rulesync 19.0.0 → 21.0.0

package/dist/{import-BFhL78qW.cjs → import-CGT8v9bO.cjs}

@@ -5254,8 +5254,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
-* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 41 entries as
+* of v0.21.5 (`v2026.9.24`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5279,13 +5279,14 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* Verified against the tag `v2026.9.24` (v0.21.5): `VALID_HOOKS` holds 41
 * entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
-* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
-* This list holds 38 of them — see
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`,
+* and v0.21.5 added `pre_auxiliary_call` and `post_auxiliary_call`.
+* This list holds 40 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5303,6 +5304,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_api_request",
 	"post_api_request",
 	"api_request_error",
+	"pre_auxiliary_call",
+	"post_auxiliary_call",
 	"on_session_start",
 	"on_session_end",
 	"on_session_finalize",
@@ -5337,8 +5340,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -26053,7 +26056,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.5; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -44329,7 +44332,8 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 	applyDefaultGitWriteRules({
 		config,
 		filesystem,
-		workspaceRootFilesystem
+		workspaceRootFilesystem,
+		logger
 	});
 	if (Object.keys(workspaceRootFilesystem).length > 0) {
 		const directWorkspaceRootsAccess = filesystem[CODEX_WORKSPACE_ROOTS_KEY];
@@ -44383,11 +44387,32 @@ function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFiles
 		});
 	}
 }
-function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem }) {
+function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem, logger }) {
 	if (config.codexcli?.git_write_rules === false) return;
 	if (config.codexcli?.base_permission_profile === CODEX_READ_ONLY_BASELINE) return;
 	if (typeof filesystem[CODEX_WORKSPACE_ROOTS_KEY] === "string") return;
-	for (const [pattern, access] of Object.entries(CODEX_GIT_WRITE_RULES)) workspaceRootFilesystem[pattern] ??= access;
+	for (const [pattern, access] of Object.entries(CODEX_GIT_WRITE_RULES)) {
+		if (workspaceRootFilesystem[pattern] !== void 0) continue;
+		if (isRestrictedInWorkspaceRootTable({
+			pattern,
+			table: workspaceRootFilesystem
+		})) {
+			logger?.warn(`Skipping the default Codex CLI "${pattern}" = "${access}" carve-out: ".git" is covered by a broader workspace-relative deny or read-only rule, which the carve-out would reopen. To keep it, author read and edit allows for "${pattern}"; to silence this warning, set codexcli.git_write_rules to false.`);
+			continue;
+		}
+		workspaceRootFilesystem[pattern] = access;
+	}
+}
+function isRestrictedInWorkspaceRootTable({ pattern, table }) {
+	const readRules = {};
+	for (const [tablePattern, access] of Object.entries(table)) {
+		if (tablePattern === pattern) continue;
+		readRules[tablePattern] = access === "write" ? "allow" : "deny";
+	}
+	return isCoveredByReadRestriction({
+		pattern,
+		readRules
+	});
 }
 function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 	const permission = {};
@@ -44401,7 +44426,10 @@ function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 				continue;
 			}
 			if (isCodexFilesystemRuleTable(access)) for (const [nestedPattern, nestedAccess] of Object.entries(access)) {
-				if (pattern === CODEX_WORKSPACE_ROOTS_KEY && CODEX_GIT_WRITE_RULES[nestedPattern] === nestedAccess) continue;
+				if (pattern === CODEX_WORKSPACE_ROOTS_KEY && CODEX_GIT_WRITE_RULES[nestedPattern] === nestedAccess && !isRestrictedInWorkspaceRootTable({
+					pattern: nestedPattern,
+					table: access
+				})) continue;
 				addRulesyncFilesystemRule(permission, nestedPattern, nestedAccess);
 			}
 		}
@@ -44983,14 +45011,14 @@ const COMMANDCODE_TOOL_TO_CATEGORY = {
 	web_fetch: "webfetch",
 	web_search: "websearch"
 };
-const ACTION_RANK$1 = {
+const ACTION_RANK$2 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
 /** Whether `action` outranks `existing` (deny > ask > allow). */
 function isStricterAction({ action, existing }) {
-	return existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing];
+	return existing === void 0 || ACTION_RANK$2[action] > ACTION_RANK$2[existing];
 }
 /**
 * Why a padded `Shell( * )` cannot stand in for the bare `Shell` in `allow`:
@@ -48338,20 +48366,22 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
 const CATCH_ALL_PATTERN$4 = "*";
-const RULESYNC_TO_GOOSE_TOOL_NAME = {
-	bash: "developer__shell",
-	edit: "developer__text_editor",
-	write: "developer__text_editor"
-};
-const GOOSE_TO_RULESYNC_TOOL_NAME = {
-	developer__shell: "bash",
-	developer__text_editor: "edit"
+const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
+const GOOSE_TO_RULESYNC_TOOL_NAMES = {
+	shell: ["bash"],
+	developer__shell: ["bash"],
+	developer__text_editor: ["edit", "write"]
 };
 const ACTION_TO_GOOSE_LIST = {
 	allow: "always_allow",
 	ask: "ask_before",
 	deny: "never_allow"
 };
+const ACTION_RANK$1 = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
 const GOOSE_LIST_TO_ACTION = {
 	always_allow: "allow",
 	ask_before: "ask",
@@ -48376,10 +48406,11 @@ const GOOSE_PERMISSION_LIST_KEYS = [
 *
 * Mapping (rulesync canonical -> Goose):
 *   - Action: `allow` -> `always_allow`, `ask` -> `ask_before`, `deny` -> `never_allow`.
-*   - Tool name: `bash` -> `developer__shell`, `edit` -> `developer__text_editor`;
-*     any other category passes through verbatim as the Goose tool name (mirrors
-*     the Gemini CLI adapter). `write` collapses onto `developer__text_editor`
-*     too, so a conflicting `edit`/`write` catch-all is reported and `edit` wins.
+*   - Tool name: `bash` -> `shell`; any other category (including `edit` and
+*     `write`) passes through verbatim as the Goose tool name (mirrors the
+*     Gemini CLI adapter). The legacy `developer__shell` /
+*     `developer__text_editor` names are still accepted on import, the latter
+*     as both `edit` and `write`.
 *   - Granularity: Goose lists hold whole tool names, so only a category's
 *     catch-all `*` pattern is representable. Non-catch-all patterns cannot be
 *     expressed per-tool and are reported via `logger.warn` and skipped.
@@ -48495,8 +48526,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 		never_allow: []
 	};
 	const assigned = /* @__PURE__ */ new Map();
-	const orderedEntries = Object.entries(honorAllToolsOnBash(config.permission)).toSorted(([a], [b]) => (a === "edit" ? 1 : 0) - (b === "edit" ? 1 : 0));
-	for (const [category, rules] of orderedEntries) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
 			if (pattern !== CATCH_ALL_PATTERN$4) {
@@ -48504,12 +48534,15 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 				continue;
 			}
 			const previous = assigned.get(toolName);
-			if (previous !== void 0 && previous !== action) {
-				logger?.warn(`Goose maps "${category}" onto the "${toolName}" tool, which already has a conflicting permission ("${previous}"). The "${action}" value takes precedence.`);
+			if (previous === action) continue;
+			if (previous !== void 0) {
+				const stricter = ACTION_RANK$1[action] > ACTION_RANK$1[previous] ? action : previous;
+				logger?.warn(`Goose maps "${category}" onto the "${toolName}" tool, which already has a conflicting permission ("${previous}"). Keeping the stricter "${stricter}" (deny > ask > allow).`);
+				if (stricter === previous) continue;
 				const previousList = lists[ACTION_TO_GOOSE_LIST[previous]];
 				const index = previousList.indexOf(toolName);
 				if (index !== -1) previousList.splice(index, 1);
-			} else if (previous === action) continue;
+			}
 			lists[ACTION_TO_GOOSE_LIST[action]].push(toolName);
 			assigned.set(toolName, action);
 		}
@@ -48525,8 +48558,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
 		const toolNames = isStringArray$2(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
-		for (const toolName of toolNames) {
-			const category = GOOSE_TO_RULESYNC_TOOL_NAME[toolName] ?? toolName;
+		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
 			permission[category][CATCH_ALL_PATTERN$4] = action;
 		}

package/dist/{import-C-Jsxedt.js → import-CSKYRGa5.js}

@@ -5229,8 +5229,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 39 entries as
-* of v0.21.3 (`v2026.9.14`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 41 entries as
+* of v0.21.5 (`v2026.9.24`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5254,13 +5254,14 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v2026.9.14` (v0.21.3): `VALID_HOOKS` holds 39
+* Verified against the tag `v2026.9.24` (v0.21.5): `VALID_HOOKS` holds 41
 * entries, grown from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16`
-* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`.
-* This list holds 38 of them — see
+* (v0.20.2) — v0.21 added `agent_loop_stopped` and `on_room_member_activity`,
+* and v0.21.5 added `pre_auxiliary_call` and `post_auxiliary_call`.
+* This list holds 40 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5278,6 +5279,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_api_request",
 	"post_api_request",
 	"api_request_error",
+	"pre_auxiliary_call",
+	"post_auxiliary_call",
 	"on_session_start",
 	"on_session_end",
 	"on_session_finalize",
@@ -5312,8 +5315,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.14/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v2026.9.24/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -26028,7 +26031,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.3; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.5; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -44304,7 +44307,8 @@ function convertRulesyncToCodexProfile({ config, logger }) {
 	applyDefaultGitWriteRules({
 		config,
 		filesystem,
-		workspaceRootFilesystem
+		workspaceRootFilesystem,
+		logger
 	});
 	if (Object.keys(workspaceRootFilesystem).length > 0) {
 		const directWorkspaceRootsAccess = filesystem[CODEX_WORKSPACE_ROOTS_KEY];
@@ -44358,11 +44362,32 @@ function addCodexFilesystemRules({ categoryRules, filesystem, workspaceRootFiles
 		});
 	}
 }
-function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem }) {
+function applyDefaultGitWriteRules({ config, filesystem, workspaceRootFilesystem, logger }) {
 	if (config.codexcli?.git_write_rules === false) return;
 	if (config.codexcli?.base_permission_profile === CODEX_READ_ONLY_BASELINE) return;
 	if (typeof filesystem[CODEX_WORKSPACE_ROOTS_KEY] === "string") return;
-	for (const [pattern, access] of Object.entries(CODEX_GIT_WRITE_RULES)) workspaceRootFilesystem[pattern] ??= access;
+	for (const [pattern, access] of Object.entries(CODEX_GIT_WRITE_RULES)) {
+		if (workspaceRootFilesystem[pattern] !== void 0) continue;
+		if (isRestrictedInWorkspaceRootTable({
+			pattern,
+			table: workspaceRootFilesystem
+		})) {
+			logger?.warn(`Skipping the default Codex CLI "${pattern}" = "${access}" carve-out: ".git" is covered by a broader workspace-relative deny or read-only rule, which the carve-out would reopen. To keep it, author read and edit allows for "${pattern}"; to silence this warning, set codexcli.git_write_rules to false.`);
+			continue;
+		}
+		workspaceRootFilesystem[pattern] = access;
+	}
+}
+function isRestrictedInWorkspaceRootTable({ pattern, table }) {
+	const readRules = {};
+	for (const [tablePattern, access] of Object.entries(table)) {
+		if (tablePattern === pattern) continue;
+		readRules[tablePattern] = access === "write" ? "allow" : "deny";
+	}
+	return isCoveredByReadRestriction({
+		pattern,
+		readRules
+	});
 }
 function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 	const permission = {};
@@ -44376,7 +44401,10 @@ function convertCodexProfileToRulesync({ profile, domainsHadUnknown }) {
 				continue;
 			}
 			if (isCodexFilesystemRuleTable(access)) for (const [nestedPattern, nestedAccess] of Object.entries(access)) {
-				if (pattern === CODEX_WORKSPACE_ROOTS_KEY && CODEX_GIT_WRITE_RULES[nestedPattern] === nestedAccess) continue;
+				if (pattern === CODEX_WORKSPACE_ROOTS_KEY && CODEX_GIT_WRITE_RULES[nestedPattern] === nestedAccess && !isRestrictedInWorkspaceRootTable({
+					pattern: nestedPattern,
+					table: access
+				})) continue;
 				addRulesyncFilesystemRule(permission, nestedPattern, nestedAccess);
 			}
 		}
@@ -44958,14 +44986,14 @@ const COMMANDCODE_TOOL_TO_CATEGORY = {
 	web_fetch: "webfetch",
 	web_search: "websearch"
 };
-const ACTION_RANK$1 = {
+const ACTION_RANK$2 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
 /** Whether `action` outranks `existing` (deny > ask > allow). */
 function isStricterAction({ action, existing }) {
-	return existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing];
+	return existing === void 0 || ACTION_RANK$2[action] > ACTION_RANK$2[existing];
 }
 /**
 * Why a padded `Shell( * )` cannot stand in for the bare `Shell` in `allow`:
@@ -48313,20 +48341,22 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
 const CATCH_ALL_PATTERN$4 = "*";
-const RULESYNC_TO_GOOSE_TOOL_NAME = {
-	bash: "developer__shell",
-	edit: "developer__text_editor",
-	write: "developer__text_editor"
-};
-const GOOSE_TO_RULESYNC_TOOL_NAME = {
-	developer__shell: "bash",
-	developer__text_editor: "edit"
+const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
+const GOOSE_TO_RULESYNC_TOOL_NAMES = {
+	shell: ["bash"],
+	developer__shell: ["bash"],
+	developer__text_editor: ["edit", "write"]
 };
 const ACTION_TO_GOOSE_LIST = {
 	allow: "always_allow",
 	ask: "ask_before",
 	deny: "never_allow"
 };
+const ACTION_RANK$1 = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
 const GOOSE_LIST_TO_ACTION = {
 	always_allow: "allow",
 	ask_before: "ask",
@@ -48351,10 +48381,11 @@ const GOOSE_PERMISSION_LIST_KEYS = [
 *
 * Mapping (rulesync canonical -> Goose):
 *   - Action: `allow` -> `always_allow`, `ask` -> `ask_before`, `deny` -> `never_allow`.
-*   - Tool name: `bash` -> `developer__shell`, `edit` -> `developer__text_editor`;
-*     any other category passes through verbatim as the Goose tool name (mirrors
-*     the Gemini CLI adapter). `write` collapses onto `developer__text_editor`
-*     too, so a conflicting `edit`/`write` catch-all is reported and `edit` wins.
+*   - Tool name: `bash` -> `shell`; any other category (including `edit` and
+*     `write`) passes through verbatim as the Goose tool name (mirrors the
+*     Gemini CLI adapter). The legacy `developer__shell` /
+*     `developer__text_editor` names are still accepted on import, the latter
+*     as both `edit` and `write`.
 *   - Granularity: Goose lists hold whole tool names, so only a category's
 *     catch-all `*` pattern is representable. Non-catch-all patterns cannot be
 *     expressed per-tool and are reported via `logger.warn` and skipped.
@@ -48470,8 +48501,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 		never_allow: []
 	};
 	const assigned = /* @__PURE__ */ new Map();
-	const orderedEntries = Object.entries(honorAllToolsOnBash(config.permission)).toSorted(([a], [b]) => (a === "edit" ? 1 : 0) - (b === "edit" ? 1 : 0));
-	for (const [category, rules] of orderedEntries) {
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
 			if (pattern !== CATCH_ALL_PATTERN$4) {
@@ -48479,12 +48509,15 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 				continue;
 			}
 			const previous = assigned.get(toolName);
-			if (previous !== void 0 && previous !== action) {
-				logger?.warn(`Goose maps "${category}" onto the "${toolName}" tool, which already has a conflicting permission ("${previous}"). The "${action}" value takes precedence.`);
+			if (previous === action) continue;
+			if (previous !== void 0) {
+				const stricter = ACTION_RANK$1[action] > ACTION_RANK$1[previous] ? action : previous;
+				logger?.warn(`Goose maps "${category}" onto the "${toolName}" tool, which already has a conflicting permission ("${previous}"). Keeping the stricter "${stricter}" (deny > ask > allow).`);
+				if (stricter === previous) continue;
 				const previousList = lists[ACTION_TO_GOOSE_LIST[previous]];
 				const index = previousList.indexOf(toolName);
 				if (index !== -1) previousList.splice(index, 1);
-			} else if (previous === action) continue;
+			}
 			lists[ACTION_TO_GOOSE_LIST[action]].push(toolName);
 			assigned.set(toolName, action);
 		}
@@ -48500,8 +48533,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
 		const toolNames = isStringArray$2(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
-		for (const toolName of toolNames) {
-			const category = GOOSE_TO_RULESYNC_TOOL_NAME[toolName] ?? toolName;
+		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
 			permission[category][CATCH_ALL_PATTERN$4] = action;
 		}
@@ -82584,4 +82616,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncCommand as $, toPosixPath as $t, CLAUDECODE_MEMORIES_DIR_NAME as A, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as An, checkPathTraversal as At, RulesyncSubagent as B, stripControlCharacters as Bn, listDirectoryEntryNames as Bt, COMMANDCODE_DIR as C, RULESYNC_PERMISSIONS_SCHEMA_URL as Cn, withWarnOnceScope as Ct, CODEXCLI_DIR as D, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, assertDirectoryIfExists as Dt, CODEXCLI_BASH_RULES_FILE_NAME as E, RULESYNC_SKILLS_RELATIVE_DIR_PATH as En, applyFileMode as Et, caseFoldIdentity as F, formatError as Fn, getFileSize as Ft, RulesyncRuleFrontmatterSchema as G, readFileContentOrNull as Gt, RulesyncSkill as H, stripHiddenCharacters as Hn, listSubdirectoryNames as Ht, groupSpellingsByCaseFoldedIdentity as I, truncateText as In, getHomeDirectory as It, RulesyncIgnore as J, removeFile as Jt, RulesyncPermissions as K, removeDirectory as Kt, AUGMENTCODE_DIR as L, hasDeceptiveHiddenCharacters as Ln, isFileNotFoundError as Lt, CLAUDECODE_SKILLS_DIR_PATH as M, ALL_FEATURES as Mn, directoryExists as Mt, FACTORYDROID_DIR as N, ALL_FEATURES_WITH_WILDCARD as Nn, ensureDir as Nt, CLAUDECODE_DIR as O, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as On, assertTreeContainsNoSymlinks as Ot, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as P, DEPRECATED_FEATURE_REPLACEMENTS as Pn, fileExists as Pt, parseJsonc as Q, runWithDirectoryRollback as Qt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as R, hasEnclosingMarkOutsideKeycap as Rn, isFileSystemError as Rt, QWENCODE_LOCAL_RULE_FILE_NAME as S, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Sn, resetRunWarningState as St, ChecksProcessor as T, RULESYNC_RULES_RELATIVE_DIR_PATH as Tn, ErrorCodes as Tt, RulesyncSkillFrontmatterSchema as U, pathEscapesRoot as Ut, RulesyncSubagentFrontmatterSchema as V, stripControlCharactersKeepingLineFeeds as Vn, listFilePathsRecursively as Vt, RulesyncRule as W, readFileContent as Wt, getRulesyncSourceCandidates as X, removeTempDirectory as Xt, RulesyncHooks as Y, removeFileStrict as Yt, resolveRulesyncSourceWritePath as Z, resolvePath as Zt, IgnoreProcessor as _, RULESYNC_IGNORE_RELATIVE_FILE_PATH as _n, JsonLogger as _t, getProcessorRegistryEntry as a, ToolTargetSchema as an, SHARED_USER_MANAGED_CONFIG_PATHS as at, CommandsProcessor as b, RULESYNC_MCP_SCHEMA_URL as bn, warnOnConflictingFlags as bt, RulesProcessor as c, MAX_FILE_SIZE as cn, mergeInputRootConfigs as ct, CODEBUDDY_DIR as d, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as dn, ConfigFileSchema as dt, writeFileBuffer as en, RulesyncCommandFrontmatterSchema as et, CODEBUDDY_LOCAL_RULE_FILE_NAME as f, RULESYNC_CONFIG_RELATIVE_FILE_PATH as fn, GITIGNORE_DESTINATION_KEY as ft, McpProcessor as g, RULESYNC_HOOKS_RELATIVE_FILE_PATH as gn, ConsoleLogger as gt, shortenToWidth as h, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as hn, findControlCharacter as ht, inspectInputRoots as i, PACKAGING_TOOL_TARGETS as in, loadYaml as it, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as j, parseCommaSeparatedList as jn, createTempDirectory as jt, CLAUDECODE_LOCAL_RULE_FILE_NAME as k, RULESYNC_USER_CONFIG_DIR_NAME as kn, assertWritablePathInsideRoot as kt, SubagentsProcessor as l, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as ln, resolveEffectiveInputRoots as lt, displayWidthOf as m, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as mn, assertTargetsFeaturesExclusive as mt, formatSourceLoadFailure as n, ALL_TOOL_TARGETS as nn, RulesyncCheckFrontmatterSchema as nt, convertFromTool as o, CURATED_RULES_FEATURE_SUBDIR as on, SKILL_FILE_NAME as ot, ELLIPSIS_WIDTH as p, RULESYNC_CONFIG_SCHEMA_URL as pn, SourceEntrySchema as pt, RulesyncMcp as q, removeDirectoryStrict as qt, generate as r, ALL_TOOL_TARGETS_WITH_WILDCARD as rn, stringifyFrontmatter as rt, isPackagingToolTarget as s, FEATURE_SOURCE_TREE_ENTRIES as sn, ConfigResolver as st, importFromTool as t, writeFileContent as tn, RulesyncCheck as tt, SkillsProcessor as u, RULESYNC_CHECKS_RELATIVE_DIR_PATH as un, CONFLICTING_TARGET_PAIRS as ut, HooksProcessor as v, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as vn, WarningCollectingLogger as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_RELATIVE_DIR_PATH as wn, CLIError as wt, QWENCODE_DIR as x, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as xn, withFallbackLoggerTarget as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_MCP_RELATIVE_FILE_PATH as yn, fallbackLogger as yt, getLocalSkillDirNames as z, quoteForLog as zn, isSymlink as zt };
 
-//# sourceMappingURL=import-C-Jsxedt.js.map
+//# sourceMappingURL=import-CSKYRGa5.js.map