rulesync 16.9.1 → 16.11.0

package/dist/{import-BaRDaZET.cjs → import--_2cfZlH.cjs}

@@ -134,27 +134,27 @@ const isFeatureValueEnabled = (value) => {
 };
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$282 } = node_path.posix;
+const { join: join$288 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "rules");
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$282(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "commands");
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "subagents");
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "checks");
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$282(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "rules");
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$288(RULESYNC_RULES_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "commands");
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "subagents");
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "checks");
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$288(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$282(RULESYNC_RELATIVE_DIR_PATH, "skills");
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$282(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$288(RULESYNC_RELATIVE_DIR_PATH, "skills");
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$288(RULESYNC_SKILLS_RELATIVE_DIR_PATH, ".curated");
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -196,6 +196,7 @@ const rulesProcessorToolTargetTuple = [
 	"kiro",
 	"kiro-cli",
 	"kiro-ide",
+	"musecode",
 	"opencode",
 	"pi",
 	"qwencode",
@@ -259,6 +260,7 @@ const mcpProcessorToolTargetTuple = [
 	"kiro-cli",
 	"kiro-ide",
 	"junie",
+	"musecode",
 	"opencode",
 	"qwencode",
 	"reasonix",
@@ -366,6 +368,7 @@ const skillsProcessorToolTargetTuple = [
 	"kiro",
 	"kiro-cli",
 	"kiro-ide",
+	"musecode",
 	"opencode",
 	"pi",
 	"qwencode",
@@ -420,6 +423,7 @@ const permissionsProcessorToolTargetTuple = [
 	"cline",
 	"codexcli",
 	"copilot",
+	"copilotcli",
 	"cursor",
 	"devin",
 	"factorydroid",
@@ -443,6 +447,7 @@ const permissionsProcessorToolTargetTuple = [
 ];
 const checksProcessorToolTargetTuple = [
 	"amp",
+	"augmentcode",
 	"cursor",
 	"hermesagent",
 	"rovodev",
@@ -1755,6 +1760,8 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".claude/settings.json",
 	".claude/settings.local.json",
 	".codex/config.toml",
+	".copilot/settings.json",
+	".github/copilot/settings.json",
 	".devin/config.json",
 	".factory/settings.json",
 	".grok/config.toml",
@@ -2494,14 +2501,23 @@ const CLINE_HOOK_EVENTS = [
 /**
 * Hook events supported by GitHub Copilot (cloud coding agent).
 *
-* GitHub now documents an eight-event surface for `.github/hooks/*.json`:
+* The events rulesync writes to `.github/hooks/*.json`:
 * `sessionStart`, `sessionEnd`, `userPromptSubmitted` ← `beforeSubmitPrompt`,
-* `preToolUse`, `postToolUse`, `agentStop` ← `stop`, `subagentStop`, and
-* `errorOccurred` ← `afterError`. `subagentStart` is intentionally absent: it is
-* not part of the documented cloud-agent surface.
+* `preToolUse`, `postToolUse`, `agentStop` ← `stop`, `subagentStart`,
+* `subagentStop`, `errorOccurred` ← `afterError`, and `preCompact`.
 *
-* @see https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-hooks
-* @see https://docs.github.com/en/copilot/concepts/agents/hooks
+* `preCompact` and `subagentStart` are authorable because the unified hooks
+* reference's per-event "Cloud agent" column says both fire there. That column
+* is the authority for this set: the older cloud-agent concept page still
+* lists only the eight events this set began as, and re-narrowing to it would
+* undo that. `notification` and `permissionRequest` stay out because the same
+* column is explicit that they do not fire on the cloud agent.
+*
+* Two further CLI events — `postToolUseFailure` and `userPromptTransformed`
+* ({@link COPILOTCLI_HOOK_EVENTS}) — are documented as firing on the cloud
+* agent as well but are not modelled here yet.
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
 */
 const COPILOT_HOOK_EVENTS = [
 	"sessionStart",
@@ -2510,8 +2526,10 @@ const COPILOT_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
 	"stop",
+	"subagentStart",
 	"subagentStop",
-	"afterError"
+	"afterError",
+	"preCompact"
 ];
 /**
 * Hook events supported by the GitHub Copilot CLI (`copilotcli-hooks.ts`).
@@ -2613,8 +2631,8 @@ const CODEXCLI_HOOK_EVENTS = [
 * has NO `SubagentStart`/`SubagentStop` arms — emitting them would write keys
 * Goose silently ignores, so `subagentStart`/`subagentStop` are intentionally
 * excluded here and from `CANONICAL_TO_GOOSE_EVENT_NAMES`.
-* @see https://github.com/block/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
-* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
+* @see https://github.com/aaif-goose/goose/blob/v1.41.0/crates/goose/src/hooks/mod.rs
+* @see https://goose-docs.ai/docs/guides/context-engineering/hooks/
 */
 const GOOSE_HOOK_EVENTS = [
 	"sessionStart",
@@ -2651,8 +2669,8 @@ const KIRO_HOOK_EVENTS = [
 * `UserPromptSubmit`, `PreToolUse`, and `PostToolUse`. Kiro also documents
 * file-event (`PostFileCreate`/`PostFileSave`/`PostFileDelete`) and spec-task
 * (`PreTaskExec`/`PostTaskExec`) triggers that have no canonical equivalent;
-* those can still be emitted verbatim via a `kiro-ide` or `kiro-cli` override
-* block (unknown event keys pass through unchanged). There is no `SessionEnd`
+* those can still be emitted verbatim via the shared `kiro` override block
+* (unknown event keys pass through unchanged). There is no `SessionEnd`
 * trigger, so the canonical `sessionEnd` has no home here.
 * @see https://kiro.dev/docs/hooks/types/
 */
@@ -3247,8 +3265,10 @@ const CANONICAL_TO_COPILOT_EVENT_NAMES = {
 	preToolUse: "preToolUse",
 	postToolUse: "postToolUse",
 	stop: "agentStop",
+	subagentStart: "subagentStart",
 	subagentStop: "subagentStop",
-	afterError: "errorOccurred"
+	afterError: "errorOccurred",
+	preCompact: "preCompact"
 };
 /**
 * Map Copilot camelCase event names to canonical camelCase.
@@ -3385,6 +3405,47 @@ const CANONICAL_TO_KIRO_EVENT_NAMES = {
 	stop: "stop"
 };
 /**
+* Native event keys of the embedded agent-config hook format, as listed by the
+* Kiro CLI 3.0 migration guide's old-format column: `agentSpawn`,
+* `userPromptSubmit`, `preToolUse`, `postToolUse`, `fileEdited`, `fileCreated`
+* and `agentStop`/`stop`. Two of them (`fileEdited`, `fileCreated`) have no
+* canonical equivalent, so they exist only here.
+*
+* The `kiro` override block is shared with the standalone-format targets, whose
+* trigger vocabulary is different, so the alias writer uses this list to decide
+* what it can express.
+* @see https://kiro.dev/docs/cli/v3/hooks-migration/
+*/
+const KIRO_AGENT_CONFIG_NATIVE_EVENT_NAMES = [
+	"agentSpawn",
+	"userPromptSubmit",
+	"preToolUse",
+	"postToolUse",
+	"fileEdited",
+	"fileCreated",
+	"agentStop",
+	"stop"
+];
+/**
+* Old agent-config event keys mapped to their standalone v1 trigger, so a
+* `kiro.hooks` block authored in the deprecated spelling still emits a valid
+* trigger for the `kiro-cli` / `kiro-ide` targets that read the same block.
+* The migration guide states the old names "map directly to their newer
+* equivalents" and spells out `agentSpawn` → `SessionStart` and `fileEdited` →
+* `PostFileSave`; the rest are the same event under the v1 casing.
+* @see https://kiro.dev/docs/cli/v3/hooks-migration/
+*/
+const KIRO_LEGACY_TO_KIRO_IDE_TRIGGER_NAMES = {
+	agentSpawn: "SessionStart",
+	userPromptSubmit: "UserPromptSubmit",
+	preToolUse: "PreToolUse",
+	postToolUse: "PostToolUse",
+	fileEdited: "PostFileSave",
+	fileCreated: "PostFileCreate",
+	agentStop: "Stop",
+	stop: "Stop"
+};
+/**
 * Map Kiro CLI camelCase event names to canonical camelCase.
 */
 const KIRO_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_KIRO_EVENT_NAMES).map(([k, v]) => [v, k]));
@@ -3392,8 +3453,8 @@ const KIRO_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICA
 * Map canonical camelCase event names to Kiro IDE PascalCase triggers.
 *
 * Only the canonical lifecycle events with a clean IDE equivalent are mapped.
-* Unknown keys (e.g. IDE-only `PostFileSave`/`PreTaskExec` set via a `kiro-ide`
-* override) pass through unchanged.
+* Unknown keys (e.g. IDE-only `PostFileSave`/`PreTaskExec` set via the shared
+* `kiro` override block) pass through unchanged.
 * @see https://kiro.dev/docs/hooks/types/
 */
 const CANONICAL_TO_KIRO_IDE_EVENT_NAMES = {
@@ -4894,13 +4955,57 @@ const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	git_write_rules: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
+* Tool-scoped override block for Zed. Two Zed surfaces sit outside the canonical
+* allow/ask/deny model that `agent.tool_permissions` implements, and both are
+* authored here verbatim:
+*
+* - `sandbox_permissions` — the OS-level agent sandbox, on by default since Zed
+*   1.14.2 for the `terminal` and `fetch` tools. Its defaults forbid network
+*   access, writing outside the project directories, and writing to `.git`, so a
+*   real setup usually needs to relax one of them (`network_hosts` with exact
+*   hostnames or leading `*.` wildcards, `allow_all_hosts`, `write_paths`,
+*   `allow_fs_write_all`, `allow_unsandboxed`). This is containment, not tool
+*   gating: no canonical category expresses it, so the block is written straight
+*   into `agent.sandbox_permissions`, mirroring the Kilo / Claude Code / Codex
+*   CLI `sandbox` passthrough precedent. Kept a bare `looseObject` rather than
+*   enumerating the keys, since upstream adds to them release over release.
+* - `profiles` — the tool-availability layer, a separate enforcement stage from
+*   `tool_permissions`: a tool absent from the active profile cannot be used no
+*   matter what the permission rules say. Per-profile keys are `name`, `tools`
+*   (per-tool booleans), `enable_all_context_servers`, `context_servers` and
+*   `default_model`. Like Kimi Code's `tools.enabled`/`disabled` block this is a
+*   verbatim passthrough — no canonicalization is attempted.
+*
+* Neither surface can weaken a canonical deny, because `agent.tool_permissions`
+* is off-limits to this override: the translator consumes only the two keys
+* above by name and rejects a `tool_permissions` key with a warning.
+*
+* @see https://zed.dev/docs/ai/sandboxing
+* @see https://zed.dev/docs/ai/agent-profiles
+*
+* @example
+* { "sandbox_permissions": { "network_hosts": ["*.github.com"], "write_paths": ["/tmp"] },
+*   "profiles": { "review": { "name": "Review", "tools": { "terminal": false } } } }
+*/
+const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	sandbox_permissions: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	profiles: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({
+		name: zod_mini.z.optional(zod_mini.z.string()),
+		tools: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.boolean())),
+		enable_all_context_servers: zod_mini.z.optional(zod_mini.z.boolean()),
+		context_servers: zod_mini.z.optional(zod_mini.z.looseObject({})),
+		default_model: zod_mini.z.optional(zod_mini.z.looseObject({}))
+	})))
+});
+/**
 * Permissions configuration.
 * Keys are tool category names (e.g., "bash", "edit", "read", "webfetch").
 * Values are pattern-to-action mappings for that tool category.
 *
 * The optional `opencode`/`hermes`/`cline`/`kilo`/`claudecode`/`vibe`/`cursor`/
 * `qwencode`/`reasonix`/`factorydroid`/`warp`/`junie`/`takt`/`amp`/
-* `antigravity-cli`/`augmentcode`/`kiro`/`codexcli` keys are tool-scoped
+* `antigravity-cli`/`augmentcode`/`kiro`/`codexcli`/`zed` keys are tool-scoped
 * overrides consumed only by their respective translator (see the matching
 * `*PermissionsOverrideSchema`); every other tool reads the shared `permission`
 * block and ignores them.
@@ -4940,14 +5045,15 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	augmentcode: zod_mini.z.optional(AugmentcodePermissionsOverrideSchema),
 	kiro: zod_mini.z.optional(KiroPermissionsOverrideSchema),
 	codexcli: zod_mini.z.optional(CodexcliPermissionsOverrideSchema),
+	zed: zod_mini.z.optional(ZedPermissionsOverrideSchema),
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	devin: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
-	rovodev: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
-	zed: zod_mini.z.optional(CanonicalPermissionsOverrideSchema)
+	rovodev: zod_mini.z.optional(CanonicalPermissionsOverrideSchema)
 });
 /**
 * Full permissions file schema including optional $schema field.
@@ -5660,6 +5766,33 @@ function resolveUserInvocable({ rootFrontmatter, section }) {
 	return section?.["user-invocable"] ?? rootFrontmatter["user-invocable"];
 }
 //#endregion
+//#region src/constants/augmentcode-paths.ts
+const AUGMENTCODE_DIR = ".augment";
+const AUGMENTCODE_COMMANDS_DIR_PATH = (0, node_path.join)(AUGMENTCODE_DIR, "commands");
+/**
+* The cross-tool `.agents/commands/` root Auggie also discovers commands from.
+* Auggie resolves commands over `.augment`, `.claude` and `.agents` in both the
+* workspace and the home directory; rulesync writes to its own `.augment` root
+* and reads this one as well, mirroring how skills treat `.agents/skills`.
+* @see https://docs.augmentcode.com/cli/custom-commands
+*/
+const AUGMENTCODE_AGENTS_COMMANDS_DIR_PATH = (0, node_path.join)(".agents", "commands");
+const AUGMENTCODE_SKILLS_DIR_PATH = (0, node_path.join)(AUGMENTCODE_DIR, "skills");
+const AUGMENTCODE_AGENTS_DIR_PATH = (0, node_path.join)(AUGMENTCODE_DIR, "agents");
+const AUGMENTCODE_ALT_AGENTS_DIR_PATH = ".agents";
+const AUGMENTCODE_AGENTS_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
+const AUGMENTCODE_SETTINGS_FILE_NAME = "settings.json";
+const AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME = "settings.local.json";
+/**
+* Augment Code Review's custom guidelines file. Read from the repository root's
+* `.augment/` folder, project scope only — Augment documents no user-level
+* equivalent, and the reviewer runs against the committed tree.
+* @see https://docs.augmentcode.com/codereview/review-guidelines
+*/
+const AUGMENTCODE_CODE_REVIEW_GUIDELINES_FILE_NAME = "code_review_guidelines.yaml";
+const AUGMENTCODE_IGNORE_FILE_NAME = ".augmentignore";
+const AUGMENTCODE_LEGACY_RULE_FILE_NAME = ".augment-guidelines";
+//#endregion
 //#region src/constants/cursor-paths.ts
 const CURSOR_DIR = ".cursor";
 const CURSOR_COMMANDS_DIR_PATH = (0, node_path.join)(CURSOR_DIR, "commands");
@@ -5709,6 +5842,19 @@ const TAKT_RULE_OVERVIEW_FILE_NAME = "overview.md";
 */
 const TAKT_CONFIG_FILE_NAME = "config.yaml";
 /**
+* Takt's runtime provider config (Takt 0.56.0+). Lives at `.takt/runtime.yaml`
+* (project) and `~/.takt/runtime.yaml` (global), and owns provider/model/
+* provider-option assignment. Takt generates the global file on first launch,
+* so most installs have one; "runtime mode" only activates when its `provider:`
+* section carries an actual assignment.
+*
+* rulesync only ever READS this file: it resolves the active provider from it,
+* and it refuses to write the legacy `provider_options` key into `config.yaml`
+* while runtime mode is active (Takt hard-fails on that combination).
+* @see https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+const TAKT_RUNTIME_CONFIG_FILE_NAME = "runtime.yaml";
+/**
 * Top-level key in Takt's `config.yaml` holding the workflow MCP transport
 * allowlist (`stdio` / `sse` / `http` booleans). Takt is default-deny: a
 * transport must be explicitly enabled here before any workflow-defined MCP
@@ -6184,6 +6330,363 @@ function slugifyCheckName(value) {
 	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48).replace(/-+$/, "");
 }
 //#endregion
+//#region src/features/checks/augmentcode-check.ts
+/** Augment's severity scale. Narrower than the canonical one. */
+const AUGMENTCODE_SEVERITIES = [
+	"high",
+	"medium",
+	"low"
+];
+/**
+* Canonical severity to Augment's scale. Augment has no band above `high`, so
+* canonical `critical` folds into it — the alternative, dropping the rule or
+* demoting it to `medium`, would either lose the check or understate the one
+* severity a reviewer most wants raised. The fold is one-way: a `critical`
+* check generates `high` and imports back as `high`, so the canonical value is
+* not recoverable from Augment's file alone.
+*/
+const CANONICAL_TO_AUGMENTCODE_SEVERITY = {
+	low: "low",
+	medium: "medium",
+	high: "high",
+	critical: "high"
+};
+/**
+* Every field of an `areas.<key>` entry is required upstream, so a check with no
+* `severity` still has to emit one. `medium` is the neutral middle of Augment's
+* three bands: defaulting to `high` would inflate every unannotated check past
+* the ones deliberately marked `medium`, and `low` would bury them.
+*/
+const DEFAULT_AUGMENTCODE_SEVERITY = "medium";
+/**
+* Augment's own example uses `["**"]`, and `globs` is required per area. Built
+* fresh per area rather than shared: js-yaml serializes a repeated reference as
+* an anchor/alias pair, which would litter a file Augment tells users to edit by
+* hand with `&ref_0` / `*ref_0`.
+*/
+const defaultAreaGlobs = () => ["**"];
+/**
+* The `augmentcode` block of a check's frontmatter, carrying the two things the
+* canonical check model has no home for: which area a rule belongs to (so
+* several checks can share one), and the area's `globs`.
+*/
+const AugmentcodeCheckOverrideSchema = zod_mini.z.looseObject({
+	/** Area key this check's rule is grouped under; defaults to the check's slug. */
+	area: zod_mini.z.optional(zod_mini.z.string().check(zod_mini.z.minLength(1))),
+	/** Human-readable `areas.<key>.description`; defaults to the check's own. */
+	areaDescription: zod_mini.z.optional(zod_mini.z.string()),
+	globs: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string().check(zod_mini.z.minLength(1)))),
+	/** Rule `id`; defaults to the check's slug. */
+	id: zod_mini.z.optional(zod_mini.z.string().check(zod_mini.z.minLength(1)))
+});
+function parseOverride$1(raw, filePath, logger) {
+	if (raw === void 0) return {};
+	if (!isPlainObject$1(raw)) {
+		logger?.warn(`Ignoring the \`augmentcode\` block in ${filePath}: expected a mapping.`);
+		return {};
+	}
+	const result = AugmentcodeCheckOverrideSchema.safeParse(raw);
+	if (!result.success) throw new Error(`Invalid \`augmentcode\` block in ${filePath}: ${result.error.message}`, { cause: result.error });
+	return result.data;
+}
+function stemOf$1(rulesyncCheck) {
+	return (0, node_path.basename)(rulesyncCheck.getRelativeFilePath(), ".md");
+}
+/**
+* Disambiguate a name against the ones already taken. Used for rule ids on
+* generate (two same-named checks in different subdirectories) and for check
+* file names on import (one rule id repeated across two areas), since a
+* collision in either direction silently loses one of the pair.
+*/
+function uniqueName(preferred, used) {
+	let name = preferred;
+	let suffix = 2;
+	while (used.has(name)) {
+		name = `${preferred}-${suffix}`;
+		suffix += 1;
+	}
+	used.add(name);
+	return name;
+}
+/**
+* A rule's `description` is the whole instruction Augment acts on, so the check
+* body is preferred; the frontmatter `description` is a summary, used only when
+* there is no body. Both empty falls back to the check name, which at least
+* names the concern rather than emitting an empty required field.
+*/
+function toRuleDescription(rulesyncCheck) {
+	const body = rulesyncCheck.getBody().trim();
+	if (body.length > 0) return body;
+	return rulesyncCheck.getFrontmatter().description?.trim() || stemOf$1(rulesyncCheck);
+}
+function toRule(rulesyncCheck, override, usedRuleIds) {
+	const severity = rulesyncCheck.getFrontmatter().severity;
+	return {
+		id: uniqueName(override.id ?? slugifyCheckName(stemOf$1(rulesyncCheck)), usedRuleIds),
+		description: toRuleDescription(rulesyncCheck),
+		severity: severity ? CANONICAL_TO_AUGMENTCODE_SEVERITY[severity] ?? DEFAULT_AUGMENTCODE_SEVERITY : DEFAULT_AUGMENTCODE_SEVERITY
+	};
+}
+/**
+* An authored area key is used verbatim. Slugifying it would rewrite the
+* underscores in Augment's own documented example (`memory_safety`), and since
+* import writes the key back unchanged, the next generate would build a second
+* area under the slugified spelling while the original stayed put — the same
+* rules twice. Only the file-stem default is slugified, because that one has to
+* become a legal area key from an arbitrary file name.
+*/
+function areaKeyFor(rulesyncCheck, override) {
+	return override.area ?? slugifyCheckName(stemOf$1(rulesyncCheck));
+}
+/** Rule ids belonging to areas this generate preserves rather than rewrites. */
+function collectRuleIds(existingAreas, claimedKeys) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const [areaKey, rawArea] of Object.entries(existingAreas)) {
+		if (claimedKeys.has(areaKey) || !isPlainObject$1(rawArea)) continue;
+		for (const rawRule of readArea(rawArea).rules) {
+			const rule = readRule(rawRule);
+			if (rule) ids.add(rule.id);
+		}
+	}
+	return ids;
+}
+/**
+* Group the checks into `areas`. One area per check by default; checks naming
+* the same `augmentcode.area` share one, with the first check to name it
+* supplying the area's `description` and `globs`.
+*/
+function buildAreas({ entries, reservedRuleIds }) {
+	const areas = /* @__PURE__ */ new Map();
+	const usedRuleIds = new Set(reservedRuleIds);
+	for (const { rulesyncCheck, override } of entries) {
+		const key = areaKeyFor(rulesyncCheck, override);
+		const rule = toRule(rulesyncCheck, override, usedRuleIds);
+		const existing = areas.get(key);
+		if (existing) {
+			existing.rules.push(rule);
+			continue;
+		}
+		areas.set(key, {
+			description: override.areaDescription || rulesyncCheck.getFrontmatter().description?.trim() || stemOf$1(rulesyncCheck),
+			globs: override.globs ?? defaultAreaGlobs(),
+			rules: [rule]
+		});
+	}
+	return Object.fromEntries(areas);
+}
+function parseGuidelines(fileContent, filePath) {
+	if (fileContent.trim().length === 0) return {};
+	let parsed;
+	try {
+		parsed = loadYaml(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse AugmentCode code review guidelines at ${filePath}: ${formatError(error)}`, { cause: error });
+	}
+	if (parsed === void 0 || parsed === null) return {};
+	if (!isPlainObject$1(parsed)) throw new Error(`Failed to parse AugmentCode code review guidelines at ${filePath}: expected a mapping at the document root.`);
+	return parsed;
+}
+/** An area's shared fields, read defensively out of hand-written YAML. */
+function readArea(rawArea) {
+	const rawGlobs = Array.isArray(rawArea.globs) ? rawArea.globs : void 0;
+	const globs = rawGlobs?.filter((glob) => typeof glob === "string");
+	const authoredGlobs = globs && (globs.length > 0 || rawGlobs?.length === 0) ? globs : void 0;
+	return {
+		...typeof rawArea.description === "string" && { description: rawArea.description },
+		...authoredGlobs && { globs: authoredGlobs },
+		rules: Array.isArray(rawArea.rules) ? rawArea.rules : []
+	};
+}
+/**
+* A rule missing `id` or `description` is not a shape Augment itself reads, so
+* it is skipped rather than imported as a check with an invented field.
+*/
+function readRule(rawRule) {
+	if (!isPlainObject$1(rawRule)) return void 0;
+	const id = typeof rawRule.id === "string" ? rawRule.id : void 0;
+	const description = typeof rawRule.description === "string" ? rawRule.description : void 0;
+	if (!id || !description) return void 0;
+	const severity = AUGMENTCODE_SEVERITIES.find((value) => value === rawRule.severity);
+	return {
+		id,
+		description,
+		...severity && { severity }
+	};
+}
+/**
+* Checks adapter for Augment Code Review's custom guidelines
+* (`.augment/code_review_guidelines.yaml`).
+*
+* Augment groups review rules into named **areas**: each area carries a
+* `description`, the `globs` it applies to, and a list of `rules`, every rule
+* being an `id` / `description` / `severity` triple. Every one of those fields
+* is required upstream. Rulesync maps one `.rulesync/checks/*.md` onto one rule,
+* in an area of its own unless an `augmentcode.area` groups several together —
+* so the whole set collapses into this one file via {@link fromRulesyncChecks}
+* rather than a file per check.
+*
+* **Severity is lossy in one direction.** Augment's scale is `high` / `medium` /
+* `low` with no band above `high`, so canonical `critical` maps to `high` and
+* imports back as `high`. A check with no `severity` at all emits `medium`,
+* since the field cannot be omitted.
+*
+* **`file_paths_to_ignore`** is recognized and preserved verbatim, but never
+* authored or imported: the canonical check model has no ignore surface, and
+* inventing one here is a separate design question.
+*
+* **Generation merges rather than replaces.** Augment's own documentation tells
+* users to hand-write this file, so only the areas the current check set claims
+* are rewritten; every other area, `file_paths_to_ignore`, and any unknown
+* top-level key survive. The cost of that is that rulesync cannot tell its own
+* leftovers from a hand-written area: renaming a check strands the area under
+* the old key, and dropping the last Augment-targeting check leaves the areas in
+* place with a warning rather than guessing which of them to delete. Deleting
+* the file outright is likewise refused whenever it exists.
+*
+* Project scope only — the reviewer reads the file from the committed
+* repository, and Augment documents no user-level equivalent.
+*
+* @see https://docs.augmentcode.com/codereview/review-guidelines
+*/
+var AugmentcodeCheck = class AugmentcodeCheck extends ToolCheck {
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: AUGMENTCODE_DIR,
+			relativeFilePath: AUGMENTCODE_CODE_REVIEW_GUIDELINES_FILE_NAME
+		};
+	}
+	static isTargetedByRulesyncCheck(rulesyncCheck) {
+		return this.isTargetedByRulesyncCheckDefault({
+			rulesyncCheck,
+			toolTarget: "augmentcode"
+		});
+	}
+	/**
+	* Ownership guard the processor consults before it deletes anything for this
+	* tool. Unlike the Markdown adapters, whose section markers say which text is
+	* rulesync's, YAML carries no such marker — js-yaml drops comments on rewrite,
+	* and an unknown top-level key risks Augment's own parser. So an existing file
+	* is never rulesync's to delete: it may hold hand-written areas, and there is
+	* no way to prove otherwise.
+	*/
+	static async canDeleteAuxiliaryFiles({ outputRoot }) {
+		const paths = AugmentcodeCheck.getSettablePaths();
+		return !await fileExists((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath ?? "code_review_guidelines.yaml"));
+	}
+	static fromRulesyncCheck(_params) {
+		throw new Error("AugmentCode checks are built from all checks at once; use fromRulesyncChecks.");
+	}
+	static async fromRulesyncChecks({ outputRoot = process.cwd(), rulesyncChecks, global = false, logger }) {
+		const paths = AugmentcodeCheck.getSettablePaths({ global });
+		const relativeFilePath = paths.relativeFilePath ?? "code_review_guidelines.yaml";
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const existing = parseGuidelines(await readFileContentOrNull(filePath) ?? "", filePath);
+		const existingAreas = isPlainObject$1(existing.areas) ? existing.areas : {};
+		if (rulesyncChecks.length === 0) {
+			if (Object.keys(existingAreas).length > 0) logger?.warn(`AugmentCode checks: no check targets AugmentCode, but ${filePath} still holds review areas. They are left in place — rulesync cannot tell the ones it generated from ones you wrote, so removing them is a manual edit.`);
+			return [];
+		}
+		const entries = rulesyncChecks.map((rulesyncCheck) => ({
+			rulesyncCheck,
+			override: parseOverride$1(rulesyncCheck.getFrontmatter().augmentcode, (0, node_path.join)(RULESYNC_CHECKS_RELATIVE_DIR_PATH, rulesyncCheck.getRelativeFilePath()), logger)
+		}));
+		const generatedAreas = buildAreas({
+			entries,
+			reservedRuleIds: collectRuleIds(existingAreas, new Set(entries.map(({ rulesyncCheck, override }) => areaKeyFor(rulesyncCheck, override))))
+		});
+		const fileContent = (0, js_yaml.dump)({
+			...existing,
+			areas: {
+				...existingAreas,
+				...generatedAreas
+			}
+		}, {
+			lineWidth: -1,
+			noRefs: true
+		});
+		return [new AugmentcodeCheck({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			fileContent,
+			global
+		})];
+	}
+	static async fromFile({ outputRoot = process.cwd(), global = false }) {
+		const paths = AugmentcodeCheck.getSettablePaths({ global });
+		const relativeFilePath = paths.relativeFilePath ?? "code_review_guidelines.yaml";
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		return new AugmentcodeCheck({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			fileContent: await readFileContentOrNull(filePath) ?? "",
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new AugmentcodeCheck({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncCheck() {
+		const first = this.toRulesyncChecks()[0];
+		if (!first) throw new Error(`No review areas found in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}.`);
+		return first;
+	}
+	/**
+	* One check per rule, not per area: an area with three rules is three
+	* independent review instructions, and collapsing them into one check would
+	* make the next generate emit a single merged rule in their place. The area's
+	* key, description and globs ride along in each check's `augmentcode` block,
+	* so regenerating regroups the rules exactly where they were.
+	*/
+	toRulesyncChecks() {
+		const filePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
+		const guidelines = parseGuidelines(this.getFileContent(), filePath);
+		const areas = isPlainObject$1(guidelines.areas) ? guidelines.areas : {};
+		const checks = [];
+		const usedNames = /* @__PURE__ */ new Set();
+		for (const [areaKey, rawArea] of Object.entries(areas)) {
+			if (!isPlainObject$1(rawArea)) continue;
+			const { description: areaDescription, globs, rules } = readArea(rawArea);
+			for (const rawRule of rules) {
+				const rule = readRule(rawRule);
+				if (!rule) continue;
+				const name = uniqueName(slugifyCheckName(rule.id) || slugifyCheckName(areaKey) || "check", usedNames);
+				checks.push(new RulesyncCheck({
+					outputRoot: ".",
+					relativeDirPath: RULESYNC_CHECKS_RELATIVE_DIR_PATH,
+					relativeFilePath: `${name}.md`,
+					frontmatter: {
+						targets: ["*"],
+						...rule.severity && { severity: rule.severity },
+						augmentcode: {
+							area: areaKey,
+							...areaDescription !== void 0 && { areaDescription },
+							...globs && { globs },
+							id: rule.id
+						}
+					},
+					body: rule.description
+				}));
+			}
+		}
+		return checks;
+	}
+};
+//#endregion
 //#region src/features/checks/aggregated-check-file.ts
 /**
 * Shared machinery for the tools whose checks surface is **one aggregated
@@ -7106,6 +7609,22 @@ const SHARED_CONFIG_OWNERSHIP = {
 			}
 		}
 	},
+	".github/copilot/settings.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["deniedUrls"]
+		} }
+	},
+	".copilot/settings.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["allowedUrls", "deniedUrls"]
+		} }
+	},
 	".vscode/settings.json": {
 		format: "jsonc",
 		invalidRootPolicy: "error",
@@ -7186,6 +7705,14 @@ const SHARED_CONFIG_OWNERSHIP = {
 			}
 		}
 	},
+	".config/muse/settings.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp_servers", "schema_version"]
+		} }
+	},
 	".kiro/agents/default.json": {
 		format: "json",
 		features: {
@@ -7833,6 +8360,14 @@ const toolCheckFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.md"
 		}
 	}],
+	["augmentcode", {
+		class: AugmentcodeCheck,
+		meta: {
+			supportsGlobal: false,
+			filePattern: AUGMENTCODE_CODE_REVIEW_GUIDELINES_FILE_NAME,
+			committedOutput: true
+		}
+	}],
 	["cursor", {
 		class: CursorCheck,
 		meta: {
@@ -8620,26 +9155,6 @@ var AntigravityIdeCommand = class extends AntigravitySharedCommand {
 	}
 };
 //#endregion
-//#region src/constants/augmentcode-paths.ts
-const AUGMENTCODE_DIR = ".augment";
-const AUGMENTCODE_COMMANDS_DIR_PATH = (0, node_path.join)(AUGMENTCODE_DIR, "commands");
-/**
-* The cross-tool `.agents/commands/` root Auggie also discovers commands from.
-* Auggie resolves commands over `.augment`, `.claude` and `.agents` in both the
-* workspace and the home directory; rulesync writes to its own `.augment` root
-* and reads this one as well, mirroring how skills treat `.agents/skills`.
-* @see https://docs.augmentcode.com/cli/custom-commands
-*/
-const AUGMENTCODE_AGENTS_COMMANDS_DIR_PATH = (0, node_path.join)(".agents", "commands");
-const AUGMENTCODE_SKILLS_DIR_PATH = (0, node_path.join)(AUGMENTCODE_DIR, "skills");
-const AUGMENTCODE_AGENTS_DIR_PATH = (0, node_path.join)(AUGMENTCODE_DIR, "agents");
-const AUGMENTCODE_ALT_AGENTS_DIR_PATH = ".agents";
-const AUGMENTCODE_AGENTS_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
-const AUGMENTCODE_SETTINGS_FILE_NAME = "settings.json";
-const AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME = "settings.local.json";
-const AUGMENTCODE_IGNORE_FILE_NAME = ".augmentignore";
-const AUGMENTCODE_LEGACY_RULE_FILE_NAME = ".augment-guidelines";
-//#endregion
 //#region src/features/commands/augmentcode-command.ts
 const AugmentcodeCommandFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.optional(zod_mini.z.string()),
@@ -9173,6 +9688,8 @@ const COPILOT_GLOBAL_HOOKS_FILE_NAME = "copilot-ide-hooks.json";
 const COPILOT_MCP_DIR = ".vscode";
 const COPILOT_MCP_FILE_NAME = "mcp.json";
 const COPILOT_VSCODE_SETTINGS_FILE_NAME = "settings.json";
+const COPILOTCLI_SETTINGS_FILE_NAME = "settings.json";
+const COPILOTCLI_PROJECT_SETTINGS_DIR_PATH = (0, node_path.join)(GITHUB_DIR, "copilot");
 const COPILOTCLI_MCP_FILE_NAME = "mcp-config.json";
 const COPILOTCLI_PROJECT_MCP_FILE_NAME = "mcp.json";
 const COPILOTCLI_AGENTS_DIR_PATH = (0, node_path.join)(COPILOT_DIR, "agents");
@@ -9432,6 +9949,7 @@ const DEVIN_HOOKS_V1_FILE_NAME = "hooks.v1.json";
 const DEVIN_GLOBAL_AGENTS_FILE_NAME = "AGENTS.md";
 const DEVIN_IGNORE_FILE_NAME = ".devinignore";
 const DEVIN_LEGACY_IGNORE_FILE_NAME = ".codeiumignore";
+const DEVIN_WINDSURF_IGNORE_FILE_NAME = ".windsurfignore";
 const DEVIN_GLOBAL_IGNORE_DIR_PATH = ".codeium";
 const DEVIN_GLOBAL_IGNORE_FILE_NAME = DEVIN_LEGACY_IGNORE_FILE_NAME;
 //#endregion
@@ -9786,7 +10304,7 @@ var GooseCommandConfigFile = class extends ToolFile {
 * The whole file is a YAML mapping (not frontmatter + markdown body), so the
 * class stores the parsed recipe object rather than a frontmatter/body split.
 *
-* @see https://block.github.io/goose/docs/guides/recipes/recipe-reference/
+* @see https://goose-docs.ai/docs/guides/recipes/recipe-reference/
 */
 const GooseCommandRecipeSchema = zod_mini.z.looseObject({
 	version: zod_mini.z.optional(zod_mini.z.string()),
@@ -13280,7 +13798,7 @@ function collectHandlers({ effectiveHooks, eventMap }) {
 	}
 	return handlerGroups;
 }
-function buildCommandLines({ handler, usesToolName, blocksToolCall }) {
+function buildCommandLines$1({ handler, usesToolName, blocksToolCall }) {
 	const lines = [];
 	const indent = usesToolName && handler.matcher ? "      " : "    ";
 	if (usesToolName && handler.matcher) lines.push(`    if (new RegExp(${matcherToEmbeddedLiteral$1(handler.matcher)}).test(event.tool)) {`);
@@ -13305,7 +13823,7 @@ function buildSubscriptionLines$1(handlerGroups) {
 		const usesToolName = AMP_TOOL_EVENTS.has(ampEvent) && handlers.some((handler) => handler.matcher);
 		const blocksToolCall = ampEvent === "tool.call";
 		lines.push(`  amp.on(${JSON.stringify(ampEvent)}, async (${usesToolName ? "event, ctx" : "_event, ctx"}) => {`);
-		for (const handler of handlers) lines.push(...buildCommandLines({
+		for (const handler of handlers) lines.push(...buildCommandLines$1({
 			handler,
 			usesToolName,
 			blocksToolCall
@@ -15290,8 +15808,10 @@ const CopilotHookEntrySchema = zod_mini.z.looseObject({
 	bash: zod_mini.z.optional(zod_mini.z.string()),
 	powershell: zod_mini.z.optional(zod_mini.z.string()),
 	command: zod_mini.z.optional(zod_mini.z.string()),
+	cwd: zod_mini.z.optional(zod_mini.z.string()),
 	env: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
-	timeoutSec: zod_mini.z.optional(zod_mini.z.number())
+	timeoutSec: zod_mini.z.optional(zod_mini.z.number()),
+	timeout: zod_mini.z.optional(zod_mini.z.number())
 });
 /**
 * Convert canonical hooks config to Copilot format.
@@ -15371,6 +15891,22 @@ function resolveImportCommand$1(entry, logger) {
 	return typeof entry.command === "string" ? { command: entry.command } : {};
 }
 /**
+* Extract the non-command fields preserved across import.
+*
+* Generate re-emits any non-canonical key verbatim through `rest`, so a key
+* dropped here does not survive an import → generate round trip. `cwd` is a
+* documented Copilot hook field and was previously lost that way.
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-hooks
+*/
+function importPassthrough$1(entry) {
+	const passthrough = {};
+	if (entry.cwd !== void 0) passthrough.cwd = entry.cwd;
+	if (entry.env !== void 0) passthrough.env = entry.env;
+	return passthrough;
+}
+/**
 * Extract hooks from Copilot hooks JSON into canonical format.
 * Copilot format: { version: 1, hooks: { eventName: [...hookEntries] } }
 */
@@ -15386,13 +15922,13 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			if (!parseResult.success) continue;
 			const entry = parseResult.data;
 			const { command, shell } = resolveImportCommand$1(entry, logger);
-			const timeout = entry.timeoutSec;
+			const timeout = entry.timeoutSec ?? entry.timeout;
 			defs.push({
 				type: "command",
 				...command !== void 0 && { command },
 				...shell !== void 0 && { shell },
-				...entry.env !== void 0 && { env: entry.env },
-				...timeout !== void 0 && { timeout }
+				...timeout !== void 0 && { timeout },
+				...importPassthrough$1(entry)
 			});
 		}
 		if (defs.length > 0) canonical[eventName] = defs;
@@ -15675,19 +16211,19 @@ function importPassthrough(entry) {
 * A shell-specific field carries its `shell` through so re-export writes the
 * same field back. An entry using only the portable `command` field leaves
 * `shell` unset, which re-export renders as the portable field again.
+*
+* When both shell-specific fields are present, `bash` wins and a warning names
+* the ignored `powershell`. The choice is deliberately not platform-dependent:
+* importing on Windows must not produce a different canonical config than
+* importing the same file on Linux, which would make the rulesync hooks file
+* differ per machine for anyone who checks it in.
 */
 function resolveImportCommand(entry, logger) {
 	const hasBash = typeof entry.bash === "string";
 	const hasPowershell = typeof entry.powershell === "string";
 	if (hasBash && hasPowershell) {
-		const isWindows = process.platform === "win32";
-		const chosen = isWindows ? "powershell" : "bash";
-		const ignored = isWindows ? "bash" : "powershell";
-		logger?.warn(`Copilot CLI hook has both bash and powershell commands; using ${chosen} and ignoring ${ignored} on this platform.`);
-		return isWindows ? {
-			command: entry.powershell,
-			shell: "powershell"
-		} : {
+		logger?.warn("Copilot CLI hook has both bash and powershell commands; using bash and ignoring powershell, so the imported config does not depend on the machine the import ran on.");
+		return {
 			command: entry.bash,
 			shell: "bash"
 		};
@@ -16346,7 +16882,7 @@ const GOOSE_CONVERTER_CONFIG = {
 *
 * The JSON shape matches Claude Code's: each PascalCase event maps to an array of
 * `{ matcher, hooks: [{ type: "command", command }] }` entries.
-* @see https://block.github.io/goose/docs/guides/context-engineering/hooks/
+* @see https://goose-docs.ai/docs/guides/context-engineering/hooks/
 */
 var GooseHooks = class GooseHooks extends ToolHooks {
 	constructor(params) {
@@ -16547,6 +17083,13 @@ var GrokcliHooks = class GrokcliHooks extends ToolHooks {
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
 */
 const HERMESAGENT_MATCHER_EVENTS = /* @__PURE__ */ new Set(["pre_tool_call", "post_tool_call"]);
+/**
+* The only Hermes event that can block, and therefore the only one whose
+* entries accept `fail_closed`. Upstream warns and ignores the key on every
+* other event ("only blocking-capable events can fail closed").
+* @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
+*/
+const HERMESAGENT_FAIL_CLOSED_EVENT = "pre_tool_call";
 const HERMESAGENT_CANONICAL_EVENTS = new Set(HERMESAGENT_HOOK_EVENTS);
 const HERMESAGENT_NATIVE_EVENTS = new Set(HERMESAGENT_NATIVE_HOOK_EVENTS);
 /**
@@ -16580,7 +17123,9 @@ function isHermesHookEventEntry(key, value) {
 * unsupported hook types centrally). `matcher` is only carried through for
 * `pre_tool_call`/`post_tool_call`; on any other event it is dropped with a
 * warning, mirroring how other adapters (e.g. AugmentCode) handle
-* matcher-less lifecycle events.
+* matcher-less lifecycle events. The canonical `failClosed` field (shared with
+* Cursor, whose semantics Hermes copied) becomes `fail_closed`, which upstream
+* only honours on `pre_tool_call`.
 */
 function definitionsToHermesEntries({ event, sourceEvent = event, definitions, logger }) {
 	const supportsMatcher = HERMESAGENT_MATCHER_EVENTS.has(event);
@@ -16591,6 +17136,10 @@ function definitionsToHermesEntries({ event, sourceEvent = event, definitions, l
 		if (typeof definition.matcher === "string" && definition.matcher !== "") if (supportsMatcher) entry.matcher = definition.matcher;
 		else logger?.warn(`matcher "${definition.matcher}" on "${sourceEvent}" hook will be ignored — Hermes Agent only supports matchers on pre_tool_call/post_tool_call`);
 		if (typeof definition.timeout === "number") entry.timeout = definition.timeout;
+		if (typeof definition.failClosed === "boolean") {
+			if (event === HERMESAGENT_FAIL_CLOSED_EVENT) entry.fail_closed = definition.failClosed;
+			else if (definition.failClosed) logger?.warn(`failClosed on "${sourceEvent}" hook will be ignored — Hermes Agent only supports fail_closed on pre_tool_call`);
+		}
 		entries.push(entry);
 	}
 	return entries;
@@ -16642,6 +17191,37 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	return result;
 }
 /**
+* Reads a hook entry's fail-closed flag. Upstream accepts its own `fail_closed`
+* and the Cursor/Claude Code `failClosed` spelling alike, so both have to be
+* read back into the single canonical field.
+*/
+function readHermesFailClosed(entry) {
+	if (typeof entry.fail_closed === "boolean") return entry.fail_closed;
+	if (typeof entry.failClosed === "boolean") return entry.failClosed;
+}
+/**
+* Converts one serialized Hermes hook entry back into a canonical definition,
+* or `undefined` when it is not a hook rulesync models (no string `command`).
+* `matcher` and `fail_closed` are read only on the events upstream honours them
+* on, so an imported value is never one the next generate warns about and drops.
+*/
+function hermesEntryToDefinition({ nativeEvent, raw }) {
+	if (!isRecord$1(raw)) return;
+	const entry = raw;
+	if (typeof entry.command !== "string") return;
+	const def = {
+		type: "command",
+		command: entry.command
+	};
+	if (HERMESAGENT_MATCHER_EVENTS.has(nativeEvent) && typeof entry.matcher === "string" && entry.matcher !== "") def.matcher = entry.matcher;
+	if (typeof entry.timeout === "number") def.timeout = entry.timeout;
+	if (nativeEvent === HERMESAGENT_FAIL_CLOSED_EVENT) {
+		const failClosed = readHermesFailClosed(entry);
+		if (failClosed !== void 0) def.failClosed = failClosed;
+	}
+	return def;
+}
+/**
 * Reverse {@link canonicalToHermesHooks}: parse Hermes's native
 * `hooks: { <event>: [...] }` map back into a canonical event → definition[]
 * record. Native events with no canonical equivalent (`pre_verify`,
@@ -16655,19 +17235,10 @@ function hermesHooksToCanonical(hooks) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(nativeEvent) || !Array.isArray(entries)) continue;
 		if (!isHermesHookEventEntry(nativeEvent, entries)) continue;
 		const rulesyncEvent = HERMESAGENT_TO_CANONICAL_EVENT_NAMES[nativeEvent] ?? nativeEvent;
-		const defs = [];
-		for (const raw of entries) {
-			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) continue;
-			const entry = raw;
-			if (typeof entry.command !== "string") continue;
-			const def = {
-				type: "command",
-				command: entry.command
-			};
-			if (HERMESAGENT_MATCHER_EVENTS.has(nativeEvent) && typeof entry.matcher === "string" && entry.matcher !== "") def.matcher = entry.matcher;
-			if (typeof entry.timeout === "number") def.timeout = entry.timeout;
-			defs.push(def);
-		}
+		const defs = entries.map((raw) => hermesEntryToDefinition({
+			nativeEvent,
+			raw
+		})).filter((def) => def !== void 0);
 		if (defs.length > 0) canonical[rulesyncEvent] = defs;
 	}
 	return canonical;
@@ -17255,6 +17826,38 @@ function stripTrustedDirectoryWrapper(command) {
 	if (posix?.[1]) return posix[1];
 	return command.match(/^set "RULESYNC_KIMI_HOOK_CWD=1" && cd \/d "(?:""|[^"])*" && ([\s\S]*)$/)?.[1] ?? command;
 }
+/**
+* Native Kimi Code events whose Event Reference row lists the matcher as
+* "Empty string". Kimi Code documents `matcher` as "a regular expression to
+* filter event targets; if omitted, matches all", so on these events the
+* regex is tested against `""`: any non-trivial matcher simply never matches
+* and the hook silently never runs. Dropping the matcher is what makes the
+* hook fire at all, which is the authored intent — these events have no target
+* to filter on in the first place.
+*
+* Keyed on native names because the check runs after the canonical → native
+* mapping: `SessionHeartbeat` and `Interrupt` have no canonical counterpart and
+* are only reachable through a per-tool `kimi-code` override naming them
+* directly.
+*
+* Deliberately narrower than Claude Code's equivalent set: Kimi Code's
+* `UserPromptSubmit` matches the submitted prompt text, and `PermissionResult`
+* matches the tool name, so a matcher on either is meaningful and is kept.
+*
+* @see https://moonshotai.github.io/kimi-code/en/customization/hooks.html
+*/
+const KIMI_CODE_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"Stop",
+	"SessionHeartbeat",
+	"Interrupt"
+]);
+/** Resolve the `matcher` part of an emitted entry, dropping dead matchers. */
+function resolveMatcherPart({ matcher, nativeEvent, logger }) {
+	if (!matcher) return {};
+	if (!KIMI_CODE_NO_MATCHER_EVENTS.has(nativeEvent)) return { matcher };
+	logger?.warn(`matcher "${matcher}" on "${nativeEvent}" hook will be ignored — this event does not support matchers`);
+	return {};
+}
 function buildEffectiveHooks(config, toolOverrideHooks) {
 	const supported = new Set(KIMI_CODE_HOOK_EVENTS);
 	const shared = {};
@@ -17284,7 +17887,11 @@ function canonicalToKimiCodeHooks({ config, toolOverrideHooks, trustedDirectory,
 					command: definition.command,
 					trustedDirectory
 				}),
-				...definition.matcher && { matcher: definition.matcher },
+				...resolveMatcherPart({
+					matcher: definition.matcher,
+					nativeEvent,
+					logger
+				}),
 				...validTimeout && timeout !== void 0 && { timeout }
 			});
 		}
@@ -17482,17 +18089,33 @@ function buildKiroIdeEntriesForEvent(trigger, definitions) {
 	}
 	return entries;
 }
-function canonicalToKiroIdeHooks(config, overrideKey) {
+/**
+* The single `HooksConfig` key every Kiro target reads its tool-specific
+* overrides from.
+*
+* `kiro-ide` and `kiro-cli` write the same `.kiro/hooks/rulesync.json` at both
+* scopes, so per-target override blocks would make that one file's content
+* depend on generation order (last writer wins). All Kiro variants therefore
+* share the `kiro` block — the same resolution the Kiro MCP and permissions
+* wiring already use for the file they share.
+*/
+const KIRO_HOOKS_OVERRIDE_KEY = "kiro";
+/**
+* Override keys a user might reach for that nothing reads, mapped to the key
+* that is actually read.
+*/
+const KIRO_HOOKS_IGNORED_OVERRIDE_KEYS = ["kiro-ide", "kiro-cli"];
+function canonicalToKiroIdeHooks(config) {
 	const kiroIdeSupported = new Set(KIRO_IDE_HOOK_EVENTS);
 	const sharedHooks = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (kiroIdeSupported.has(event)) sharedHooks[event] = defs;
 	const effectiveHooks = {
 		...sharedHooks,
-		...config[overrideKey]?.hooks
+		...config[KIRO_HOOKS_OVERRIDE_KEY]?.hooks
 	};
 	const entries = [];
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
-		const trigger = CANONICAL_TO_KIRO_IDE_EVENT_NAMES[eventName] ?? eventName;
+		const trigger = CANONICAL_TO_KIRO_IDE_EVENT_NAMES[eventName] ?? KIRO_LEGACY_TO_KIRO_IDE_TRIGGER_NAMES[eventName] ?? eventName;
 		entries.push(...buildKiroIdeEntriesForEvent(trigger, definitions));
 	}
 	return entries;
@@ -17537,6 +18160,11 @@ function kiroIdeHooksToCanonical(entries) {
 * still writes the embedded `.kiro/agents/default.json` agent-config shape,
 * which Kiro CLI 3.0 no longer reads.
 *
+* Because both targets write the very same file, they resolve their
+* tool-specific overrides from one shared block
+* ({@link KIRO_HOOKS_OVERRIDE_KEY}) rather than per-target blocks, so
+* generating either or both targets always yields the same file.
+*
 * @see https://kiro.dev/docs/hooks/
 */
 var KiroIdeHooks = class extends ToolHooks {
@@ -17549,14 +18177,6 @@ var KiroIdeHooks = class extends ToolHooks {
 			}, null, 2)
 		});
 	}
-	/**
-	* The `HooksConfig` key whose `hooks` block provides tool-specific overrides
-	* for this target. {@link import("./kiro-cli-hooks.js").KiroCliHooks}
-	* overrides this to `kiro-cli`.
-	*/
-	static getOverrideKey() {
-		return "kiro-ide";
-	}
 	static getSettablePaths(_options = {}) {
 		return {
 			relativeDirPath: KIRO_IDE_HOOKS_DIR_PATH,
@@ -17577,9 +18197,14 @@ var KiroIdeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
-		const hooks = canonicalToKiroIdeHooks(rulesyncHooks.getJson(), this.getOverrideKey());
+		const config = rulesyncHooks.getJson();
+		for (const ignoredKey of KIRO_HOOKS_IGNORED_OVERRIDE_KEYS) {
+			if (config[ignoredKey]?.hooks === void 0) continue;
+			logger?.warn(`The "${ignoredKey}.hooks" block in ${(0, node_path.join)(rulesyncHooks.getRelativeDirPath(), rulesyncHooks.getRelativeFilePath())} is ignored. Author it under the "${KIRO_HOOKS_OVERRIDE_KEY}.hooks" key instead: the Kiro IDE and Kiro CLI targets write the same hooks file, so they read one shared block.`);
+		}
+		const hooks = canonicalToKiroIdeHooks(config);
 		const fileContent = JSON.stringify({
 			version: "v1",
 			hooks
@@ -17600,10 +18225,9 @@ var KiroIdeHooks = class extends ToolHooks {
 			throw new Error(`Failed to parse Kiro IDE hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = kiroIdeHooksToCanonical(parsed.hooks ?? []);
-		const overrideKey = this.constructor.getOverrideKey();
 		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
 			hooks,
-			overrideKey
+			overrideKey: KIRO_HOOKS_OVERRIDE_KEY
 		}), null, 2) });
 	}
 	validate() {
@@ -17631,9 +18255,13 @@ var KiroIdeHooks = class extends ToolHooks {
 * Hooks generator for the **Kiro CLI**.
 *
 * Kiro CLI 3.0 reads the same standalone `.kiro/hooks/*.json` v1 format the
-* Kiro IDE reads, so this reuses {@link KiroIdeHooks} and only redirects the
-* tool-specific override key to `kiro-cli` (so `kiro-cli.hooks` overrides in
-* the rulesync hooks config are honored, rather than `kiro-ide.hooks`).
+* Kiro IDE reads — the same directory, and in rulesync the same
+* `.kiro/hooks/rulesync.json` file — so this is {@link KiroIdeHooks} under a
+* second target name, down to the shared `kiro` override block both resolve
+* their tool-specific hooks from. A per-target override block would make that
+* one file's content depend on which target was generated last, which is
+* exactly what the shared block avoids (the Kiro MCP and permissions wiring
+* resolve their shared files the same way).
 *
 * The embedded `.kiro/agents/default.json` agent-hook format this target used
 * to emit is documented as not working in 3.0, so it is left to the deprecated
@@ -17642,11 +18270,7 @@ var KiroIdeHooks = class extends ToolHooks {
 * @see https://kiro.dev/docs/cli/v3/hooks-migration/
 * @see https://kiro.dev/docs/hooks/
 */
-var KiroCliHooks = class extends KiroIdeHooks {
-	static getOverrideKey() {
-		return "kiro-cli";
-	}
-};
+var KiroCliHooks = class extends KiroIdeHooks {};
 //#endregion
 //#region src/features/hooks/kiro-hooks.ts
 /**
@@ -17671,14 +18295,30 @@ function buildKiroEntriesForEvent(definitions) {
 	}
 	return entries;
 }
-function canonicalToKiroHooks(config) {
+/**
+* Event keys the embedded agent-config format defines: the canonical events it
+* supports plus its own native spellings (`agentSpawn`, `userPromptSubmit`, …).
+*
+* The `kiro` override block is shared with the standalone `.kiro/hooks/*.json`
+* targets, whose vocabulary is different (`PostFileSave`, `PreTaskExec`, …).
+* Passing those through here would write event keys Kiro does not define into
+* `.kiro/agents/default.json`, so they are dropped instead.
+* @see https://kiro.dev/docs/cli/v3/hooks-migration/
+*/
+const KIRO_AGENT_CONFIG_EVENT_KEYS = /* @__PURE__ */ new Set([...KIRO_HOOK_EVENTS, ...KIRO_AGENT_CONFIG_NATIVE_EVENT_NAMES]);
+function canonicalToKiroHooks({ config, logger }) {
 	const overrideKey = "kiro";
 	const kiroSupported = new Set(KIRO_HOOK_EVENTS);
 	const sharedHooks = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (kiroSupported.has(event)) sharedHooks[event] = defs;
+	const overrideHooks = {};
+	const droppedEvents = [];
+	for (const [event, defs] of Object.entries(config[overrideKey]?.hooks ?? {})) if (KIRO_AGENT_CONFIG_EVENT_KEYS.has(event)) overrideHooks[event] = defs;
+	else droppedEvents.push(event);
+	if (droppedEvents.length > 0) logger?.warn(`Skipped hook event(s) from the "kiro" override block for the deprecated kiro agent config (no event key of that format): ${droppedEvents.join(", ")}. They are emitted for the kiro-cli / kiro-ide targets, which read the same block.`);
 	const effectiveHooks = {
 		...sharedHooks,
-		...config[overrideKey]?.hooks
+		...overrideHooks
 	};
 	const kiro = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
@@ -17773,11 +18413,14 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = KiroHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
-		const kiroHooks = canonicalToKiroHooks(rulesyncHooks.getJson());
+		const kiroHooks = canonicalToKiroHooks({
+			config: rulesyncHooks.getJson(),
+			logger
+		});
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
@@ -17893,6 +18536,30 @@ const PI_TOOL_EVENTS = /* @__PURE__ */ new Set(["tool_call", "tool_result"]);
 */
 const PI_ASSISTANT_MESSAGE_EVENTS = /* @__PURE__ */ new Set(["message_end"]);
 /**
+* `tool_call` is the only Pi extension event that can block, and it is Pi's
+* only tool gate. Its return contract is
+* `{ block: true, reason?: string, terminate?: boolean }`.
+*
+* @see https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool_call
+*/
+const PI_BLOCKING_EVENT = "tool_call";
+/**
+* Helper emitted alongside blocking handlers. `promisify(exec)` rejects on a
+* non-zero exit with an error carrying `stdout` / `stderr` / `code`, so the
+* reason is derived from the rejection rather than from a resolved exit code.
+*/
+const BLOCK_REASON_HELPER_LINES = [
+	"function toBlockReason(error: unknown): string {",
+	"  const result = error as { stdout?: unknown; stderr?: unknown; code?: unknown } | null;",
+	"  const stderr = String(result?.stderr ?? \"\").trim();",
+	"  if (stderr) return stderr;",
+	"  const stdout = String(result?.stdout ?? \"\").trim();",
+	"  if (stdout) return stdout;",
+	"  if (result?.code !== undefined) return `Hook command failed with exit code ${result.code}.`;",
+	"  return error instanceof Error ? error.message : String(error);",
+	"}"
+];
+/**
 * Validate a hook matcher as a regular expression and return it as a JS
 * string-literal (JSON.stringify quoting) safe to embed in generated code.
 */
@@ -17929,6 +18596,22 @@ function collectPiHandlers({ effectiveHooks, eventMap }) {
 	}
 	return handlerGroups;
 }
+function buildCommandLines({ handler, usesToolName, blocksToolCall }) {
+	const lines = [];
+	const gated = usesToolName && Boolean(handler.matcher);
+	const indent = gated ? "      " : "    ";
+	const embeddedCommand = JSON.stringify(handler.command);
+	if (gated && handler.matcher) lines.push(`    if (new RegExp(${matcherToEmbeddedLiteral(handler.matcher)}).test(event.toolName)) {`);
+	if (blocksToolCall) {
+		lines.push(`${indent}try {`);
+		lines.push(`${indent}  await run(${embeddedCommand});`);
+		lines.push(`${indent}} catch (error) {`);
+		lines.push(`${indent}  return { block: true, reason: toBlockReason(error) };`);
+		lines.push(`${indent}}`);
+	} else lines.push(`${indent}await run(${embeddedCommand});`);
+	if (gated) lines.push("    }");
+	return lines;
+}
 function buildSubscriptionLines(handlerGroups) {
 	const lines = [];
 	for (const [piEvent, handlers] of Object.entries(handlerGroups)) {
@@ -17937,14 +18620,11 @@ function buildSubscriptionLines(handlerGroups) {
 		const usesEvent = usesToolName || gatesOnAssistant;
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${usesEvent ? "event" : ""}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
-		for (const handler of handlers) {
-			const embeddedCommand = JSON.stringify(handler.command);
-			if (usesToolName && handler.matcher) {
-				lines.push(`    if (new RegExp(${matcherToEmbeddedLiteral(handler.matcher)}).test(event.toolName)) {`);
-				lines.push(`      await run(${embeddedCommand});`);
-				lines.push("    }");
-			} else lines.push(`    await run(${embeddedCommand});`);
-		}
+		for (const handler of handlers) lines.push(...buildCommandLines({
+			handler,
+			usesToolName,
+			blocksToolCall: piEvent === PI_BLOCKING_EVENT
+		}));
 		lines.push("  });");
 	}
 	return lines;
@@ -17953,8 +18633,9 @@ function buildSubscriptionLines(handlerGroups) {
 * Generate the rulesync-owned Pi extension (a TypeScript module with a
 * default-export factory receiving Pi's ExtensionAPI) that subscribes to the
 * mapped lifecycle events and executes the configured hook commands via the
-* platform shell. The generated extension observes events only: it never
-* blocks or mutates Pi events.
+* platform shell. Handlers observe events, except on `tool_call` — Pi's only
+* blocking event and its only tool gate — where a hook command that exits
+* non-zero denies the call with `{ block: true, reason }`.
 *
 * @see https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md
 */
@@ -17966,10 +18647,12 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap }) {
 	};
 	const effectiveHooks = {};
 	for (const [event, defs] of Object.entries(configHooks)) if (supported.has(event)) effectiveHooks[event] = defs;
-	const subscriptionLines = buildSubscriptionLines(collectPiHandlers({
+	const handlerGroups = collectPiHandlers({
 		effectiveHooks,
 		eventMap
-	}));
+	});
+	const subscriptionLines = buildSubscriptionLines(handlerGroups);
+	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]);
 	const lines = ["// Generated by rulesync. Do not edit manually."];
 	if (subscriptionLines.length === 0) {
 		lines.push("export default function () {}");
@@ -17983,6 +18666,10 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap }) {
 	lines.push("");
 	lines.push("const run = promisify(exec);");
 	lines.push("");
+	if (needsBlockReasonHelper) {
+		lines.push(...BLOCK_REASON_HELPER_LINES);
+		lines.push("");
+	}
 	lines.push("export default function (pi: ExtensionAPI) {");
 	lines.push(...subscriptionLines);
 	lines.push("}");
@@ -18712,6 +19399,20 @@ function unsupportedMatcherEventNames({ factory, effectiveHooks }) {
 	}
 	return [...eventsWithMatcher];
 }
+/**
+* Targets that read their tool-scoped `{key}.hooks` override from a differently
+* named key. The two Kiro standalone-format targets write the very same
+* `.kiro/hooks/rulesync.json`, so they share the `kiro` block: a per-target
+* block would make that one file's content depend on generation order. The same
+* resolution is used by the MCP (`MCP_BLOCK_KEY_ALIASES`) and permissions
+* (`PERMISSION_OVERRIDE_KEY_ALIASES`) features for the files they share.
+*/
+const HOOKS_OVERRIDE_KEY_ALIASES = {
+	"kiro-cli": KIRO_HOOKS_OVERRIDE_KEY,
+	"kiro-ide": KIRO_HOOKS_OVERRIDE_KEY
+};
+/** The targets writing the standalone `.kiro/hooks/*.json` v1 format. */
+const KIRO_STANDALONE_HOOKS_TARGETS = /* @__PURE__ */ new Set(["kiro-cli", "kiro-ide"]);
 const toolHooksFactories = /* @__PURE__ */ new Map([
 	["amp", {
 		class: AmpHooks,
@@ -18952,7 +19653,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: KIRO_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: true
+		supportsMatcher: true,
+		passthroughOverrideEvents: true
 	}],
 	["kiro-cli", {
 		class: KiroCliHooks,
@@ -19132,7 +19834,7 @@ var HooksProcessor = class extends FeatureProcessor {
 		if (!factory) throw new Error(`Unsupported tool target: ${this.toolTarget}`);
 		const config = rulesyncHooks.getJson();
 		const sharedHooks = config.hooks;
-		const overrideHooks = config[this.toolTarget]?.hooks ?? {};
+		const overrideHooks = config[HOOKS_OVERRIDE_KEY_ALIASES[this.toolTarget] ?? this.toolTarget]?.hooks ?? {};
 		const effectiveHooks = {
 			...sharedHooks,
 			...overrideHooks
@@ -19158,14 +19860,14 @@ var HooksProcessor = class extends FeatureProcessor {
 			}
 			for (const [hookType, events] of unsupportedTypeToEvents) this.logger.warn(`Skipped ${hookType}-type hook(s) for ${this.toolTarget} (not supported): ${Array.from(events).join(", ")}`);
 		}
-		if (this.toolTarget !== "kiro-ide") {
+		if (!KIRO_STANDALONE_HOOKS_TARGETS.has(this.toolTarget)) {
 			const skippedEvents = new Set(unsupportedEventNames({
 				factory,
 				sharedHooks,
 				effectiveHooks
 			}));
 			const eventsWithDisabledHooks = Object.entries(sharedHooks).filter(([event, defs]) => !skippedEvents.has(event) && defs.some((def) => def.enabled === false)).map(([event]) => event);
-			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only kiro-ide supports the flag): ${eventsWithDisabledHooks.join(", ")}`);
+			if (eventsWithDisabledHooks.length > 0) this.logger.warn(`Emitting "enabled: false" hook(s) as active for ${this.toolTarget} (only the kiro-cli / kiro-ide standalone hooks format supports the flag): ${eventsWithDisabledHooks.join(", ")}`);
 		}
 		const eventsWithUnsupportedMatcher = unsupportedMatcherEventNames({
 			factory,
@@ -19664,9 +20366,11 @@ var CursorIgnore = class CursorIgnore extends ToolIgnore {
 *
 * Generates the brand-aligned `.devinignore` file with gitignore-compatible
 * syntax. Devin automatically respects `.gitignore` patterns and has built-in
-* defaults for node_modules/ and hidden files. On import, the legacy
-* `.codeiumignore` filename is read as a fallback so existing projects still
-* round-trip.
+* defaults for node_modules/ and hidden files. On import, the pre-rebrand
+* `.codeiumignore` and `.windsurfignore` filenames are read as fallbacks so
+* existing projects still round-trip. The docs list the three names side by
+* side without defining a precedence between them, so the order below is
+* rulesync's own choice: brand-aligned name first, then the legacy names.
 *
 * In global mode the enterprise-wide `~/.codeium/.codeiumignore` is written
 * instead; see `DEVIN_GLOBAL_IGNORE_DIR_PATH` for why that path keeps the
@@ -19705,9 +20409,16 @@ var DevinIgnore = class DevinIgnore extends ToolIgnore {
 			validate,
 			global
 		});
-		const primaryPath = (0, node_path.join)(outputRoot, relativeDirPath, relativeFilePath);
-		const legacyPath = (0, node_path.join)(outputRoot, relativeDirPath, DEVIN_LEGACY_IGNORE_FILE_NAME);
-		const resolvedFilePath = !await fileExists(primaryPath) && await fileExists(legacyPath) ? DEVIN_LEGACY_IGNORE_FILE_NAME : relativeFilePath;
+		const candidateFileNames = [
+			relativeFilePath,
+			DEVIN_LEGACY_IGNORE_FILE_NAME,
+			DEVIN_WINDSURF_IGNORE_FILE_NAME
+		];
+		let resolvedFilePath = relativeFilePath;
+		for (const candidateFileName of candidateFileNames) if (await fileExists((0, node_path.join)(outputRoot, relativeDirPath, candidateFileName))) {
+			resolvedFilePath = candidateFileName;
+			break;
+		}
 		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativeDirPath, resolvedFilePath));
 		return new DevinIgnore({
 			outputRoot,
@@ -22936,8 +23647,8 @@ function convertToGoosePluginMcpServers(mcpServers, logger) {
 *   shape and cannot express `url`/`headers`, so remote servers are skipped with
 *   a warning in project mode (use `--global` to sync them instead).
 *
-* @see https://block.github.io/goose/docs/getting-started/using-extensions/
-* @see https://github.com/block/goose/pull/9471
+* @see https://goose-docs.ai/docs/getting-started/using-extensions/
+* @see https://github.com/aaif-goose/goose/pull/9471
 */
 var GooseMcp = class GooseMcp extends ToolMcp {
 	config;
@@ -23208,7 +23919,7 @@ function resolveHermesTimeout(config) {
 * alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
 * path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
 * `connect_timeout` (seconds), `supports_parallel_tool_calls`,
-* `keepalive_interval`, and `elicitation` — verbatim
+* `keepalive_interval`, `elicitation`, `trust`, and `identity_header` — verbatim
 * from `source` to `target`. Field names are identical on both sides (the
 * canonical `McpServerSchema` is a `looseObject`), so this serves export and
 * import alike. See the Hermes mcp-config-reference.
@@ -23277,6 +23988,14 @@ function copyHermesAdvancedFields(source, target) {
 		target.elicitation = omitPrototypePollutionKeys(structuredClone(source.elicitation));
 		copied = true;
 	}
+	if (typeof source.trust === "string") {
+		target.trust = source.trust;
+		copied = true;
+	}
+	if (isPlainObject$1(source.identity_header)) {
+		target.identity_header = omitPrototypePollutionKeys(structuredClone(source.identity_header));
+		copied = true;
+	}
 	return copied;
 }
 /**
@@ -24441,6 +25160,213 @@ var KiroMcp = class KiroMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/constants/musecode-paths.ts
+const MUSECODE_RULE_FILE_NAME = "AGENTS.md";
+const MUSECODE_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
+const MUSECODE_GLOBAL_CONFIG_DIR_PATH = (0, node_path.join)(".config", "muse");
+const MUSECODE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(MUSECODE_GLOBAL_CONFIG_DIR_PATH, "skills");
+const MUSECODE_SETTINGS_FILE_NAME = "settings.json";
+//#endregion
+//#region src/features/mcp/musecode-mcp.ts
+const MUSECODE_GLOBAL_ONLY_MESSAGE = "Muse Code MCP is global-only; use --global to sync ~/.config/muse/settings.json";
+/**
+* Single spelling of the settings.json codec/policy, matching the
+* `SHARED_CONFIG_OWNERSHIP` declaration for `.config/muse/settings.json`:
+* fail closed on an unparseable root rather than replacing the user's primary
+* Muse Code config with generated output.
+*/
+function parseMusecodeSettings(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "json",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Convert canonical rulesync servers to Muse Code's native `mcp_servers` shape.
+* Each entry carries a `transport` discriminator: `stdio` servers spawn a
+* `command` (single string) with `args`/`env`, and `streamable_http` servers
+* are reached at a `url` with optional `headers`. Only documented fields are
+* emitted; a canonical `disabled: true` maps to Muse's `enabled: false`.
+*/
+function convertToMusecodeFormat(mcpServers, logger) {
+	const result = {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!isRecord$1(config)) continue;
+		if (declaresNoTransport(config)) {
+			warnAndSkipMcpServer({
+				toolName: "Muse Code",
+				serverName: name,
+				reason: "no transport",
+				logger
+			});
+			continue;
+		}
+		const converted = {};
+		if (isRemoteMcpServer(config)) {
+			const url = resolveRemoteMcpUrl(config);
+			if (!url) {
+				warnAndSkipMcpServer({
+					toolName: "Muse Code",
+					serverName: name,
+					reason: "a remote transport without a url",
+					logger
+				});
+				continue;
+			}
+			const stated = config.type ?? config.transport;
+			if (stated === "sse" || stated === "ws" || stated === void 0 && /^wss?:\/\//i.test(url)) {
+				warnAndSkipMcpServer({
+					toolName: "Muse Code",
+					serverName: name,
+					reason: `the "${stated ?? "ws"}" transport, which Muse Code does not implement (only stdio and streamable_http are supported)`,
+					logger
+				});
+				continue;
+			}
+			converted.transport = "streamable_http";
+			converted.url = url;
+			if (config.headers && Object.keys(config.headers).length > 0) converted.headers = config.headers;
+		} else {
+			const [command, ...args] = resolveLocalMcpCommand(config);
+			if (!command) {
+				warnAndSkipMcpServer({
+					toolName: "Muse Code",
+					serverName: name,
+					reason: "a stdio transport without a command",
+					logger
+				});
+				continue;
+			}
+			converted.transport = "stdio";
+			converted.command = command;
+			converted.args = args;
+			if (config.env && Object.keys(config.env).length > 0) converted.env = config.env;
+		}
+		if (config.disabled === true) converted.enabled = false;
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Convert Muse Code's native `mcp_servers` shape back to canonical rulesync
+* servers. The `transport` discriminator is dropped (`streamable_http` is not a
+* canonical enum value; the transport is re-derived from `command`/`url` on the
+* next generate), `enabled: false` maps back to `disabled: true`, and unknown
+* keys (e.g. `mode`, `framing`) pass through untouched.
+*/
+function convertFromMusecodeFormat(musecodeMcp) {
+	const result = {};
+	for (const [name, config] of Object.entries(musecodeMcp)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const converted = {};
+		for (const [key, value] of Object.entries(config)) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (key === "transport") continue;
+			if (key === "enabled") {
+				if (value === false) converted.disabled = true;
+				continue;
+			}
+			converted[key] = value;
+		}
+		result[name] = converted;
+	}
+	return result;
+}
+/**
+* Meta Muse Code MCP servers.
+*
+* Muse Code reads MCP servers only from the `mcp_servers` block of the GLOBAL
+* user settings file `~/.config/muse/settings.json`; no project-scoped MCP
+* location is documented. The settings file must carry
+* `"schema_version": 1` — a file that omits that key fails every command at
+* startup with `malformed settings file` — so the key is bootstrapped when the
+* file is created and preserved when it already exists. Other settings keys are
+* preserved via the shared-config gateway, and the file is never deleted.
+*
+* @see https://dev.meta.ai/docs/muse-code/configuration.md
+* @see https://dev.meta.ai/docs/muse-code/extending.md
+*/
+var MusecodeMcp = class MusecodeMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseMusecodeSettings(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths(_options) {
+		return {
+			relativeDirPath: MUSECODE_GLOBAL_CONFIG_DIR_PATH,
+			relativeFilePath: MUSECODE_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		if (!global) throw new Error(MUSECODE_GLOBAL_ONLY_MESSAGE);
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new MusecodeMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		if (!global) throw new Error(MUSECODE_GLOBAL_ONLY_MESSAGE);
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parseMusecodeSettings(existingContent, filePath);
+		const converted = convertToMusecodeFormat(rulesyncMcp.getMcpServers(), logger);
+		return new MusecodeMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: {
+					mcp_servers: converted,
+					...existing.schema_version === void 0 && { schema_version: 1 }
+				},
+				filePath
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const converted = convertFromMusecodeFormat(isRecord$1(this.json.mcp_servers) ? this.json.mcp_servers : {});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: converted }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new MusecodeMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: JSON.stringify({ mcp_servers: {} }, null, 2),
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/opencode-mcp.ts
 const OPENCODE_ENV_VAR_PATTERN = /(?<!\$)\{env:([^}:]+)\}/g;
 const OpencodeMcpLocalServerSchema = zod_mini.z.looseObject({
@@ -26397,6 +27323,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: false
 		}
 	}],
+	["musecode", {
+		class: MusecodeMcp,
+		meta: {
+			supportsProject: false,
+			supportsGlobal: true,
+			supportsEnabledTools: false,
+			supportsDisabledTools: false
+		}
+	}],
 	["opencode", {
 		class: OpencodeMcp,
 		meta: {
@@ -29212,6 +30147,163 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 	}
 };
 //#endregion
+//#region src/features/permissions/copilotcli-permissions.ts
+/**
+* The only canonical category the Copilot CLI settings can express: URL
+* approvals. Every other category (`bash`, `edit`, `read`, ...) has no
+* user-authorable surface — the CLI's `permissions.allow`/`ask`/`deny` rule
+* arrays are accepted only in MDM/enterprise managed settings, and session
+* tool approvals are machine-written to `permissions-config.json`.
+*/
+const WEBFETCH_CATEGORY = "webfetch";
+/** `~/.copilot/settings.json` and `.github/copilot/settings.json` keys. */
+const ALLOWED_URLS_KEY = "allowedUrls";
+const DENIED_URLS_KEY = "deniedUrls";
+function toUrlList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((entry) => typeof entry === "string");
+}
+/**
+* Split one canonical category's rules into the two URL lists. `ask` entries
+* are omitted: the CLI prompts for any URL that is in neither list, which is
+* exactly what `ask` means.
+*/
+function splitUrlRules(rules) {
+	const allowedUrls = [];
+	const deniedUrls = [];
+	for (const [pattern, action] of Object.entries(rules)) if (action === "allow") allowedUrls.push(pattern);
+	else if (action === "deny") deniedUrls.push(pattern);
+	return {
+		allowedUrls,
+		deniedUrls
+	};
+}
+/**
+* Permissions generator for the GitHub Copilot CLI.
+*
+* The CLI keeps two persistent settings files: the user-scope
+* `~/.copilot/settings.json` and the repository-scope
+* `.github/copilot/settings.json` (shipped in v1.0.60). Both are shared,
+* hand-edited files carrying unrelated keys (`model`, `effortLevel`, `hooks`,
+* `sandbox.*`, ...), so writes go through the shared-config gateway, only the
+* URL keys are owned, and the file is never deleted.
+*
+* The canonical `webfetch` category maps onto the CLI's two URL lists:
+* `allow` → `allowedUrls`, `deny` → `deniedUrls`, `ask` → the pattern is
+* omitted so the CLI falls through to its approval prompt.
+*
+* Scope asymmetry: the repository-scope key table documents `deniedUrls`
+* (union — a repository may add entries, never remove them) but NOT
+* `allowedUrls`, so an allow rule is only enforceable at user scope. At project
+* scope allow rules are therefore dropped with a warning rather than written to
+* a key the CLI ignores. (v1.0.79 additionally warns on startup about unknown
+* top-level keys in the user `settings.json`, so only documented keys are ever
+* emitted there either.)
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+* @see https://github.com/github/copilot-cli/blob/main/changelog.md
+*/
+var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	/**
+	* `settings.json` holds unrelated user settings (`model`, `effortLevel`,
+	* `hooks`, ...), so it must not be deleted.
+	*/
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return global ? {
+			relativeDirPath: COPILOT_DIR,
+			relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+		} : {
+			relativeDirPath: COPILOTCLI_PROJECT_SETTINGS_DIR_PATH,
+			relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = CopilotcliPermissions.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new CopilotcliPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
+		const paths = CopilotcliPermissions.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const rules = rulesyncPermissions.getJson().permission[WEBFETCH_CATEGORY];
+		const patch = {};
+		if (rules !== void 0) {
+			const { allowedUrls, deniedUrls } = splitUrlRules(rules);
+			patch[DENIED_URLS_KEY] = deniedUrls.length > 0 ? deniedUrls : void 0;
+			if (global) patch[ALLOWED_URLS_KEY] = allowedUrls.length > 0 ? allowedUrls : void 0;
+			else if (allowedUrls.length > 0) logger?.warn(`Copilot CLI permissions: dropping ${allowedUrls.length} "webfetch" allow rule(s) at project scope — ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${ALLOWED_URLS_KEY}" (repository settings may only add denials). Author allow rules in global scope (\`--global\`) instead.`);
+		}
+		return new CopilotcliPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch,
+				filePath
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const settings = this.parseSettings();
+		const rules = {};
+		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
+		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
+		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY]: rules } : {};
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+	}
+	parseSettings() {
+		const relativePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
+		try {
+			return parseSharedConfig({
+				format: "json",
+				fileContent: this.getFileContent() || "{}",
+				filePath: relativePath,
+				invalidRootPolicy: "error"
+			});
+		} catch (error) {
+			throw new Error(`Failed to parse Copilot CLI settings in ${relativePath}: ${formatError(error)}`, { cause: error });
+		}
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new CopilotcliPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/permissions/cursor-permissions.ts
 /**
 * Mapping from rulesync canonical tool category names (lowercase) to Cursor CLI
@@ -30229,6 +31321,9 @@ const GROK_TOOL_TO_CATEGORY = {
 	WebSearch: "websearch"
 };
 const GROK_MCP_TOOL = "MCPTool";
+const GROK_TOOL_TO_CATEGORY_LOWER = Object.fromEntries(Object.entries(GROK_TOOL_TO_CATEGORY).map(([tool, category]) => [tool.toLowerCase(), category]));
+const GROK_MCP_TOOL_ALIASES = /* @__PURE__ */ new Set(["mcp", GROK_MCP_TOOL.toLowerCase()]);
+const GROKCLI_PERMISSION_RULES_KEY = "rules";
 /**
 * Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
 * `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
@@ -30281,6 +31376,44 @@ function parseGrokEntry(entry) {
 	};
 }
 /**
+* Parse one entry of the verbose `[[permission.rules]]` form
+* (`{ action = "allow", tool = "bash", pattern = "git *" }`) into a canonical
+* category + pattern + action. Unlike the compact array entries these are TOML
+* tables, so the tool name arrives as its own field instead of an entry string.
+* Returns `null` for malformed entries and for tools with no canonical
+* equivalent, so callers can skip them (the whole `rules` array is preserved
+* verbatim on generate regardless).
+*/
+function parseGrokRule(rule) {
+	if (!isRecord$1(rule)) return null;
+	const { action: rawAction, tool, pattern } = rule;
+	const parsedAction = PermissionActionSchema.safeParse(rawAction);
+	if (!parsedAction.success) return null;
+	const action = parsedAction.data;
+	if (typeof tool !== "string") return null;
+	if (pattern !== void 0 && typeof pattern !== "string") return null;
+	const trimmedPattern = pattern?.trim() ?? "";
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$2;
+	const lowerTool = tool.trim().toLowerCase();
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$2 ? {
+		category: "mcp",
+		pattern: CATCH_ALL_PATTERN$2,
+		action
+	} : {
+		category: `${MCP_CANONICAL_PREFIX$1}${resolvedPattern}`,
+		pattern: CATCH_ALL_PATTERN$2,
+		action
+	};
+	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
+	const category = GROK_TOOL_TO_CATEGORY_LOWER[lowerTool];
+	if (category === void 0) return null;
+	return {
+		category,
+		pattern: resolvedPattern,
+		action
+	};
+}
+/**
 * Permissions adapter for the xAI Grok Build CLI (`grokcli`).
 *
 * Grok Build CLI ships a Claude-style rule system under `[permission]` in
@@ -30301,9 +31434,17 @@ function parseGrokEntry(entry) {
 *     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
 *     the strictest wins (`deny > ask > allow`) and a warning is logged, so the
 *     entry never lands contradictorily in two arrays.
-*   - Import: the `[permission]` arrays are parsed back into canonical
-*     categories. When no `[permission]` section is present (older configs), the
-*     coarse `[ui] permission_mode` is used as a fallback.
+*   - Import: both documented `[permission]` forms are parsed back into
+*     canonical categories — the compact `allow`/`deny`/`ask` arrays and the
+*     verbose `[[permission.rules]]` tables
+*     (`{ action = "allow", tool = "bash", pattern = "git *" }`), whose `tool`
+*     field is matched case-insensitively against the same tool table, plus
+*     the documented `mcp` alias for the compact form's `MCPTool`. Rules
+*     from the two forms are merged with the same `deny > ask > allow`
+*     precedence. When neither form carries a rule (older configs), the coarse
+*     `[ui] permission_mode` is used as a fallback. Generate always emits the
+*     compact arrays, so a user-authored `rules` array is preserved verbatim
+*     but not reconciled against them.
 *
 * The coarse `[ui] permission_mode` toggle is still written for backward
 * compatibility with older Grok versions: `always-approve` when the config is
@@ -30470,29 +31611,44 @@ function buildGrokPermissionArrays(config, existingPermission, logger) {
 	};
 }
 /**
-* Parse Grok's `[permission]` allow/deny/ask arrays back into a canonical
-* permission map. Returns `null` when the section defines none of the three
-* arrays, so the caller can fall back to the coarse `permission_mode`.
-* Precedence `deny > ask > allow` is applied so a tool listed in multiple
-* arrays resolves to the strictest action.
+* Parse Grok's `[permission]` section back into a canonical permission map,
+* reading both supported forms: the compact `allow`/`deny`/`ask` arrays of
+* Claude-style entries and the verbose `[[permission.rules]]` tables
+* (`{ action, tool, pattern }`). Returns `null` only when neither form carries
+* any rule, so the caller can fall back to the coarse `permission_mode`.
+* Precedence `deny > ask > allow` is applied across both forms, so a tool
+* described more than once resolves to the strictest action.
 */
 function parseGrokPermissionArrays(permission) {
 	const allow = isStringArray$1(permission.allow) ? permission.allow : void 0;
 	const deny = isStringArray$1(permission.deny) ? permission.deny : void 0;
 	const ask = isStringArray$1(permission.ask) ? permission.ask : void 0;
-	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) === 0) return null;
+	const rules = Array.isArray(permission[GROKCLI_PERMISSION_RULES_KEY]) ? permission[GROKCLI_PERMISSION_RULES_KEY] : void 0;
+	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
-	const apply = (entries, action) => {
+	const record = ({ category, pattern, action }) => {
+		const bucket = result[category] ??= {};
+		const existing = bucket[pattern];
+		if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) bucket[pattern] = action;
+	};
+	const applyEntries = (entries, action) => {
 		for (const entry of entries ?? []) {
 			const parsed = parseGrokEntry(entry);
 			if (parsed === null) continue;
-			const bucket = result[parsed.category] ??= {};
-			bucket[parsed.pattern] = action;
+			record({
+				...parsed,
+				action
+			});
 		}
 	};
-	apply(allow, "allow");
-	apply(ask, "ask");
-	apply(deny, "deny");
+	applyEntries(allow, "allow");
+	applyEntries(ask, "ask");
+	applyEntries(deny, "deny");
+	for (const rule of rules ?? []) {
+		const parsed = parseGrokRule(rule);
+		if (parsed === null) continue;
+		record(parsed);
+	}
 	return result;
 }
 /**
@@ -33177,6 +34333,13 @@ const TAKT_PROVIDER_PROFILES_KEY = "provider_profiles";
 const TAKT_DEFAULT_PERMISSION_MODE_KEY = "default_permission_mode";
 const TAKT_STEP_PERMISSION_OVERRIDES_KEY = "step_permission_overrides";
 const TAKT_PROVIDER_OPTIONS_KEY = "provider_options";
+const TAKT_RUNTIME_PROVIDER_KEY = "provider";
+const TAKT_RUNTIME_DEFAULTS_KEY = "defaults";
+const TAKT_RUNTIME_PROFILES_KEY = "profiles";
+const TAKT_RUNTIME_TARGETS_KEY = "targets";
+const TAKT_RUNTIME_AUTO_ROUTING_KEY = "auto_routing";
+const TAKT_RUNTIME_PROFILE_KEY = "profile";
+const TAKT_RUNTIME_OPTIONS_KEY = "options";
 const TAKT_SECURITY_POLICIES = {
 	workflow_arpeggio: [
 		"custom_data_source_modules",
@@ -33229,13 +34392,36 @@ const CATCH_ALL_PATTERN = "*";
 * profile, layered on top of `default_permission_mode`) and `provider_options`
 * (a top-level per-provider sandbox/network table). Both are authored on
 * generate and re-extracted on import.
+*
+* Takt 0.56.0 moved provider configuration into a separate `runtime.yaml`
+* (`.takt/runtime.yaml`, `~/.takt/runtime.yaml`). Once its `provider:` section
+* carries an assignment ("runtime mode" — the state a freshly installed Takt is
+* in, since it generates an active global runtime.yaml on first launch), any
+* legacy provider setting left in `config.yaml` makes Takt stop before running
+* an agent with "Mixed provider configuration detected". rulesync only reads
+* that file, in two places:
+*   - the active provider is resolved from it first (the `provider_profiles`
+*     key that carries the permission mode is still keyed by provider name, and
+*     `provider_profiles` is not itself a legacy signal);
+*   - an authored `provider_options` is refused with a warning rather than
+*     written while runtime mode is active, and its runtime-side counterpart
+*     (`provider.profiles.*.options`) is lifted back out on import.
+* Installs with no runtime.yaml, or an inactive one, keep the legacy behavior
+* unchanged.
 */
 var TaktPermissions = class TaktPermissions extends ToolPermissions {
-	constructor(params) {
+	/**
+	* The sibling `runtime.yaml` as read from the same scope, or `""` when the
+	* install has none. Import needs it — `toRulesyncPermissions()` is
+	* synchronous, so the file is read alongside config.yaml in `fromFile()`.
+	*/
+	runtimeFileContent;
+	constructor({ runtimeFileContent, ...params }) {
 		super({
 			...params,
 			fileContent: params.fileContent ?? ""
 		});
+		this.runtimeFileContent = runtimeFileContent ?? "";
 	}
 	isDeletable() {
 		return false;
@@ -33249,11 +34435,13 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
 		const paths = TaktPermissions.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		const runtimeFileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, "runtime.yaml")) ?? "";
 		return new TaktPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
+			runtimeFileContent,
 			validate,
 			global
 		});
@@ -33268,12 +34456,22 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 			filePath,
 			invalidRootPolicy: "error"
 		});
+		const runtime = await readTaktRuntimeConfig({
+			outputRoot,
+			logger
+		});
 		const rulesyncJson = rulesyncPermissions.getJson();
-		const provider = resolveActiveProvider(config);
+		const provider = resolveActiveProvider({
+			config,
+			runtime: runtime.active ? runtime.config : void 0
+		});
 		const mode = deriveTaktPermissionMode(rulesyncJson);
 		const override = isPlainObject$1(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
 		const stepOverrides = isPlainObject$1(override?.[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? override[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
-		const overrideProviderOptions = isPlainObject$1(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const authoredProviderOptions = isPlainObject$1(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const runtimeModeRefusesProviderOptions = authoredProviderOptions !== void 0 && runtime.active;
+		if (runtimeModeRefusesProviderOptions) logger?.warn(`Takt permissions: not writing "${TAKT_PROVIDER_OPTIONS_KEY}" to ${filePath} because ${runtime.filePaths.join(" + ")} puts Takt in runtime provider mode (Takt 0.56.0+), where any legacy provider setting in config.yaml makes Takt fail with "Mixed provider configuration detected". Move those options to \`provider.profiles.<profile>.options\` in runtime.yaml, and remove them from the \`takt\` block of the rulesync source. A "${TAKT_PROVIDER_OPTIONS_KEY}" already in ${filePath} is left untouched — rulesync does not own that key.`);
+		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : authoredProviderOptions;
 		const authoredPolicies = pickSecurityPolicies(override, {
 			filePath,
 			logger,
@@ -33319,13 +34517,26 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 			filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath()),
 			invalidRootPolicy: "error"
 		});
-		const provider = resolveActiveProvider(config);
+		const runtimeFilePath = (0, node_path.join)(this.getRelativeDirPath(), TAKT_RUNTIME_CONFIG_FILE_NAME);
+		const runtime = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.runtimeFileContent,
+			filePath: runtimeFilePath
+		});
+		const runtimeActive = isRuntimeModeActive(runtime);
+		const provider = resolveActiveProvider({
+			config,
+			runtime: runtimeActive ? runtime : void 0
+		});
 		const profiles = isPlainObject$1(config[TAKT_PROVIDER_PROFILES_KEY]) ? config[TAKT_PROVIDER_PROFILES_KEY] : {};
 		const profile = isPlainObject$1(profiles[provider]) ? profiles[provider] : {};
 		const mode = profile[TAKT_DEFAULT_PERMISSION_MODE_KEY];
 		const rulesyncConfig = taktModeToRulesyncConfig(mode);
 		const stepOverrides = isPlainObject$1(profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY]) ? profile[TAKT_STEP_PERMISSION_OVERRIDES_KEY] : void 0;
-		const providerOptions = isPlainObject$1(config[TAKT_PROVIDER_OPTIONS_KEY]) ? config[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
+		const providerOptions = mergeSharedConfigDeep({
+			base: isPlainObject$1(config[TAKT_PROVIDER_OPTIONS_KEY]) ? config[TAKT_PROVIDER_OPTIONS_KEY] : {},
+			patch: runtimeActive ? collectRuntimeProviderOptions(runtime) : {}
+		});
 		const taktOverride = {};
 		if (stepOverrides && Object.keys(stepOverrides).length > 0) taktOverride[TAKT_STEP_PERMISSION_OVERRIDES_KEY] = stepOverrides;
 		if (providerOptions && Object.keys(providerOptions).length > 0) taktOverride[TAKT_PROVIDER_OPTIONS_KEY] = providerOptions;
@@ -33352,10 +34563,18 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 	}
 };
 /**
-* Resolve the active Takt provider: the top-level `provider:` value, else the
-* sole key in `provider_profiles`, else the `claude` default.
+* Resolve the active Takt provider.
+*
+* Under runtime mode (Takt 0.56.0+) the real provider assignment lives in
+* `runtime.yaml`, and `config.yaml:provider` cannot coexist with it, so the
+* runtime document is consulted first: the provider of the profile named by
+* `provider.defaults.profile`. Everything else falls through to the legacy
+* chain — the top-level `provider:` value, else the sole key in
+* `provider_profiles`, else the `claude` default.
 */
-function resolveActiveProvider(config) {
+function resolveActiveProvider({ config, runtime }) {
+	const fromRuntime = runtime === void 0 ? void 0 : resolveRuntimeProvider(runtime);
+	if (fromRuntime !== void 0) return fromRuntime;
 	if (typeof config[TAKT_PROVIDER_KEY] === "string" && config[TAKT_PROVIDER_KEY].trim() !== "") return config[TAKT_PROVIDER_KEY];
 	const profiles = config[TAKT_PROVIDER_PROFILES_KEY];
 	if (isPlainObject$1(profiles)) {
@@ -33364,6 +34583,170 @@ function resolveActiveProvider(config) {
 	}
 	return TAKT_DEFAULT_PROVIDER;
 }
+/** A plain object carrying at least one entry (Takt's "assignment" test). */
+function hasEntries(value) {
+	return isPlainObject$1(value) && Object.keys(value).length > 0;
+}
+function runtimeProfiles(runtime) {
+	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	if (!isPlainObject$1(provider)) return {};
+	const profiles = provider[TAKT_RUNTIME_PROFILES_KEY];
+	return isPlainObject$1(profiles) ? profiles : {};
+}
+/**
+* Whether a parsed `runtime.yaml` puts Takt into runtime mode, mirroring
+* upstream's mode detection: the `provider:` section must carry an actual
+* assignment — a non-empty `defaults`, `profiles` or `auto_routing`, or a
+* `targets` map with at least one non-empty nested map. The file existing is not
+* enough, and empty nested maps (`defaults: {}`, `targets: { personas: {} }`)
+* must not flip the mode.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/mode.ts
+*/
+function isRuntimeModeActive(runtime) {
+	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	if (!isPlainObject$1(provider)) return false;
+	if (hasEntries(provider[TAKT_RUNTIME_DEFAULTS_KEY]) || hasEntries(provider[TAKT_RUNTIME_PROFILES_KEY]) || hasEntries(provider[TAKT_RUNTIME_AUTO_ROUTING_KEY])) return true;
+	const targets = provider[TAKT_RUNTIME_TARGETS_KEY];
+	return isPlainObject$1(targets) && Object.values(targets).some(hasEntries);
+}
+/** The provider named by the runtime profile Takt would use by default. */
+function resolveRuntimeProvider(runtime) {
+	const provider = runtime[TAKT_RUNTIME_PROVIDER_KEY];
+	const profiles = runtimeProfiles(runtime);
+	const providerOf = (profileName) => {
+		if (profileName === void 0) return;
+		const profile = profiles[profileName];
+		if (!isPlainObject$1(profile)) return;
+		const value = profile[TAKT_RUNTIME_PROVIDER_KEY];
+		return typeof value === "string" && value.trim() !== "" ? value : void 0;
+	};
+	if (!isPlainObject$1(provider)) return;
+	const defaults = provider[TAKT_RUNTIME_DEFAULTS_KEY];
+	if (!isPlainObject$1(defaults) || typeof defaults[TAKT_RUNTIME_PROFILE_KEY] !== "string") return;
+	return providerOf(defaults[TAKT_RUNTIME_PROFILE_KEY]);
+}
+/**
+* Lift the runtime profiles' flat `options` bags back into the per-provider
+* shape the `takt` override uses. Each profile's options belong to that
+* profile's own provider; when several profiles name the same provider they are
+* merged in document order, so a later profile wins on a colliding option key.
+*/
+function collectRuntimeProviderOptions(runtime) {
+	const collected = {};
+	for (const profile of Object.values(runtimeProfiles(runtime))) {
+		if (!isPlainObject$1(profile)) continue;
+		const providerName = profile[TAKT_RUNTIME_PROVIDER_KEY];
+		const options = profile[TAKT_RUNTIME_OPTIONS_KEY];
+		if (typeof providerName !== "string" || providerName.trim() === "" || !hasEntries(options)) continue;
+		const existing = collected[providerName];
+		collected[providerName] = {
+			...isPlainObject$1(existing) ? existing : {},
+			...options
+		};
+	}
+	return collected;
+}
+/**
+* Read one `runtime.yaml`. A file that cannot be parsed reports `unparsable`
+* rather than a document: Takt refuses to start on a broken runtime.yaml, and
+* treating it as legacy would be the one outcome that writes the
+* mixed-configuration key into the user's config.yaml.
+*/
+async function readTaktRuntimeFile({ filePath, logger }) {
+	const fileContent = await readFileContentOrNull(filePath);
+	if (fileContent === null) return;
+	try {
+		return {
+			config: parseSharedConfig({
+				format: "yaml",
+				fileContent,
+				filePath
+			}),
+			unparsable: false
+		};
+	} catch (error) {
+		logger?.warn(`Takt permissions: could not parse ${filePath} (${formatError(error)}); assuming Takt's runtime provider mode is active so no legacy provider setting is written to config.yaml.`);
+		return {
+			config: {},
+			unparsable: true
+		};
+	}
+}
+/**
+* Collapse the project and global `runtime.yaml` into the single document Takt
+* itself resolves against, matching upstream's loader: `profiles` is a union
+* with the project definition of a same-named profile replacing the global one,
+* while `defaults`, `targets` and `auto_routing` are taken from the project file
+* whole whenever it states them at all (`??`, so a project `targets: {}` masks
+* the global one rather than merging with it).
+* https://github.com/nrslib/takt/blob/main/src/infra/config/runtime-provider/loader.ts
+*
+* Merging before mode detection matters in both directions: a project file
+* active only through `targets:` still resolves its provider from the global
+* file's `defaults`/`profiles`, and a project section that masks the global one
+* leaves the merged document inactive even though the global file alone was not.
+*/
+function mergeTaktRuntimeConfigs({ project, global: globalConfig }) {
+	const sectionOf = (config) => {
+		const provider = config?.[TAKT_RUNTIME_PROVIDER_KEY];
+		return isPlainObject$1(provider) ? provider : {};
+	};
+	const projectSection = sectionOf(project);
+	const globalSection = sectionOf(globalConfig);
+	const replaced = (key) => projectSection[key] ?? globalSection[key];
+	const profilesOf = (section) => isPlainObject$1(section[TAKT_RUNTIME_PROFILES_KEY]) ? section[TAKT_RUNTIME_PROFILES_KEY] : void 0;
+	const globalProfiles = profilesOf(globalSection);
+	const projectProfiles = profilesOf(projectSection);
+	const provider = {};
+	if (globalProfiles !== void 0 || projectProfiles !== void 0) provider[TAKT_RUNTIME_PROFILES_KEY] = {
+		...globalProfiles,
+		...projectProfiles
+	};
+	for (const key of [
+		TAKT_RUNTIME_DEFAULTS_KEY,
+		TAKT_RUNTIME_TARGETS_KEY,
+		TAKT_RUNTIME_AUTO_ROUTING_KEY
+	]) {
+		const value = replaced(key);
+		if (value !== void 0) provider[key] = value;
+	}
+	return { [TAKT_RUNTIME_PROVIDER_KEY]: provider };
+}
+/**
+* The runtime provider configuration in force for a generate run: the project
+* and global `runtime.yaml` merged the way Takt merges them, plus whether the
+* result puts Takt in runtime mode.
+*
+* Both scopes are read whichever scope is being generated: Takt collects legacy
+* signals from the project and global `config.yaml` alike, so a global
+* `runtime.yaml` — the one Takt generates on first launch — makes a legacy key
+* in the project config.yaml a hard failure just the same.
+*/
+async function readTaktRuntimeConfig({ outputRoot, logger }) {
+	const projectPath = (0, node_path.join)(outputRoot, TAKT_DIR, TAKT_RUNTIME_CONFIG_FILE_NAME);
+	let globalPath;
+	try {
+		const resolved = (0, node_path.join)(getHomeDirectory(), TAKT_DIR, TAKT_RUNTIME_CONFIG_FILE_NAME);
+		globalPath = resolved === projectPath ? void 0 : resolved;
+	} catch {}
+	const [project, globalFile] = await Promise.all([readTaktRuntimeFile({
+		filePath: projectPath,
+		logger
+	}), globalPath === void 0 ? Promise.resolve(void 0) : readTaktRuntimeFile({
+		filePath: globalPath,
+		logger
+	})]);
+	const filePaths = [...project === void 0 ? [] : [projectPath], ...globalFile === void 0 || globalPath === void 0 ? [] : [globalPath]];
+	const config = mergeTaktRuntimeConfigs({
+		project: project?.config,
+		global: globalFile?.config
+	});
+	return {
+		filePaths,
+		config,
+		active: project?.unparsable === true || globalFile?.unparsable === true || isRuntimeModeActive(config)
+	};
+}
 /**
 * Collapse a rulesync permissions config into Takt's single coarse mode.
 *
@@ -34223,6 +35606,57 @@ function asRecord(value) {
 	return Object.fromEntries(Object.entries(value));
 }
 /**
+* The `agent` keys the `zed` override may author. Everything else — above all
+* `tool_permissions`, which the canonical `permission` block owns end to end —
+* is refused, so an override can never reach past its own surface and weaken a
+* canonical deny. The override object is read key by key rather than spread, so
+* an unlisted key is inert whether or not it is named here — an allowlist, not a
+* denylist, because `agent` carries blunt instruments of its own (Zed's
+* `always_allow_tool_actions` would disarm every permission rule at once), and a
+* verbatim `agent` merge would hand them to the override.
+*
+* Every key the patch does not consume is reported, so an unsupported or
+* misspelled one surfaces as a warning rather than as config that quietly does
+* nothing. `permission` is exempt: it is the canonical tool-scoped block, and
+* `RulesyncPermissions.forTarget` has already consumed and stripped it.
+*/
+const ZED_OVERRIDE_AGENT_KEYS = ["sandbox_permissions", "profiles"];
+const ZED_CANONICAL_AGENT_KEY = "tool_permissions";
+const ZED_OVERRIDE_CONSUMED_KEYS = /* @__PURE__ */ new Set([...ZED_OVERRIDE_AGENT_KEYS, "permission"]);
+/**
+* Build the `agent` patch fragment carrying the `zed` override's verbatim
+* blocks. A key the override supplies replaces the existing block wholesale
+* (Zed reads each as one unit — a deep merge would leave half of a rewritten
+* sandbox policy behind); a key it omits is left out of the fragment, so the
+* existing value survives via the caller's spread of `agent`.
+*/
+function buildZedOverridePatch({ override, logger }) {
+	if (!isPlainObject$1(override)) return {};
+	if (ZED_CANONICAL_AGENT_KEY in override) logger?.warn(`Zed permissions: ignoring the 'zed.${ZED_CANONICAL_AGENT_KEY}' override; \`agent.${ZED_CANONICAL_AGENT_KEY}\` is driven by the canonical permission block.`);
+	const unsupportedKeys = Object.keys(override).filter((key) => key !== ZED_CANONICAL_AGENT_KEY && !ZED_OVERRIDE_CONSUMED_KEYS.has(key));
+	if (unsupportedKeys.length > 0) logger?.warn(`Zed permissions: ignoring the ${unsupportedKeys.map((key) => `'zed.${key}'`).join(", ")} override ${unsupportedKeys.length === 1 ? "key" : "keys"} — the \`zed\` block authors only ${ZED_OVERRIDE_AGENT_KEYS.map((key) => `\`${key}\``).join(" and ")}.`);
+	const patch = {};
+	for (const key of ZED_OVERRIDE_AGENT_KEYS) {
+		const value = override[key];
+		if (isPlainObject$1(value)) patch[key] = value;
+	}
+	return patch;
+}
+/**
+* The write-side inverse: lift `agent.sandbox_permissions` / `agent.profiles`
+* back into the `zed` override so a hand-written sandbox policy or profile set
+* round-trips instead of being lost on the next generate. Returns `undefined`
+* when the settings carry neither, so the override key is omitted.
+*/
+function extractZedOverride(agent) {
+	const override = {};
+	for (const key of ZED_OVERRIDE_AGENT_KEYS) {
+		const value = agent[key];
+		if (isPlainObject$1(value)) override[key] = value;
+	}
+	return Object.keys(override).length > 0 ? override : void 0;
+}
+/**
 * Permissions generator for the Zed editor.
 *
 * Zed maps tool permissions onto `agent.tool_permissions` inside its settings
@@ -34230,6 +35664,11 @@ function asRecord(value) {
 * global). That file is shared with the MCP (`context_servers`) and ignore
 * (`private_files`) features, so reads and writes merge into the existing JSON
 * rather than overwriting it, and the file is never deleted.
+*
+* Zed's OS sandbox (`agent.sandbox_permissions`) and its tool-availability
+* profiles (`agent.profiles`) are separate enforcement layers with no canonical
+* counterpart; they are authored verbatim through the `zed` override and lifted
+* back out of the settings on import. See `ZedPermissionsOverrideSchema`.
 */
 var ZedPermissions = class ZedPermissions extends ToolPermissions {
 	constructor(params) {
@@ -34308,6 +35747,10 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 				existingContent,
 				patch: { agent: {
 					...agent,
+					...buildZedOverridePatch({
+						override: config.zed,
+						logger
+					}),
 					tool_permissions: {
 						...toolPermissions,
 						...managedDefault !== void 0 && { default: managedDefault },
@@ -34329,7 +35772,8 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 		} catch (error) {
 			throw new Error(`Failed to parse Zed permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
-		const toolPermissionsRaw = asRecord(settings.agent).tool_permissions;
+		const agent = asRecord(settings.agent);
+		const toolPermissionsRaw = agent.tool_permissions;
 		const parsed = ZedToolPermissionsSchema.safeParse(toolPermissionsRaw ?? {});
 		const tools = parsed.success ? parsed.data.tools ?? {} : {};
 		const globalDefault = parsed.success ? parsed.data.default : void 0;
@@ -34353,7 +35797,10 @@ var ZedPermissions = class ZedPermissions extends ToolPermissions {
 			for (const entry of toolPermission.always_deny ?? []) ensure(category)[entry.pattern] = "deny";
 			for (const entry of toolPermission.always_confirm ?? []) ensure(category)[entry.pattern] = "ask";
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const zedOverride = extractZedOverride(agent);
+		const result = { permission };
+		if (zedOverride !== void 0) result.zed = zedOverride;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
 		return {
@@ -34439,6 +35886,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["copilotcli", {
+		class: CopilotcliPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["cursor", {
 		class: CursorPermissions,
 		meta: {
@@ -36392,7 +37847,8 @@ function openaiYamlToCodexcliSection(parsed) {
 /**
 * Represents a Codex CLI skill directory.
 * Codex CLI supports skills in both project mode (under $CWD/.agents/skills)
-* and global mode (under $CODEX_HOME/skills, typically ~/.agents/skills).
+* and global mode (under ~/.agents/skills — Rulesync resolves the home
+* directory rather than $CODEX_HOME).
 */
 var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 	constructor({ outputRoot = process.cwd(), relativeDirPath = CODEXCLI_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
@@ -38428,6 +39884,145 @@ var KiroIdeSkill = class extends KiroSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/musecode-skill.ts
+const MusecodeSkillFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.string()
+});
+/**
+* Represents a Meta Muse Code skill directory.
+*
+* Muse Code reads Agent Skills as `<skill-id>/SKILL.md` directories from the
+* project (`.agents/skills/`) and from the user config
+* (`$XDG_CONFIG_HOME/muse/skills`, plus `~/.agents/skills`). rulesync emits the
+* project directory and, at global scope, only the XDG-default
+* `~/.config/muse/skills` so a skill is written exactly once. Muse Code's
+* compat scans of repo-local `.codex/skills` and `.claude/skills` belong to
+* other tools and are not emitted.
+* @see https://dev.meta.ai/docs/muse-code/extending.md
+*/
+var MusecodeSkill = class MusecodeSkill extends ToolSkill {
+	constructor({ outputRoot = process.cwd(), relativeDirPath = MUSECODE_SKILLS_DIR_PATH, dirName, frontmatter, body, otherFiles = [], validate = true, global = false }) {
+		super({
+			outputRoot,
+			relativeDirPath,
+			dirName,
+			mainFile: {
+				name: SKILL_FILE_NAME,
+				body,
+				frontmatter: { ...frontmatter }
+			},
+			otherFiles,
+			global
+		});
+		if (validate) {
+			const result = this.validate();
+			if (!result.success) throw result.error;
+		}
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? MUSECODE_GLOBAL_SKILLS_DIR_PATH : MUSECODE_SKILLS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return MusecodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
+	}
+	getBody() {
+		return this.mainFile?.body ?? "";
+	}
+	validate() {
+		if (!this.mainFile) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`${this.getDirPath()}: ${SKILL_FILE_NAME} file does not exist`)
+		};
+		const result = MusecodeSkillFrontmatterSchema.safeParse(this.mainFile.frontmatter);
+		if (!result.success) return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${this.getDirPath()}: ${formatError(result.error)}`)
+		};
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncSkill() {
+		const frontmatter = this.getFrontmatter();
+		const rulesyncFrontmatter = {
+			name: frontmatter.name,
+			description: frontmatter.description,
+			targets: ["*"]
+		};
+		return new RulesyncSkill({
+			outputRoot: this.outputRoot,
+			relativeDirPath: RULESYNC_SKILLS_RELATIVE_DIR_PATH,
+			dirName: this.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: this.getBody(),
+			otherFiles: this.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
+		const settablePaths = MusecodeSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const musecodeFrontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description
+		};
+		return new MusecodeSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName: rulesyncSkill.getDirName(),
+			frontmatter: musecodeFrontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("musecode");
+	}
+	static async fromDir(params) {
+		const loaded = await this.loadSkillDirContent({
+			...params,
+			getSettablePaths: MusecodeSkill.getSettablePaths
+		});
+		const result = MusecodeSkillFrontmatterSchema.safeParse(loaded.frontmatter);
+		if (!result.success) {
+			const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+			throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
+		}
+		return new MusecodeSkill({
+			outputRoot: loaded.outputRoot,
+			relativeDirPath: loaded.relativeDirPath,
+			dirName: loaded.dirName,
+			frontmatter: result.data,
+			body: loaded.body,
+			otherFiles: loaded.otherFiles,
+			validate: true,
+			global: loaded.global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, dirName, global = false }) {
+		const settablePaths = MusecodeSkill.getSettablePaths({ global });
+		return new MusecodeSkill({
+			outputRoot,
+			relativeDirPath: relativeDirPath ?? settablePaths.relativeDirPath,
+			dirName,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			otherFiles: [],
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/skills/opencode-skill.ts
 const OpenCodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -40256,6 +41851,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["musecode", {
+		class: MusecodeSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["opencode", {
 		class: OpenCodeSkill,
 		meta: {
@@ -42776,7 +44379,7 @@ var FactorydroidSubagent = class FactorydroidSubagent extends ToolSubagent {
 * `sub_recipes` list, which rulesync never wrote) — so those files were inert.
 * The custom-agent surface is the one Goose actually reads.
 *
-* @see https://block.github.io/goose/docs/guides/context-engineering/custom-agents/
+* @see https://goose-docs.ai/docs/guides/context-engineering/custom-agents/
 */
 const GooseSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -48110,7 +49713,7 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 * touches during a session. The separate `.goose/memories/` tree is the Memory
 * extension's storage and is NOT auto-loaded as session context.
 * (Verified against the official docs:
-* https://block.github.io/goose/docs/guides/context-engineering/using-goosehints/)
+* https://goose-docs.ai/docs/guides/context-engineering/using-goosehints/)
 *
 * rulesync's topic-based non-root rules have no project subdirectory to map onto,
 * so writing them under `.goose/memories/` made them effectively invisible to
@@ -48121,7 +49724,7 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 * Goose uses plain markdown files (.goosehints) without frontmatter.
 *
 * Global scope emits only `~/.config/goose/.goosehints`. Goose v1.41.0 (PR
-* block/goose#9736) additionally loads the vendor-neutral
+* aaif-goose/goose#9736) additionally loads the vendor-neutral
 * `~/.agents/AGENTS.md` alongside the config-dir hints, but rulesync
 * deliberately does not emit that shared path from the goose target: the
 * config-dir hints remain fully loaded (no capability loss), and the
@@ -48829,6 +50432,73 @@ var KiroIdeRule = class extends KiroRule {
 	}
 };
 //#endregion
+//#region src/features/rules/musecode-rule.ts
+var MusecodeRule = class MusecodeRule extends ToolRule {
+	constructor({ fileContent, root, ...rest }) {
+		super({
+			...rest,
+			fileContent,
+			root: root ?? false
+		});
+	}
+	static getSettablePaths(_options = {}) {
+		return { root: {
+			relativeDirPath: ".",
+			relativeFilePath: MUSECODE_RULE_FILE_NAME
+		} };
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const relativePath = (0, node_path.join)(root.relativeDirPath, root.relativeFilePath);
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
+		return new MusecodeRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = rulesyncRule.getFrontmatter().root ?? false;
+		return new MusecodeRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		return this.toRulesyncRuleDefault();
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new MusecodeRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: relativeFilePath === "AGENTS.md" && relativeDirPath === "."
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "musecode"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/opencode-rule.ts
 var OpenCodeRule = class OpenCodeRule extends ToolRule {
 	static getSettablePaths({ global, excludeToolDir } = {}) {
@@ -50409,6 +52079,15 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			ruleDiscoveryMode: "toon"
 		}
 	}],
+	["musecode", {
+		class: MusecodeRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: false,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold"
+		}
+	}],
 	["opencode", {
 		class: OpenCodeRule,
 		meta: {