rulesync 18.0.0 → 20.0.0

package/dist/{import-KY5Q7laH.cjs → import-Cp3q904n.cjs}

@@ -5254,8 +5254,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
-* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 41 entries as
+* of v0.21.5 (`v2026.9.24`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5279,13 +5279,14 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* Verified against the tag `v2026.9.24` (v0.21.5): `VALID_HOOKS` holds 41
 * entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
-* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
-* This list holds 38 of them — see
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`,
+* and v0.21.5 added `pre_auxiliary_call` and `post_auxiliary_call`.
+* This list holds 40 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5303,6 +5304,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_api_request",
 	"post_api_request",
 	"api_request_error",
+	"pre_auxiliary_call",
+	"post_auxiliary_call",
 	"on_session_start",
 	"on_session_end",
 	"on_session_finalize",
@@ -5337,8 +5340,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -26053,7 +26056,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.5; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -44111,6 +44114,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 //#region src/features/permissions/codexcli-permissions.ts
 const RULESYNC_PROFILE_NAME = "rulesync";
 const CODEX_WORKSPACE_ROOTS_KEY = ":workspace_roots";
+const CODEX_WORKSPACE_ROOT_SUBPATH = ".";
 const CODEX_WORKSPACE_BASELINE = ":workspace";
 const CODEX_READ_ONLY_BASELINE = ":read-only";
 const CODEX_DANGER_FULL_ACCESS_BASELINE = ":danger-full-access";
@@ -44328,10 +44332,19 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 	applyDefaultGitWriteRules({
 		config,
 		filesystem,
-		workspaceRootFilesystem
+		workspaceRootFilesystem,
+		logger
 	});
 	if (Object.keys(workspaceRootFilesystem).length > 0) {
-		if (typeof filesystem[CODEX_WORKSPACE_ROOTS_KEY] === "string") logger?.warn(`"${CODEX_WORKSPACE_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions, but it will be overwritten by workspace-root rules. Consider removing the direct "${CODEX_WORKSPACE_ROOTS_KEY}" entry.`);
+		const directWorkspaceRootsAccess = filesystem[CODEX_WORKSPACE_ROOTS_KEY];
+		if (isCodexFilesystemAccess(directWorkspaceRootsAccess)) {
+			mergeIntoWorkspaceRootTable({
+				workspaceRootFilesystem,
+				pattern: CODEX_WORKSPACE_ROOT_SUBPATH,
+				access: directWorkspaceRootsAccess
+			});
+			logger?.warn(`"${CODEX_WORKSPACE_ROOTS_KEY}" is set as a direct filesystem access rule in the permissions alongside workspace-relative rules; it is emitted as the "${CODEX_WORKSPACE_ROOT_SUBPATH}" entry of the "${CODEX_WORKSPACE_ROOTS_KEY}" table.`);
+		}
 		if (Object.keys(workspaceRootFilesystem).some((pattern) => pattern.includes("**"))) filesystem.glob_scan_max_depth = CODEX_GLOB_SCAN_MAX_DEPTH;
 		filesystem[CODEX_WORKSPACE_ROOTS_KEY] = workspaceRootFilesystem;
 	}
@@ -44348,9 +44361,13 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 	};
 }
 function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFilesystem, logger }) {
-	for (const rule of mergeFilesystemCategoryRules({
+	const normalizedCategoryRules = normalizeWorkspaceRelativeCategoryRules({
 		categoryRules,
 		logger
+	});
+	for (const rule of mergeFilesystemCategoryRules({
+		categoryRules: normalizedCategoryRules,
+		logger
 	})) {
 		const access = normalizeCodexFilesystemAccess({
 			pattern: rule.pattern,
@@ -44370,11 +44387,32 @@ function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFiles
 		});
 	}
 }
-function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem }) {
+function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem, logger }) {
 	if (config.codexcli?.git_write_rules === false) return;
 	if (config.codexcli?.base_permission_profile === CODEX_READ_ONLY_BASELINE) return;
 	if (typeof filesystem[CODEX_WORKSPACE_ROOTS_KEY] === "string") return;
-	for (const [pattern, access] of Object.entries(CODEX_GIT_WRITE_RULES)) workspaceRootFilesystem[pattern] ??= access;
+	for (const [pattern, access] of Object.entries(CODEX_GIT_WRITE_RULES)) {
+		if (workspaceRootFilesystem[pattern] !== void 0) continue;
+		if (isRestrictedInWorkspaceRootTable({
+			pattern,
+			table: workspaceRootFilesystem
+		})) {
+			logger?.warn(`Skipping the default Codex CLI "${pattern}" = "${access}" carve-out: ".git" is covered by a broader workspace-relative deny or read-only rule, which the carve-out would reopen. To keep it, author read and edit allows for "${pattern}"; to silence this warning, set codexcli.git_write_rules to false.`);
+			continue;
+		}
+		workspaceRootFilesystem[pattern] = access;
+	}
+}
+function isRestrictedInWorkspaceRootTable({ pattern, table }) {
+	const readRules = {};
+	for (const [tablePattern, access] of Object.entries(table)) {
+		if (tablePattern === pattern) continue;
+		readRules[tablePattern] = access === "write" ? "allow" : "deny";
+	}
+	return isCoveredByReadRestriction({
+		pattern,
+		readRules
+	});
 }
 function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 	const permission = {};
@@ -44388,7 +44426,10 @@ function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 				continue;
 			}
 			if (isCodexFilesystemRuleTable(access)) for (const [nestedPattern, nestedAccess] of Object.entries(access)) {
-				if (pattern === CODEX_WORKSPACE_ROOTS_KEY && CODEX_GIT_WRITE_RULES[nestedPattern] === nestedAccess) continue;
+				if (pattern === CODEX_WORKSPACE_ROOTS_KEY && CODEX_GIT_WRITE_RULES[nestedPattern] === nestedAccess && !isRestrictedInWorkspaceRootTable({
+					pattern: nestedPattern,
+					table: access
+				})) continue;
 				addRulesyncFilesystemRule(permission, nestedPattern, nestedAccess);
 			}
 		}
@@ -44517,9 +44558,59 @@ function addFilesystemRule({ filesystem, workspaceRootFilesystem, pattern, acces
 		filesystem[pattern] = access;
 		return;
 	}
-	workspaceRootFilesystem[pattern] = access;
+	mergeIntoWorkspaceRootTable({
+		workspaceRootFilesystem,
+		pattern,
+		access
+	});
+}
+const PERMISSION_ACTION_RESTRICTIVENESS = {
+	deny: 2,
+	ask: 1,
+	allow: 0
+};
+function normalizeWorkspaceRelativeCategoryRules({ categoryRules, logger }) {
+	const result = {};
+	for (const category of [
+		"read",
+		"edit",
+		"write"
+	]) {
+		const rules = categoryRules[category];
+		if (rules === void 0) continue;
+		const normalized = {};
+		for (const [pattern, action] of Object.entries(rules)) {
+			const key = pattern.trim() === "" || canBeCodexFilesystemRoot(pattern) ? pattern : toWorkspaceRootSubpath(pattern);
+			if (key === void 0) {
+				logger?.warn(`Skipping Codex CLI ${category} filesystem entry for workspace-relative pattern "${pattern}": Codex rejects a ":workspace_roots" subpath containing a ".." segment or an empty leading segment and would refuse the whole config, so the rule is dropped entirely — even a deny — and the path is NOT protected by the generated profile. Use a normalized relative path instead.`);
+				continue;
+			}
+			const existing = normalized[key];
+			normalized[key] = existing === void 0 || PERMISSION_ACTION_RESTRICTIVENESS[action] > PERMISSION_ACTION_RESTRICTIVENESS[existing] ? action : existing;
+		}
+		result[category] = normalized;
+	}
+	return result;
+}
+function toWorkspaceRootSubpath(pattern) {
+	let subpath = pattern;
+	while (subpath.startsWith("./")) subpath = subpath.slice(2);
+	if (subpath === "" || subpath === "**" && subpath !== pattern) return CODEX_WORKSPACE_ROOT_SUBPATH;
+	if (subpath.startsWith("/") || subpath.split(/[\\/]/).some((segment) => segment === "..")) return;
+	return subpath;
+}
+function mergeIntoWorkspaceRootTable({ workspaceRootFilesystem, pattern, access }) {
+	const existing = workspaceRootFilesystem[pattern];
+	workspaceRootFilesystem[pattern] = existing === void 0 ? access : moreRestrictiveCodexAccess({
+		a: existing,
+		b: access
+	});
 }
 function normalizeCodexFilesystemAccess({ pattern, access, writeRestriction, logger }) {
+	if (isWindowsDevicePath(pattern) && !canBeCodexFilesystemRoot(pattern)) {
+		logger?.warn(`Skipping Codex CLI ${access} filesystem entry for Windows device path "${pattern}": Codex cannot express it as a workspace-root entry (it is rejected on Windows and matches nothing elsewhere), so the rule is dropped entirely — even a deny — and the path is NOT protected by the generated profile. Use a plain drive path such as "C:\\..." instead.`);
+		return;
+	}
 	if ((access === "read" || access === "write") && isWindowsDevicePath(pattern)) {
 		if (writeRestriction !== void 0) {
 			logger?.warn(`Codex CLI does not support Windows device paths for read/write access: pattern "${pattern}" will be emitted as "deny" because its write-side ${writeRestriction} restriction cannot be represented as read-only access. Use a plain drive path such as "C:\\..." instead.`);
@@ -44560,7 +44651,9 @@ function addRulesyncFilesystemRule(permission, pattern, access) {
 		permission.read ??= {};
 		permission.read[pattern] = "allow";
 	} else {
+		permission.read ??= {};
 		permission.edit ??= {};
+		permission.read[pattern] = "allow";
 		permission.edit[pattern] = "allow";
 	}
 }
@@ -44696,10 +44789,13 @@ function mapWriteAction(action) {
 * - A write-side non-allow → `"read"` (readable but not writable — exactly
 *   what Codex's `"read"` level expresses). An `ask` action is approximated
 *   this way because Codex has no path-level write approval.
-* - A write-side-only non-allow (no `read` rule for the same pattern) whose
-*   path is covered by a broader `read` deny/ask rule (e.g. `X/**` covering
-*   `X/id_rsa`, or `:root`) → `"deny"`. Codex resolves the most specific
-*   path, so emitting `"read"` there would re-open reads the user denied.
+* - A write-side-only rule (no `read` rule for the same pattern) whose path
+*   is covered by a broader `read` deny/ask rule (e.g. `X/**` covering
+*   `X/id_rsa`, or `:root`) → `"deny"`, for a write-side `allow` too (with a
+*   warning). Codex resolves the most specific path, so emitting `"read"` or
+*   `"write"` there would re-open reads the user denied. Only the most
+*   specific covering read rule counts: a narrower `read: allow` between the
+*   broad deny and the path keeps the path readable.
 * - A `read` non-allow on the same pattern → `"deny"` regardless of the
 *   write side; a contradictory write-side `allow` (unreadable but writable
 *   is not expressible in Codex) is warned about.
@@ -44747,10 +44843,11 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 		}
 		const writeRestriction = writeAction === "allow" ? void 0 : writeAction;
 		const readUnspecified = readAction === void 0;
-		if (readUnspecified && writeRestriction !== void 0 && isCoveredByReadRestriction({
+		if (readUnspecified && isCoveredByReadRestriction({
 			pattern,
 			readRules
 		})) {
+			if (writeRestriction === void 0) logger?.warn(`Codex CLI cannot express "writable but not readable": pattern "${pattern}" has a write-side allow but is covered by a broader read deny/ask rule. Emitting "deny".`);
 			merged.push({
 				pattern,
 				access: "deny"
@@ -44767,33 +44864,89 @@ function mergeFilesystemCategoryRules({ categoryRules, logger }) {
 	return merged;
 }
 function collapseWriteSideRules(categoryRules) {
-	const writeSideRestrictiveness = {
-		deny: 2,
-		ask: 1,
-		allow: 0
-	};
 	const writeSideRules = {};
 	for (const category of ["edit", "write"]) for (const [pattern, action] of Object.entries(categoryRules[category] ?? {})) {
 		const existing = writeSideRules[pattern];
-		if (existing === void 0 || writeSideRestrictiveness[action] > writeSideRestrictiveness[existing]) writeSideRules[pattern] = action;
+		if (existing === void 0 || PERMISSION_ACTION_RESTRICTIVENESS[action] > PERMISSION_ACTION_RESTRICTIVENESS[existing]) writeSideRules[pattern] = action;
 	}
 	return writeSideRules;
 }
 function isCoveredByReadRestriction({ pattern, readRules }) {
-	const key = stripLeadingDotSlash(pattern);
-	return Object.entries(readRules).some(([readPattern, action]) => {
-		if (action === "allow" || readPattern === pattern) return false;
-		if (readPattern === ":root" || readPattern === "/**") return true;
-		if (readPattern === "**") return !canBeCodexFilesystemRoot(pattern);
-		const withoutTrailingGlob = readPattern.endsWith("/**") ? readPattern.slice(0, -3) : readPattern;
-		if (withoutTrailingGlob.startsWith(":") || hasCodexFilesystemGlob(withoutTrailingGlob)) return false;
-		const base = stripTrailingSlash(stripLeadingDotSlash(withoutTrailingGlob));
-		if (base === "") return false;
-		return key === base || key.startsWith(base.endsWith("/") ? base : `${base}/`);
-	});
+	const key = normalizeCoverageKey(pattern);
+	const isWorkspaceRelative = !canBeCodexFilesystemRoot(pattern);
+	const keyHasDotSegment = hasDotPathSegment(pattern);
+	let best;
+	for (const [readPattern, action] of Object.entries(readRules)) {
+		if (readPattern === pattern) continue;
+		const specificity = coverageSpecificity({
+			readPattern,
+			key,
+			isWorkspaceRelative
+		});
+		if (specificity === void 0) continue;
+		const restrictive = action !== "allow";
+		if (!restrictive && isSkippedCodexGrant(readPattern)) continue;
+		if (!restrictive && (keyHasDotSegment || hasDotPathSegment(readPattern))) continue;
+		if (best === void 0 || specificity > best.specificity || specificity === best.specificity && restrictive) best = {
+			specificity,
+			restrictive
+		};
+	}
+	return best?.restrictive ?? false;
+}
+function coverageSpecificity({ readPattern, key, isWorkspaceRelative }) {
+	if (readPattern === ":root" || readPattern === "/**") return 0;
+	if (readPattern === CODEX_WORKSPACE_ROOTS_KEY) return isWorkspaceRelative ? 1 : void 0;
+	if (canBeCodexFilesystemRoot(readPattern) === isWorkspaceRelative) return;
+	const normalized = normalizeCoverageKey(readPattern);
+	if (normalized === "**" || normalized === ".") return isWorkspaceRelative ? 1 : void 0;
+	const withoutTrailingGlob = normalized.endsWith("/**") ? normalized.slice(0, -3) : normalized;
+	if (withoutTrailingGlob.startsWith(":") || hasCodexFilesystemGlob(withoutTrailingGlob)) return;
+	const base = stripTrailingSlash(withoutTrailingGlob);
+	if (base === "") return;
+	return key === base || key.startsWith(base.endsWith("/") ? base : `${base}/`) ? 2 + base.length : void 0;
+}
+function normalizeCoverageKey(pattern) {
+	const form = toCoverageForm(pattern);
+	return canBeCodexFilesystemRoot(pattern) && !pattern.startsWith(":") ? resolveDotSegments(form) : form;
+}
+function resolveDotSegments(path) {
+	const [anchor = "", ...rest] = path.split("/");
+	const stack = [];
+	for (const segment of rest) {
+		if (segment === ".") continue;
+		if (segment === "..") {
+			if (stack.length > 0 && stack[stack.length - 1] !== "..") stack.pop();
+			else if (anchor === "~") stack.push(segment);
+			continue;
+		}
+		stack.push(segment);
+	}
+	const resolved = [anchor, ...stack].join("/");
+	return resolved === "" ? "/" : stripTrailingSlash(resolved);
+}
+function toCoverageForm(pattern) {
+	let normalized = /^[A-Za-z]:[\\/]/.test(pattern) ? `${pattern.charAt(0).toLowerCase()}${pattern.slice(1).replaceAll("\\", "/")}` : pattern;
+	while (normalized.startsWith("./")) normalized = normalized.slice(2);
+	normalized = stripTrailingSlash(normalized);
+	return normalized === "" && pattern !== "" ? "." : normalized;
+}
+function hasDotPathSegment(pattern) {
+	const form = toCoverageForm(pattern);
+	if (form === ".") return false;
+	return form.split(/[\\/]/).some((segment) => segment === "." || segment === "..");
 }
-function stripLeadingDotSlash(pattern) {
-	return pattern.startsWith("./") ? pattern.slice(2) : pattern;
+function isSkippedCodexGrant(pattern) {
+	return isWindowsDevicePath(pattern) || hasUnsupportedCodexFilesystemGlob(pattern);
+}
+function moreRestrictiveCodexAccess({ a, b }) {
+	const rank = {
+		deny: 0,
+		none: 0,
+		read: 1,
+		write: 2
+	};
+	return rank[a] <= rank[b] ? a : b;
 }
 function stripTrailingSlash(pattern) {
 	return pattern.length > 1 && pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;