rulesync 18.0.0 → 19.0.0

package/dist/{import-KY5Q7laH.cjs → import-BFhL78qW.cjs}

@@ -44111,6 +44111,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 //#region src/features/permissions/codexcli-permissions.ts
 const RULESYNC_PROFILE_NAME = "rulesync";
 const CODEX_WORKSPACE_ROOTS_KEY = ":workspace_roots";
+const CODEX_WORKSPACE_ROOT_SUBPATH = ".";
 const CODEX_WORKSPACE_BASELINE = ":workspace";
 const CODEX_READ_ONLY_BASELINE = ":read-only";
 const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
@@ -44331,7 +44332,15 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 		workspaceRootFilesystem
 	});
 	if (Object.keys(workspaceRootFilesystem).length > 0) {
-		if (typeof filesystem[CODEX_WORKSPACE_ROOTS_KEY] === "string") logger?.warn(`"${CODEX_WORKSPACE_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions, but it will be overwritten by workspace-root rules. Consider removing the direct "${CODEX_WORKSPACE_ROOTS_KEY}" entry.`);
+		const directWorkspaceRootsAccess = filesystem[CODEX_WORKSPACE_ROOTS_KEY];
+		if (isCodexFilesystemAccess(directWorkspaceRootsAccess)) {
+			mergeIntoWorkspaceRootTable({
+				workspaceRootFilesystem,
+				pattern: CODEX_WORKSPACE_ROOT_SUBPATH,
+				access: directWorkspaceRootsAccess
+			});
+			logger?.warn(`"${CODEX_WORKSPACE_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions alongside workspace-relative rules; it is emitted as the "${CODEX_WORKSPACE_ROOT_SUBPATH}" entry of the "${CODEX_WORKSPACE_ROOTS_KEY}" table.`);
+		}
 		if (Object.keys(workspaceRootFilesystem).some((pattern) => pattern.includes("**"))) filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
 		filesystem[CODEX_WORKSPACE_ROOTS_KEY] = workspaceRootFilesystem;
 	}
@@ -44348,9 +44357,13 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 	};
 }
 function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFilesystem, logger }) {
-	for (const rule of mergeFilesystemCategoryRules({
+	const normalizedCategoryRules = normalizeWorkspaceRelativeCategoryRules({
 		categoryRules,
 		logger
+	});
+	for (const rule of mergeFilesystemCategoryRules({
+		categoryRules: normalizedCategoryRules,
+		logger
 	})) {
 		const access = normalizeCodexFilesystemAccess({
 			pattern: rule.pattern,
@@ -44517,9 +44530,59 @@ function addFilesystemRule({ filesystem, workspaceRootFilesystem, pattern, acces
 		filesystem[pattern] = access;
 		return;
 	}
-	workspaceRootFilesystem[pattern] = access;
+	mergeIntoWorkspaceRootTable({
+		workspaceRootFilesystem,
+		pattern,
+		access
+	});
+}
+const PERMISSION_ACTION_RESTRICTIVENESS = {
+	deny: 2,
+	ask: 1,
+	allow: 0
+};
+function normalizeWorkspaceRelativeCategoryRules({ categoryRules, logger }) {
+	const result = {};
+	for (const category of [
+		"read",
+		"edit",
+		"write"
+	]) {
+		const rules = categoryRules[category];
+		if (rules === void 0) continue;
+		const normalized = {};
+		for (const [pattern, action] of Object.entries(rules)) {
+			const key = pattern.trim() === "" || canBeCodexFilesystemRoot(pattern) ? pattern : toWorkspaceRootSubpath(pattern);
+			if (key === void 0) {
+				logger?.warn(`Skipping Codex CLI ${category} filesystem entry for workspace-relative pattern "${pattern}": Codex rejects a ":workspace_roots" subpath containing a ".." segment or an empty leading segment and would refuse the whole config, so the rule is dropped entirely — even a deny — and the path is NOT protected by the generated profile. Use a normalized relative path instead.`);
+				continue;
+			}
+			const existing = normalized[key];
+			normalized[key] = existing === void 0 || PERMISSION_ACTION_RESTRICTIVENESS[action] > PERMISSION_ACTION_RESTRICTIVENESS[existing] ? action : existing;
+		}
+		result[category] = normalized;
+	}
+	return result;
+}
+function toWorkspaceRootSubpath(pattern) {
+	let subpath = pattern;
+	while (subpath.startsWith("./")) subpath = subpath.slice(2);
+	if (subpath === "" || subpath === "**" && subpath !== pattern) return CODEX_WORKSPACE_ROOT_SUBPATH;
+	if (subpath.startsWith("/") || subpath.split(/[\\/]/).some((segment) => segment === "..")) return;
+	return subpath;
+}
+function mergeIntoWorkspaceRootTable({ workspaceRootFilesystem, pattern, access }) {
+	const existing = workspaceRootFilesystem[pattern];
+	workspaceRootFilesystem[pattern] = existing === void 0 ? access : moreRestrictiveCodexAccess({
+		a: existing,
+		b: access
+	});
 }
 function normalizeCodexFilesystemAccess({ pattern, access, writeRestriction, logger }) {
+	if (isWindowsDevicePath(pattern) && !canBeCodexFilesystemRoot(pattern)) {
+		logger?.warn(`Skipping Codex CLI ${access} filesystem entry for Windows device path "${pattern}": Codex cannot express it as a workspace-root entry (it is rejected on Windows and matches nothing elsewhere), so the rule is dropped entirely — even a deny — and the path is NOT protected by the generated profile. Use a plain drive path such as "C:\\..." instead.`);
+		return;
+	}
 	if ((access === "read" || access === "write") && isWindowsDevicePath(pattern)) {
 		if (writeRestriction !== void 0) {
 			logger?.warn(`Codex CLI does not support Windows device paths for read/write access: pattern "${pattern}" will be emitted as "deny" because its write-side ${writeRestriction} restriction cannot be represented as read-only access. Use a plain drive path such as "C:\\..." instead.`);
@@ -44560,7 +44623,9 @@ function addRulesyncFilesystemRule(permission, pattern, access) {
 		permission.read ??= {};
 		permission.read[pattern] = "allow";
 	} else {
+		permission.read ??= {};
 		permission.edit ??= {};
+		permission.read[pattern] = "allow";
 		permission.edit[pattern] = "allow";
 	}
 }
@@ -44696,10 +44761,13 @@ function mapWriteAction(action) {
 * - A write-side non-allow → `"read"` (readable but not writable — exactly
 *   what Codex's `"read"` level expresses). An `ask` action is approximated
 *   this way because Codex has no path-level write approval.
-* - A write-side-only non-allow (no `read` rule for the same pattern) whose
-*   path is covered by a broader `read` deny/ask rule (e.g. `X/**` covering
-*   `X/id_rsa`, or `:root`) → `"deny"`. Codex resolves the most specific
-*   path, so emitting `"read"` there would re-open reads the user denied.
+* - A write-side-only rule (no `read` rule for the same pattern) whose path
+*   is covered by a broader `read` deny/ask rule (e.g. `X/**` covering
+*   `X/id_rsa`, or `:root`) → `"deny"`, for a write-side `allow` too (with a
+*   warning). Codex resolves the most specific path, so emitting `"read"` or
+*   `"write"` there would re-open reads the user denied. Only the most
+*   specific covering read rule counts: a narrower `read: allow` between the
+*   broad deny and the path keeps the path readable.
 * - A `read` non-allow on the same pattern → `"deny"` regardless of the
 *   write side; a contradictory write-side `allow` (unreadable but writable
 *   is not expressible in Codex) is warned about.
@@ -44747,10 +44815,11 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 		}
 		const writeRestriction = writeAction === "allow" ? void 0 : writeAction;
 		const readUnspecified = readAction === void 0;
-		if (readUnspecified && writeRestriction !== void 0 && isCoveredByReadRestriction({
+		if (readUnspecified && isCoveredByReadRestriction({
 			pattern,
 			readRules
 		})) {
+			if (writeRestriction === void 0) logger?.warn(`Codex CLI cannot express "writable but not readable": pattern "${pattern}" has a write-side allow but is covered by a broader read deny/ask rule. Emitting "deny".`);
 			merged.push({
 				pattern,
 				access: "deny"
@@ -44767,33 +44836,89 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 	return merged;
 }
 function collapseWriteSideRules(categoryRules) {
-	const writeSideRestrictiveness = {
-		deny: 2,
-		ask: 1,
-		allow: 0
-	};
 	const writeSideRules = {};
 	for (const category of ["edit", "write"]) for (const [pattern, action] of Object.entries(categoryRules[category] ?? {})) {
 		const existing = writeSideRules[pattern];
-		if (existing === void 0 || writeSideRestrictiveness[action] > writeSideRestrictiveness[existing]) writeSideRules[pattern] = action;
+		if (existing === void 0 || PERMISSION_ACTION_RESTRICTIVENESS[action] > PERMISSION_ACTION_RESTRICTIVENESS[existing]) writeSideRules[pattern] = action;
 	}
 	return writeSideRules;
 }
 function isCoveredByReadRestriction({ pattern, readRules }) {
-	const key = stripLeadingDotSlash(pattern);
-	return Object.entries(readRules).some(([readPattern, action]) => {
-		if (action === "allow" || readPattern === pattern) return false;
-		if (readPattern === ":root" || readPattern === "/**") return true;
-		if (readPattern === "**") return !canBeCodexFilesystemRoot(pattern);
-		const withoutTrailingGlob = readPattern.endsWith("/**") ? readPattern.slice(0, -3) : readPattern;
-		if (withoutTrailingGlob.startsWith(":") || hasCodexFilesystemGlob(withoutTrailingGlob)) return false;
-		const base = stripTrailingSlash(stripLeadingDotSlash(withoutTrailingGlob));
-		if (base === "") return false;
-		return key === base || key.startsWith(base.endsWith("/") ? base : `${base}/`);
-	});
+	const key = normalizeCoverageKey(pattern);
+	const isWorkspaceRelative = !canBeCodexFilesystemRoot(pattern);
+	const keyHasDotSegment = hasDotPathSegment(pattern);
+	let best;
+	for (const [readPattern, action] of Object.entries(readRules)) {
+		if (readPattern === pattern) continue;
+		const specificity = coverageSpecificity({
+			readPattern,
+			key,
+			isWorkspaceRelative
+		});
+		if (specificity === void 0) continue;
+		const restrictive = action !== "allow";
+		if (!restrictive && isSkippedCodexGrant(readPattern)) continue;
+		if (!restrictive && (keyHasDotSegment || hasDotPathSegment(readPattern))) continue;
+		if (best === void 0 || specificity > best.specificity || specificity === best.specificity && restrictive) best = {
+			specificity,
+			restrictive
+		};
+	}
+	return best?.restrictive ?? false;
+}
+function coverageSpecificity({ readPattern, key, isWorkspaceRelative }) {
+	if (readPattern === ":root" || readPattern === "/**") return 0;
+	if (readPattern === CODEX_WORKSPACE_ROOTS_KEY) return isWorkspaceRelative ? 1 : void 0;
+	if (canBeCodexFilesystemRoot(readPattern) === isWorkspaceRelative) return;
+	const normalized = normalizeCoverageKey(readPattern);
+	if (normalized === "**" || normalized === ".") return isWorkspaceRelative ? 1 : void 0;
+	const withoutTrailingGlob = normalized.endsWith("/**") ? normalized.slice(0, -3) : normalized;
+	if (withoutTrailingGlob.startsWith(":") || hasCodexFilesystemGlob(withoutTrailingGlob)) return;
+	const base = stripTrailingSlash(withoutTrailingGlob);
+	if (base === "") return;
+	return key === base || key.startsWith(base.endsWith("/") ? base : `${base}/`) ? 2 + base.length : void 0;
+}
+function normalizeCoverageKey(pattern) {
+	const form = toCoverageForm(pattern);
+	return canBeCodexFilesystemRoot(pattern) && !pattern.startsWith(":") ? resolveDotSegments(form) : form;
+}
+function resolveDotSegments(path) {
+	const [anchor = "", ...rest] = path.split("/");
+	const stack = [];
+	for (const segment of rest) {
+		if (segment === ".") continue;
+		if (segment === "..") {
+			if (stack.length > 0 && stack[stack.length - 1] !== "..") stack.pop();
+			else if (anchor === "~") stack.push(segment);
+			continue;
+		}
+		stack.push(segment);
+	}
+	const resolved = [anchor, ...stack].join("/");
+	return resolved === "" ? "/" : stripTrailingSlash(resolved);
 }
-function stripLeadingDotSlash(pattern) {
-	return pattern.startsWith("./") ? pattern.slice(2) : pattern;
+function toCoverageForm(pattern) {
+	let normalized = /^[A-Za-z]:[\\/]/.test(pattern) ? `${pattern.charAt(0).toLowerCase()}${pattern.slice(1).replaceAll("\\", "/")}` : pattern;
+	while (normalized.startsWith("./")) normalized = normalized.slice(2);
+	normalized = stripTrailingSlash(normalized);
+	return normalized === "" && pattern !== "" ? "." : normalized;
+}
+function hasDotPathSegment(pattern) {
+	const form = toCoverageForm(pattern);
+	if (form === ".") return false;
+	return form.split(/[\\/]/).some((segment) => segment === "." || segment === "..");
+}
+function isSkippedCodexGrant(pattern) {
+	return isWindowsDevicePath(pattern) || hasUnsupportedCodexFilesystemGlob(pattern);
+}
+function moreRestrictiveCodexAccess({ a, b }) {
+	const rank = {
+		deny: 0,
+		none: 0,
+		read: 1,
+		write: 2
+	};
+	return rank[a] <= rank[b] ? a : b;
 }
 function stripTrailingSlash(pattern) {
 	return pattern.length > 1 && pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;

package/dist/{import-CA3RFpGB.js → import-C-Jsxedt.js}

@@ -44086,6 +44086,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 //#region src/features/permissions/codexcli-permissions.ts
 const RULESYNC_PROFILE_NAME = "rulesync";
 const CODEX_WORKSPACE_ROOTS_KEY = ":workspace_roots";
+const CODEX_WORKSPACE_ROOT_SUBPATH = ".";
 const CODEX_WORKSPACE_BASELINE = ":workspace";
 const CODEX_READ_ONLY_BASELINE = ":read-only";
 const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
@@ -44306,7 +44307,15 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 		workspaceRootFilesystem
 	});
 	if (Object.keys(workspaceRootFilesystem).length > 0) {
-		if (typeof filesystem[CODEX_WORKSPACE_ROOTS_KEY] === "string") logger?.warn(`"${CODEX_WORKSPACE_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions, but it will be overwritten by workspace-root rules. Consider removing the direct "${CODEX_WORKSPACE_ROOTS_KEY}" entry.`);
+		const directWorkspaceRootsAccess = filesystem[CODEX_WORKSPACE_ROOTS_KEY];
+		if (isCodexFilesystemAccess(directWorkspaceRootsAccess)) {
+			mergeIntoWorkspaceRootTable({
+				workspaceRootFilesystem,
+				pattern: CODEX_WORKSPACE_ROOT_SUBPATH,
+				access: directWorkspaceRootsAccess
+			});
+			logger?.warn(`"${CODEX_WORKSPACE_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions alongside workspace-relative rules; it is emitted as the "${CODEX_WORKSPACE_ROOT_SUBPATH}" entry of the "${CODEX_WORKSPACE_ROOTS_KEY}" table.`);
+		}
 		if (Object.keys(workspaceRootFilesystem).some((pattern) => pattern.includes("**"))) filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
 		filesystem[CODEX_WORKSPACE_ROOTS_KEY] = workspaceRootFilesystem;
 	}
@@ -44323,9 +44332,13 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 	};
 }
 function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFilesystem, logger }) {
-	for (const rule of mergeFilesystemCategoryRules({
+	const normalizedCategoryRules = normalizeWorkspaceRelativeCategoryRules({
 		categoryRules,
 		logger
+	});
+	for (const rule of mergeFilesystemCategoryRules({
+		categoryRules: normalizedCategoryRules,
+		logger
 	})) {
 		const access = normalizeCodexFilesystemAccess({
 			pattern: rule.pattern,
@@ -44492,9 +44505,59 @@ function addFilesystemRule({ filesystem, workspaceRootFilesystem, pattern, acces
 		filesystem[pattern] = access;
 		return;
 	}
-	workspaceRootFilesystem[pattern] = access;
+	mergeIntoWorkspaceRootTable({
+		workspaceRootFilesystem,
+		pattern,
+		access
+	});
+}
+const PERMISSION_ACTION_RESTRICTIVENESS = {
+	deny: 2,
+	ask: 1,
+	allow: 0
+};
+function normalizeWorkspaceRelativeCategoryRules({ categoryRules, logger }) {
+	const result = {};
+	for (const category of [
+		"read",
+		"edit",
+		"write"
+	]) {
+		const rules = categoryRules[category];
+		if (rules === void 0) continue;
+		const normalized = {};
+		for (const [pattern, action] of Object.entries(rules)) {
+			const key = pattern.trim() === "" || canBeCodexFilesystemRoot(pattern) ? pattern : toWorkspaceRootSubpath(pattern);
+			if (key === void 0) {
+				logger?.warn(`Skipping Codex CLI ${category} filesystem entry for workspace-relative pattern "${pattern}": Codex rejects a ":workspace_roots" subpath containing a ".." segment or an empty leading segment and would refuse the whole config, so the rule is dropped entirely — even a deny — and the path is NOT protected by the generated profile. Use a normalized relative path instead.`);
+				continue;
+			}
+			const existing = normalized[key];
+			normalized[key] = existing === void 0 || PERMISSION_ACTION_RESTRICTIVENESS[action] > PERMISSION_ACTION_RESTRICTIVENESS[existing] ? action : existing;
+		}
+		result[category] = normalized;
+	}
+	return result;
+}
+function toWorkspaceRootSubpath(pattern) {
+	let subpath = pattern;
+	while (subpath.startsWith("./")) subpath = subpath.slice(2);
+	if (subpath === "" || subpath === "**" && subpath !== pattern) return CODEX_WORKSPACE_ROOT_SUBPATH;
+	if (subpath.startsWith("/") || subpath.split(/[\\/]/).some((segment) => segment === "..")) return;
+	return subpath;
+}
+function mergeIntoWorkspaceRootTable({ workspaceRootFilesystem, pattern, access }) {
+	const existing = workspaceRootFilesystem[pattern];
+	workspaceRootFilesystem[pattern] = existing === void 0 ? access : moreRestrictiveCodexAccess({
+		a: existing,
+		b: access
+	});
 }
 function normalizeCodexFilesystemAccess({ pattern, access, writeRestriction, logger }) {
+	if (isWindowsDevicePath(pattern) && !canBeCodexFilesystemRoot(pattern)) {
+		logger?.warn(`Skipping Codex CLI ${access} filesystem entry for Windows device path "${pattern}": Codex cannot express it as a workspace-root entry (it is rejected on Windows and matches nothing elsewhere), so the rule is dropped entirely — even a deny — and the path is NOT protected by the generated profile. Use a plain drive path such as "C:\\..." instead.`);
+		return;
+	}
 	if ((access === "read" || access === "write") && isWindowsDevicePath(pattern)) {
 		if (writeRestriction !== void 0) {
 			logger?.warn(`Codex CLI does not support Windows device paths for read/write access: pattern "${pattern}" will be emitted as "deny" because its write-side ${writeRestriction} restriction cannot be represented as read-only access. Use a plain drive path such as "C:\\..." instead.`);
@@ -44535,7 +44598,9 @@ function addRulesyncFilesystemRule(permission, pattern, access) {
 		permission.read ??= {};
 		permission.read[pattern] = "allow";
 	} else {
+		permission.read ??= {};
 		permission.edit ??= {};
+		permission.read[pattern] = "allow";
 		permission.edit[pattern] = "allow";
 	}
 }
@@ -44671,10 +44736,13 @@ function mapWriteAction(action) {
 * - A write-side non-allow → `"read"` (readable but not writable — exactly
 *   what Codex's `"read"` level expresses). An `ask` action is approximated
 *   this way because Codex has no path-level write approval.
-* - A write-side-only non-allow (no `read` rule for the same pattern) whose
-*   path is covered by a broader `read` deny/ask rule (e.g. `X/**` covering
-*   `X/id_rsa`, or `:root`) → `"deny"`. Codex resolves the most specific
-*   path, so emitting `"read"` there would re-open reads the user denied.
+* - A write-side-only rule (no `read` rule for the same pattern) whose path
+*   is covered by a broader `read` deny/ask rule (e.g. `X/**` covering
+*   `X/id_rsa`, or `:root`) → `"deny"`, for a write-side `allow` too (with a
+*   warning). Codex resolves the most specific path, so emitting `"read"` or
+*   `"write"` there would re-open reads the user denied. Only the most
+*   specific covering read rule counts: a narrower `read: allow` between the
+*   broad deny and the path keeps the path readable.
 * - A `read` non-allow on the same pattern → `"deny"` regardless of the
 *   write side; a contradictory write-side `allow` (unreadable but writable
 *   is not expressible in Codex) is warned about.
@@ -44722,10 +44790,11 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 		}
 		const writeRestriction = writeAction === "allow" ? void 0 : writeAction;
 		const readUnspecified = readAction === void 0;
-		if (readUnspecified && writeRestriction !== void 0 && isCoveredByReadRestriction({
+		if (readUnspecified && isCoveredByReadRestriction({
 			pattern,
 			readRules
 		})) {
+			if (writeRestriction === void 0) logger?.warn(`Codex CLI cannot express "writable but not readable": pattern "${pattern}" has a write-side allow but is covered by a broader read deny/ask rule. Emitting "deny".`);
 			merged.push({
 				pattern,
 				access: "deny"
@@ -44742,33 +44811,89 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 	return merged;
 }
 function collapseWriteSideRules(categoryRules) {
-	const writeSideRestrictiveness = {
-		deny: 2,
-		ask: 1,
-		allow: 0
-	};
 	const writeSideRules = {};
 	for (const category of ["edit", "write"]) for (const [pattern, action] of Object.entries(categoryRules[category] ?? {})) {
 		const existing = writeSideRules[pattern];
-		if (existing === void 0 || writeSideRestrictiveness[action] > writeSideRestrictiveness[existing]) writeSideRules[pattern] = action;
+		if (existing === void 0 || PERMISSION_ACTION_RESTRICTIVENESS[action] > PERMISSION_ACTION_RESTRICTIVENESS[existing]) writeSideRules[pattern] = action;
 	}
 	return writeSideRules;
 }
 function isCoveredByReadRestriction({ pattern, readRules }) {
-	const key = stripLeadingDotSlash(pattern);
-	return Object.entries(readRules).some(([readPattern, action]) => {
-		if (action === "allow" || readPattern === pattern) return false;
-		if (readPattern === ":root" || readPattern === "/**") return true;
-		if (readPattern === "**") return !canBeCodexFilesystemRoot(pattern);
-		const withoutTrailingGlob = readPattern.endsWith("/**") ? readPattern.slice(0, -3) : readPattern;
-		if (withoutTrailingGlob.startsWith(":") || hasCodexFilesystemGlob(withoutTrailingGlob)) return false;
-		const base = stripTrailingSlash(stripLeadingDotSlash(withoutTrailingGlob));
-		if (base === "") return false;
-		return key === base || key.startsWith(base.endsWith("/") ? base : `${base}/`);
-	});
+	const key = normalizeCoverageKey(pattern);
+	const isWorkspaceRelative = !canBeCodexFilesystemRoot(pattern);
+	const keyHasDotSegment = hasDotPathSegment(pattern);
+	let best;
+	for (const [readPattern, action] of Object.entries(readRules)) {
+		if (readPattern === pattern) continue;
+		const specificity = coverageSpecificity({
+			readPattern,
+			key,
+			isWorkspaceRelative
+		});
+		if (specificity === void 0) continue;
+		const restrictive = action !== "allow";
+		if (!restrictive && isSkippedCodexGrant(readPattern)) continue;
+		if (!restrictive && (keyHasDotSegment || hasDotPathSegment(readPattern))) continue;
+		if (best === void 0 || specificity > best.specificity || specificity === best.specificity && restrictive) best = {
+			specificity,
+			restrictive
+		};
+	}
+	return best?.restrictive ?? false;
+}
+function coverageSpecificity({ readPattern, key, isWorkspaceRelative }) {
+	if (readPattern === ":root" || readPattern === "/**") return 0;
+	if (readPattern === CODEX_WORKSPACE_ROOTS_KEY) return isWorkspaceRelative ? 1 : void 0;
+	if (canBeCodexFilesystemRoot(readPattern) === isWorkspaceRelative) return;
+	const normalized = normalizeCoverageKey(readPattern);
+	if (normalized === "**" || normalized === ".") return isWorkspaceRelative ? 1 : void 0;
+	const withoutTrailingGlob = normalized.endsWith("/**") ? normalized.slice(0, -3) : normalized;
+	if (withoutTrailingGlob.startsWith(":") || hasCodexFilesystemGlob(withoutTrailingGlob)) return;
+	const base = stripTrailingSlash(withoutTrailingGlob);
+	if (base === "") return;
+	return key === base || key.startsWith(base.endsWith("/") ? base : `${base}/`) ? 2 + base.length : void 0;
+}
+function normalizeCoverageKey(pattern) {
+	const form = toCoverageForm(pattern);
+	return canBeCodexFilesystemRoot(pattern) && !pattern.startsWith(":") ? resolveDotSegments(form) : form;
+}
+function resolveDotSegments(path) {
+	const [anchor = "", ...rest] = path.split("/");
+	const stack = [];
+	for (const segment of rest) {
+		if (segment === ".") continue;
+		if (segment === "..") {
+			if (stack.length > 0 && stack[stack.length - 1] !== "..") stack.pop();
+			else if (anchor === "~") stack.push(segment);
+			continue;
+		}
+		stack.push(segment);
+	}
+	const resolved = [anchor, ...stack].join("/");
+	return resolved === "" ? "/" : stripTrailingSlash(resolved);
 }
-function stripLeadingDotSlash(pattern) {
-	return pattern.startsWith("./") ? pattern.slice(2) : pattern;
+function toCoverageForm(pattern) {
+	let normalized = /^[A-Za-z]:[\\/]/.test(pattern) ? `${pattern.charAt(0).toLowerCase()}${pattern.slice(1).replaceAll("\\", "/")}` : pattern;
+	while (normalized.startsWith("./")) normalized = normalized.slice(2);
+	normalized = stripTrailingSlash(normalized);
+	return normalized === "" && pattern !== "" ? "." : normalized;
+}
+function hasDotPathSegment(pattern) {
+	const form = toCoverageForm(pattern);
+	if (form === ".") return false;
+	return form.split(/[\\/]/).some((segment) => segment === "." || segment === "..");
+}
+function isSkippedCodexGrant(pattern) {
+	return isWindowsDevicePath(pattern) || hasUnsupportedCodexFilesystemGlob(pattern);
+}
+function moreRestrictiveCodexAccess({ a, b }) {
+	const rank = {
+		deny: 0,
+		none: 0,
+		read: 1,
+		write: 2
+	};
+	return rank[a] <= rank[b] ? a : b;
 }
 function stripTrailingSlash(pattern) {
 	return pattern.length > 1 && pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;
@@ -82459,4 +82584,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
 
-//# sourceMappingURL=import-CA3RFpGB.js.map
+//# sourceMappingURL=import-C-Jsxedt.js.map