rulesync 16.8.0 → 16.9.1

package/dist/{import-DEK1TMmW.cjs → import-BaRDaZET.cjs}

@@ -382,6 +382,7 @@ const skillsProcessorToolTargetTuple = [
 ];
 const hooksProcessorToolTargetTuple = [
 	"amp",
+	"cline",
 	"antigravity-cli",
 	"antigravity-ide",
 	"antigravity-plugin",
@@ -657,6 +658,29 @@ async function writeFileContent(filepath, content) {
 	await ensureDir((0, node_path.dirname)(filepath));
 	await (0, node_fs_promises.writeFile)(filepath, content, "utf-8");
 }
+/**
+* Apply a POSIX mode to an existing file. Windows has no executable bit and
+* `chmod` there only toggles the read-only flag, so the call is skipped rather
+* than writing a mode the platform cannot honor.
+*/
+async function applyFileMode(filepath, mode) {
+	if (process.platform === "win32") return;
+	await (0, node_fs_promises.chmod)(filepath, mode);
+}
+/**
+* Restore an executable bit that went missing (interrupted run, a copy that
+* dropped the mode). A file whose mode is merely stricter than `mode` — the
+* user chose 0700 over 0755 — is left alone.
+*/
+async function restoreMissingExecutableBit(filepath, mode) {
+	if (process.platform === "win32") return;
+	try {
+		if (((await (0, node_fs_promises.stat)(filepath)).mode & 73) !== 0) return;
+	} catch {
+		return;
+	}
+	await (0, node_fs_promises.chmod)(filepath, mode);
+}
 async function writeFileBuffer(filepath, buffer) {
 	await ensureDir((0, node_path.dirname)(filepath));
 	await (0, node_fs_promises.writeFile)(filepath, buffer);
@@ -1826,6 +1850,13 @@ var AiFile = class {
 		return false;
 	}
 	/**
+	* POSIX mode to apply after writing, or `undefined` to leave the default
+	* alone. Override in subclasses whose output the tool executes directly
+	* (e.g. Cline's hook scripts, which are spawned by path and therefore need
+	* the executable bit).
+	*/
+	getFileMode() {}
+	/**
 	* Returns whether this file can be deleted by rulesync.
 	* Override in subclasses that should not be deleted (e.g., user-managed config files).
 	*/
@@ -2269,7 +2300,8 @@ const HOOK_EVENTS = [
 	"fileChanged",
 	"directoryAdded",
 	"elicitation",
-	"elicitationResult"
+	"elicitationResult",
+	"sessionDelete"
 ];
 /** Hook events supported by Cursor. */
 const CURSOR_HOOK_EVENTS = [
@@ -2365,9 +2397,10 @@ const DEVIN_HOOK_EVENTS = [
 /**
 * Hook events supported by OpenCode.
 *
-* `preCompact` maps to `experimental.session.compacting`, which the plugin docs
-* document as a named `(input, output)` hook rather than an `event.type`
-* dispatch; the other entries are all generic events.
+* `preCompact` maps to `experimental.session.compacting` and
+* `beforeSubmitPrompt` to `chat.message`, both of which the plugin docs
+* document as named `(input, output)` hooks rather than `event.type`
+* dispatches; the other entries are all generic events.
 *
 * @see https://opencode.ai/docs/plugins/
 */
@@ -2383,16 +2416,22 @@ const OPENCODE_HOOK_EVENTS = [
 	"preCompact",
 	"postCompact",
 	"afterError",
-	"fileChanged"
+	"fileChanged",
+	"notification",
+	"permissionDenied",
+	"beforeSubmitPrompt"
 ];
 /**
-* Hook events supported by Kilo. Identical to OpenCode: Kilo's plugin docs list
-* the same event surface, including `session.compacted`, `session.error`,
-* `file.watcher.updated` and the experimental compaction hook.
+* Hook events supported by Kilo. Kilo's plugin docs list the same event surface
+* as OpenCode's — including `session.compacted`, `session.error`,
+* `file.watcher.updated`, `permission.replied`, `chat.message` and the
+* experimental compaction hook — with one exception: they document no TUI
+* events at all, so `tui.toast.show` (canonical `notification`) is left out
+* rather than emitted into a plugin where it may never fire.
 *
 * @see https://kilo.ai/docs/automate/extending/plugins
 */
-const KILO_HOOK_EVENTS = OPENCODE_HOOK_EVENTS;
+const KILO_HOOK_EVENTS = OPENCODE_HOOK_EVENTS.filter((event) => event !== "notification");
 /**
 * Hook events supported by Pi Coding Agent, bridged through a generated
 * TypeScript extension (Pi has no static hook config file; its extension API
@@ -2430,6 +2469,29 @@ const AMP_HOOK_EVENTS = [
 	"stop"
 ];
 /**
+* Hook events supported by Cline's file-based hooks. Cline resolves one
+* executable per lifecycle event from its hooks directory, and the event names
+* it accepts are fixed by `VALID_HOOK_TYPES` in
+* `apps/vscode/src/core/hooks/utils.ts`: `TaskStart`, `TaskResume`,
+* `TaskCancel`, `TaskComplete`, `PreToolUse`, `PostToolUse`,
+* `UserPromptSubmit`, `Notification` and `PreCompact`.
+*
+* `TaskResume` and `TaskCancel` have no canonical counterpart and stay
+* unmapped rather than being approximated by `sessionEnd` / `stop`, whose
+* semantics differ.
+*
+* @see https://github.com/cline/cline/blob/main/apps/vscode/src/core/hooks/utils.ts
+*/
+const CLINE_HOOK_EVENTS = [
+	"sessionStart",
+	"preToolUse",
+	"postToolUse",
+	"beforeSubmitPrompt",
+	"preCompact",
+	"notification",
+	"taskCompleted"
+];
+/**
 * Hook events supported by GitHub Copilot (cloud coding agent).
 *
 * GitHub now documents an eight-event surface for `.github/hooks/*.json`:
@@ -2567,7 +2629,11 @@ const GOOSE_HOOK_EVENTS = [
 	"beforeShellExecution",
 	"afterShellExecution"
 ];
-/** Hook events supported by Kiro CLI. */
+/**
+* Hook events supported by the embedded agent-config hook format, which only
+* the deprecated `kiro` alias still writes. See {@link KIRO_IDE_HOOK_EVENTS}
+* for the standalone format both Kiro products read today.
+*/
 const KIRO_HOOK_EVENTS = [
 	"sessionStart",
 	"sessionEnd",
@@ -2577,15 +2643,17 @@ const KIRO_HOOK_EVENTS = [
 	"stop"
 ];
 /**
-* Hook events supported by the Kiro IDE (`.kiro/hooks/*.json` v1).
-*
-* Kiro IDE 1.0 exposes PascalCase triggers. rulesync maps the canonical
-* lifecycle events that have a clean 1:1 IDE equivalent: `SessionStart`,
-* `Stop`, `UserPromptSubmit`, `PreToolUse`, and `PostToolUse`. The IDE also
-* documents file-event (`PostFileCreate`/`PostFileSave`/`PostFileDelete`) and
-* spec-task (`PreTaskExec`/`PostTaskExec`) triggers that have no canonical
-* equivalent; those can still be emitted verbatim via a `kiro-ide` override
-* block (unknown event keys pass through unchanged).
+* Hook events supported by Kiro's standalone hooks format
+* (`.kiro/hooks/*.json` v1), which the Kiro IDE and Kiro CLI 3.0 both read.
+*
+* Kiro exposes PascalCase triggers. rulesync maps the canonical lifecycle
+* events that have a clean 1:1 equivalent: `SessionStart`, `Stop`,
+* `UserPromptSubmit`, `PreToolUse`, and `PostToolUse`. Kiro also documents
+* file-event (`PostFileCreate`/`PostFileSave`/`PostFileDelete`) and spec-task
+* (`PreTaskExec`/`PostTaskExec`) triggers that have no canonical equivalent;
+* those can still be emitted verbatim via a `kiro-ide` or `kiro-cli` override
+* block (unknown event keys pass through unchanged). There is no `SessionEnd`
+* trigger, so the canonical `sessionEnd` has no home here.
 * @see https://kiro.dev/docs/hooks/types/
 */
 const KIRO_IDE_HOOK_EVENTS = [
@@ -2707,7 +2775,8 @@ const QWENCODE_HOOK_EVENTS = [
 	"instructionsLoaded",
 	"todoCreated",
 	"todoCompleted",
-	"messageDisplay"
+	"messageDisplay",
+	"sessionDelete"
 ];
 /**
 * Hook events supported by Reasonix.
@@ -2770,7 +2839,11 @@ const GROKCLI_HOOK_EVENTS = [
 /**
 * Hook events supported by Kimi Code.
 *
-* Kimi Code also exposes `Interrupt`, which has no canonical rulesync event.
+* Kimi Code also exposes `PermissionResult`, `Interrupt`, and the four events
+* added in 0.32.0 (`TurnStarted`, `UserPromptQueued`, `TaskStarted`,
+* `SessionHeartbeat`), none of which have a canonical rulesync event. They are
+* listed in `KIMI_CODE_NATIVE_HOOK_EVENTS` so a per-tool `kimi-code` override
+* can address them by their native name.
 *
 * @see https://moonshotai.github.io/kimi-code/en/customization/hooks.html
 */
@@ -2806,10 +2879,27 @@ const CANONICAL_TO_KIMI_CODE_EVENT_NAMES = {
 	preCompact: "PreCompact",
 	postCompact: "PostCompact"
 };
+/**
+* Every event name Kimi Code accepts in a `[[hooks]]` entry: the ones with a
+* canonical rulesync counterpart plus the native-only ones, which are reachable
+* through a per-tool `kimi-code` override that names them directly.
+*
+* `TurnStarted`, `UserPromptQueued`, `TaskStarted`, and `SessionHeartbeat` were
+* added in Kimi Code 0.32.0. They stay native-only: `TaskStarted` fires when a
+* background task starts and matches on task kind, whereas the canonical
+* `taskCreated` models Claude Code's blocking, matcher-less `TaskCreated`
+* (fired while a task is being created), so the two are not interchangeable.
+*
+* @see https://moonshotai.github.io/kimi-code/en/customization/hooks.html
+*/
 const KIMI_CODE_NATIVE_HOOK_EVENTS = [
 	...Object.values(CANONICAL_TO_KIMI_CODE_EVENT_NAMES),
 	"PermissionResult",
-	"Interrupt"
+	"Interrupt",
+	"TurnStarted",
+	"UserPromptQueued",
+	"TaskStarted",
+	"SessionHeartbeat"
 ];
 const KIMI_CODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_KIMI_CODE_EVENT_NAMES).map(([canonical, kimiCode]) => [kimiCode, canonical]));
 /**
@@ -3086,14 +3176,20 @@ const CANONICAL_TO_OPENCODE_EVENT_NAMES = {
 	stop: "session.idle",
 	afterFileEdit: "file.edited",
 	permissionRequest: "permission.asked",
+	permissionDenied: "permission.replied",
+	notification: "tui.toast.show",
 	preCompact: "experimental.session.compacting",
+	beforeSubmitPrompt: "chat.message",
 	postCompact: "session.compacted",
 	afterError: "session.error",
 	fileChanged: "file.watcher.updated"
 };
 /**
 * Map canonical camelCase event names to Kilo dot-notation.
-* (Currently identical to OpenCode)
+*
+* Shared with OpenCode: the two name the same events. The `notification` entry
+* is unreachable for Kilo because `KILO_HOOK_EVENTS` omits it, and the
+* generator emits only supported events.
 */
 const CANONICAL_TO_KILO_EVENT_NAMES = CANONICAL_TO_OPENCODE_EVENT_NAMES;
 /**
@@ -3131,6 +3227,16 @@ const CANONICAL_TO_AMP_EVENT_NAMES = {
 	beforeSubmitPrompt: "agent.start",
 	stop: "agent.end"
 };
+/** Map canonical hook events to Cline's `VALID_HOOK_TYPES` file names. */
+const CANONICAL_TO_CLINE_EVENT_NAMES = {
+	sessionStart: "TaskStart",
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	beforeSubmitPrompt: "UserPromptSubmit",
+	preCompact: "PreCompact",
+	notification: "Notification",
+	taskCompleted: "TaskComplete"
+};
 /**
 * Map canonical camelCase event names to Copilot camelCase.
 */
@@ -3367,7 +3473,8 @@ const CANONICAL_TO_QWENCODE_EVENT_NAMES = {
 	instructionsLoaded: "InstructionsLoaded",
 	todoCreated: "TodoCreated",
 	todoCompleted: "TodoCompleted",
-	messageDisplay: "MessageDisplay"
+	messageDisplay: "MessageDisplay",
+	sessionDelete: "SessionDelete"
 };
 /**
 * Map Qwen Code PascalCase event names to canonical camelCase.
@@ -4204,14 +4311,20 @@ const VibePermissionsOverrideSchema = zod_mini.z.looseObject({
 * Tool-scoped override block for Cursor CLI. Cursor's `cli.json` carries scalar
 * autonomy settings with no canonical permission category — `approvalMode`
 * (`allowlist` | `auto-review` | `unrestricted`) and a `sandbox` object
-* (`mode`/`networkAccess`). Fields placed here are merged into the top-level of
-* `.cursor/cli.json` (project) / `~/.cursor/cli-config.json` (global) and emitted
-* only for Cursor, while the shared `permission` block continues to drive the
-* `permissions.allow`/`permissions.deny` arrays. Kept a `looseObject` so extra
-* `cli.json` keys can be authored (they are merged verbatim on generate);
-* `sandbox`'s accepted values are not documented so it passes through verbatim.
+* (`mode`/`networkAccess`). Fields placed here are merged into the top level of
+* `~/.cursor/cli-config.json` and emitted only for Cursor, while the shared
+* `permission` block continues to drive the `permissions.allow`/`permissions.deny`
+* arrays. Kept a `looseObject` so extra config keys can be authored (they are
+* merged verbatim on generate); `sandbox`'s accepted values are not documented
+* so it passes through verbatim.
+*
+* These are **global-only** settings: Cursor documents that "Only permissions
+* can be configured at the project level. All other CLI settings must be set
+* globally", so a project generate skips them with a warning instead of writing
+* keys `.cursor/cli.json` would ignore. Author them with `--global`.
+*
 * Note: only `approvalMode` and `sandbox` round-trip back on import — other keys
-* authored here reach `cli.json` on generate but are not re-extracted.
+* authored here reach the global config on generate but are not re-extracted.
 *
 * @example
 * { "approvalMode": "auto-review" }
@@ -4229,7 +4342,10 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * Tool-scoped override block for Qwen Code. Qwen's `settings.json` exposes
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
-* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`). It also
+* `sandbox`, `sandboxImage`, `disabled`) and `security` (`folderTrust`,
+* `allowedHttpHookUrls`, `allowPrivateNetworkHooks` — the latter is honored by
+* Qwen Code only in user/system settings, so generate skips it in project scope).
+* It also
 * exposes `permissions.autoMode` (the Auto Mode classifier config:
 * `hints.{allow,softDeny,hardDeny}`, `environment`, `classifyAllShell` — see
 * https://qwenlm.github.io/qwen-code-docs/en/users/features/auto-mode/), which
@@ -4995,7 +5111,10 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 		name: zod_mini.z.optional(zod_mini.z.string()),
 		description: zod_mini.z.optional(zod_mini.z.string())
 	})),
-	pi: zod_mini.z.optional(zod_mini.z.looseObject({ systemPrompt: zod_mini.z.optional(zod_mini.z.enum(["append"])) })),
+	pi: zod_mini.z.optional(zod_mini.z.looseObject({
+		systemPrompt: zod_mini.z.optional(zod_mini.z.enum(["append"])),
+		contextFile: zod_mini.z.optional(zod_mini.z.enum(["override"]))
+	})),
 	takt: zod_mini.z.optional(zod_mini.z.looseObject({
 		name: zod_mini.z.optional(zod_mini.z.string()),
 		extends: zod_mini.z.optional(zod_mini.z.string()),
@@ -5190,7 +5309,10 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
 		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
 		"scheduled-task": zod_mini.z.optional(zod_mini.z.boolean()),
-		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+		license: zod_mini.z.optional(zod_mini.z.string()),
+		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	})),
 	codexcli: zod_mini.z.optional(zod_mini.z.looseObject({
 		"short-description": zod_mini.z.optional(zod_mini.z.string()),
@@ -5802,13 +5924,20 @@ var FeatureProcessor = class {
 				filePath,
 				content: contentWithNewline
 			})) continue;
+			const fileMode = aiFile.getFileMode?.();
 			if (fileContentsEquivalent({
 				filePath,
 				expected: contentWithNewline,
 				existing: existingContent
-			})) continue;
+			})) {
+				if (fileMode !== void 0 && !this.dryRun) await restoreMissingExecutableBit(filePath, fileMode);
+				continue;
+			}
 			if (this.dryRun) this.logger.info(`[DRY RUN] Would write: ${filePath}`);
-			else await writeFileContent(filePath, contentWithNewline);
+			else {
+				await writeFileContent(filePath, contentWithNewline);
+				if (fileMode !== void 0) await applyFileMode(filePath, fileMode);
+			}
 			changedCount++;
 			changedPaths.push(aiFile.getRelativePathFromCwd());
 		}
@@ -7169,10 +7298,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 	".config/goose/config.yaml": {
 		format: "yaml",
 		invalidRootPolicy: "error",
-		features: { mcp: {
-			kind: "replace-owned-keys",
-			ownedKeys: ["extensions"]
-		} }
+		features: {
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["extensions"]
+			},
+			commands: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["slash_commands"]
+			}
+		}
 	},
 	[CODEXCLI_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
@@ -7876,6 +8011,22 @@ var ChecksProcessor = class extends FeatureProcessor {
 	}
 };
 //#endregion
+//#region src/constants/goose-paths.ts
+const GOOSE_DIR = ".goose";
+const GOOSE_GLOBAL_DIR = (0, node_path.join)(".config", "goose");
+const GOOSE_RULE_FILE_NAME = ".goosehints";
+const GOOSE_MCP_FILE_NAME = "config.yaml";
+const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
+const GOOSE_HOOKS_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync", "hooks");
+const GOOSE_HOOKS_FILE_NAME = "hooks.json";
+const GOOSE_PLUGIN_MCP_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync");
+const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
+const GOOSE_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "skills");
+const GOOSE_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "recipes");
+const GOOSE_GLOBAL_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "recipes");
+const GOOSE_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "agents");
+const GOOSE_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "agents");
+//#endregion
 //#region src/utils/tool-home.ts
 /**
 * Where the rulesync-side source files of a tool with a home override belong.
@@ -8817,6 +8968,9 @@ const CLINE_MCP_DIR_PATH = (0, node_path.join)(CLINE_DIR, "data", "settings");
 const CLINE_MCP_FILE_NAME = "cline_mcp_settings.json";
 const CLINE_PERMISSIONS_FILE_NAME = "command-permissions.json";
 const CLINE_IGNORE_FILE_NAME = ".clineignore";
+const CLINE_HOOKS_DIR_PATH = (0, node_path.join)(CLINERULES_DIR, "hooks");
+const CLINE_HOOKS_GLOBAL_DIR_PATH = (0, node_path.join)("Documents", "Cline", "Hooks");
+const CLINE_HOOKS_MANIFEST_FILE_NAME = "rulesync-hooks.json";
 //#endregion
 //#region src/features/commands/cline-command.ts
 var ClineCommand = class ClineCommand extends ToolCommand {
@@ -9278,6 +9432,8 @@ const DEVIN_HOOKS_V1_FILE_NAME = "hooks.v1.json";
 const DEVIN_GLOBAL_AGENTS_FILE_NAME = "AGENTS.md";
 const DEVIN_IGNORE_FILE_NAME = ".devinignore";
 const DEVIN_LEGACY_IGNORE_FILE_NAME = ".codeiumignore";
+const DEVIN_GLOBAL_IGNORE_DIR_PATH = ".codeium";
+const DEVIN_GLOBAL_IGNORE_FILE_NAME = DEVIN_LEGACY_IGNORE_FILE_NAME;
 //#endregion
 //#region src/features/commands/command-skill-ownership.ts
 /**
@@ -9526,24 +9682,99 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	}
 };
 //#endregion
-//#region src/constants/goose-paths.ts
-const GOOSE_DIR = ".goose";
-const GOOSE_GLOBAL_DIR = (0, node_path.join)(".config", "goose");
-const GOOSE_RULE_FILE_NAME = ".goosehints";
-const GOOSE_MCP_FILE_NAME = "config.yaml";
-const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
-const GOOSE_HOOKS_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync", "hooks");
-const GOOSE_HOOKS_FILE_NAME = "hooks.json";
-const GOOSE_PLUGIN_MCP_DIR_PATH = (0, node_path.join)(".agents", "plugins", "rulesync");
-const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
-const GOOSE_SKILLS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "skills");
-const GOOSE_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "recipes");
-const GOOSE_GLOBAL_RECIPES_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "recipes");
-const GOOSE_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_DIR, "agents");
-const GOOSE_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(GOOSE_GLOBAL_DIR, "agents");
-//#endregion
 //#region src/features/commands/goose-command.ts
 const RECIPE_VERSION = "1.0.0";
+const SLASH_COMMANDS_KEY = "slash_commands";
+const GOOSE_GLOBAL_RECIPES_POSIX_DIR = toPosixPath(GOOSE_GLOBAL_RECIPES_DIR_PATH);
+function slashCommandEntry({ outputRoot, relativeFilePath }) {
+	const fileName = (0, node_path.basename)(toPosixPath(relativeFilePath));
+	return {
+		command: fileName.replace(/\.ya?ml$/, "").toLowerCase(),
+		recipe_path: (0, node_path.join)(outputRoot, GOOSE_GLOBAL_RECIPES_DIR_PATH, fileName)
+	};
+}
+/**
+* Whether an existing `slash_commands` entry points at a recipe rulesync owns:
+* a direct child of the global recipes directory. Anything else — a recipe
+* elsewhere on disk, or a sub-recipe under `recipes/subagents/` — belongs to
+* the user and is carried over untouched. A path that cannot be resolved into
+* the managed directory is preserved rather than claimed.
+*/
+function isManagedRecipePath(value) {
+	if (typeof value !== "string") return false;
+	const segments = toPosixPath(value).replace(/^~\//, "").split("/");
+	const fileName = segments.pop();
+	if (fileName === void 0 || fileName === "") return false;
+	const dirSegments = GOOSE_GLOBAL_RECIPES_POSIX_DIR.split("/");
+	return segments.length >= dirSegments.length && segments.slice(-dirSegments.length).join("/") === GOOSE_GLOBAL_RECIPES_POSIX_DIR;
+}
+/**
+* Whether a config file carries a registration rulesync owns. Rewriting a
+* config that holds none of them would reformat the user's file (comments and
+* all) for nothing, so both writers check this first.
+*/
+function hasManagedGooseSlashCommands(fileContent) {
+	const existing = parseSharedConfig({
+		format: "yaml",
+		fileContent
+	})[SLASH_COMMANDS_KEY];
+	return Array.isArray(existing) && existing.some((entry) => isRecord$1(entry) && isManagedRecipePath(entry.recipe_path));
+}
+/**
+* Recompute `slash_commands` from the entries rulesync generates: user entries
+* pointing outside the managed recipes directory are carried over, entries
+* inside it are replaced (so a deleted command's registration is retracted),
+* and the key is dropped entirely when nothing is left.
+*/
+function getGooseSlashCommandsConfigContent({ currentContent, entries }) {
+	const config = parseSharedConfig({
+		format: "yaml",
+		fileContent: currentContent
+	});
+	const next = [...(Array.isArray(config[SLASH_COMMANDS_KEY]) ? config[SLASH_COMMANDS_KEY] : []).filter((entry) => !isRecord$1(entry) || !isManagedRecipePath(entry.recipe_path)), ...entries];
+	return applySharedConfigPatch({
+		fileKey: sharedConfigFileKey({
+			relativeDirPath: GOOSE_GLOBAL_DIR,
+			relativeFilePath: GOOSE_MCP_FILE_NAME
+		}),
+		feature: "commands",
+		existingContent: currentContent,
+		patch: { [SLASH_COMMANDS_KEY]: next.length > 0 ? next : void 0 }
+	});
+}
+/**
+* The Goose user `config.yaml`, carrying the `slash_commands` registrations for
+* the generated recipes. The file is shared with the user's own settings, so it
+* is always merged into rather than replaced.
+*/
+var GooseCommandConfigFile = class extends ToolFile {
+	entries;
+	constructor(params) {
+		super(params);
+		this.entries = params.entries;
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	shouldMergeExistingFileContent() {
+		return true;
+	}
+	setFileContent(newFileContent) {
+		super.setFileContent(getGooseSlashCommandsConfigContent({
+			currentContent: newFileContent,
+			entries: this.entries
+		}));
+	}
+	getFileContent() {
+		return getGooseSlashCommandsConfigContent({
+			currentContent: super.getFileContent(),
+			entries: this.entries
+		});
+	}
+};
 /**
 * Goose recipe files are reusable YAML workflow documents. A recipe requires
 * `version`, `title`, and `description`, plus at least one of `instructions` /
@@ -9578,6 +9809,40 @@ var GooseCommand = class GooseCommand extends ToolCommand {
 	static getSettablePaths({ global = false } = {}) {
 		return { relativeDirPath: global ? GOOSE_GLOBAL_RECIPES_DIR_PATH : GOOSE_RECIPES_DIR_PATH };
 	}
+	/**
+	* The user `config.yaml` holding the `slash_commands` registrations. Global
+	* scope only — Goose has no project-level registration surface.
+	*/
+	static getExtraSharedWritePaths({ global = false } = {}) {
+		if (!global) return [];
+		return [{
+			relativeDirPath: GOOSE_GLOBAL_DIR,
+			relativeFilePath: GOOSE_MCP_FILE_NAME
+		}];
+	}
+	/**
+	* Register the generated recipes as slash commands. The config file is also
+	* emitted when no command is generated but the existing file still carries
+	* managed registrations, so removing the last command retracts them instead of
+	* leaving `/name` pointing at a deleted recipe.
+	*/
+	static async getAuxiliaryFiles({ toolCommands, outputRoot = process.cwd(), global = false, forDeletion = false }) {
+		if (!global || forDeletion) return [];
+		const entries = toolCommands.map((command) => slashCommandEntry({
+			outputRoot,
+			relativeFilePath: command.getRelativeFilePath()
+		}));
+		const existingContent = await readFileContentOrNull((0, node_path.join)(outputRoot, GOOSE_GLOBAL_DIR, GOOSE_MCP_FILE_NAME));
+		if (entries.length === 0 && !hasManagedGooseSlashCommands(existingContent ?? "")) return [];
+		return [new GooseCommandConfigFile({
+			outputRoot,
+			relativeDirPath: GOOSE_GLOBAL_DIR,
+			relativeFilePath: GOOSE_MCP_FILE_NAME,
+			fileContent: existingContent ?? "",
+			entries,
+			global
+		})];
+	}
 	parseRecipeContent(content) {
 		const where = (0, node_path.join)(this.relativeDirPath, this.relativeFilePath);
 		let parsed;
@@ -11063,8 +11328,9 @@ const KIRO_SETTINGS_DIR_PATH = (0, node_path.join)(KIRO_DIR, "settings");
 const KIRO_AGENTS_DIR_PATH = (0, node_path.join)(KIRO_DIR, "agents");
 const KIRO_HOOKS_FILE_NAME = "default.json";
 /**
-* Kiro IDE 1.0 stores hooks as structured JSON files in `.kiro/hooks/`
-* (workspace) and `~/.kiro/hooks/` (user). A single file may declare multiple
+* Kiro stores hooks as structured JSON files in `.kiro/hooks/` (workspace) and
+* `~/.kiro/hooks/` (user) — the format the IDE reads and the one Kiro CLI 3.0
+* migrated to. A single file may declare multiple
 * hooks in its `hooks` array, so rulesync emits all generated hooks into one
 * `rulesync.json` file per scope.
 * @see https://kiro.dev/docs/hooks/
@@ -11407,6 +11673,7 @@ const PI_EXTENSIONS_DIR_PATH = (0, node_path.join)(".pi", "extensions");
 const PI_PROMPTS_DIR_PATH = (0, node_path.join)(".pi", "prompts");
 const PI_SKILLS_DIR_PATH = (0, node_path.join)(".pi", "skills");
 const PI_RULE_FILE_NAME = "AGENTS.md";
+const PI_RULE_OVERRIDE_FILE_NAME = "AGENTS.override.md";
 const PI_APPEND_SYSTEM_FILE_NAME = "APPEND_SYSTEM.md";
 const PI_HOOKS_FILE_NAME = "rulesync-hooks.ts";
 //#endregion
@@ -12898,6 +13165,7 @@ var CommandsProcessor = class extends FeatureProcessor {
 		}));
 		const shouldDisableHermesCommandsPlugin = this.toolTarget === "hermesagent" && existingFiles.some((file) => file.getFilePath() === ownershipPath) && !generatedFiles.some((file) => file.getFilePath() === ownershipPath);
 		let changedCount = await super.removeOrphanAiFiles(existingFiles, generatedFiles);
+		changedCount += await this.retractGooseSlashCommands(generatedFiles);
 		if (!shouldDisableHermesCommandsPlugin) return changedCount;
 		const configPath = (0, node_path.join)(this.outputRoot, getHermesagentRelativeFilePath({
 			global: this.global,
@@ -12916,6 +13184,27 @@ var CommandsProcessor = class extends FeatureProcessor {
 		return changedCount;
 	}
 	/**
+	* Drop the `slash_commands` registrations when no Goose recipe is generated
+	* any more. `GooseCommand.getAuxiliaryFiles` handles every other case, but it
+	* is not reached when the whole feature has no source files left (`--delete`
+	* removes the recipes there), which would strand `/name` on a deleted recipe.
+	*/
+	async retractGooseSlashCommands(generatedFiles) {
+		if (this.toolTarget !== "goose" || !this.global) return 0;
+		if (generatedFiles.some((file) => file instanceof GooseCommand)) return 0;
+		const configPath = (0, node_path.join)(this.outputRoot, GOOSE_GLOBAL_DIR, GOOSE_MCP_FILE_NAME);
+		const currentContent = await readFileContentOrNull(configPath);
+		if (currentContent === null || !hasManagedGooseSlashCommands(currentContent)) return 0;
+		const nextContent = getGooseSlashCommandsConfigContent({
+			currentContent,
+			entries: []
+		});
+		if (nextContent === currentContent) return 0;
+		if (this.dryRun) this.logger.info(`[DRY RUN] Would write: ${configPath}`);
+		else await writeFileContent(configPath, nextContent);
+		return 1;
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Return the tool targets that this processor supports
 	*/
@@ -13084,6 +13373,14 @@ var ToolHooks = class extends ToolFile {
 	static async getAuxiliaryFiles(_params) {
 		return [];
 	}
+	/**
+	* Extra files the deletion sweep may remove, for adapters that write more
+	* than their settable path. Kept separate from {@link getAuxiliaryFiles},
+	* which may legitimately return a shared user-owned config file.
+	*/
+	static async getDeletableAuxiliaryFiles(_params) {
+		return [];
+	}
 };
 //#endregion
 //#region src/features/hooks/amp-hooks.ts
@@ -14366,8 +14663,7 @@ const CLAUDE_CONVERTER_CONFIG = {
 		"teammateIdle",
 		"cwdChanged",
 		"beforeSubmitPrompt",
-		"stop",
-		"directoryAdded"
+		"stop"
 	]),
 	supportedHookTypes: /* @__PURE__ */ new Set([
 		"command",
@@ -14541,6 +14837,281 @@ var ClaudecodePluginHooks = class extends ClaudecodeHooks {
 	}
 };
 //#endregion
+//#region src/features/hooks/cline-hooks-generator.ts
+/**
+* Marker line every generated hook script carries. Cline resolves hooks by
+* exact event name from a directory users also hand-author scripts in, so the
+* marker is what tells a rulesync-owned script apart from a user's own: only
+* files carrying it are rewritten or cleaned up.
+*/
+const CLINE_HOOK_SCRIPT_MARKER = "rulesync-owned: cline-hooks";
+/** Exit code a hook command uses to cancel the task (Claude Code convention). */
+const CANCEL_EXIT_CODE = 2;
+function sanitizeCommand(command) {
+	let sanitized = command;
+	for (const char of CONTROL_CHARS) sanitized = sanitized.replaceAll(char, "");
+	return sanitized;
+}
+/** Single-quote a string for POSIX shells. */
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/** Single-quote a string for PowerShell. */
+function powerShellQuote(value) {
+	return `'${value.replaceAll("'", "''")}'`;
+}
+function collectClineHookCommands({ effectiveHooks, eventMap }) {
+	const commandsByEvent = {};
+	for (const [canonicalEvent, definitions] of Object.entries(effectiveHooks)) {
+		const clineEvent = eventMap[canonicalEvent];
+		if (!clineEvent) continue;
+		const commands = definitions.filter((definition) => (definition.type ?? "command") === "command" && definition.command).map((definition) => sanitizeCommand(definition.command)).filter((command) => command.trim() !== "");
+		if (commands.length === 0) continue;
+		const existing = commandsByEvent[clineEvent];
+		if (existing) existing.push(...commands);
+		else commandsByEvent[clineEvent] = commands;
+	}
+	return commandsByEvent;
+}
+/**
+* A POSIX wrapper script for one Cline hook event.
+*
+* Cline spawns the file itself (`spawn(scriptPath, [], { shell: true })`), feeds
+* the event payload on stdin and reads a JSON result from stdout. The wrapper
+* therefore forwards the payload to each configured command in order and
+* translates the exit codes: `2` cancels the task, any other failure is
+* reported through `errorMessage` without cancelling, mirroring how the
+* canonical `command` hook type behaves for the tools that support blocking.
+*/
+function generateClineHookScript({ event, commands }) {
+	const lines = [
+		"#!/bin/bash",
+		`# ${event} hook generated by rulesync — edit .rulesync/hooks.jsonc and regenerate.`,
+		`# ${CLINE_HOOK_SCRIPT_MARKER}`,
+		"",
+		"payload=$(cat)",
+		"cancel=false",
+		"error_message=''",
+		""
+	];
+	for (const command of commands) {
+		const quoted = shellQuote(command);
+		lines.push("if [ \"$cancel\" = false ]; then", `  if bash -n -c ${quoted} 2>/dev/null; then`, `    hook_stderr=$(printf '%s' "$payload" | bash -c ${quoted} 2>&1 >/dev/null)`, "    hook_status=$?", `    if [ "$hook_status" -eq ${CANCEL_EXIT_CODE} ]; then`, "      cancel=true", "      error_message=\"$hook_stderr\"", "    elif [ \"$hook_status\" -ne 0 ]; then", `      printf '%s\\n' "rulesync ${event} hook failed (exit $hook_status): $hook_stderr" >&2`, "      error_message=\"$hook_stderr\"", "    fi", "  else", `    error_message="rulesync ${event} hook command is not valid shell syntax"`, `    printf '%s\\n' "$error_message" >&2`, "  fi", "fi", "");
+	}
+	lines.push("escape_json() {", `  printf '%s' "$1" | tr '\\n\\r\\t' '   ' | tr -d '\\000-\\037' | sed -e 's/\\\\/\\\\\\\\/g' -e 's/"/\\\\"/g'`, "}", "", `printf '{"cancel": %s, "contextModification": "", "errorMessage": "%s"}\\n' "$cancel" "$(escape_json "$error_message")"`, "");
+	return lines.join("\n");
+}
+/**
+* The PowerShell twin of {@link generateClineHookScript}. On Windows Cline
+* resolves only `<Event>.ps1` and runs it through `powershell -File`, so both
+* spellings are written and the platform picks one.
+*/
+function generateClineHookPowerShellScript({ event, commands }) {
+	const lines = [
+		`# ${event} hook generated by rulesync — edit .rulesync/hooks.jsonc and regenerate.`,
+		`# ${CLINE_HOOK_SCRIPT_MARKER}`,
+		"",
+		"$payload = [Console]::In.ReadToEnd()",
+		"$cancel = $false",
+		"$errorMessage = ''",
+		""
+	];
+	for (const command of commands) lines.push("if (-not $cancel) {", `  $hookStderr = ($payload | & cmd /c ${powerShellQuote(command)} 2>&1 | Out-String)`, "  $hookStatus = $LASTEXITCODE", `  if ($hookStatus -eq ${CANCEL_EXIT_CODE}) {`, "    $cancel = $true", "    $errorMessage = $hookStderr", "  } elseif ($hookStatus -ne 0) {", `    Write-Error ${powerShellQuote(`rulesync ${event} hook failed`)}`, "    $errorMessage = $hookStderr", "  }", "}", "");
+	lines.push("@{", "  cancel = $cancel", "  contextModification = \"\"", "  errorMessage = $errorMessage", "} | ConvertTo-Json -Compress", "");
+	return lines.join("\n");
+}
+//#endregion
+//#region src/features/hooks/cline-hooks.ts
+/** Mode Cline's hook scripts need: it spawns the file itself on Unix. */
+const HOOK_SCRIPT_MODE = 493;
+/** The only file names this adapter ever writes into the hooks directory. */
+const MANAGED_EVENT_NAMES = new Set(Object.values(CANONICAL_TO_CLINE_EVENT_NAMES));
+/**
+* Read the manifest of a previous run. Event names are filtered against the
+* names this adapter emits: the manifest is a file in the repository, and
+* anything else there would otherwise be turned into a path — an executable one
+* — that rulesync writes.
+*/
+function parseManifest(fileContent) {
+	try {
+		const parsed = JSON.parse(fileContent);
+		if (!isRecord$1(parsed) || !isStringArray$1(parsed.events)) return null;
+		return {
+			generatedBy: "rulesync",
+			events: parsed.events.filter((event) => MANAGED_EVENT_NAMES.has(event))
+		};
+	} catch {
+		return null;
+	}
+}
+/** One generated hook script. Written executable so Cline can spawn it. */
+var ClineHookScript = class extends ToolFile {
+	getFileMode() {
+		return this.getRelativeFilePath().endsWith(".ps1") ? void 0 : HOOK_SCRIPT_MODE;
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+/**
+* Hooks adapter for Cline's file-based hooks.
+*
+* Cline (VS Code extension / Cline Desktop) resolves one executable per
+* lifecycle event from `<project>/.clinerules/hooks/` or the global
+* `~/Documents/Cline/Hooks/`, named exactly after the event: the extensionless
+* name on Unix, `<Event>.ps1` on Windows. The script receives the event payload
+* as JSON on stdin and answers with `{"cancel": …, "contextModification": …,
+* "errorMessage": …}` on stdout. rulesync emits a wrapper script per configured
+* event in both spellings, plus a `rulesync-hooks.json` manifest naming the
+* scripts it owns.
+*
+* The directory is shared with hand-authored hooks and the filenames are fixed
+* by the contract, so every generated script carries a marker line and a script
+* without it is never overwritten.
+*
+* Cline's CLI and SDK use a different, in-process hook surface (`AgentHooks`
+* from `@cline/core`), which this adapter does not target.
+*
+* @see https://github.com/cline/cline/blob/main/apps/vscode/src/core/hooks/utils.ts
+*/
+var ClineHooks = class ClineHooks extends ToolHooks {
+	scriptsByEvent;
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+		this.scriptsByEvent = params.scriptsByEvent ?? {};
+	}
+	static getSettablePaths(options) {
+		return {
+			relativeDirPath: options?.global ? CLINE_HOOKS_GLOBAL_DIR_PATH : CLINE_HOOKS_DIR_PATH,
+			relativeFilePath: CLINE_HOOKS_MANIFEST_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = ClineHooks.getSettablePaths({ global });
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		return new ClineHooks({
+			outputRoot,
+			...paths,
+			fileContent,
+			validate
+		});
+	}
+	static fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+		const config = rulesyncHooks.getJson();
+		const overrideHooks = config.cline?.hooks ?? {};
+		const scriptsByEvent = collectClineHookCommands({
+			effectiveHooks: {
+				...config.hooks,
+				...overrideHooks
+			},
+			eventMap: CANONICAL_TO_CLINE_EVENT_NAMES
+		});
+		const manifest = {
+			generatedBy: "rulesync",
+			events: Object.keys(scriptsByEvent).toSorted()
+		};
+		return new ClineHooks({
+			outputRoot,
+			...ClineHooks.getSettablePaths({ global }),
+			fileContent: `${JSON.stringify(manifest, null, 2)}\n`,
+			validate,
+			scriptsByEvent
+		});
+	}
+	/**
+	* The per-event scripts, plus a neutralized script for every event a previous
+	* run generated and this one no longer covers — those files stay on disk (the
+	* hooks feature only reconciles its single settable path), so they are
+	* rewritten as no-ops instead of being left running a removed hook.
+	*/
+	async getScriptFiles({ global = false, logger } = {}) {
+		const paths = ClineHooks.getSettablePaths({ global });
+		const previous = parseManifest(await readFileContentOrNull((0, node_path.join)(this.outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "")?.events ?? [];
+		const events = [.../* @__PURE__ */ new Set([...Object.keys(this.scriptsByEvent), ...previous])].toSorted();
+		const files = [];
+		for (const event of events) {
+			const commands = this.scriptsByEvent[event] ?? [];
+			for (const [relativeFilePath, fileContent] of [[event, generateClineHookScript({
+				event,
+				commands
+			})], [`${event}.ps1`, generateClineHookPowerShellScript({
+				event,
+				commands
+			})]]) {
+				const existing = await readFileContentOrNull((0, node_path.join)(this.outputRoot, paths.relativeDirPath, relativeFilePath));
+				if (existing !== null && !existing.includes("rulesync-owned: cline-hooks")) {
+					logger?.warn(`Kept the existing ${(0, node_path.join)(paths.relativeDirPath, relativeFilePath)}: it was not generated by rulesync, so the ${event} hook from .rulesync/hooks.jsonc is not written. Remove or rename that file to let rulesync manage the event.`);
+					continue;
+				}
+				files.push(new ClineHookScript({
+					outputRoot: this.outputRoot,
+					relativeDirPath: paths.relativeDirPath,
+					relativeFilePath,
+					fileContent
+				}));
+			}
+		}
+		return files;
+	}
+	/**
+	* The generated scripts ride alongside the manifest. Only a `ClineHooks`
+	* instance can produce them, so the processor hands its freshly built one
+	* back here.
+	*/
+	static async getAuxiliaryFiles({ global = false, toolHooks, logger } = {}) {
+		if (!(toolHooks instanceof ClineHooks)) return [];
+		return toolHooks.getScriptFiles({
+			global,
+			logger
+		});
+	}
+	/**
+	* Every rulesync-marked script currently on disk. Dropping the target must
+	* take the scripts with it: they hold the actual commands, and leaving them
+	* behind keeps a removed hook running.
+	*/
+	static async getDeletableAuxiliaryFiles({ outputRoot = process.cwd(), global = false } = {}) {
+		const paths = ClineHooks.getSettablePaths({ global });
+		const files = [];
+		for (const event of [...MANAGED_EVENT_NAMES].toSorted()) for (const relativeFilePath of [event, `${event}.ps1`]) {
+			const existing = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath));
+			if (existing === null || !existing.includes("rulesync-owned: cline-hooks")) continue;
+			files.push(new ClineHookScript({
+				outputRoot,
+				relativeDirPath: paths.relativeDirPath,
+				relativeFilePath,
+				fileContent: "",
+				validate: false
+			}));
+		}
+		return files;
+	}
+	toRulesyncHooks() {
+		throw new Error("Not implemented because generated Cline hook scripts cannot be imported back into canonical hooks.");
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new ClineHooks({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/hooks/codexcli-hooks.ts
 const CODEXCLI_CONVERTER_CONFIG = {
 	supportedEvents: CODEXCLI_HOOK_EVENTS,
@@ -14707,12 +15278,19 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 /**
 * Copilot hook entry as stored in .github/hooks/copilot-hooks.json.
 *
-* On Windows, commands are emitted under `powershell`; on other platforms, under `bash`.
+* The canonical `shell` selector chooses `bash` or `powershell`; without it the
+* portable `command` field is written, which upstream copies to both when
+* neither is present. Note the cloud agent runs hooks in a Linux sandbox and
+* honors only `bash` and `command` — a `powershell` entry is ignored there.
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
 */
 const CopilotHookEntrySchema = zod_mini.z.looseObject({
 	type: zod_mini.z.string(),
 	bash: zod_mini.z.optional(zod_mini.z.string()),
 	powershell: zod_mini.z.optional(zod_mini.z.string()),
+	command: zod_mini.z.optional(zod_mini.z.string()),
+	env: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	timeoutSec: zod_mini.z.optional(zod_mini.z.number())
 });
 /**
@@ -14720,12 +15298,16 @@ const CopilotHookEntrySchema = zod_mini.z.looseObject({
 * Filters shared hooks to COPILOT_HOOK_EVENTS, merges config.copilot?.hooks,
 * then converts to Copilot event names and field format.
 *
-* On Windows the command is emitted under the `powershell` key;
-* on all other platforms it is emitted under `bash`.
+* The command field is chosen by the canonical `shell` selector, falling back to
+* the portable `command` field — never by the platform Rulesync happens to run
+* on. Keying it off `process.platform` meant a file generated on Windows carried
+* only `powershell`, which the Linux-sandboxed cloud agent ignores outright, so
+* the hook silently never ran; it also made the output differ per generating
+* machine, which shows up as churn for anyone who checks the file in (the cloud
+* agent reads it from the repository).
 */
 function canonicalToCopilotHooks(config) {
 	const canonicalSchemaKeys = Object.keys(HookDefinitionSchema.shape);
-	const commandField = process.platform === "win32" ? "powershell" : "bash";
 	const supported = new Set(COPILOT_HOOK_EVENTS);
 	const sharedConfigHooks = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (supported.has(event)) sharedConfigHooks[event] = defs;
@@ -14743,10 +15325,12 @@ function canonicalToCopilotHooks(config) {
 			if (hookType !== "command") continue;
 			const command = def.command;
 			const timeout = def.timeout;
+			const commandField = def.shell ?? "command";
 			const rest = Object.fromEntries(Object.entries(def).filter(([k]) => !canonicalSchemaKeys.includes(k)));
 			entries.push({
 				type: hookType,
 				...command !== void 0 && command !== null && { [commandField]: command },
+				...def.env !== void 0 && { env: def.env },
 				...timeout !== void 0 && timeout !== null && { timeoutSec: timeout },
 				...rest
 			});
@@ -14756,24 +15340,35 @@ function canonicalToCopilotHooks(config) {
 	return copilot;
 }
 /**
-* Resolve the command string from a Copilot hook entry.
+* Resolve the command and its shell selector from a Copilot hook entry.
 *
-* - If only `bash` is present, use it.
-* - If only `powershell` is present, use it.
-* - If both are present, use `powershell` on Windows, `bash` otherwise,
-*   and log a warning that the other value was ignored.
+* - If only one shell-specific field is present, use it and record the shell,
+*   so a re-export writes the same field back.
+* - If both are present, take `bash` and warn. The choice is deliberately not
+*   platform-dependent: the cloud agent runs hooks in a Linux sandbox and
+*   ignores `powershell` entirely, and importing on Windows must not produce a
+*   different canonical config than importing the same file on Linux.
+* - Otherwise fall back to the portable `command` field, leaving `shell` unset
+*   so a re-export renders the portable field again.
 */
 function resolveImportCommand$1(entry, logger) {
 	const hasBash = typeof entry.bash === "string";
 	const hasPowershell = typeof entry.powershell === "string";
 	if (hasBash && hasPowershell) {
-		const isWindows = process.platform === "win32";
-		const chosen = isWindows ? "powershell" : "bash";
-		const ignored = isWindows ? "bash" : "powershell";
-		logger?.warn(`Copilot hook has both bash and powershell commands; using ${chosen} and ignoring ${ignored} on this platform.`);
-		return isWindows ? entry.powershell : entry.bash;
-	} else if (hasBash) return entry.bash;
-	else if (hasPowershell) return entry.powershell;
+		logger?.warn("Copilot hook has both bash and powershell commands; using bash and ignoring powershell, which the Linux-sandboxed cloud agent does not run.");
+		return {
+			command: entry.bash,
+			shell: "bash"
+		};
+	} else if (hasBash) return {
+		command: entry.bash,
+		shell: "bash"
+	};
+	else if (hasPowershell) return {
+		command: entry.powershell,
+		shell: "powershell"
+	};
+	return typeof entry.command === "string" ? { command: entry.command } : {};
 }
 /**
 * Extract hooks from Copilot hooks JSON into canonical format.
@@ -14790,11 +15385,13 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			const parseResult = CopilotHookEntrySchema.safeParse(rawEntry);
 			if (!parseResult.success) continue;
 			const entry = parseResult.data;
-			const command = resolveImportCommand$1(entry, logger);
+			const { command, shell } = resolveImportCommand$1(entry, logger);
 			const timeout = entry.timeoutSec;
 			defs.push({
 				type: "command",
 				...command !== void 0 && { command },
+				...shell !== void 0 && { shell },
+				...entry.env !== void 0 && { env: entry.env },
 				...timeout !== void 0 && { timeout }
 			});
 		}
@@ -15953,6 +16550,27 @@ const HERMESAGENT_MATCHER_EVENTS = /* @__PURE__ */ new Set(["pre_tool_call", "po
 const HERMESAGENT_CANONICAL_EVENTS = new Set(HERMESAGENT_HOOK_EVENTS);
 const HERMESAGENT_NATIVE_EVENTS = new Set(HERMESAGENT_NATIVE_HOOK_EVENTS);
 /**
+* Whether an entry of the `hooks:` mapping is a hook-event list rather than one
+* of its non-event siblings.
+*
+* The mapping is not all events: Hermes v0.20.0 nests the outbound webhook
+* registry there as `hooks.outbound`, a list of targets (`name`, `url`,
+* `events`, `secret_env`, `matcher`, `timeout`) that rulesync neither authors
+* nor imports. A documented native event is an event whatever its value; for
+* anything else the value decides, because rulesync also emits *undocumented*
+* event names supplied through the `hermesagent.hooks` override (forward
+* compatibility), and those must stay retractable. Everything rulesync writes
+* is a non-empty list of entries carrying a string `command`, which no registry
+* entry has — `outbound` entries carry `url`/`events` instead.
+*
+* Both directions ask this one question, so import and generate cannot drift.
+* @see https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks
+*/
+function isHermesHookEventEntry(key, value) {
+	if (HERMESAGENT_NATIVE_EVENTS.has(key)) return true;
+	return Array.isArray(value) && value.length > 0 && value.every((entry) => isPlainObject$1(entry) && typeof entry.command === "string");
+}
+/**
 * Convert the canonical hooks config into Hermes's native
 * `hooks: { <event>: [{ matcher?, command, timeout? }] }` shape.
 *
@@ -16013,7 +16631,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	}
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
-		if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.19.0; preserving it for forward compatibility.`);
+		if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.20.0; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -16035,6 +16653,7 @@ function hermesHooksToCanonical(hooks) {
 	if (hooks === null || typeof hooks !== "object" || Array.isArray(hooks)) return canonical;
 	for (const [nativeEvent, entries] of Object.entries(hooks)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(nativeEvent) || !Array.isArray(entries)) continue;
+		if (!isHermesHookEventEntry(nativeEvent, entries)) continue;
 		const rulesyncEvent = HERMESAGENT_TO_CANONICAL_EVENT_NAMES[nativeEvent] ?? nativeEvent;
 		const defs = [];
 		for (const raw of entries) {
@@ -16054,6 +16673,32 @@ function hermesHooksToCanonical(hooks) {
 	return canonical;
 }
 /**
+* Recompute the `hooks:` mapping that is written back to `config.yaml`.
+*
+* rulesync owns the hook events inside that mapping, but not the mapping
+* itself: Hermes v0.20.0 nests the outbound webhook registry under the same key
+* as `hooks.outbound`, and it is a list of webhook targets rather than a hook
+* event, so it has no rulesync spelling and no migration path. Replacing the
+* whole mapping destroyed it on every generate. Every key that is not an event
+* ({@link isHermesHookEventEntry}) is therefore carried over from the existing
+* file, while event keys are replaced wholesale so a hook deleted from the
+* rulesync source is retracted — including one written under an undocumented
+* event name through the `hermesagent.hooks` override.
+* @see https://hermes-agent.nousresearch.com/docs/user-guide/features/hooks
+*/
+function mergeHermesHooksBlock({ existingHooks, generatedHooks }) {
+	const preserved = {};
+	if (isPlainObject$1(existingHooks)) for (const [key, value] of Object.entries(existingHooks)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (isHermesHookEventEntry(key, value)) continue;
+		preserved[key] = value;
+	}
+	return {
+		...preserved,
+		...isPlainObject$1(generatedHooks) ? generatedHooks : {}
+	};
+}
+/**
 * Hermes Agent shell hooks.
 *
 * Hermes Agent registers shell-command hooks under the `hooks:` key of the
@@ -16121,14 +16766,22 @@ var HermesagentHooks = class HermesagentHooks extends ToolHooks {
 		return true;
 	}
 	setFileContent(fileContent) {
+		const existing = parseSharedConfig({
+			format: "yaml",
+			fileContent
+		});
+		const generated = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.fileContent
+		});
 		this.fileContent = applySharedConfigPatch({
 			fileKey: getHermesagentConfigSharedFileKey({ global: this.global }),
 			feature: "hooks",
 			existingContent: fileContent,
-			patch: parseSharedConfig({
-				format: "yaml",
-				fileContent: this.fileContent
-			})
+			patch: { hooks: mergeHermesHooksBlock({
+				existingHooks: existing.hooks,
+				generatedHooks: generated.hooks
+			}) }
 		});
 	}
 	toRulesyncHooks() {
@@ -16282,15 +16935,36 @@ var JunieHooks = class JunieHooks extends ToolHooks {
 *
 * `experimental.session.compacting` receives `(input, output)` and exposes no
 * per-invocation identifier worth matching on, so it takes `null`.
+* `chat.message` receives `(input, output)` with the prompt text living in
+* `output.parts` rather than a single matchable field, so it takes `null` too.
 *
 * @see https://opencode.ai/docs/plugins/
 */
 const NAMED_HOOK_MATCHER_SUBJECTS = {
 	"tool.execute.before": "input.tool",
 	"tool.execute.after": "input.tool",
-	"experimental.session.compacting": null
+	"experimental.session.compacting": null,
+	"chat.message": null
 };
 /**
+* Canonical events whose generic (`event.type`) dispatch fires more broadly
+* than the canonical event means, mapped to the extra condition the generated
+* handler gates on. Keyed by canonical event like `SHELL_EVENT_TOOL_GATES`, so
+* a second canonical event mapped onto the same dispatch does not inherit a
+* gate meant for its sibling.
+*
+* `permission.replied` fires for every reply — `once`, `always` and `reject` —
+* so the canonical `permissionDenied` handler runs only for a rejecting reply.
+*
+* Note the v1 SDK's generated `Event` typing still describes this payload as
+* `{ permissionID, response }`; the schema source, the v2 typings and the TUI's
+* live consumer all agree on `{ requestID, reply }`, so the stale codegen is
+* not followed here.
+*
+* @see https://opencode.ai/docs/plugins/
+*/
+const GENERIC_EVENT_PROPERTY_GATES = { permissionDenied: "event.properties.reply === \"reject\"" };
+/**
 * OpenCode (and Kilo) have no shell-execution lifecycle event — the
 * `command.executed` event these canonical events were once mapped to is a
 * *slash-command* event, so a hook wired there never fired on bash commands
@@ -16335,6 +17009,7 @@ function validateAndSanitizeMatcher(matcher) {
 function collectOpencodeStyleHandlers({ effectiveHooks, eventMap, namedEventHandlers, genericEventHandlers }) {
 	for (const [canonicalEvent, definitions] of Object.entries(effectiveHooks)) {
 		const shellGate = SHELL_EVENT_TOOL_GATES[canonicalEvent];
+		const propertyGate = GENERIC_EVENT_PROPERTY_GATES[canonicalEvent];
 		const toolEvent = shellGate?.toolEvent ?? eventMap[canonicalEvent];
 		if (!toolEvent) continue;
 		const matcherSupported = !shellGate && Object.hasOwn(NAMED_HOOK_MATCHER_SUBJECTS, toolEvent) && NAMED_HOOK_MATCHER_SUBJECTS[toolEvent] !== null;
@@ -16346,7 +17021,8 @@ function collectOpencodeStyleHandlers({ effectiveHooks, eventMap, namedEventHand
 			handlers.push({
 				command: def.command,
 				matcher: def.matcher ? def.matcher : void 0,
-				...shellGate ? { toolGate: shellGate.tool } : {}
+				...shellGate ? { toolGate: shellGate.tool } : {},
+				...propertyGate ? { propertyGate } : {}
 			});
 		}
 		if (handlers.length > 0) {
@@ -16368,7 +17044,11 @@ function buildGenericEventBodyLines(genericEventHandlers) {
 		isFirst = false;
 		for (const handler of handlers) {
 			const escapedCommand = escapeForTemplateLiteral(handler.command);
-			bodyLines.push(`        await $\`${escapedCommand}\`;`);
+			if (handler.propertyGate) {
+				bodyLines.push(`        if (${handler.propertyGate}) {`);
+				bodyLines.push(`          await $\`${escapedCommand}\`;`);
+				bodyLines.push("        }");
+			} else bodyLines.push(`        await $\`${escapedCommand}\`;`);
 		}
 		bodyLines.push("      }");
 	}
@@ -16736,13 +17416,246 @@ var KimiCodeHooks = class KimiCodeHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/features/hooks/kiro-ide-hooks.ts
+/**
+* One hook entry inside the Kiro IDE v1 `hooks` array.
+*
+* `z.looseObject` keeps unknown fields added by future Kiro IDE versions, so
+* imports do not drop data they do not yet understand.
+* @see https://kiro.dev/docs/hooks/types/
+*/
+const KiroIdeHookActionSchema = zod_mini.z.union([zod_mini.z.looseObject({
+	type: zod_mini.z.literal("command"),
+	command: zod_mini.z.optional(safeString)
+}), zod_mini.z.looseObject({
+	type: zod_mini.z.literal("agent"),
+	prompt: zod_mini.z.optional(safeString)
+})]);
+const KiroIdeHookEntrySchema = zod_mini.z.looseObject({
+	name: zod_mini.z.optional(zod_mini.z.string()),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	trigger: zod_mini.z.optional(zod_mini.z.string()),
+	matcher: zod_mini.z.optional(zod_mini.z.string()),
+	action: zod_mini.z.optional(KiroIdeHookActionSchema),
+	timeout: zod_mini.z.optional(zod_mini.z.number()),
+	enabled: zod_mini.z.optional(zod_mini.z.boolean())
+});
+const KiroIdeHooksFileSchema = zod_mini.z.looseObject({
+	version: zod_mini.z.optional(zod_mini.z.string()),
+	hooks: zod_mini.z.optional(zod_mini.z.array(KiroIdeHookEntrySchema))
+});
+/**
+* Build the Kiro IDE hook entries for a single canonical event's definitions.
+*
+* `command`-type definitions become `{ type: "command", command }` actions and
+* `prompt`-type definitions become `{ type: "agent", prompt }` actions. Other
+* types are skipped (the {@link import("./hooks-processor.js").HooksProcessor}
+* already warns about unsupported types).
+*/
+function buildKiroIdeEntriesForEvent(trigger, definitions) {
+	const entries = [];
+	for (const def of definitions) {
+		const type = def.type ?? "command";
+		let action;
+		if (type === "command") {
+			if (def.command === void 0) continue;
+			action = {
+				type: "command",
+				command: def.command
+			};
+		} else if (type === "prompt") {
+			if (def.prompt === void 0) continue;
+			action = {
+				type: "agent",
+				prompt: def.prompt
+			};
+		} else continue;
+		entries.push({
+			name: def.name ?? trigger,
+			...def.description !== void 0 && def.description !== null && { description: def.description },
+			trigger,
+			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
+			action,
+			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
+			enabled: def.enabled ?? true
+		});
+	}
+	return entries;
+}
+function canonicalToKiroIdeHooks(config, overrideKey) {
+	const kiroIdeSupported = new Set(KIRO_IDE_HOOK_EVENTS);
+	const sharedHooks = {};
+	for (const [event, defs] of Object.entries(config.hooks)) if (kiroIdeSupported.has(event)) sharedHooks[event] = defs;
+	const effectiveHooks = {
+		...sharedHooks,
+		...config[overrideKey]?.hooks
+	};
+	const entries = [];
+	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
+		const trigger = CANONICAL_TO_KIRO_IDE_EVENT_NAMES[eventName] ?? eventName;
+		entries.push(...buildKiroIdeEntriesForEvent(trigger, definitions));
+	}
+	return entries;
+}
+function kiroIdeHooksToCanonical(entries) {
+	const canonical = {};
+	for (const entry of entries) {
+		if (entry.trigger === void 0 || entry.action === void 0) continue;
+		const eventName = KIRO_IDE_TO_CANONICAL_EVENT_NAMES[entry.trigger] ?? entry.trigger;
+		if (isPrototypePollutionKey(eventName)) continue;
+		const def = {};
+		if (entry.action.type === "command") {
+			if (!entry.action.command) continue;
+			def.type = "command";
+			def.command = entry.action.command;
+		} else {
+			if (!entry.action.prompt) continue;
+			def.type = "prompt";
+			def.prompt = entry.action.prompt;
+		}
+		if (entry.name !== void 0 && entry.name !== null) def.name = entry.name;
+		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
+		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
+		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
+		if (entry.enabled === false) def.enabled = false;
+		(canonical[eventName] ??= []).push(def);
+	}
+	return canonical;
+}
+/**
+* Hooks generator for the standalone Kiro hooks format (`.kiro/hooks/*.json`
+* v1), used by the **Kiro IDE** and, since Kiro CLI 3.0, by the CLI too.
+*
+* Kiro reads structured JSON hooks from `.kiro/hooks/` (workspace) and
+* `~/.kiro/hooks/` (user). A single file may declare multiple hooks in its
+* `hooks` array, so rulesync emits every generated hook into one
+* `rulesync.json` file per scope (`{ "version": "v1", "hooks": [ ... ] }`),
+* which keeps it within the single-file hooks architecture.
+*
+* {@link import("./kiro-cli-hooks.js").KiroCliHooks} subclasses this to write
+* the same format for the `kiro-cli` target; only the deprecated `kiro` alias
+* still writes the embedded `.kiro/agents/default.json` agent-config shape,
+* which Kiro CLI 3.0 no longer reads.
+*
+* @see https://kiro.dev/docs/hooks/
+*/
+var KiroIdeHooks = class extends ToolHooks {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? JSON.stringify({
+				version: "v1",
+				hooks: []
+			}, null, 2)
+		});
+	}
+	/**
+	* The `HooksConfig` key whose `hooks` block provides tool-specific overrides
+	* for this target. {@link import("./kiro-cli-hooks.js").KiroCliHooks}
+	* overrides this to `kiro-cli`.
+	*/
+	static getOverrideKey() {
+		return "kiro-ide";
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: KIRO_IDE_HOOKS_DIR_PATH,
+			relativeFilePath: KIRO_IDE_HOOKS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({
+			version: "v1",
+			hooks: []
+		}, null, 2);
+		return new this({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const hooks = canonicalToKiroIdeHooks(rulesyncHooks.getJson(), this.getOverrideKey());
+		const fileContent = JSON.stringify({
+			version: "v1",
+			hooks
+		}, null, 2);
+		return new this({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	toRulesyncHooks() {
+		let parsed;
+		try {
+			parsed = KiroIdeHooksFileSchema.parse(JSON.parse(this.getFileContent()));
+		} catch (error) {
+			throw new Error(`Failed to parse Kiro IDE hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+		}
+		const hooks = kiroIdeHooksToCanonical(parsed.hooks ?? []);
+		const overrideKey = this.constructor.getOverrideKey();
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+			hooks,
+			overrideKey
+		}), null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: JSON.stringify({
+				version: "v1",
+				hooks: []
+			}, null, 2),
+			validate: false
+		});
+	}
+};
+//#endregion
+//#region src/features/hooks/kiro-cli-hooks.ts
+/**
+* Hooks generator for the **Kiro CLI**.
+*
+* Kiro CLI 3.0 reads the same standalone `.kiro/hooks/*.json` v1 format the
+* Kiro IDE reads, so this reuses {@link KiroIdeHooks} and only redirects the
+* tool-specific override key to `kiro-cli` (so `kiro-cli.hooks` overrides in
+* the rulesync hooks config are honored, rather than `kiro-ide.hooks`).
+*
+* The embedded `.kiro/agents/default.json` agent-hook format this target used
+* to emit is documented as not working in 3.0, so it is left to the deprecated
+* `kiro` alias ({@link import("./kiro-hooks.js").KiroHooks}).
+*
+* @see https://kiro.dev/docs/cli/v3/hooks-migration/
+* @see https://kiro.dev/docs/hooks/
+*/
+var KiroCliHooks = class extends KiroIdeHooks {
+	static getOverrideKey() {
+		return "kiro-cli";
+	}
+};
+//#endregion
 //#region src/features/hooks/kiro-hooks.ts
 /**
-* Convert canonical hooks config to Kiro CLI format.
+* Convert canonical hooks config to the legacy embedded Kiro agent-config
+* format.
 * Filters shared hooks to KIRO_HOOK_EVENTS, merges config.kiro?.hooks,
-* then maps event names and emits Kiro CLI hook arrays.
+* then maps event names and emits the agent config's hook arrays.
 */
-/** Build the Kiro CLI hook entries for a single canonical event's definitions. */
+/** Build the agent-config hook entries for a single canonical event's definitions. */
 function buildKiroEntriesForEvent(definitions) {
 	const entries = [];
 	for (const def of definitions) {
@@ -16758,7 +17671,8 @@ function buildKiroEntriesForEvent(definitions) {
 	}
 	return entries;
 }
-function canonicalToKiroHooks(config, overrideKey = "kiro") {
+function canonicalToKiroHooks(config) {
+	const overrideKey = "kiro";
 	const kiroSupported = new Set(KIRO_HOOK_EVENTS);
 	const sharedHooks = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (kiroSupported.has(event)) sharedHooks[event] = defs;
@@ -16776,8 +17690,8 @@ function canonicalToKiroHooks(config, overrideKey = "kiro") {
 	return kiro;
 }
 /**
-* Kiro CLI hook entry as stored in each event's array.
-* Uses `z.looseObject` so that unknown fields added by future Kiro CLI
+* Hook entry as stored in each event's array of the agent config.
+* Uses `z.looseObject` so that unknown fields added by future Kiro
 * versions are accepted and silently ignored during import.
 */
 const KiroHookEntrySchema = zod_mini.z.looseObject({
@@ -16793,7 +17707,7 @@ function importCacheTtl(entry) {
 	return { cacheTtl: entry.cache_ttl_seconds };
 }
 /**
-* Extract hooks from Kiro CLI agent config into canonical format.
+* Extract hooks from the Kiro agent config into canonical format.
 */
 function kiroHooksToCanonical(kiroHooks) {
 	if (kiroHooks === null || kiroHooks === void 0 || typeof kiroHooks !== "object") return {};
@@ -16821,6 +17735,17 @@ function kiroHooksToCanonical(kiroHooks) {
 	}
 	return canonical;
 }
+/**
+* Hooks generator for the deprecated `kiro` alias: the embedded hook block of
+* `.kiro/agents/default.json`.
+*
+* Kiro's hooks migration guide states this format "does not work in 3.0", so
+* the `kiro-cli` target writes the standalone `.kiro/hooks/*.json` v1 format
+* instead ({@link import("./kiro-cli-hooks.js").KiroCliHooks}). It is kept here
+* so an existing agent config still round-trips.
+*
+* @see https://kiro.dev/docs/cli/v3/hooks-migration/
+*/
 var KiroHooks = class KiroHooks extends ToolHooks {
 	constructor(params) {
 		super({
@@ -16828,14 +17753,6 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 			fileContent: params.fileContent ?? "{}"
 		});
 	}
-	/**
-	* The `HooksConfig` key whose `hooks` block provides tool-specific overrides
-	* for this target. The legacy `kiro` alias uses `kiro`; {@link import(
-	* "./kiro-cli-hooks.js").KiroCliHooks} overrides this to `kiro-cli`.
-	*/
-	static getOverrideKey() {
-		return "kiro";
-	}
 	isDeletable() {
 		return false;
 	}
@@ -16860,7 +17777,7 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 		const paths = KiroHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const kiroHooks = canonicalToKiroHooks(rulesyncHooks.getJson(), this.getOverrideKey());
+		const kiroHooks = canonicalToKiroHooks(rulesyncHooks.getJson());
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
@@ -16884,10 +17801,9 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 			throw new Error(`Failed to parse Kiro hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = kiroHooksToCanonical(agentConfig.hooks);
-		const overrideKey = this.constructor.getOverrideKey();
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey
+			overrideKey: "kiro"
 		}), null, 2) });
 	}
 	validate() {
@@ -16907,222 +17823,6 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/features/hooks/kiro-cli-hooks.ts
-/**
-* Hooks generator for the **Kiro CLI**.
-*
-* The Kiro CLI uses the same `.kiro/agents/default.json` agent-hook format as
-* the legacy `kiro` alias, so this reuses {@link KiroHooks} and only redirects
-* the tool-specific override key to `kiro-cli` (so `kiro-cli.hooks` overrides in
-* the rulesync hooks config are honored, rather than the legacy `kiro.hooks`).
-*
-* (The Kiro IDE uses the structured `.kiro/hooks/*.json` v1 format instead; see
-* {@link import("./kiro-ide-hooks.js").KiroIdeHooks}.)
-*/
-var KiroCliHooks = class extends KiroHooks {
-	static getOverrideKey() {
-		return "kiro-cli";
-	}
-};
-//#endregion
-//#region src/features/hooks/kiro-ide-hooks.ts
-/**
-* One hook entry inside the Kiro IDE v1 `hooks` array.
-*
-* `z.looseObject` keeps unknown fields added by future Kiro IDE versions, so
-* imports do not drop data they do not yet understand.
-* @see https://kiro.dev/docs/hooks/types/
-*/
-const KiroIdeHookActionSchema = zod_mini.z.union([zod_mini.z.looseObject({
-	type: zod_mini.z.literal("command"),
-	command: zod_mini.z.optional(safeString)
-}), zod_mini.z.looseObject({
-	type: zod_mini.z.literal("agent"),
-	prompt: zod_mini.z.optional(safeString)
-})]);
-const KiroIdeHookEntrySchema = zod_mini.z.looseObject({
-	name: zod_mini.z.optional(zod_mini.z.string()),
-	description: zod_mini.z.optional(zod_mini.z.string()),
-	trigger: zod_mini.z.optional(zod_mini.z.string()),
-	matcher: zod_mini.z.optional(zod_mini.z.string()),
-	action: zod_mini.z.optional(KiroIdeHookActionSchema),
-	timeout: zod_mini.z.optional(zod_mini.z.number()),
-	enabled: zod_mini.z.optional(zod_mini.z.boolean())
-});
-const KiroIdeHooksFileSchema = zod_mini.z.looseObject({
-	version: zod_mini.z.optional(zod_mini.z.string()),
-	hooks: zod_mini.z.optional(zod_mini.z.array(KiroIdeHookEntrySchema))
-});
-/**
-* Build the Kiro IDE hook entries for a single canonical event's definitions.
-*
-* `command`-type definitions become `{ type: "command", command }` actions and
-* `prompt`-type definitions become `{ type: "agent", prompt }` actions. Other
-* types are skipped (the {@link import("./hooks-processor.js").HooksProcessor}
-* already warns about unsupported types).
-*/
-function buildKiroIdeEntriesForEvent(trigger, definitions) {
-	const entries = [];
-	for (const def of definitions) {
-		const type = def.type ?? "command";
-		let action;
-		if (type === "command") {
-			if (def.command === void 0) continue;
-			action = {
-				type: "command",
-				command: def.command
-			};
-		} else if (type === "prompt") {
-			if (def.prompt === void 0) continue;
-			action = {
-				type: "agent",
-				prompt: def.prompt
-			};
-		} else continue;
-		entries.push({
-			name: def.name ?? trigger,
-			...def.description !== void 0 && def.description !== null && { description: def.description },
-			trigger,
-			...def.matcher !== void 0 && def.matcher !== null && def.matcher !== "" && { matcher: def.matcher },
-			action,
-			...def.timeout !== void 0 && def.timeout !== null && def.timeout >= 0 && { timeout: def.timeout },
-			enabled: def.enabled ?? true
-		});
-	}
-	return entries;
-}
-function canonicalToKiroIdeHooks(config) {
-	const kiroIdeSupported = new Set(KIRO_IDE_HOOK_EVENTS);
-	const sharedHooks = {};
-	for (const [event, defs] of Object.entries(config.hooks)) if (kiroIdeSupported.has(event)) sharedHooks[event] = defs;
-	const effectiveHooks = {
-		...sharedHooks,
-		...config["kiro-ide"]?.hooks
-	};
-	const entries = [];
-	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const trigger = CANONICAL_TO_KIRO_IDE_EVENT_NAMES[eventName] ?? eventName;
-		entries.push(...buildKiroIdeEntriesForEvent(trigger, definitions));
-	}
-	return entries;
-}
-function kiroIdeHooksToCanonical(entries) {
-	const canonical = {};
-	for (const entry of entries) {
-		if (entry.trigger === void 0 || entry.action === void 0) continue;
-		const eventName = KIRO_IDE_TO_CANONICAL_EVENT_NAMES[entry.trigger] ?? entry.trigger;
-		if (isPrototypePollutionKey(eventName)) continue;
-		const def = {};
-		if (entry.action.type === "command") {
-			if (!entry.action.command) continue;
-			def.type = "command";
-			def.command = entry.action.command;
-		} else {
-			if (!entry.action.prompt) continue;
-			def.type = "prompt";
-			def.prompt = entry.action.prompt;
-		}
-		if (entry.name !== void 0 && entry.name !== null) def.name = entry.name;
-		if (entry.description !== void 0 && entry.description !== null) def.description = entry.description;
-		if (entry.matcher !== void 0 && entry.matcher !== null && entry.matcher !== "") def.matcher = entry.matcher;
-		if (entry.timeout !== void 0 && entry.timeout !== null) def.timeout = entry.timeout;
-		if (entry.enabled === false) def.enabled = false;
-		(canonical[eventName] ??= []).push(def);
-	}
-	return canonical;
-}
-/**
-* Hooks generator for the **Kiro IDE** (`.kiro/hooks/*.json` v1).
-*
-* Kiro IDE 1.0 reads structured JSON hooks from `.kiro/hooks/` (workspace) and
-* `~/.kiro/hooks/` (user). A single file may declare multiple hooks in its
-* `hooks` array, so rulesync emits every generated hook into one
-* `rulesync.json` file per scope (`{ "version": "v1", "hooks": [ ... ] }`),
-* which keeps it within the single-file hooks architecture.
-*
-* This is distinct from the Kiro CLI ({@link import("./kiro-cli-hooks.js").
-* KiroCliHooks}), which uses the `.kiro/agents/default.json` agent-config shape.
-*
-* @see https://kiro.dev/docs/hooks/
-*/
-var KiroIdeHooks = class KiroIdeHooks extends ToolHooks {
-	constructor(params) {
-		super({
-			...params,
-			fileContent: params.fileContent ?? JSON.stringify({
-				version: "v1",
-				hooks: []
-			}, null, 2)
-		});
-	}
-	static getSettablePaths(_options = {}) {
-		return {
-			relativeDirPath: KIRO_IDE_HOOKS_DIR_PATH,
-			relativeFilePath: KIRO_IDE_HOOKS_FILE_NAME
-		};
-	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
-		const paths = KiroIdeHooks.getSettablePaths({ global });
-		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({
-			version: "v1",
-			hooks: []
-		}, null, 2);
-		return new KiroIdeHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
-		const paths = KiroIdeHooks.getSettablePaths({ global });
-		const hooks = canonicalToKiroIdeHooks(rulesyncHooks.getJson());
-		const fileContent = JSON.stringify({
-			version: "v1",
-			hooks
-		}, null, 2);
-		return new KiroIdeHooks({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: paths.relativeFilePath,
-			fileContent,
-			validate
-		});
-	}
-	toRulesyncHooks() {
-		let parsed;
-		try {
-			parsed = KiroIdeHooksFileSchema.parse(JSON.parse(this.getFileContent()));
-		} catch (error) {
-			throw new Error(`Failed to parse Kiro IDE hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
-		}
-		const hooks = kiroIdeHooksToCanonical(parsed.hooks ?? []);
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
-			hooks,
-			overrideKey: "kiro-ide"
-		}), null, 2) });
-	}
-	validate() {
-		return {
-			success: true,
-			error: null
-		};
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new KiroIdeHooks({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			fileContent: JSON.stringify({
-				version: "v1",
-				hooks: []
-			}, null, 2),
-			validate: false
-		});
-	}
-};
-//#endregion
 //#region src/features/hooks/opencode-hooks.ts
 var OpencodeHooks = class OpencodeHooks extends ToolHooks {
 	constructor(params) {
@@ -18186,6 +18886,17 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command"],
 		supportsMatcher: true
 	}],
+	["cline", {
+		class: ClineHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: false
+		},
+		supportedEvents: CLINE_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: false
+	}],
 	["goose", {
 		class: GooseHooks,
 		meta: {
@@ -18247,12 +18958,13 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		class: KiroCliHooks,
 		meta: {
 			supportsProject: true,
-			supportsGlobal: false,
+			supportsGlobal: true,
 			supportsImport: true
 		},
-		supportedEvents: KIRO_HOOK_EVENTS,
-		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportedEvents: KIRO_IDE_HOOK_EVENTS,
+		supportedHookTypes: ["command", "prompt"],
+		supportsMatcher: true,
+		passthroughOverrideEvents: true
 	}],
 	["kiro-ide", {
 		class: KiroIdeHooks,
@@ -18391,7 +19103,11 @@ var HooksProcessor = class extends FeatureProcessor {
 					relativeFilePath: paths.relativeFilePath,
 					global: this.global
 				});
-				const list = toolHooks.isDeletable?.() !== false ? [toolHooks] : [];
+				const auxiliaryFiles = await factory.class.getDeletableAuxiliaryFiles?.({
+					outputRoot: this.outputRoot,
+					global: this.global
+				}) ?? [];
+				const list = [...toolHooks.isDeletable?.() !== false ? [toolHooks] : [], ...auxiliaryFiles.filter((file) => file.isDeletable())];
 				this.logger.debug(`Successfully loaded ${list.length} ${this.toolTarget} hooks files for deletion`);
 				return list;
 			}
@@ -18456,7 +19172,7 @@ var HooksProcessor = class extends FeatureProcessor {
 			effectiveHooks
 		});
 		if (eventsWithUnsupportedMatcher.length > 0) this.logger.warn(`Skipped matcher hook(s) for ${this.toolTarget} (not supported): ${eventsWithUnsupportedMatcher.join(", ")}`);
-		const result = [await factory.class.fromRulesyncHooks({
+		const toolHooks = await factory.class.fromRulesyncHooks({
 			outputRoot: this.outputRoot,
 			rulesyncHooks,
 			validate: true,
@@ -18465,10 +19181,16 @@ var HooksProcessor = class extends FeatureProcessor {
 				logger: this.logger,
 				toolTarget: this.toolTarget
 			})
-		})];
+		});
+		const result = [toolHooks];
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
 			outputRoot: this.outputRoot,
-			global: this.global
+			global: this.global,
+			toolHooks,
+			logger: withToolTargetPrefix({
+				logger: this.logger,
+				toolTarget: this.toolTarget
+			})
 		});
 		if (auxiliaryFiles && auxiliaryFiles.length > 0) result.push(...auxiliaryFiles);
 		return result;
@@ -18946,29 +19668,43 @@ var CursorIgnore = class CursorIgnore extends ToolIgnore {
 * `.codeiumignore` filename is read as a fallback so existing projects still
 * round-trip.
 *
+* In global mode the enterprise-wide `~/.codeium/.codeiumignore` is written
+* instead; see `DEVIN_GLOBAL_IGNORE_DIR_PATH` for why that path keeps the
+* legacy brand spelling and sits outside `~/.config/devin`.
+*
 * @see https://docs.devin.ai/desktop/changelog — v3.1.7 added `.devinignore`
 *   alongside `.windsurfignore` and `.codeiumignore`.
 */
 var DevinIgnore = class DevinIgnore extends ToolIgnore {
-	static getSettablePaths() {
+	static getSettablePaths({ global = false } = {}) {
 		return {
-			relativeDirPath: ".",
-			relativeFilePath: DEVIN_IGNORE_FILE_NAME
+			relativeDirPath: global ? DEVIN_GLOBAL_IGNORE_DIR_PATH : ".",
+			relativeFilePath: global ? DEVIN_GLOBAL_IGNORE_FILE_NAME : DEVIN_IGNORE_FILE_NAME
 		};
 	}
 	toRulesyncIgnore() {
 		return this.toRulesyncIgnoreDefault();
 	}
-	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore }) {
+	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+		const paths = this.getSettablePaths({ global });
 		return new DevinIgnore({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
-			relativeFilePath: this.getSettablePaths().relativeFilePath,
-			fileContent: rulesyncIgnore.getFileContent()
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: rulesyncIgnore.getFileContent(),
+			global
 		});
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
-		const { relativeDirPath, relativeFilePath } = this.getSettablePaths();
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const { relativeDirPath, relativeFilePath } = this.getSettablePaths({ global });
+		if (global) return new DevinIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: await readFileContent((0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath)),
+			validate,
+			global
+		});
 		const primaryPath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
 		const legacyPath = (0, node_path.join)(outputRoot, relativeDirPath, DEVIN_LEGACY_IGNORE_FILE_NAME);
 		const resolvedFilePath = !await fileExists(primaryPath) && await fileExists(legacyPath) ? DEVIN_LEGACY_IGNORE_FILE_NAME : relativeFilePath;
@@ -18978,16 +19714,18 @@ var DevinIgnore = class DevinIgnore extends ToolIgnore {
 			relativeDirPath,
 			relativeFilePath: resolvedFilePath,
 			fileContent,
-			validate
+			validate,
+			global
 		});
 	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		return new DevinIgnore({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
-			validate: false
+			validate: false,
+			global
 		});
 	}
 };
@@ -19861,6 +20599,7 @@ const toolIgnoreFactories = /* @__PURE__ */ new Map([
 ]);
 const ignoreProcessorToolTargets = [...toolIgnoreFactories.keys()];
 const ignoreProcessorGlobalToolTargets = [
+	"devin",
 	"kiro",
 	"kiro-cli",
 	"kiro-ide",
@@ -20788,6 +21527,65 @@ const RULESYNC_TO_CODEX_SCALAR_FIELD_MAP = { experimentalEnvironment: "experimen
 const CODEX_TO_RULESYNC_SCALAR_FIELD_MAP = Object.fromEntries(Object.entries(RULESYNC_TO_CODEX_SCALAR_FIELD_MAP).map(([canonical, codex]) => [codex, canonical]));
 const MAX_REMOVE_EMPTY_ENTRIES_DEPTH$1 = 32;
 /**
+* Canonical per-server keys Codex has no counterpart for.
+*
+* Codex's deserializer (`RawMcpServerConfig`) does not reject unknown keys, so
+* these are inert rather than fatal — but they are rulesync's own spellings and
+* only add noise to a hand-edited `config.toml`. `type`/`transport` are safe to
+* drop because Codex infers the transport from `command` versus `url`.
+* `tools` is handled separately: it is fatal rather than inert.
+* @see https://github.com/openai/codex/blob/rust-v0.146.1/codex-rs/config/src/mcp_types.rs
+*/
+const CODEX_UNSUPPORTED_CANONICAL_KEYS = /* @__PURE__ */ new Set([
+	"type",
+	"transport",
+	"alwaysAllow",
+	"trust",
+	"kiroAutoApprove",
+	"kiroAutoBlock"
+]);
+/**
+* Canonical millisecond timeouts and the Codex fields they translate to.
+* Codex takes both as seconds (`f64`), so the value is divided by 1000 and a
+* fractional result is emitted as-is.
+* - `timeout` → `tool_timeout_sec`: default timeout for tool calls on the server.
+* - `networkTimeout` → `startup_timeout_sec`: initialize + list-tools timeout.
+*/
+const RULESYNC_TO_CODEX_TIMEOUT_FIELD_MAP = {
+	timeout: "tool_timeout_sec",
+	networkTimeout: "startup_timeout_sec"
+};
+const CODEX_TO_RULESYNC_TIMEOUT_FIELD_MAP = Object.fromEntries(Object.entries(RULESYNC_TO_CODEX_TIMEOUT_FIELD_MAP).map(([canonical, codex]) => [codex, canonical]));
+const MILLISECONDS_PER_SECOND = 1e3;
+/**
+* Whether a value is usable as a timeout. Codex builds a `Duration` out of both
+* timeout fields, and `Duration::try_from_secs_f64` errors on a negative value —
+* which fails the whole `config.toml`, not just the one server — so a negative
+* timeout is rejected here rather than written.
+*/
+function isTimeoutValue(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+/**
+* Whether a value is usable as the canonical `headers` map, whose schema is
+* `record(string, string)`. Checked in both directions so a hand-written
+* `http_headers` can never be imported into a `.rulesync/mcp.jsonc` that the
+* next generate would refuse to parse.
+*/
+function isHeadersRecord(value) {
+	return isPlainObject$1(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+/**
+* Whether a server config describes a Codex stdio server. Codex branches on
+* `command` first; a config carrying both `command` and `url` is classified as
+* stdio here, which matches upstream in the sense that it never reaches the
+* remote arm — upstream rejects that combination outright ("url is not
+* supported for stdio").
+*/
+function isCodexStdioServer(config) {
+	return config["command"] !== void 0;
+}
+/**
 * `env_vars` entries are either a bare variable name or `{ name, source }`,
 * where `source = "remote"` reads the variable from the remote executor
 * environment. The other renamed keys (`enabled_tools`, `disabled_tools`) stay
@@ -20845,6 +21643,75 @@ function normalizeCodexMcpServerName(name) {
 		usedFallback: true
 	};
 }
+/**
+* Translate the Codex-native per-server keys that carry a canonical
+* counterpart under a different name or unit. Returns `undefined` for a key
+* this translation does not own, leaving it to the caller's other branches.
+*/
+function translateCodexOnlyKey({ key, value, config, serverName }) {
+	if (key === "tools") return {};
+	if (key === "http_headers") {
+		if ("headers" in config) return {};
+		if (isHeadersRecord(value)) return { entry: ["headers", omitPrototypePollutionKeys(value)] };
+		warnWithFallback(void 0, `Ignored malformed value for ${key} in MCP server ${serverName}: expected a table of string values`);
+		return {};
+	}
+	const mappedKey = CODEX_TO_RULESYNC_TIMEOUT_FIELD_MAP[key];
+	if (mappedKey) {
+		if (isTimeoutValue(value)) return { entry: [mappedKey, value * MILLISECONDS_PER_SECOND] };
+		warnWithFallback(void 0, `Ignored malformed value for ${key} in MCP server ${serverName}: expected a non-negative number of seconds`);
+		return {};
+	}
+	if (key === "startup_timeout_ms") {
+		if ("startup_timeout_sec" in config) return {};
+		if (isTimeoutValue(value)) return { entry: ["networkTimeout", value] };
+		warnWithFallback(void 0, `Ignored malformed value for ${key} in MCP server ${serverName}: expected a non-negative number of milliseconds`);
+		return {};
+	}
+}
+/**
+* Translate the canonical per-server keys that Codex spells differently, reads
+* in another unit, or cannot accept at all. Returns `undefined` for a key this
+* translation does not own.
+*/
+function translateCanonicalKeyToCodex({ key, value, isStdio, serverName }) {
+	if (key === "tools") {
+		warnWithFallback(void 0, `[CodexCliMcp] Dropping 'tools' from MCP server "${serverName}": Codex reads it as a per-tool approval table, not a tool allowlist. Use 'enabledTools' / 'disabledTools' instead.`);
+		return {};
+	}
+	if (CODEX_UNSUPPORTED_CANONICAL_KEYS.has(key)) return {};
+	if (key === "headers") {
+		if (!isHeadersRecord(value)) {
+			warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key 'headers': expected a table of string values, got ${typeof value}`);
+			return {};
+		}
+		if (isStdio) {
+			warnWithFallback(void 0, `[CodexCliMcp] Dropping 'headers' from stdio MCP server "${serverName}": Codex accepts HTTP headers only on url-based servers.`);
+			return {};
+		}
+		return { entry: ["http_headers", omitPrototypePollutionKeys(value)] };
+	}
+	const mappedKey = RULESYNC_TO_CODEX_TIMEOUT_FIELD_MAP[key];
+	if (mappedKey) {
+		if (isTimeoutValue(value)) return { entry: [mappedKey, value / MILLISECONDS_PER_SECOND] };
+		warnWithFallback(void 0, `[CodexCliMcp] Skipping invalid value type for mapped key '${key}': expected a non-negative number of milliseconds, got ${typeof value}`);
+		return {};
+	}
+}
+/**
+* Codex states no transport of its own — it infers one from `command` versus
+* `url`, which is why generate drops the canonical `type`. Restate it for a url
+* server on the way back, so a config imported from Codex reaches the adapters
+* that branch on `type` as a remote server rather than one with no transport at
+* all. `streamable_http` is Codex's only remote transport, and canonical spells
+* that `http`.
+*/
+function restateCanonicalTransport(converted) {
+	if (converted["type"] !== void 0) return;
+	if (isCodexStdioServer(converted)) return;
+	if (typeof converted["url"] !== "string") return;
+	converted["type"] = "http";
+}
 function convertFromCodexFormat(codexMcp) {
 	const result = {};
 	for (const [name, config] of Object.entries(codexMcp)) {
@@ -20852,7 +21719,15 @@ function convertFromCodexFormat(codexMcp) {
 		const converted = {};
 		for (const [key, value] of Object.entries(config)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			if (key === "enabled") {
+			const codexOnly = translateCodexOnlyKey({
+				key,
+				value,
+				config,
+				serverName: name
+			});
+			if (codexOnly) {
+				if (codexOnly.entry) converted[codexOnly.entry[0]] = codexOnly.entry[1];
+			} else if (key === "enabled") {
 				if (value === false) converted["disabled"] = true;
 			} else if (key === "oauth" && isRecord$1(value)) converted[key] = mapOauthFromCodex(value);
 			else if (Object.hasOwn(CODEX_TO_RULESYNC_FIELD_MAP, key)) {
@@ -20865,6 +21740,7 @@ function convertFromCodexFormat(codexMcp) {
 				else warnWithFallback(void 0, `Ignored malformed value for ${key} in MCP server ${name}: expected a string`);
 			} else converted[key] = value;
 		}
+		restateCanonicalTransport(converted);
 		result[name] = converted;
 	}
 	return result;
@@ -20877,9 +21753,18 @@ function convertToCodexFormat(mcpServers) {
 		const { codexName, usedFallback } = normalizeCodexMcpServerName(name);
 		if (usedFallback) warnWithFallback(void 0, `MCP server "${name}" cannot be represented as a Codex MCP server name (ASCII [a-zA-Z0-9_-] only), so the stable fallback name "${codexName}" was used. Rename the server in .rulesync/mcp.jsonc to choose a readable Codex name.`);
 		const converted = {};
+		const isStdio = isCodexStdioServer(config);
 		for (const [key, value] of Object.entries(config)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			if (key === "disabled") {
+			const translated = translateCanonicalKeyToCodex({
+				key,
+				value,
+				isStdio,
+				serverName: name
+			});
+			if (translated) {
+				if (translated.entry) converted[translated.entry[0]] = translated.entry[1];
+			} else if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
 			} else if (key === "oauth" && isRecord$1(value)) converted[key] = mapOauthToCodex(value);
 			else if (Object.hasOwn(RULESYNC_TO_CODEX_FIELD_MAP, key)) {
@@ -22322,7 +23207,8 @@ function resolveHermesTimeout(config) {
 * Copies the advanced Hermes-recognized per-server fields that have no canonical
 * alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
 * path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
-* `connect_timeout` (seconds), and `supports_parallel_tool_calls` — verbatim
+* `connect_timeout` (seconds), `supports_parallel_tool_calls`,
+* `keepalive_interval`, and `elicitation` — verbatim
 * from `source` to `target`. Field names are identical on both sides (the
 * canonical `McpServerSchema` is a `looseObject`), so this serves export and
 * import alike. See the Hermes mcp-config-reference.
@@ -22383,6 +23269,14 @@ function copyHermesAdvancedFields(source, target) {
 		target.sampling = omitPrototypePollutionKeys(structuredClone(source.sampling));
 		copied = true;
 	}
+	if (typeof source.keepalive_interval === "number") {
+		target.keepalive_interval = source.keepalive_interval;
+		copied = true;
+	}
+	if (isPlainObject$1(source.elicitation)) {
+		target.elicitation = omitPrototypePollutionKeys(structuredClone(source.elicitation));
+		copied = true;
+	}
 	return copied;
 }
 /**
@@ -22426,8 +23320,10 @@ function applyHermesToolsBlock(hermesTools, server) {
 * `url`/`headers`, and per-server tool scoping lives under a `tools: { include,
 * exclude }` block (from the canonical `enabledTools`/`disabledTools`). Only
 * fields Hermes understands are emitted, so the shared `config.yaml` is not
-* polluted with canonical-only aliases (`type`, `transport`, `httpUrl`,
-* `networkTimeout`, ...).
+* polluted with canonical-only aliases (`type`, `httpUrl`, `networkTimeout`,
+* ...) — with one exception since v0.20.0: a canonical `sse` server is written
+* as Hermes's own `transport: sse`, without which Hermes would connect to it
+* over Streamable HTTP.
 */
 function convertServerToHermes(config) {
 	const out = {};
@@ -22447,6 +23343,7 @@ function convertServerToHermes(config) {
 	} else if (url !== void 0) {
 		out.url = url;
 		if (isPlainObject$1(config.headers)) out.headers = omitPrototypePollutionKeys(config.headers);
+		if (config.type === "sse" || config.transport === "sse") out.transport = "sse";
 	}
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
@@ -22494,6 +23391,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 		if (typeof config.url === "string") server.url = config.url;
 		if (isPlainObject$1(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
+		if (typeof config.url === "string" && config.transport === "sse") server.type = "sse";
 		if (config.enabled === false) server.disabled = true;
 		if (typeof config.timeout === "number") server.networkTimeout = config.timeout;
 		if (isRecord$1(config.tools)) applyHermesToolsBlock(config.tools, server);
@@ -24066,6 +24964,7 @@ const REASONIX_PLUGIN_FIELDS = [
 	"env",
 	"url",
 	"headers",
+	"startup_timeout_seconds",
 	"call_timeout_seconds",
 	"tool_timeout_seconds"
 ];
@@ -24742,20 +25641,6 @@ function deriveTransportAllowlist(servers) {
 	return allowlist;
 }
 //#endregion
-//#region src/features/shared/vibe-config-scope.ts
-/**
-* Vibe selects exactly **one** persistence TOML and does not merge scopes: the
-* trusted project `.vibe/config.toml` when one is discovered, otherwise
-* `~/.vibe/config.toml` (single code path since v2.22.0's ConfigOrchestrator
-* migration). A `--global` run that writes the home file is therefore inert in
-* any project that has its own config — worth a heads-up, since the other Vibe
-* surfaces (rules, hooks, agents, skills) genuinely combine scopes.
-*/
-async function warnIfGlobalVibeConfigIsShadowed(logger) {
-	if (!await fileExists((0, node_path.join)(process.cwd(), ".vibe", "config.toml"))) return;
-	logger?.warn("Vibe reads exactly one config.toml (project .vibe/config.toml when present, otherwise ~/.vibe/config.toml — a fallback, not a merge). This project has .vibe/config.toml, so the global file written by --global is ignored here.");
-}
-//#endregion
 //#region src/features/mcp/vibe-mcp.ts
 const VIBE_MCP_SERVER_FIELDS = [
 	"transport",
@@ -24824,9 +25709,8 @@ var VibeMcp = class VibeMcp extends ToolMcp {
 			global
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, logger, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		if (global) await warnIfGlobalVibeConfigIsShadowed(logger);
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const existingServers = normalizeMcpServersArray(parseSharedConfig({
@@ -28481,6 +29365,81 @@ function asCursorPermissionEntryArray(value, logger, fieldLabel) {
 	else logger?.warn(`Cursor CLI permissions${fieldLabel ? `.${fieldLabel}` : ""} contains a non-string entry; dropping ${JSON.stringify(item)}.`);
 	return result;
 }
+/**
+* Assemble the Cursor CLI config to write.
+*
+* Cursor scopes the file asymmetrically: "Only permissions can be configured at
+* the project level. All other CLI settings must be set globally." So
+* `version`, `editor.vimMode`, `approvalMode` and `sandbox` belong to
+* `~/.cursor/cli-config.json` alone — writing them into `.cursor/cli.json`
+* produces keys Cursor ignores, which silently strands an authored
+* `cursor.approvalMode`.
+*
+* @see https://cursor.com/docs/cli/reference/configuration
+*/
+function mergeCursorCliConfig({ settings, mergedPermissions, cursorOverride, global, filePath, logger }) {
+	if (!global) {
+		warnAboutGlobalOnlyOverrideKeys({
+			cursorOverride,
+			filePath,
+			logger
+		});
+		return {
+			...settings,
+			permissions: mergedPermissions
+		};
+	}
+	const existingEditor = asExistingEditor({
+		settings,
+		filePath,
+		logger
+	});
+	return {
+		...settings,
+		...cursorOverride,
+		version: settings.version ?? 1,
+		editor: {
+			...existingEditor,
+			vimMode: existingEditor.vimMode ?? false
+		},
+		permissions: mergedPermissions
+	};
+}
+/**
+* The existing `editor` object to merge rulesync's managed `vimMode` into.
+* Only called in global scope: a project config's `editor` is passed through
+* untouched, so narrowing it there would warn about a value nothing ignores.
+*/
+function asExistingEditor({ settings, filePath, logger }) {
+	const raw = settings.editor;
+	if (raw === void 0) return {};
+	if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) return raw;
+	logger?.warn(`Cursor CLI config at ${filePath} has a non-object \`editor\` field; ignoring existing editor settings.`);
+	return {};
+}
+/**
+* Override keys that never reach the file from the override in any scope,
+* because rulesync re-applies its own managed value over them. Naming them in
+* the project-scope warning would wrongly promise that `--global` makes them
+* take effect.
+*/
+const CURSOR_OVERRIDE_KEYS_ALWAYS_CLOBBERED = /* @__PURE__ */ new Set([
+	"version",
+	"editor",
+	"permissions"
+]);
+/**
+* Name the override keys that would have been written in global scope but are
+* dropped here, so the user learns the setting did not take effect and how to
+* make it.
+*/
+function warnAboutGlobalOnlyOverrideKeys({ cursorOverride, filePath, logger }) {
+	const strandedKeys = Object.keys(cursorOverride).filter((key) => !CURSOR_OVERRIDE_KEYS_ALWAYS_CLOBBERED.has(key)).toSorted();
+	if (strandedKeys.length === 0) return;
+	const names = strandedKeys.map((key) => `\`${key}\``).join(", ");
+	const [wasWere, itThem] = strandedKeys.length === 1 ? ["was", "it"] : ["were", "them"];
+	logger?.warn(`Cursor applies only \`permissions\` from a project config, so ${names} from the \`cursor\` override ${wasWere} not written to ${filePath}. Generate with --global to set ${itThem} in ~/.cursor/cli-config.json.`);
+}
 var CursorPermissions = class CursorPermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -28521,14 +29480,6 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		const config = rulesyncPermissions.getJson();
 		const { allow, deny } = convertRulesyncToCursorPermissions(config, logger);
 		const managedTypes = new Set(Object.keys(config.permission).map((category) => toCursorType(category)));
-		const existingEditorRaw = settings.editor;
-		let existingEditor;
-		if (existingEditorRaw === void 0) existingEditor = {};
-		else if (existingEditorRaw !== null && typeof existingEditorRaw === "object" && !Array.isArray(existingEditorRaw)) existingEditor = existingEditorRaw;
-		else {
-			logger?.warn(`Cursor CLI config at ${filePath} has a non-object \`editor\` field; ignoring existing editor settings.`);
-			existingEditor = {};
-		}
 		const existingPermissionsRaw = settings.permissions;
 		let existingPermissions;
 		if (existingPermissionsRaw === void 0) existingPermissions = {};
@@ -28545,17 +29496,14 @@ var CursorPermissions = class CursorPermissions extends ToolPermissions {
 		mergedPermissions.allow = mergedAllow;
 		if (mergedDeny.length > 0) mergedPermissions.deny = mergedDeny;
 		else delete mergedPermissions.deny;
-		const cursorOverride = config.cursor;
-		const merged = {
-			...settings,
-			...cursorOverride,
-			version: settings.version ?? 1,
-			editor: {
-				...existingEditor,
-				vimMode: existingEditor.vimMode ?? false
-			},
-			permissions: mergedPermissions
-		};
+		const merged = mergeCursorCliConfig({
+			settings,
+			mergedPermissions,
+			cursorOverride: config.cursor ?? {},
+			global,
+			filePath,
+			logger
+		});
 		const fileContent = JSON.stringify(merged, null, 2);
 		return new CursorPermissions({
 			outputRoot,
@@ -29269,14 +30217,16 @@ const CATEGORY_TO_GROK_TOOL = {
 	edit: "Edit",
 	write: "Edit",
 	grep: "Grep",
-	webfetch: "WebFetch"
+	webfetch: "WebFetch",
+	websearch: "WebSearch"
 };
 const GROK_TOOL_TO_CATEGORY = {
 	Bash: "bash",
 	Read: "read",
 	Edit: "edit",
 	Grep: "grep",
-	WebFetch: "webfetch"
+	WebFetch: "webfetch",
+	WebSearch: "websearch"
 };
 const GROK_MCP_TOOL = "MCPTool";
 /**
@@ -29335,18 +30285,18 @@ function parseGrokEntry(entry) {
 *
 * Grok Build CLI ships a Claude-style rule system under `[permission]` in
 * `~/.grok/config.toml`: `allow` / `deny` / `ask` arrays of entries such as
-* `Bash(git *)`, `Read(src/**)`, `Edit`, `Grep`, `MCPTool(server__tool)`, and
-* `WebFetch`, evaluated with precedence `deny > ask > allow`
+* `Bash(git *)`, `Read(src/**)`, `Edit`, `Grep`, `MCPTool(server__tool)`,
+* `WebFetch`, and `WebSearch`, evaluated with precedence `deny > ask > allow`
 * (https://docs.x.ai/build/settings/reference). rulesync's canonical
 * per-category, per-pattern model maps almost 1:1:
 *   - Generate: each `permission.<category>.<pattern> = allow|ask|deny` becomes
 *     the matching Grok entry and is bucketed into the `[permission]` array for
-*     that action. `bash|read|edit|grep|webfetch` map to their Grok tool;
-*     `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*` maps to
-*     `MCPTool(...)` (a scoped MCP category folds its address into the
+*     that action. `bash|read|edit|grep|webfetch|websearch` map to their Grok
+*     tool; `write` collapses onto `Edit` (Grok has no `Write` tool); `mcp__*`
+*     maps to `MCPTool(...)` (a scoped MCP category folds its address into the
 *     parentheses, so a non-`*` argument pattern on it is not represented).
-*     Categories with no Grok tool (`websearch`, `glob`, `notebookedit`,
-*     `agent`) are skipped (with a warning when they carry a `deny` rule, to
+*     Categories with no Grok tool (`glob`, `notebookedit`, `agent`) are
+*     skipped (with a warning when they carry a `deny` rule, to
 *     surface the gap). When two canonical rules collapse onto the same Grok
 *     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
 *     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
@@ -29373,8 +30323,8 @@ function parseGrokEntry(entry) {
 * tools it models and (in global scope) the `[ui] permission_mode` value, while
 * every other key
 * (e.g. `[mcp_servers]`, `[permission] rules`, `[sandbox]`) and any user-authored
-* entries for tools rulesync cannot model (e.g. `WebSearch`) are preserved. The
-* file is never deleted.
+* entries for tool prefixes rulesync cannot model (e.g. `any`) are preserved.
+* The file is never deleted.
 */
 var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 	constructor(params) {
@@ -29481,7 +30431,7 @@ const ACTION_RANK = {
 };
 /**
 * Collect user-authored entries from an existing `[permission]` array whose
-* tool prefix rulesync cannot model (e.g. `WebSearch`, `any`). Such entries are
+* tool prefix rulesync cannot model (e.g. `any`). Such entries are
 * preserved verbatim so replacing the arrays does not silently drop them
 * (mirrors the Cursor adapter's preservation of unmanaged types).
 */
@@ -31217,7 +32167,12 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"disabled",
 	"visible"
 ];
-const QWEN_OVERRIDE_SECURITY_KEYS = ["folderTrust"];
+const QWEN_OVERRIDE_SECURITY_KEYS = [
+	"folderTrust",
+	"allowedHttpHookUrls",
+	"allowPrivateNetworkHooks"
+];
+const QWEN_GLOBAL_ONLY_SECURITY_KEYS = ["allowPrivateNetworkHooks"];
 const QWEN_OVERRIDE_PERMISSIONS_KEYS = ["autoMode"];
 function asPlainRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -31229,6 +32184,21 @@ function pickQwenOverrideKeys(group, keys) {
 	for (const key of keys) if (source[key] !== void 0) picked[key] = source[key];
 	return picked;
 }
+/**
+* Drop the global-only `security` keys from the override when generating project
+* settings, warning once per dropped key. Only the override copy is filtered, so
+* a value the user already wrote into the project file stays untouched.
+*/
+function scopeOverrideSecurity(overrideSecurity, { global, relativeFilePath, logger }) {
+	const scoped = { ...asPlainRecord(overrideSecurity) };
+	if (global) return scoped;
+	for (const key of QWEN_GLOBAL_ONLY_SECURITY_KEYS) {
+		if (scoped[key] === void 0) continue;
+		delete scoped[key];
+		logger?.warn(`Qwen permissions: 'security.${key}' is only honored in user/system settings, so it is skipped for the project-scoped ${relativeFilePath}. Author it in the global scope instead.`);
+	}
+	return scoped;
+}
 var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 	constructor(params) {
 		super({
@@ -31297,10 +32267,18 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 			...asPlainRecord(settings.tools),
 			...asPlainRecord(override.tools)
 		};
-		if (override?.security !== void 0) patch.security = {
-			...asPlainRecord(settings.security),
-			...asPlainRecord(override.security)
-		};
+		if (override?.security !== void 0) {
+			const scopedSecurity = scopeOverrideSecurity(override.security, {
+				global,
+				relativeFilePath: paths.relativeFilePath,
+				logger
+			});
+			const mergedSecurity = {
+				...asPlainRecord(settings.security),
+				...scopedSecurity
+			};
+			if (Object.keys(mergedSecurity).length > 0) patch.security = mergedSecurity;
+		}
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "permissions",
@@ -31334,6 +32312,10 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		});
 		const overrideTools = pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS);
 		const overrideSecurity = pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS);
+		for (const key of QWEN_GLOBAL_ONLY_SECURITY_KEYS) {
+			if (overrideSecurity[key] === void 0) continue;
+			moduleLogger.warn(`Qwen permissions: imported 'security.${key}'. Qwen Code ignores it in workspace settings but enforces it in user/system settings, so review it before generating with the global scope.`);
+		}
 		const overridePermissions = pickQwenOverrideKeys(settings.permissions, QWEN_OVERRIDE_PERMISSIONS_KEYS);
 		const qwencodeOverride = {};
 		if (Object.keys(overrideTools).length > 0) qwencodeOverride.tools = overrideTools;
@@ -32509,7 +33491,6 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		if (global) await warnIfGlobalVibeConfigIsShadowed(logger);
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
 		const config = parseVibeConfig(existingContent);
@@ -32791,7 +33772,9 @@ function warpSettingsDir() {
 * `[agents.execution_profiles.<id>]` collection:
 * - `command_allowlist` — commands that auto-execute.
 * - `command_denylist` — commands that always require permission (the denylist
-*   wins over the allowlist).
+*   wins over the allowlist). Writing it at all replaces Warp's built-in
+*   default denylist, so rulesync warns whenever it emits a non-empty one.
+*   https://docs.warp.dev/cli/permissions-and-profiles/
 *
 * The legacy `[agents.profiles]` keys
 * (`agent_mode_command_execution_allowlist` / `denylist`) are consumed only
@@ -32889,6 +33872,7 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		if (mergedDeny.length > 0) profiles[DENYLIST_KEY] = mergedDeny;
 		else delete profiles[DENYLIST_KEY];
 		agents.profiles = profiles;
+		if (mergedDeny.length > 0 && logger) logger.warn(`Warp's command_denylist replaces its built-in default denylist, which covers rm, curl, wget, eval, ssh, shells, and other risky command patterns. The ${mergedDeny.length} deny rule(s) from .rulesync/permissions.jsonc are now the whole denylist — add equivalents for the built-in patterns you want to keep.`);
 		mergeIntoDefaultExecutionProfile({
 			agents,
 			mergedAllow,
@@ -34820,7 +35804,10 @@ const ClaudecodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	shell: zod_mini.z.optional(zod_mini.z.string()),
 	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
 	"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
-	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	license: zod_mini.z.optional(zod_mini.z.string()),
+	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 });
 /**
 * Builds the Claude Code SKILL.md frontmatter from a rulesync skill, carrying
@@ -34847,7 +35834,10 @@ function buildClaudecodeSkillFrontmatter({ rulesyncFrontmatter, resolvedDisableM
 		hooks: section.hooks,
 		"disable-model-invocation": resolvedDisableModelInvocation,
 		"user-invocable": resolvedUserInvocable,
-		paths: section.paths
+		paths: section.paths,
+		license: section.license,
+		compatibility: section.compatibility,
+		metadata: section.metadata
 	};
 	const frontmatter = {
 		name: rulesyncFrontmatter.name,
@@ -34858,6 +35848,115 @@ function buildClaudecodeSkillFrontmatter({ rulesyncFrontmatter, resolvedDisableM
 	return frontmatter;
 }
 /**
+* Builds the `claudecode:` section of a rulesync skill from a Claude Code
+* SKILL.md frontmatter — the inverse of `buildClaudecodeSkillFrontmatter`, and
+* extracted for the same reason: to keep `toRulesyncSkill` under the
+* cyclomatic-complexity cap as fields are added. The truthy/defined split
+* mirrors that function exactly so the conversion stays symmetric.
+*/
+function buildClaudecodeSkillSection({ frontmatter, resolvedPaths, scheduledTask }) {
+	const fields = [
+		[
+			"when_to_use",
+			frontmatter.when_to_use,
+			"truthy"
+		],
+		[
+			"allowed-tools",
+			frontmatter["allowed-tools"],
+			"truthy"
+		],
+		[
+			"disallowed-tools",
+			frontmatter["disallowed-tools"],
+			"truthy"
+		],
+		[
+			"model",
+			frontmatter.model,
+			"truthy"
+		],
+		[
+			"effort",
+			frontmatter.effort,
+			"truthy"
+		],
+		[
+			"argument-hint",
+			frontmatter["argument-hint"],
+			"truthy"
+		],
+		[
+			"arguments",
+			frontmatter.arguments,
+			"defined"
+		],
+		[
+			"context",
+			frontmatter.context,
+			"truthy"
+		],
+		[
+			"agent",
+			frontmatter.agent,
+			"truthy"
+		],
+		[
+			"background",
+			frontmatter.background,
+			"defined"
+		],
+		[
+			"hooks",
+			frontmatter.hooks,
+			"defined"
+		],
+		[
+			"shell",
+			frontmatter.shell,
+			"truthy"
+		],
+		[
+			"disable-model-invocation",
+			frontmatter["disable-model-invocation"],
+			"defined"
+		],
+		[
+			"user-invocable",
+			frontmatter["user-invocable"],
+			"defined"
+		],
+		[
+			"scheduled-task",
+			scheduledTask || void 0,
+			"defined"
+		],
+		[
+			"paths",
+			resolvedPaths,
+			"defined"
+		],
+		[
+			"license",
+			frontmatter.license,
+			"defined"
+		],
+		[
+			"compatibility",
+			frontmatter.compatibility,
+			"defined"
+		],
+		[
+			"metadata",
+			frontmatter.metadata,
+			"defined"
+		]
+	];
+	const section = {};
+	for (const [key, value, presence] of fields) if (presence === "truthy" ? Boolean(value) : value !== void 0) section[key] = value;
+	return section;
+}
+/**
 * Escapes the glob metacharacters in a directory path so it matches literally.
 * A real directory name may contain them — `app/[slug]` in a Next.js tree is
 * the common case, and unescaped `[slug]` reads as a bracket expression that
@@ -34978,25 +36077,11 @@ var ClaudecodeSkill = class extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
-		const resolvedPaths = frontmatter.paths !== void 0 ? frontmatter.paths : deriveNestedSkillPaths(this.relativeDirPath);
-		const claudecodeSection = {
-			...frontmatter.when_to_use && { when_to_use: frontmatter.when_to_use },
-			...frontmatter["allowed-tools"] && { "allowed-tools": frontmatter["allowed-tools"] },
-			...frontmatter["disallowed-tools"] && { "disallowed-tools": frontmatter["disallowed-tools"] },
-			...frontmatter.model && { model: frontmatter.model },
-			...frontmatter.effort && { effort: frontmatter.effort },
-			...frontmatter["argument-hint"] && { "argument-hint": frontmatter["argument-hint"] },
-			...frontmatter.arguments !== void 0 && { arguments: frontmatter.arguments },
-			...frontmatter.context && { context: frontmatter.context },
-			...frontmatter.agent && { agent: frontmatter.agent },
-			...frontmatter.background !== void 0 && { background: frontmatter.background },
-			...frontmatter.hooks !== void 0 && { hooks: frontmatter.hooks },
-			...frontmatter.shell && { shell: frontmatter.shell },
-			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] },
-			...frontmatter["user-invocable"] !== void 0 && { "user-invocable": frontmatter["user-invocable"] },
-			...this.relativeDirPath === CLAUDECODE_SCHEDULED_TASKS_DIR_PATH && { "scheduled-task": true },
-			...resolvedPaths !== void 0 && { paths: resolvedPaths }
-		};
+		const claudecodeSection = buildClaudecodeSkillSection({
+			frontmatter,
+			resolvedPaths: frontmatter.paths !== void 0 ? frontmatter.paths : deriveNestedSkillPaths(this.relativeDirPath),
+			scheduledTask: this.relativeDirPath === CLAUDECODE_SCHEDULED_TASKS_DIR_PATH
+		});
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
 			description: frontmatter.description,
@@ -47857,19 +48942,21 @@ var OpenCodeRule = class OpenCodeRule extends ToolRule {
 */
 var PiRule = class PiRule extends ToolRule {
 	appendSystemPrompt;
-	constructor({ fileContent, root, appendSystemPrompt = false, ...rest }) {
+	contextFileOverride;
+	constructor({ fileContent, root, appendSystemPrompt = false, contextFileOverride = false, ...rest }) {
 		super({
 			...rest,
 			fileContent,
 			root: root ?? false
 		});
 		this.appendSystemPrompt = appendSystemPrompt;
+		this.contextFileOverride = contextFileOverride;
 	}
-	static getSettablePaths({ global = false, excludeToolDir } = {}) {
+	static getSettablePaths({ global = false, excludeToolDir, contextFile } = {}) {
 		return {
 			root: {
 				relativeDirPath: global ? buildToolPath(".pi", "agent", excludeToolDir) : ".",
-				relativeFilePath: PI_RULE_FILE_NAME
+				relativeFilePath: contextFile === "override" ? PI_RULE_OVERRIDE_FILE_NAME : PI_RULE_FILE_NAME
 			},
 			appendSystemPrompt: {
 				relativeDirPath: global ? buildToolPath(".pi", "agent", excludeToolDir) : ".pi",
@@ -47883,7 +48970,22 @@ var PiRule = class PiRule extends ToolRule {
 	* `APPEND_SYSTEM.md` is cleaned up once no rule opts in anymore.
 	*/
 	static getExtraFixedFiles({ global = false } = {}) {
-		return [this.getSettablePaths({ global }).appendSystemPrompt];
+		return [this.getSettablePaths({ global }).appendSystemPrompt, this.getSettablePaths({
+			global,
+			contextFile: "override"
+		}).root];
+	}
+	/**
+	* The project-root `AGENTS.md` is written by several other targets
+	* (agentsmd, codexcli, warp, devin, ...), and the root-file ownership map that
+	* arbitrates a shared path only applies to `--check`. With
+	* `pi.contextFile: override` Pi stops writing that file, so leaving it on the
+	* orphan list would make every `pi` generate delete another target's freshly
+	* written output. The global `~/.pi/agent/AGENTS.md` is Pi-exclusive and stays
+	* deletable.
+	*/
+	isDeletable() {
+		return !(this.getRelativeDirPath() === "." && this.getRelativeFilePath() === "AGENTS.md");
 	}
 	/**
 	* Pi appends `APPEND_SYSTEM.md` to the system prompt itself, so listing it in
@@ -47908,20 +49010,29 @@ var PiRule = class PiRule extends ToolRule {
 				appendSystemPrompt: true
 			});
 		}
-		const relativePath = (0, node_path.join)(root.relativeDirPath, root.relativeFilePath);
+		const isOverride = relativeFilePath === PI_RULE_OVERRIDE_FILE_NAME;
+		const rootPaths = isOverride ? this.getSettablePaths({
+			global,
+			contextFile: "override"
+		}).root : root;
+		const relativePath = (0, node_path.join)(rootPaths.relativeDirPath, rootPaths.relativeFilePath);
 		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
 		return new PiRule({
 			outputRoot,
-			relativeDirPath: root.relativeDirPath,
-			relativeFilePath: root.relativeFilePath,
+			relativeDirPath: rootPaths.relativeDirPath,
+			relativeFilePath: rootPaths.relativeFilePath,
 			fileContent,
 			validate,
-			root: true
+			root: true,
+			contextFileOverride: isOverride
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
-		const { root, appendSystemPrompt } = this.getSettablePaths({ global });
 		const frontmatter = rulesyncRule.getFrontmatter();
+		const { root, appendSystemPrompt } = this.getSettablePaths({
+			global,
+			contextFile: frontmatter.pi?.contextFile
+		});
 		if (!frontmatter.root && frontmatter.pi?.systemPrompt === "append") return new PiRule({
 			outputRoot,
 			relativeDirPath: appendSystemPrompt.relativeDirPath,
@@ -47938,7 +49049,8 @@ var PiRule = class PiRule extends ToolRule {
 			relativeFilePath: root.relativeFilePath,
 			fileContent: rulesyncRule.getBody(),
 			validate,
-			root: isRoot
+			root: isRoot,
+			contextFileOverride: frontmatter.pi?.contextFile === "override"
 		});
 	}
 	toRulesyncRule() {
@@ -47953,6 +49065,18 @@ var PiRule = class PiRule extends ToolRule {
 			},
 			body: this.getFileContent()
 		});
+		if (this.contextFileOverride) return new RulesyncRule({
+			outputRoot: process.cwd(),
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: RULESYNC_OVERVIEW_FILE_NAME,
+			frontmatter: {
+				root: true,
+				targets: ["pi"],
+				globs: ["**/*"],
+				pi: { contextFile: "override" }
+			},
+			body: this.getFileContent()
+		});
 		return this.toRulesyncRuleDefault();
 	}
 	validate() {
@@ -47972,14 +49096,16 @@ var PiRule = class PiRule extends ToolRule {
 			root: false,
 			appendSystemPrompt: true
 		});
-		const isRoot = relativeFilePath === "AGENTS.md" && (relativeDirPath === "." || relativeDirPath === root.relativeDirPath);
+		const isOverride = relativeFilePath === PI_RULE_OVERRIDE_FILE_NAME;
+		const isRoot = (relativeFilePath === "AGENTS.md" || isOverride) && (relativeDirPath === "." || relativeDirPath === root.relativeDirPath);
 		return new PiRule({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
 			validate: false,
-			root: isRoot
+			root: isRoot,
+			contextFileOverride: isOverride
 		});
 	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
@@ -49452,8 +50578,9 @@ var RulesProcessor = class extends FeatureProcessor {
 	}
 	async convertRulesyncFilesToToolFiles(rulesyncFiles) {
 		const rulesyncRules = rulesyncFiles.filter((file) => file instanceof RulesyncRule);
-		const localRootRules = rulesyncRules.filter((rule) => rule.getFrontmatter().localRoot);
-		const nonLocalRootRules = rulesyncRules.filter((rule) => !rule.getFrontmatter().localRoot);
+		const alignedRules = this.alignPiContextFile(rulesyncRules);
+		const localRootRules = alignedRules.filter((rule) => rule.getFrontmatter().localRoot);
+		const nonLocalRootRules = alignedRules.filter((rule) => !rule.getFrontmatter().localRoot);
 		const factory = this.getFactory(this.toolTarget);
 		const { meta } = factory;
 		const convertedRules = nonLocalRootRules.map((rulesyncRule) => {
@@ -49846,6 +50973,44 @@ As this project's AI coding tool, you must follow the additional conventions bel
 		return [...targetedRootRules, ...nonRootRules];
 	}
 	/**
+	* Pi reads `AGENTS.override.md` *instead of* `AGENTS.md` from a directory, and
+	* non-root Pi rules are folded into whichever file the root emits. A mix of
+	* opted-in and opted-out rules would therefore split the output across both
+	* files and let Pi silently ignore everything in `AGENTS.md`, so the root rule
+	* decides for all of them: its `pi.contextFile` is copied onto the non-root
+	* rules, and the flag set only on a non-root rule is dropped with a warning.
+	*/
+	alignPiContextFile(rules) {
+		if (this.toolTarget !== "pi") return rules;
+		const factory = this.getFactory(this.toolTarget);
+		const targeted = rules.filter((rule) => factory.class.isTargetedByRulesyncRule(rule));
+		const rootContextFile = targeted.some((rule) => rule.getFrontmatter().root === true && rule.getFrontmatter().pi?.contextFile === "override") ? "override" : void 0;
+		const mismatched = targeted.filter((rule) => rule.getFrontmatter().pi?.contextFile !== rootContextFile);
+		if (mismatched.length === 0) return rules;
+		if (rootContextFile === void 0) this.logger.warn(`pi.contextFile is set on ${mismatched.length} non-root rule(s) but not on the root rule, so it is ignored: Pi folds every rule body into the root context file, and emitting AGENTS.override.md for some of them would hide the rest. Set it on the root rule instead: ${formatRulePaths(mismatched)}`);
+		const mismatchedSet = new Set(mismatched);
+		return rules.map((rule) => {
+			if (!mismatchedSet.has(rule)) return rule;
+			const frontmatter = rule.getFrontmatter();
+			const { contextFile: _dropped, ...pi } = frontmatter.pi ?? {};
+			const nextPi = {
+				...pi,
+				...rootContextFile ? { contextFile: rootContextFile } : {}
+			};
+			return new RulesyncRule({
+				outputRoot: rule.getOutputRoot(),
+				relativeDirPath: rule.getRelativeDirPath(),
+				relativeFilePath: rule.getRelativeFilePath(),
+				frontmatter: {
+					...frontmatter,
+					...Object.keys(nextPi).length > 0 ? { pi: nextPi } : { pi: void 0 }
+				},
+				body: rule.getBody(),
+				validate: false
+			});
+		});
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Load tool-specific rule configurations and parse them into ToolRule instances
 	*/