith(MCP_ZED_PREFIX);
+/**
+* Zed looks a tool up by exact key on the full `mcp:<server>:<tool>` triple, so
+* an address is inert unless it names both a concrete server and a concrete
+* tool: a missing half matches nothing, and so does a wildcard, since Zed does
+* no glob or prefix matching on the key.
+*/
+function isInertMcpAddress(zedToolName) {
+	if (!isMcpZedToolName(zedToolName)) return false;
+	const [server, ...toolParts] = zedToolName.slice(4).split(":");
+	const tool = toolParts.join(":");
+	return !server || server === "*" || !tool || tool === "*";
+}
+/**
+* Strip pattern-scoped rules from an MCP category, warning once about the ones
+* dropped. Non-MCP categories are returned untouched.
+*/
+function withoutInertMcpPatterns({ category, zedToolName, rules, logger }) {
+	if (!isMcpZedToolName(zedToolName)) return rules;
+	const scopedPatterns = Object.keys(rules).filter((pattern) => pattern !== "*");
+	if (scopedPatterns.length === 0) return rules;
+	logger?.warn(`Zed permissions: dropping the pattern-scoped rule(s) ${scopedPatterns.map((pattern) => `"${pattern}"`).join(", ")} in the "${category}" category — Zed dispatches an MCP tool with an empty input, so a permission pattern is matched against "" rather than against anything meaningful. Only the catch-all "*" rule is emitted, as the tool's default.`);
+	return Object.fromEntries(Object.entries(rules).filter(([pattern]) => pattern === "*"));
+}
 const CANONICAL_TO_ZED_ACTION = {
 	allow: "allow",
 	ask: "confirm",
@@ -32344,6 +33187,53 @@ function buildZedToolPermission(rules) {
 	if (alwaysConfirm.length > 0) tool.always_confirm = alwaysConfirm;
 	return Object.keys(tool).length > 0 ? tool : null;
 }
+/**
+* Split a canonical permission block into the Zed shapes it maps onto, plus the
+* categories the caller should report as dropped.
+*
+* The canonical `*` category is the all-tools catch-all. Zed's counterpart is
+* `agent.tool_permissions.default` (rung 6 of its precedence ladder), not a
+* `tools["*"]` entry — `*` is not a Zed tool name, so writing one produces a
+* rule Zed silently ignores. Only the category's own `*` pattern can be
+* expressed there: Zed's global default carries no pattern list, so
+* pattern-scoped rules in the `*` category are dropped with a warning instead of
+* being emitted as inert config.
+*/
+function buildZedToolPermissions({ permission, logger }) {
+	let managedDefault;
+	const managedTools = {};
+	const excludedCategories = [];
+	const inertMcpCategories = [];
+	for (const [category, rules] of Object.entries(permission)) {
+		if (category === "*") {
+			for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") managedDefault = CANONICAL_TO_ZED_ACTION[action];
+			else logger?.warn(`Zed permissions: dropping the "*" category rule for pattern "${pattern}" — Zed's global tool-permission default takes no patterns; scope the rule to a tool category instead.`);
+			continue;
+		}
+		if (isZedExcludedCategory(category)) {
+			if (Object.values(rules).some((action) => action === "deny" || action === "ask")) excludedCategories.push(category);
+			continue;
+		}
+		const zedToolName = toZedToolName(category);
+		if (isInertMcpAddress(zedToolName)) {
+			inertMcpCategories.push(category);
+			continue;
+		}
+		const tool = buildZedToolPermission(withoutInertMcpPatterns({
+			category,
+			zedToolName,
+			rules,
+			logger
+		}));
+		if (tool) managedTools[zedToolName] = tool;
+	}
+	return {
+		managedDefault,
+		managedTools,
+		excludedCategories,
+		inertMcpCategories
+	};
+}
 function asRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
 	return Object.fromEntries(Object.entries(value));
@@ -32414,19 +33304,15 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		const agent = asRecord(settings.agent);
 		const toolPermissions = asRecord(agent.tool_permissions);
 		const existingTools = asRecord(toolPermissions.tools);
-		let managedDefault;
-		const managedTools = {};
-		for (const [category, rules] of Object.entries(config.permission)) {
-			if (category === "*") {
-				for (const [pattern, action] of Object.entries(rules)) if (pattern === "*") managedDefault = CANONICAL_TO_ZED_ACTION[action];
-				else logger?.warn(`Zed permissions: dropping the "*" category rule for pattern "${pattern}" — Zed's global tool-permission default takes no patterns; scope the rule to a tool category instead.`);
-				continue;
-			}
-			const tool = buildZedToolPermission(rules);
-			if (tool) managedTools[toZedToolName(category)] = tool;
-		}
+		const { managedDefault, managedTools, excludedCategories, inertMcpCategories } = buildZedToolPermissions({
+			permission: config.permission,
+			logger
+		});
+		if (excludedCategories.length > 0) logger?.warn(`Zed permissions: dropping the ${excludedCategories.map((category) => `"${category}"`).join(", ")} ${excludedCategories.length === 1 ? "category" : "categories"} — Zed does not gate its read-only tools, so the entries would never be consulted. Zed's read-denial surface is \`private_files\`, which the ignore feature writes from \`.rulesync/.aiignore\`.`);
+		if (inertMcpCategories.length > 0) logger?.warn(`Zed permissions: dropping the ${inertMcpCategories.map((category) => `"${category}"`).join(", ")} ${inertMcpCategories.length === 1 ? "category" : "categories"} — Zed looks an MCP tool up by exact key on the full \`mcp:<server>:<tool>\` triple, so an address that omits or wildcards either half matches nothing. Name the individual server and tool instead.`);
 		const managedToolNames = new Set(Object.keys(managedTools));
 		if ("*" in config.permission) managedToolNames.add("*");
+		for (const toolName of Object.keys(existingTools)) if (toolName.startsWith(MCP_CANONICAL_PREFIX)) managedToolNames.add(toolName);
 		const preservedTools = Object.fromEntries(Object.entries(existingTools).filter(([toolName]) => !managedToolNames.has(toolName)));
 		return new ZedPermissions({
 			outputRoot,
@@ -33216,18 +34102,16 @@ var DirFeatureProcessor = class {
 				})) dirHasChanges = true;
 			}
 			const otherFiles = aiDir.getOtherFiles();
-			const otherFileContents = [];
 			for (const file of otherFiles) {
-				const contentWithNewline = addTrailingNewline(file.fileBuffer.toString("utf-8"));
-				otherFileContents.push(contentWithNewline);
-				if (!dirHasChanges) {
-					const filePath = (0, node_path.join)(dirPath, file.relativeFilePathToDirPath);
-					if (!fileContentsEquivalent({
-						filePath,
-						expected: contentWithNewline,
-						existing: await readFileContentOrNull(filePath)
-					})) dirHasChanges = true;
-				}
+				if (dirHasChanges) break;
+				const filePath = (0, node_path.join)(dirPath, file.relativeFilePathToDirPath);
+				const existingBuffer = await readFileBufferOrNull(filePath);
+				if (!companionFileContentsEquivalent({
+					filePath,
+					expected: file.fileBuffer,
+					existing: existingBuffer,
+					composed: file.composed
+				})) dirHasChanges = true;
 			}
 			if (!dirHasChanges) continue;
 			const relativeDir = aiDir.getRelativePathFromCwd();
@@ -33247,11 +34131,8 @@ var DirFeatureProcessor = class {
 					await writeFileContent((0, node_path.join)(dirPath, mainFile.name), mainFileContent);
 					changedPaths.push((0, node_path.join)(relativeDir, mainFile.name));
 				}
-				for (const [i, file] of otherFiles.entries()) {
-					const filePath = (0, node_path.join)(dirPath, file.relativeFilePathToDirPath);
-					const content = otherFileContents[i];
-					if (content === void 0) throw new Error(`Internal error: content for file ${file.relativeFilePathToDirPath} is undefined. This indicates a synchronization issue between otherFiles and otherFileContents arrays.`);
-					await writeFileContent(filePath, content);
+				for (const file of otherFiles) {
+					await writeFileBuffer((0, node_path.join)(dirPath, file.relativeFilePathToDirPath), file.fileBuffer);
 					changedPaths.push((0, node_path.join)(relativeDir, file.relativeFilePathToDirPath));
 				}
 			}
@@ -33977,6 +34858,39 @@ function buildClaudecodeSkillFrontmatter({ rulesyncFrontmatter, resolvedDisableM
 	return frontmatter;
 }
 /**
+* Escapes the glob metacharacters in a directory path so it matches literally.
+* A real directory name may contain them — `app/[slug]` in a Next.js tree is
+* the common case, and unescaped `[slug]` reads as a bracket expression that
+* matches a different subtree (or nothing at all).
+*
+* @see https://code.claude.com/docs/en/memory
+*/
+function escapeGlobLiteral(dirPath) {
+	return dirPath.replaceAll(/[\\*?[\]{}()!]/g, "\\$&");
+}
+/**
+* Claude Code scopes a nested skill by its location: a skill living in
+* `apps/web/.claude/skills/deploy` only activates while working under
+* `apps/web`. rulesync generates every imported skill into the project-root
+* `.claude/skills/`, so on import that location-based scoping has to be
+* re-expressed as an explicit `paths` glob — otherwise the round-trip silently
+* promotes a subtree skill to global activation.
+*
+* Returns the derived glob for a nested discovery root, or `undefined` for the
+* project-root `.claude/skills` (and for any root whose subtree cannot be
+* determined), where no scoping is implied.
+*
+* @see https://code.claude.com/docs/en/skills
+*/
+function deriveNestedSkillPaths(relativeDirPath) {
+	const posixDirPath = toPosixPath(relativeDirPath);
+	const skillsDirSuffix = `/${toPosixPath(CLAUDECODE_SKILLS_DIR_PATH)}`;
+	if (!posixDirPath.endsWith(skillsDirSuffix)) return;
+	const subtree = posixDirPath.slice(0, -skillsDirSuffix.length);
+	if (subtree === "" || subtree === ".") return;
+	return [`${escapeGlobLiteral(subtree)}/**`];
+}
+/**
 * Represents a Claude Code skill directory.
 * Unlike subagents and commands, skills are directories containing SKILL.md and other files.
 * Extends ToolSkill to inherit directory management and security features from AiDir.
@@ -34064,6 +34978,7 @@ var ClaudecodeSkill = class extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
+		const resolvedPaths = frontmatter.paths !== void 0 ? frontmatter.paths : deriveNestedSkillPaths(this.relativeDirPath);
 		const claudecodeSection = {
 			...frontmatter.when_to_use && { when_to_use: frontmatter.when_to_use },
 			...frontmatter["allowed-tools"] && { "allowed-tools": frontmatter["allowed-tools"] },
@@ -34080,7 +34995,7 @@ var ClaudecodeSkill = class extends ToolSkill {
 			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
 			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
 			...this.relativeDirPath === CLAUDECODE_SCHEDULED_TASKS_DIR_PATH && { "scheduled-task": true },
-			...frontmatter.paths !== void 0 && { paths: frontmatter.paths }
+			...resolvedPaths !== void 0 && { paths: resolvedPaths }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -34478,7 +35393,8 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 			fileBuffer: Buffer.from((0, js_yaml.dump)(openaiObject, {
 				lineWidth: -1,
 				noRefs: true
-			}))
+			})),
+			composed: true
 		}] : baseOtherFiles;
 		return new CodexCliSkill({
 			outputRoot,
@@ -34538,7 +35454,11 @@ const CopilotSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
 	license: zod_mini.z.optional(zod_mini.z.string()),
-	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	"argument-hint": zod_mini.z.optional(zod_mini.z.string()),
+	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+	context: zod_mini.z.optional(zod_mini.z.string())
 });
 /**
 * Represents a GitHub Copilot skill directory.
@@ -34593,14 +35513,10 @@ var CopilotSkill = class CopilotSkill extends ToolSkill {
 		};
 	}
 	toRulesyncSkill() {
-		const frontmatter = this.getFrontmatter();
-		const copilotSection = {
-			...frontmatter.license !== void 0 && { license: frontmatter.license },
-			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] }
-		};
+		const { name, description, ...copilotSection } = this.getFrontmatter();
 		const rulesyncFrontmatter = {
-			name: frontmatter.name,
-			description: frontmatter.description,
+			name,
+			description,
 			targets: ["*"],
 			...Object.keys(copilotSection).length > 0 && { copilot: copilotSection }
 		};
@@ -34618,11 +35534,22 @@ var CopilotSkill = class CopilotSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = CopilotSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const copilotSection = rulesyncFrontmatter.copilot;
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotSection
+		});
+		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotSection
+		});
+		const { "user-invocable": _userInvocable, "disable-model-invocation": _disableModelInvocation, ...copilotFields } = copilotSection ?? {};
 		const copilotFrontmatter = {
+			...copilotFields,
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...rulesyncFrontmatter.copilot?.license !== void 0 && { license: rulesyncFrontmatter.copilot.license },
-			...rulesyncFrontmatter.copilot?.["allowed-tools"] !== void 0 && { "allowed-tools": rulesyncFrontmatter.copilot["allowed-tools"] }
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
 		return new CopilotSkill({
 			outputRoot,
@@ -34741,17 +35668,10 @@ var CopilotcliSkill = class CopilotcliSkill extends ToolSkill {
 		};
 	}
 	toRulesyncSkill() {
-		const frontmatter = this.getFrontmatter();
-		const copilotcliSection = {
-			...frontmatter.license !== void 0 && { license: frontmatter.license },
-			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] },
-			...frontmatter["argument-hint"] !== void 0 && { "argument-hint": frontmatter["argument-hint"] },
-			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
-		};
+		const { name, description, ...copilotcliSection } = this.getFrontmatter();
 		const rulesyncFrontmatter = {
-			name: frontmatter.name,
-			description: frontmatter.description,
+			name,
+			description,
 			targets: ["*"],
 			...Object.keys(copilotcliSection).length > 0 && { copilotcli: copilotcliSection }
 		};
@@ -34769,14 +35689,22 @@ var CopilotcliSkill = class CopilotcliSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = CopilotcliSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const copilotcliSection = rulesyncFrontmatter.copilotcli;
+		const resolvedUserInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotcliSection
+		});
+		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: copilotcliSection
+		});
+		const { "user-invocable": _userInvocable, "disable-model-invocation": _disableModelInvocation, ...copilotcliFields } = copilotcliSection ?? {};
 		const copilotcliFrontmatter = {
+			...copilotcliFields,
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...rulesyncFrontmatter.copilotcli?.license !== void 0 && { license: rulesyncFrontmatter.copilotcli.license },
-			...rulesyncFrontmatter.copilotcli?.["allowed-tools"] !== void 0 && { "allowed-tools": rulesyncFrontmatter.copilotcli["allowed-tools"] },
-			...rulesyncFrontmatter.copilotcli?.["argument-hint"] !== void 0 && { "argument-hint": rulesyncFrontmatter.copilotcli["argument-hint"] },
-			...rulesyncFrontmatter.copilotcli?.["user-invocable"] !== void 0 && { "user-invocable": rulesyncFrontmatter.copilotcli["user-invocable"] },
-			...rulesyncFrontmatter.copilotcli?.["disable-model-invocation"] !== void 0 && { "disable-model-invocation": rulesyncFrontmatter.copilotcli["disable-model-invocation"] }
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation }
 		};
 		return new CopilotcliSkill({
 			outputRoot,
@@ -35334,7 +36262,9 @@ const FactorydroidSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
 	description: zod_mini.z.string(),
 	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
-	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+	enabled: zod_mini.z.optional(zod_mini.z.boolean()),
+	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
 });
 /**
 * Represents a Factory Droid skill directory.
@@ -35390,7 +36320,9 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 		const frontmatter = this.getFrontmatter();
 		const factorydroidBlock = {
 			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
-			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] }
+			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
+			...frontmatter.enabled !== void 0 && { enabled: frontmatter.enabled },
+			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -35412,19 +36344,22 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = FactorydroidSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const factorydroidSection = rulesyncFrontmatter.factorydroid;
 		const resolvedDisableModelInvocation = resolveDisableModelInvocation({
 			rootFrontmatter: rulesyncFrontmatter,
-			section: rulesyncFrontmatter.factorydroid
+			section: factorydroidSection
 		});
 		const resolvedUserInvocable = resolveUserInvocable({
 			rootFrontmatter: rulesyncFrontmatter,
-			section: rulesyncFrontmatter.factorydroid
+			section: factorydroidSection
 		});
 		const factorydroidFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...resolvedDisableModelInvocation !== void 0 && { "disable-model-invocation": resolvedDisableModelInvocation },
-			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable }
+			...resolvedUserInvocable !== void 0 && { "user-invocable": resolvedUserInvocable },
+			...factorydroidSection?.enabled !== void 0 && { enabled: factorydroidSection.enabled },
+			...factorydroidSection?.["allowed-tools"] !== void 0 && { "allowed-tools": factorydroidSection["allowed-tools"] }
 		};
 		return new FactorydroidSkill({
 			outputRoot,
@@ -36241,7 +37176,10 @@ var KimiCodeSkill = class KimiCodeSkill extends ToolSkill {
 //#region src/features/skills/kiro-skill.ts
 const KiroSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
-	description: zod_mini.z.string()
+	description: zod_mini.z.string(),
+	license: zod_mini.z.optional(zod_mini.z.string()),
+	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 });
 /**
 * Represents a Kiro skill directory.
@@ -36295,11 +37233,12 @@ var KiroSkill = class KiroSkill extends ToolSkill {
 		};
 	}
 	toRulesyncSkill() {
-		const frontmatter = this.getFrontmatter();
+		const { name, description, ...kiroSection } = this.getFrontmatter();
 		const rulesyncFrontmatter = {
-			name: frontmatter.name,
-			description: frontmatter.description,
-			targets: ["*"]
+			name,
+			description,
+			targets: ["*"],
+			...Object.keys(kiroSection).length > 0 && { kiro: kiroSection }
 		};
 		return new RulesyncSkill({
 			outputRoot: this.outputRoot,
@@ -36316,6 +37255,7 @@ var KiroSkill = class KiroSkill extends ToolSkill {
 		const settablePaths = KiroSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
 		const kiroFrontmatter = {
+			...rulesyncFrontmatter.kiro,
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description
 		};
@@ -39445,7 +40385,17 @@ var ClaudecodeSubagent = class ClaudecodeSubagent extends ToolSubagent {
 			validate: true
 		});
 	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+	/**
+	* Last chance to adjust the tool frontmatter before it is written. The base
+	* implementation only warns about names Claude Code rejects; plugin-scoped
+	* subclasses extend it to drop fields Claude Code refuses to honor for
+	* plugin-shipped agents.
+	*/
+	static sanitizeFrontmatter({ frontmatter, relativeFilePath, logger }) {
+		if (frontmatter.name.includes(":")) logger?.warn(`Claude Code will reject the subagent in ${relativeFilePath}: the name "${frontmatter.name}" contains ":", which is reserved for plugin namespacing.`);
+		return frontmatter;
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false, logger }) {
 		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
 		const claudecodeSection = this.filterToolSpecificSection(rulesyncFrontmatter.claudecode ?? {}, ["name", "description"]);
 		const rawClaudecodeFrontmatter = {
@@ -39455,7 +40405,11 @@ var ClaudecodeSubagent = class ClaudecodeSubagent extends ToolSubagent {
 		};
 		const result = ClaudecodeSubagentFrontmatterSchema.safeParse(rawClaudecodeFrontmatter);
 		if (!result.success) throw new Error(`Invalid claudecode subagent frontmatter in ${rulesyncSubagent.getRelativeFilePath()}: ${formatError(result.error)}`);
-		const claudecodeFrontmatter = result.data;
+		const claudecodeFrontmatter = this.sanitizeFrontmatter({
+			frontmatter: result.data,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			logger
+		});
 		const body = rulesyncSubagent.getBody();
 		const fileContent = stringifyFrontmatter(body, claudecodeFrontmatter);
 		const paths = this.getSettablePaths({ global });
@@ -39524,6 +40478,21 @@ var ClaudecodeSubagent = class ClaudecodeSubagent extends ToolSubagent {
 };
 //#endregion
 //#region src/features/subagents/claudecode-plugin-subagent.ts
+/**
+* Claude Code refuses these for plugin-shipped agents "for security reasons",
+* so emitting them leaves the author believing the agent is constrained when it
+* is not. Only these three are dropped: the other fields upstream does not list
+* (e.g. `color`) are merely ignored, with no misleading security posture.
+*
+* @see https://code.claude.com/docs/en/plugins-reference
+*/
+const PLUGIN_FORBIDDEN_FIELDS = [
+	"hooks",
+	"mcpServers",
+	"permissionMode"
+];
+/** The only `isolation` value plugin agents accept. */
+const PLUGIN_ISOLATION_VALUE = "worktree";
 var ClaudecodePluginSubagent = class extends ClaudecodeSubagent {
 	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
 		const targets = rulesyncSubagent.getFrontmatter().targets;
@@ -39532,6 +40501,21 @@ var ClaudecodePluginSubagent = class extends ClaudecodeSubagent {
 	static getSettablePaths() {
 		return { relativeDirPath: CLAUDECODE_PLUGIN_AGENTS_DIR };
 	}
+	static sanitizeFrontmatter({ frontmatter, relativeFilePath, logger }) {
+		const sanitized = { ...super.sanitizeFrontmatter({
+			frontmatter,
+			relativeFilePath,
+			logger
+		}) };
+		const dropped = PLUGIN_FORBIDDEN_FIELDS.filter((field) => sanitized[field] !== void 0);
+		for (const field of PLUGIN_FORBIDDEN_FIELDS) delete sanitized[field];
+		if (dropped.length > 0) logger?.warn(`Dropping ${dropped.join(", ")} from claudecode-plugin subagent ${relativeFilePath}: Claude Code does not support these fields for plugin-shipped agents.`);
+		if (sanitized.isolation !== void 0 && sanitized.isolation !== PLUGIN_ISOLATION_VALUE) {
+			logger?.warn(`Dropping isolation "${sanitized.isolation}" from claudecode-plugin subagent ${relativeFilePath}: "${PLUGIN_ISOLATION_VALUE}" is the only value Claude Code accepts for plugin-shipped agents.`);
+			delete sanitized.isolation;
+		}
+		return sanitized;
+	}
 };
 //#endregion
 //#region src/features/subagents/cline-subagent.ts
@@ -42840,14 +43824,14 @@ var ZoocodeSubagent = class extends RooSubagent {
 	static toRooMode(rulesyncSubagent) {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
-		const zoocodeSection = isRecord(frontmatter.zoocode) ? frontmatter.zoocode : {};
+		const zoocodeSection = isRecord$1(frontmatter.zoocode) ? frontmatter.zoocode : {};
 		if (isStringArray$1(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
 		return mode;
 	}
 	toRulesyncSubagents() {
 		return super.toRulesyncSubagents().map((subagent) => {
 			const frontmatter = subagent.getFrontmatter();
-			const { allowedMcpServers, ...restRooSection } = isRecord(frontmatter.roo) ? { ...frontmatter.roo } : {};
+			const { allowedMcpServers, ...restRooSection } = isRecord$1(frontmatter.roo) ? { ...frontmatter.roo } : {};
 			const rebuilt = {
 				...frontmatter,
 				targets: ["zoocode"],
@@ -43185,7 +44169,8 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			outputRoot: this.outputRoot,
 			relativeDirPath: RulesyncSubagent.getSettablePaths().relativeDirPath,
 			rulesyncSubagent,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		}));
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
@@ -45138,7 +46123,7 @@ var CodexcliRule = class CodexcliRule extends ToolRule {
 };
 //#endregion
 //#region src/features/rules/copilot-rule.ts
-const CopilotRuleFrontmatterSchema = zod_mini.z.object({
+const CopilotRuleFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.optional(zod_mini.z.string()),
 	applyTo: zod_mini.z.optional(zod_mini.z.string()),
 	name: zod_mini.z.optional(zod_mini.z.string()),
@@ -45194,15 +46179,13 @@ var CopilotRule = class CopilotRule extends ToolRule {
 	toRulesyncRule() {
 		let globs;
 		if (this.frontmatter.applyTo) globs = this.frontmatter.applyTo.split(",").map((g) => g.trim());
+		const { description, applyTo: _applyTo, ...copilotFields } = this.frontmatter;
 		const rulesyncFrontmatter = {
 			targets: ["*"],
 			root: this.isRoot(),
-			description: this.frontmatter.description,
+			description,
 			globs,
-			...(this.frontmatter.excludeAgent || this.frontmatter.name) && { copilot: {
-				...this.frontmatter.excludeAgent && { excludeAgent: this.frontmatter.excludeAgent },
-				...this.frontmatter.name && { name: this.frontmatter.name }
-			} }
+			...Object.keys(copilotFields).length > 0 && { copilot: copilotFields }
 		};
 		const relativeFilePath = this.getRelativeFilePath().replace(/\.instructions\.md$/, ".md");
 		return new RulesyncRule({
@@ -45219,10 +46202,9 @@ var CopilotRule = class CopilotRule extends ToolRule {
 		const root = rulesyncFrontmatter.root;
 		const paths = this.getSettablePaths({ global });
 		const copilotFrontmatter = {
+			...rulesyncFrontmatter.copilot,
 			description: rulesyncFrontmatter.description,
-			applyTo: rulesyncFrontmatter.globs?.length ? rulesyncFrontmatter.globs.join(",") : void 0,
-			excludeAgent: rulesyncFrontmatter.copilot?.excludeAgent,
-			name: rulesyncFrontmatter.copilot?.name
+			applyTo: rulesyncFrontmatter.globs?.length ? rulesyncFrontmatter.globs.join(",") : void 0
 		};
 		const body = rulesyncRule.getBody();
 		if (root) return new CopilotRule({
@@ -51621,6 +52603,12 @@ Object.defineProperty(exports, "warnOnConflictingFlags", {
 		return warnOnConflictingFlags;
 	}
 });
+Object.defineProperty(exports, "writeFileBuffer", {
+	enumerable: true,
+	get: function() {
+		return writeFileBuffer;
+	}
+});
 Object.defineProperty(exports, "writeFileContent", {
 	enumerable: true,
 	get: function() {