rulesync 26.0.0 → 27.0.0

package/dist/{import-CGGCq_jP.cjs → import-B8FW-x0a.cjs}

@@ -444,36 +444,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$408 } = node_path.posix;
+const { join: join$410 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$408(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$410(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$408(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$408(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$410(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$410(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$408(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$410(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -712,6 +712,7 @@ const subagentsProcessorToolTargetTuple = [
 	"antigravity-plugin",
 	"augmentcode",
 	"augmentcode-plugin",
+	"bob",
 	"claudecode",
 	"claudecode-plugin",
 	"claudecode-legacy",
@@ -878,6 +879,7 @@ const permissionsProcessorToolTargetTuple = [
 	"claudecode",
 	"cline",
 	"codebuddy",
+	"codewhale",
 	"codexcli",
 	"commandcode",
 	"continue",
@@ -899,6 +901,7 @@ const permissionsProcessorToolTargetTuple = [
 	"kiro-ide",
 	"lettacode",
 	"mimocode",
+	"omp",
 	"opencode",
 	"pi",
 	"pool",
@@ -922,6 +925,7 @@ const checksProcessorToolTargetTuple = [
 	"factorydroid",
 	"gitlabduo",
 	"hermesagent",
+	"kilo",
 	"qwencode",
 	"rovodev",
 	"takt"
@@ -3716,6 +3720,8 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".grok/sandbox.toml",
 	".letta/settings.json",
 	".qoder/settings.json",
+	".omp/config.yml",
+	".omp/agent/config.yml",
 	".rovodev/config.yml",
 	".rovodev/mcp.json",
 	".poolside/settings.yaml",
@@ -7689,6 +7695,32 @@ const ToolScopedPermissionSchema = zod_mini.z.record(PermissionCategorySchema, P
 * added without a schema break.
 */
 const CanonicalPermissionsOverrideSchema = zod_mini.z.looseObject({ permission: zod_mini.z.optional(ToolScopedPermissionSchema) });
+/**
+* One Codewhale `[[rules]]` record of `~/.codewhale/permissions.toml`, written
+* verbatim. Codewhale parses the file with unknown fields denied, so a single
+* misspelled key would make it reject every rule in the file; the record is
+* therefore strict here, surfacing the typo on the rulesync source instead.
+*
+* @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
+*/
+const CodewhalePermissionRuleSchema = zod_mini.z.strictObject({
+	tool: zod_mini.z.string(),
+	command: zod_mini.z.optional(zod_mini.z.string()),
+	command_exact: zod_mini.z.optional(zod_mini.z.boolean()),
+	path: zod_mini.z.optional(zod_mini.z.string()),
+	workspace: zod_mini.z.optional(zod_mini.z.string()),
+	action: zod_mini.z.optional(PermissionActionSchema)
+});
+/**
+* Tool-scoped override block for Codewhale. `rules` carries native records the
+* canonical category/pattern shape cannot express — a `workspace`-scoped rule,
+* a tool rulesync does not map, an exact-command deny — and is emitted ahead of
+* the rules converted from the canonical block.
+*/
+const CodewhalePermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	rules: zod_mini.z.optional(zod_mini.z.array(CodewhalePermissionRuleSchema))
+});
 const KimiCodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
 	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum([
@@ -7909,12 +7941,15 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
 * `sandbox`, `sandboxImage`, `disabled`, `visible`, `eager`, `listDirectory`,
-* `todoWrite`, `workflowsEnabled`) and `security` (`folderTrust`, `allowedHttpHookUrls`,
-* `allowPrivateNetworkHooks`, `allowedInsecureVoiceBaseUrls`). Qwen Code strips
-* `tools.workflowsEnabled`, `security.allowPrivateNetworkHooks` and
+* `todoWrite`, `workflowsEnabled`, `workflowNameOnly`, `executionSandbox`) and
+* `security` (`folderTrust`, `allowedHttpHookUrls`, `allowPrivateNetworkHooks`,
+* `allowedInsecureVoiceBaseUrls`). Qwen Code strips `tools.workflowsEnabled`,
+* `tools.executionSandbox`, `security.allowPrivateNetworkHooks` and
 * `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
-* skips those three in project scope and announces a granting value in global
-* scope. `security.allowedHttpHookUrls` (honored in a workspace only while no
+* skips those four in project scope and announces a granting value in global
+* scope (any `executionSandbox` change counts). `tools.workflowNameOnly` is
+* written in both scopes, but a workspace may only turn it on, which the
+* project-scope note says. `security.allowedHttpHookUrls` (honored in a workspace only while no
 * higher scope sets it) and `security.folderTrust` (the initial trust decision
 * is made from user/system settings alone, before the workspace merge) are
 * written in both scopes, with a note in project scope and an announcement of
@@ -8802,6 +8837,7 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	augmentcode: zod_mini.z.optional(AugmentcodePermissionsOverrideSchema),
 	kiro: zod_mini.z.optional(KiroPermissionsOverrideSchema),
 	codexcli: zod_mini.z.optional(CodexcliPermissionsOverrideSchema),
+	codewhale: zod_mini.z.optional(CodewhalePermissionsOverrideSchema),
 	zed: zod_mini.z.optional(ZedPermissionsOverrideSchema),
 	devin: zod_mini.z.optional(DevinPermissionsOverrideSchema),
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
@@ -8814,6 +8850,7 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	crush: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	omp: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	pool: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	qoder: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
@@ -10747,6 +10784,13 @@ const RulesyncSubagentFrontmatterSchema = zod_mini.z.looseObject({
 		customInstructions: zod_mini.z.optional(zod_mini.z.string()),
 		groups: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.unknown()))
 	})),
+	bob: zod_mini.z.optional(zod_mini.z.looseObject({
+		slug: zod_mini.z.optional(zod_mini.z.string()),
+		whenToUse: zod_mini.z.optional(zod_mini.z.string()),
+		roleDefinition: zod_mini.z.optional(zod_mini.z.string()),
+		customInstructions: zod_mini.z.optional(zod_mini.z.string()),
+		groups: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.unknown()))
+	})),
 	zoocode: zod_mini.z.optional(zod_mini.z.looseObject({ 
 	/** Per-mode MCP server allowlist (Zoo Code v3.60.0+); omitted = all. */
 allowedMcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) })),
@@ -11087,6 +11131,27 @@ const GITLABDUO_SKILLS_DIR = "skills";
 /** User skills (requires `--enable-global-skills` / `GITLAB_ENABLE_GLOBAL_SKILLS`). */
 const GITLABDUO_GLOBAL_SKILLS_DIR = (0, node_path.join)(GITLABDUO_DIR, "skills");
 //#endregion
+//#region src/constants/kilo-paths.ts
+const KILO_DIR = ".kilo";
+const KILO_GLOBAL_DIR = (0, node_path.join)(".config", "kilo");
+const KILO_RULES_DIR_NAME = "rules";
+const KILO_COMMANDS_DIR_PATH = (0, node_path.join)(KILO_DIR, "commands");
+const KILO_GLOBAL_COMMANDS_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "commands");
+const KILO_SKILLS_DIR_PATH = (0, node_path.join)(KILO_DIR, "skills");
+const KILO_AGENTS_DIR_PATH = (0, node_path.join)(KILO_DIR, "agents");
+const KILO_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "agents");
+const KILO_PLUGINS_DIR_PATH = (0, node_path.join)(KILO_DIR, "plugins");
+const KILO_GLOBAL_PLUGINS_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "plugins");
+const KILO_PLUGIN_DIR_PATH = (0, node_path.join)(KILO_DIR, "plugin");
+const KILO_GLOBAL_PLUGIN_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "plugin");
+const KILO_RULE_FILE_NAME = "AGENTS.md";
+const KILO_IGNORE_FILE_NAME = ".kilocodeignore";
+const KILO_LEGACY_GLOBAL_DIR = ".kilocode";
+const KILO_JSONC_FILE_NAME = "kilo.jsonc";
+const KILO_JSON_FILE_NAME = "kilo.json";
+const KILO_HOOKS_FILE_NAME = "rulesync-hooks.js";
+const KILO_REVIEW_FILE_NAME = "REVIEW.md";
+//#endregion
 //#region src/constants/qwencode-paths.ts
 const QWENCODE_DIR = ".qwen";
 const QWENCODE_COMMANDS_DIR_PATH = (0, node_path.join)(QWENCODE_DIR, "commands");
@@ -11478,8 +11543,14 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 	async removeOrphanAiFiles(existingFiles, generatedFiles) {
 		const generatedPaths = new Set(generatedFiles.map((f) => caseFoldIdentity(f.getFilePath())));
 		const orphanFiles = existingFiles.filter((f) => !generatedPaths.has(caseFoldIdentity(f.getFilePath())));
+		let removedCount = 0;
 		for (const aiFile of orphanFiles) {
 			const filePath = aiFile.getFilePath();
+			if (await refusesDeleteOutsideRoot({
+				logger: this.logger,
+				rootPath: aiFile.getOutputRoot(),
+				filePath
+			})) continue;
 			const loggedPath = stripControlCharacters(filePath);
 			if (this.dryRun) this.logger.info(`[DRY RUN] Would delete: ${loggedPath}`);
 			else {
@@ -11490,8 +11561,9 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 				path: aiFile.getRelativePathFromCwd(),
 				kind: "file"
 			});
+			removedCount++;
 		}
-		return orphanFiles.length;
+		return removedCount;
 	}
 	/**
 	* The paths {@link removeOrphanAiFiles} deleted, or would have deleted under
@@ -11599,6 +11671,25 @@ async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
 	return true;
 }
 /**
+* Whether deleting `filePath` has to be refused because a link on the way to
+* the directory holding it leads out of `rootPath`, warning about the refusal.
+*
+* Deletion candidates are enumerated without following links *inside* the
+* scanned directory, but the scanned directory itself is reached through
+* whatever links its path contains: a checked-out repository can carry
+* `.cursor/commands -> ~/notes`, and every file in `~/notes` would then read as
+* an orphan. Only the parent is judged, because removing a file that is itself
+* a link unlinks the link where it is spelled and never touches its target.
+*/
+async function refusesDeleteOutsideRoot({ logger, rootPath, filePath }) {
+	if (!await writablePathEscapesRoot({
+		rootPath,
+		targetPath: (0, node_path.dirname)(filePath)
+	})) return false;
+	logger.warn(`Refusing to delete ${quoteForLog(filePath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	return true;
+}
+/**
 * {@link refusesWriteOutsideRoot} over every path a single unit of output
 * writes, stopping at the first refusal: a directory written as one unit is
 * held back whole when any one file in it would land outside the root.
@@ -12741,7 +12832,7 @@ function stripSkillFrontmatter(fileContent) {
 		content = rest.slice(closing.index + closing[0].length).replace(LEADING_BLANK_LINE_PATTERN, "");
 	}
 }
-function handWrittenWarning({ filePath, displayName, toolTarget }) {
+function handWrittenWarning$1({ filePath, displayName, toolTarget }) {
 	return `${displayName} checks: ${filePath} holds instructions rulesync did not write, so it is left as it is and no checks were generated for ${displayName}. Run \`rulesync import --targets ${toolTarget} --features checks\` to bring them into \`.rulesync/checks/\` and then delete the file, so the next generate writes it back from there; delete it outright if you no longer want it, or rename the directory if it is an ordinary skill rather than review guidelines. Importing alone leaves this file as it is, so it keeps blocking generation until it is gone. A rulesync skill named \`${FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME}\` is no longer generated here — Factory's reviewer reads this path, so the checks feature owns it — but a directory an older rulesync wrote can still be sitting there.`;
 }
 /**
@@ -12798,7 +12889,7 @@ var FactorydroidCheck = class extends AggregatedToolCheck {
 			toolTarget: "factorydroid",
 			fallbackCheckName: FACTORYDROID_REVIEW_GUIDELINES_DIR_NAME,
 			handWrittenPreamble: "skip",
-			handWrittenWarning,
+			handWrittenWarning: handWrittenWarning$1,
 			transformImportedContent: stripSkillFrontmatter
 		};
 	}
@@ -13279,6 +13370,51 @@ var HermesagentCheck = class HermesagentCheck extends ToolCheck {
 	}
 };
 //#endregion
+//#region src/features/checks/kilo-check.ts
+function handWrittenWarning({ filePath, displayName, toolTarget }) {
+	return `${displayName} checks: ${filePath} holds instructions rulesync did not write, so it is left as it is and no checks were generated for ${displayName}. Run \`rulesync import --targets ${toolTarget} --features checks\` to bring them into \`.rulesync/checks/\` and then delete the file, so the next generate writes it back from there. Importing alone leaves this file as it is, so it keeps blocking generation until it is gone.`;
+}
+/**
+* Checks adapter for Kilo Code Reviews' repository guidance (root `REVIEW.md`).
+*
+* The Kilo review agent reads one plain-Markdown file at the repository root
+* (from the PR/MR base branch, once "Use REVIEW.md" is enabled in the Kilo web
+* app), so every `.rulesync/checks/*.md` targeting Kilo collapses into it via
+* the `fromRulesyncChecks` on {@link AggregatedToolCheck}, with each check
+* written as a marked section (see `aggregated-check-file.ts` for the marker
+* convention).
+*
+* The reviewer reads the file as free prose, so a check's `severity` and
+* `tools` have no equivalent there: they are not written and do not come back
+* on import. Neither does `description` whenever the check also has a body.
+*
+* Project scope only — the reviewer reads the file from the repository and
+* there is no user-level equivalent.
+*
+* A root-level `REVIEW.md` is a generic name other reviewers may read too, so
+* unlike Cursor Bugbot's tool-specific `.cursor/BUGBOT.md` a hand-written file
+* here is left untouched (the `skip` policy) rather than replaced.
+*
+* @see https://kilo.ai/docs/automate/code-reviews
+*/
+var KiloCheck = class extends AggregatedToolCheck {
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: ".",
+			relativeFilePath: KILO_REVIEW_FILE_NAME
+		};
+	}
+	static getAggregatedCheckConfig() {
+		return {
+			displayName: "Kilo Code",
+			toolTarget: "kilo",
+			fallbackCheckName: "review",
+			handWrittenPreamble: "skip",
+			handWrittenWarning
+		};
+	}
+};
+//#endregion
 //#region src/features/checks/qwencode-check.ts
 /**
 * Checks adapter for Qwen Code's `/review` project rules (`.qwen/review-rules.md`).
@@ -13375,6 +13511,12 @@ const CLAUDECODE_LOCAL_RULE_FILE_NAME = "CLAUDE.local.md";
 const CLAUDECODE_RULES_DIR_NAME = "rules";
 /** Memories directory name under `.claude/` (legacy format). */
 const CLAUDECODE_MEMORIES_DIR_NAME = "memories";
+/**
+* Directory under `.claude/` where Claude Code keeps the memory of a subagent
+* declared with `memory: local`; documented as not checked into version control.
+* @see https://code.claude.com/docs/en/sub-agents#enable-persistent-memory
+*/
+const CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME = "agent-memory-local";
 const CLAUDECODE_COMMANDS_DIR_PATH = (0, node_path.join)(CLAUDECODE_DIR, "commands");
 const CLAUDECODE_AGENTS_DIR_PATH = (0, node_path.join)(CLAUDECODE_DIR, "agents");
 const CLAUDECODE_SKILLS_DIR_PATH = (0, node_path.join)(CLAUDECODE_DIR, "skills");
@@ -14555,6 +14697,22 @@ const SHARED_CONFIG_OWNERSHIP = {
 			}
 		}
 	},
+	".omp/config.yml": {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["tools", "bash"]
+		} }
+	},
+	".omp/agent/config.yml": {
+		format: "yaml",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["tools", "bash"]
+		} }
+	},
 	".pi/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -15601,6 +15759,14 @@ const toolCheckFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.json"
 		}
 	}],
+	["kilo", {
+		class: KiloCheck,
+		meta: {
+			supportsGlobal: false,
+			filePattern: KILO_REVIEW_FILE_NAME,
+			committedOutput: true
+		}
+	}],
 	["qwencode", {
 		class: QwencodeCheck,
 		meta: {
@@ -16382,6 +16548,7 @@ const ANTIGRAVITY_IDE_RULE_FILE_NAME = "AGENTS.md";
 const ANTIGRAVITY_IDE_GEMINI_DIR = ".gemini";
 const ANTIGRAVITY_IDE_GLOBAL_RULE_FILE_NAME = "GEMINI.md";
 const ANTIGRAVITY_IDE_GLOBAL_CONFIG_SUBDIR = "config";
+const ANTIGRAVITY_IDE_GLOBAL_RULES_SUBDIR = (0, node_path.join)(ANTIGRAVITY_IDE_GLOBAL_CONFIG_SUBDIR, "rules");
 const ANTIGRAVITY_IDE_GLOBAL_WORKFLOWS_DIR_PATH = (0, node_path.join)(ANTIGRAVITY_IDE_GEMINI_DIR, "antigravity", "global_workflows");
 const ANTIGRAVITY_IDE_PERMISSIONS_DIR = ".antigravity";
 const ANTIGRAVITY_IDE_PERMISSIONS_FILE_NAME = "settings.json";
@@ -16660,6 +16827,7 @@ const BOB_COMMANDS_DIR_PATH = (0, node_path.join)(BOB_DIR, "commands");
 const BOB_SKILLS_DIR_PATH = (0, node_path.join)(BOB_DIR, "skills");
 const BOB_SETTINGS_FILE_NAME = "settings.json";
 const BOB_GLOBAL_SETTINGS_DIR_PATH = (0, node_path.join)(BOB_DIR, "settings");
+const BOB_CUSTOM_MODES_FILE_NAME = "custom_modes.yaml";
 //#endregion
 //#region src/features/commands/bob-command.ts
 /**
@@ -17189,6 +17357,7 @@ const CODEWHALE_COMMANDS_DIR_PATH = (0, node_path.join)(CODEWHALE_DIR, "commands
 const CODEWHALE_HOOKS_FILE_NAME = "hooks.toml";
 const CODEWHALE_CONFIG_FILE_NAME = "config.toml";
 const CODEWHALE_MCP_FILE_NAME = "mcp.json";
+const CODEWHALE_PERMISSIONS_FILE_NAME = "permissions.toml";
 //#endregion
 //#region src/features/commands/codewhale-command.ts
 /**
@@ -20121,25 +20290,6 @@ var JunieCommand = class JunieCommand extends ToolCommand {
 	}
 };
 //#endregion
-//#region src/constants/kilo-paths.ts
-const KILO_DIR = ".kilo";
-const KILO_GLOBAL_DIR = (0, node_path.join)(".config", "kilo");
-const KILO_RULES_DIR_NAME = "rules";
-const KILO_COMMANDS_DIR_PATH = (0, node_path.join)(KILO_DIR, "commands");
-const KILO_GLOBAL_COMMANDS_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "commands");
-const KILO_SKILLS_DIR_PATH = (0, node_path.join)(KILO_DIR, "skills");
-const KILO_AGENTS_DIR_PATH = (0, node_path.join)(KILO_DIR, "agents");
-const KILO_GLOBAL_AGENTS_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "agents");
-const KILO_PLUGINS_DIR_PATH = (0, node_path.join)(KILO_DIR, "plugins");
-const KILO_GLOBAL_PLUGINS_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "plugins");
-const KILO_PLUGIN_DIR_PATH = (0, node_path.join)(KILO_DIR, "plugin");
-const KILO_GLOBAL_PLUGIN_DIR_PATH = (0, node_path.join)(KILO_GLOBAL_DIR, "plugin");
-const KILO_RULE_FILE_NAME = "AGENTS.md";
-const KILO_IGNORE_FILE_NAME = ".kilocodeignore";
-const KILO_JSONC_FILE_NAME = "kilo.jsonc";
-const KILO_JSON_FILE_NAME = "kilo.json";
-const KILO_HOOKS_FILE_NAME = "rulesync-hooks.js";
-//#endregion
 //#region src/features/commands/kilo-command.ts
 const KiloCommandFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.optional(zod_mini.z.string()),
@@ -20633,9 +20783,26 @@ const OpenCodeCommandFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.optional(zod_mini.z.string()),
 	agent: (0, zod_mini.optional)(zod_mini.z.string()),
 	subtask: (0, zod_mini.optional)(zod_mini.z.boolean()),
+	subagent: (0, zod_mini.optional)(zod_mini.z.boolean()),
 	model: (0, zod_mini.optional)(zod_mini.z.string()),
 	variant: (0, zod_mini.optional)(zod_mini.z.string())
 });
+/**
+* Rewrites a boolean `subagent` (OpenCode V2) into `subtask`, the key both V1
+* and V2 read: V1's command schema rejects unknown keys, while V2 resolves
+* `subagent ?? subtask`. `subagent` therefore wins when both are set, matching
+* V2. A non-boolean `subagent` is left untouched for validation to report.
+*
+* @see https://opencode.ai/v2/docs/commands/
+*/
+function foldSubagentAlias(fields) {
+	if (typeof fields.subagent !== "boolean") return fields;
+	const { subagent, ...rest } = fields;
+	return {
+		...rest,
+		subtask: subagent
+	};
+}
 var OpenCodeCommand = class extends ToolCommand {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
 	static layout = OPENCODE_LAYOUT;
@@ -20663,7 +20830,8 @@ var OpenCodeCommand = class extends ToolCommand {
 		return this.frontmatter;
 	}
 	toRulesyncCommand() {
-		const { description, ...restFields } = this.frontmatter;
+		const { description, ...toolFields } = this.frontmatter;
+		const restFields = foldSubagentAlias(toolFields);
 		const { toolTarget } = this.constructor.layout;
 		const rulesyncFrontmatter = {
 			targets: ["*"],
@@ -20683,7 +20851,7 @@ var OpenCodeCommand = class extends ToolCommand {
 	}
 	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
-		const opencodeFields = rulesyncFrontmatter[this.layout.toolTarget] ?? {};
+		const opencodeFields = foldSubagentAlias(rulesyncFrontmatter[this.layout.toolTarget] ?? {});
 		const opencodeFrontmatter = {
 			description: rulesyncFrontmatter.description,
 			...opencodeFields
@@ -20739,7 +20907,8 @@ var OpenCodeCommand = class extends ToolCommand {
 	* Imports commands defined inline in `opencode.json` / `opencode.jsonc` under
 	* the top-level `command` key (in addition to the Markdown files under
 	* `.opencode/commands/`). Each entry's `template` becomes the command body,
-	* while `description` / `agent` / `model` / `subtask` map to the frontmatter.
+	* while `description` / `agent` / `model` / `subtask` map to the frontmatter
+	* (a V2 `subagent` is read as `subtask`, taking precedence like V2 does).
 	*
 	* Import-only: this is invoked by the commands processor when loading tool
 	* files for conversion to rulesync, never for orphan deletion.
@@ -20759,11 +20928,12 @@ var OpenCodeCommand = class extends ToolCommand {
 			const entry = asOpencodeEntries(rawEntry);
 			if (!entry) continue;
 			const body = typeof entry.template === "string" ? entry.template : "";
+			const { subtask } = foldSubagentAlias(entry);
 			const frontmatter = {
 				...typeof entry.description === "string" && { description: entry.description },
 				...typeof entry.agent === "string" && { agent: entry.agent },
 				...typeof entry.model === "string" && { model: entry.model },
-				...typeof entry.subtask === "boolean" && { subtask: entry.subtask }
+				...typeof subtask === "boolean" && { subtask }
 			};
 			commands.push(new this({
 				outputRoot,
@@ -20816,6 +20986,7 @@ const OMP_RULE_FILE_NAME = "AGENTS.md";
 const OMP_RULES_DIR_NAME = "rules";
 const OMP_AGENTS_DIR_NAME = "agents";
 const OMP_MCP_FILE_NAME = "mcp.json";
+const OMP_CONFIG_FILE_NAME = "config.yml";
 const OMP_LAYOUT = {
 	toolTarget: "omp",
 	dir: OMP_DIR,
@@ -22145,6 +22316,7 @@ function warpcliConfigDir() {
 	}
 }
 const WARP_RULE_FILE_NAME = "AGENTS.md";
+const WARP_LEGACY_RULE_FILE_NAME = "WARP.md";
 const WARP_GLOBAL_RULE_DIR = ".agents";
 const WARP_MCP_FILE_NAME = ".mcp.json";
 const WARP_PERMISSIONS_FILE_NAME = "settings.toml";
@@ -35725,7 +35897,9 @@ var JunieIgnore = class JunieIgnore extends ToolIgnore {
 * KiloIgnore represents ignore patterns for the Kilo Code VSCode extension.
 *
 * Based on the Kilo Code specification:
-* - File location: Workspace root folder only (.kilocodeignore)
+* - File location: workspace root (.kilocodeignore) for project scope, and
+*   `~/.kilocode/.kilocodeignore` for global scope. Kilo merges the global
+*   patterns first and the project ones after, so the project file wins.
 * - Syntax: Same as .gitignore
 * - Immediate reflection when saved
 * - Complete blocking of file access for ignored patterns
@@ -35733,11 +35907,12 @@ var JunieIgnore = class JunieIgnore extends ToolIgnore {
 *
 * Kilo reads `.kilocodeignore` (not `.kiloignore`), so emitting `.kiloignore`
 * left the file inert. https://kilo.ai/docs/customize/context/kilocodeignore
+* @see https://github.com/Kilo-Org/kilocode/blob/main/packages/opencode/src/kilocode/ignore-migrator.ts
 */
 var KiloIgnore = class KiloIgnore extends ToolIgnore {
-	static getSettablePaths() {
+	static getSettablePaths({ global = false } = {}) {
 		return {
-			relativeDirPath: ".",
+			relativeDirPath: global ? KILO_LEGACY_GLOBAL_DIR : ".",
 			relativeFilePath: KILO_IGNORE_FILE_NAME
 		};
 	}
@@ -35750,35 +35925,40 @@ var KiloIgnore = class KiloIgnore extends ToolIgnore {
 	/**
 	* Create KiloIgnore from RulesyncIgnore
 	*/
-	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore }) {
+	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
 		const body = rulesyncIgnore.getFileContent();
+		const paths = this.getSettablePaths({ global });
 		return new KiloIgnore({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
-			relativeFilePath: this.getSettablePaths().relativeFilePath,
-			fileContent: body
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: body,
+			global
 		});
 	}
 	/**
 	* Load KiloIgnore from .kilocodeignore file
 	*/
-	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
-		const fileContent = await readFileContent((0, node_path.join)(outputRoot, this.getSettablePaths().relativeDirPath, this.getSettablePaths().relativeFilePath));
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
 		return new KiloIgnore({
 			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
-			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
 			fileContent,
-			validate
+			validate,
+			global
 		});
 	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		return new KiloIgnore({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			fileContent: "",
-			validate: false
+			validate: false,
+			global
 		});
 	}
 };
@@ -36452,6 +36632,7 @@ const ignoreProcessorGlobalToolTargets = [
 	"continue",
 	"devin",
 	"grokcli",
+	"kilo",
 	"kiro",
 	"kiro-cli",
 	"kiro-ide",
@@ -40313,6 +40494,11 @@ var CrushMcp = class CrushMcp extends ToolMcp {
 * `g` flag is required because callers may have multiple references per value.
 */
 const CANONICAL_ENV_VAR_PATTERN = /\$\{(?!env:)([^}:]+)\}/g;
+/**
+* OpenCode / Kilo `{env:VAR}` env var reference pattern. The negative lookbehind
+* avoids matching Cursor's `${env:VAR}` format.
+*/
+const BRACE_ENV_VAR_PATTERN = /(?<!\$)\{env:([^}:]+)\}/g;
 function convertRecordValues({ record, pattern, replacement }) {
 	return Object.fromEntries(Object.entries(record).map(([k, v]) => [k, v.replace(pattern, replacement)]));
 }
@@ -40364,6 +40550,14 @@ function convertEnvVarRefsToToolFormat({ mcpServers, replacement }) {
 		}) }
 	}]));
 }
+/**
+* Names of the servers whose `env` or `headers` values carry at least one
+* canonical `${VAR}` env var reference.
+*/
+function findServersWithEnvVarRefs(mcpServers) {
+	const hasRef = (record) => Object.values(record ?? {}).some((value) => value.search(CANONICAL_ENV_VAR_PATTERN) !== -1);
+	return Object.entries(mcpServers).filter(([, config]) => hasRef(config.env) || hasRef(config.headers)).map(([name]) => name);
+}
 //#endregion
 //#region src/features/mcp/cursor-mcp.ts
 const CURSOR_ENV_VAR_PATTERN = /\$\{env:([^}:]+)\}/g;
@@ -42652,17 +42846,50 @@ function readExistingKiloMcpEntries(fileContent) {
 	}
 	return entries;
 }
-function convertToKiloFormat(mcpServers, existingMcp, logger) {
+const KILO_UNTRUSTED_ENV_REF_PATTERN = /\{env:[^}]+\}/;
+/**
+* Judged on the entry as written, not the canonical server: fields the entry
+* drops (a toggle keeps only `enabled`) cannot make Kilo reject the file.
+*/
+function rejectUntrustedEnvRef(serverName, converted, rejectEnvRefs, logger) {
+	if (!rejectEnvRefs || converted === null) return converted;
+	if (!KILO_UNTRUSTED_ENV_REF_PATTERN.test(JSON.stringify(converted))) return converted;
+	return warnAndSkipMcpServer({
+		toolName: "Kilo",
+		serverName,
+		reason: "an {env:...} reference, which makes Kilo reject the whole project config",
+		logger
+	});
+}
+function convertToKiloFormat(mcpServers, existingMcp, logger, rejectEnvRefs = false) {
 	const tools = {};
 	return {
 		mcp: Object.fromEntries(Object.entries(mcpServers).map(([serverName, serverConfig]) => {
-			const converted = convertServerToKiloFormat(serverName, serverConfig, Object.hasOwn(existingMcp, serverName) ? existingMcp[serverName] : void 0, logger);
+			const converted = rejectUntrustedEnvRef(serverName, convertServerToKiloFormat(serverName, serverConfig, Object.hasOwn(existingMcp, serverName) ? existingMcp[serverName] : void 0, logger), rejectEnvRefs, logger);
 			collectKiloServerTools(tools, serverName, serverConfig);
 			return converted === null ? null : [serverName, converted];
 		}).filter((entry) => entry !== null)),
 		tools
 	};
 }
+/**
+* Kilo expands only `{env:VAR}`, never the canonical `${VAR}`, and only in a
+* trusted config: the global `~/.config/kilo/kilo.jsonc`. A project config is
+* untrusted, so any `{env:` in it makes Kilo drop the whole file (or, in MCP
+* headers, the server). In project scope canonical references are therefore
+* left as written — Kilo passes them through literally — with a warning (a
+* written entry already carrying `{env:` is skipped by `convertToKiloFormat`).
+* @see https://github.com/Kilo-Org/kilocode/blob/main/packages/opencode/src/config/variable.ts
+*/
+function resolveKiloEnvVarRefs({ mcpServers, global, logger }) {
+	if (global) return convertEnvVarRefsToToolFormat({
+		mcpServers,
+		replacement: "{env:$1}"
+	});
+	const serverNames = findServersWithEnvVarRefs(mcpServers);
+	if (serverNames.length > 0) logger?.warn(`Kilo MCP servers ${serverNames.map((name) => `"${name}"`).join(", ")} use environment variable references (\${VAR}), which Kilo does not resolve in a project config; they are written literally. Use global mode (~/.config/kilo/kilo.jsonc) to have them expanded.`);
+	return mcpServers;
+}
 var KiloMcp = class KiloMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -42761,7 +42988,11 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 			if (fileContent) relativeFilePath = KILO_JSON_FILE_NAME;
 		}
 		const existingMcp = readExistingKiloMcpEntries(fileContent);
-		const { mcp: convertedMcp, tools: mcpTools } = convertToKiloFormat(rulesyncMcp.getMcpServers(), existingMcp, logger);
+		const { mcp: convertedMcp, tools: mcpTools } = convertToKiloFormat(resolveKiloEnvVarRefs({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			global,
+			logger
+		}), existingMcp, logger, !global);
 		return new KiloMcp({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
@@ -42827,7 +43058,10 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 		});
 	}
 	toRulesyncMcp() {
-		const { shared, toolOnly } = splitMcpServersByTransport(convertFromKiloFormat(this.json.mcp ?? {}, this.json.tools));
+		const { shared, toolOnly } = splitMcpServersByTransport(convertEnvVarRefsFromToolFormat({
+			mcpServers: convertFromKiloFormat(this.json.mcp ?? {}, this.json.tools),
+			pattern: BRACE_ENV_VAR_PATTERN
+		}));
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({
 			mcpServers: shared,
 			...Object.keys(toolOnly).length > 0 && { kilo: { mcpServers: toolOnly } }
@@ -43284,7 +43518,6 @@ var KiroMcp = class KiroMcp extends ToolMcp {
 };
 //#endregion
 //#region src/features/mcp/opencode-mcp.ts
-const OPENCODE_ENV_VAR_PATTERN = /(?<!\$)\{env:([^}:]+)\}/g;
 const OpencodeMcpLocalServerSchema = zod_mini.z.looseObject({
 	type: zod_mini.z.literal("local"),
 	command: zod_mini.z.array(zod_mini.z.string()),
@@ -43667,7 +43900,7 @@ var OpencodeMcp = class extends ToolMcp {
 	toRulesyncMcp() {
 		const { shared, toolOnly } = splitMcpServersByTransport(convertEnvVarRefsFromToolFormat({
 			mcpServers: convertFromOpencodeFormat(this.json.mcp ?? {}, this.json.tools),
-			pattern: OPENCODE_ENV_VAR_PATTERN
+			pattern: BRACE_ENV_VAR_PATTERN
 		}));
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({
 			mcpServers: shared,
@@ -44950,6 +45183,28 @@ const REASONIX_RETIRED_PLUGIN_FIELDS = ["trusted_read_only_tools"];
 function warnAboutRetiredFields({ name, serverRecord, logger }) {
 	for (const field of REASONIX_RETIRED_PLUGIN_FIELDS) if (serverRecord[field] !== void 0) logger?.warn(`Reasonix MCP: dropping "${field}" from "${name}"; Reasonix retired the field in v1.17.18 and ignores it, so it is no longer written.`);
 }
+/**
+* The `concurrency` values Reasonix honors. It trims and lowercases before
+* comparing (`mcpServerIsSerial` in `internal/agent/mcp_concurrency.go`), so
+* `" Serial "` counts too and is written as authored.
+*/
+const REASONIX_CONCURRENCY_VALUES = /* @__PURE__ */ new Set(["serial", "parallel"]);
+/**
+* Why a `concurrency` / `auto_start` value cannot be written, or `undefined`
+* when it can (and for every other field). A wrong type is the case that
+* matters: Reasonix declares the fields as `string` / `*bool`, and a TOML type
+* mismatch makes it refuse the whole config file. An unknown `concurrency`
+* string decodes fine but is ignored in favor of the server-name default, so it
+* is dropped too rather than written as a setting that does nothing.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/internal/config/plugin_entry.go
+*/
+function invalidSchedulingFieldReason(field, value) {
+	if (field === "auto_start" && typeof value !== "boolean") return "Reasonix expects a boolean and fails to load a config file holding any other type.";
+	if (field === "concurrency") {
+		if (typeof value !== "string") return "Reasonix expects a string and fails to load a config file holding any other type.";
+		if (!REASONIX_CONCURRENCY_VALUES.has(value.trim().toLowerCase())) return `Reasonix accepts only "serial" or "parallel" and ignores ${JSON.stringify(value)}, falling back to the server-name default.`;
+	}
+}
 function rulesyncMcpServerToReasonix(name, server, logger) {
 	const serverRecord = server;
 	const type = resolveReasonixType(server);
@@ -44974,7 +45229,14 @@ function rulesyncMcpServerToReasonix(name, server, logger) {
 	}
 	for (const field of REASONIX_PLUGIN_FIELDS) {
 		if (field === "type" || field === "command" || field === "args") continue;
-		if (serverRecord[field] !== void 0) plugin[field] = serverRecord[field];
+		const value = serverRecord[field];
+		if (value === void 0) continue;
+		const invalidReason = invalidSchedulingFieldReason(field, value);
+		if (invalidReason !== void 0) {
+			logger?.warn(`Reasonix MCP: dropping "${field}" from "${name}"; ${invalidReason}`);
+			continue;
+		}
+		plugin[field] = value;
 	}
 	warnAboutRetiredFields({
 		name,
@@ -52041,7 +52303,7 @@ const CODEBUDDY_RULE_LISTS = [
 	"ask",
 	"deny"
 ];
-const CATCH_ALL_PATTERN$10 = "*";
+const CATCH_ALL_PATTERN$11 = "*";
 const MCP_CATEGORY = "mcp";
 const MCP_RULE_PREFIX = "mcp__";
 const ALL_MCP_RULE = "mcp__*";
@@ -52114,7 +52376,7 @@ function categoryOfRule$2(rule) {
 *   and reach the `Bash` rules through `honorAllToolsOnBash`.
 */
 function buildCodebuddyRule({ category, pattern, action, logger }) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$10;
+	const catchAll = pattern === CATCH_ALL_PATTERN$11;
 	if (category === MCP_CATEGORY) {
 		if (catchAll && action === "allow") {
 			logger?.warn(`CodeBuddy permissions: skipping the 'mcp' allow rule '*' — CodeBuddy honors the all-MCP wildcard 'mcp__*' in deny and ask only. Allow servers by name instead (for example 'mcp__github').`);
@@ -52123,7 +52385,7 @@ function buildCodebuddyRule({ category, pattern, action, logger }) {
 		return catchAll ? ALL_MCP_RULE : `${MCP_RULE_PREFIX}${pattern}`;
 	}
 	if (category === "*") {
-		if (catchAll) return CATCH_ALL_PATTERN$10;
+		if (catchAll) return CATCH_ALL_PATTERN$11;
 		logger?.warn(`CodeBuddy permissions: skipping the all-tools '*' rule '${pattern}' — CodeBuddy's standalone '*' rule takes no specifier. Write it under the category it is meant for (for example 'bash' or 'read').`);
 		return null;
 	}
@@ -52141,7 +52403,7 @@ function parseCodebuddyRule(rule) {
 	const { specifier } = splitCodebuddyRule(rule);
 	if (specifier === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$10
+		pattern: CATCH_ALL_PATTERN$11
 	};
 	const trimmed = specifier.trim();
 	return trimmed === "" ? null : {
@@ -52317,6 +52579,633 @@ function parseCodebuddySettings({ fileContent, relativePath }) {
 	}
 }
 //#endregion
+//#region src/features/permissions/codewhale-permissions.ts
+const CODEWHALE_SHELL_TOOL = "exec_shell";
+/**
+* Canonical path categories and the Codewhale policy tool names their rules are
+* written for. Codewhale consults typed rules only for `exec_shell` and these
+* file tools, so a rule for any other tool (`fetch_url`, `web_search`, an MCP
+* tool, ...) is never evaluated. `edit` covers `apply_patch` too: both modify
+* existing files, and an `edit` deny that left `apply_patch` open would not
+* hold.
+*
+* @see https://github.com/Hmbown/Codewhale/blob/main/crates/tui/src/core/engine.rs (`file_tool_permission_paths`)
+* @see https://github.com/Hmbown/Codewhale/blob/main/crates/tui/src/tools/canonical_action.rs
+*/
+const CODEWHALE_PATH_CATEGORY_TOOLS = {
+	read: ["read_file"],
+	write: ["write_file"],
+	edit: ["edit_file", "apply_patch"],
+	grep: ["grep_files"],
+	glob: ["file_search"],
+	list: ["list_dir"]
+};
+/**
+* `apply_patch` can also create files (a `--- /dev/null` hunk), so a `write`
+* restriction is written for it too; a `write` allow is not, since it would
+* approve edits to existing files the `edit` category never allowed.
+*
+* @see https://github.com/Hmbown/Codewhale/blob/main/crates/tui/src/tools/apply_patch.rs
+*/
+const CODEWHALE_WRITE_RESTRICTION_TOOLS = ["write_file", "apply_patch"];
+/** The Codewhale tools a canonical path rule is written for. */
+function pathCategoryTools(category, action) {
+	if (category === "write" && action !== "allow") return CODEWHALE_WRITE_RESTRICTION_TOOLS;
+	return CODEWHALE_PATH_CATEGORY_TOOLS[category] ?? [];
+}
+/** The canonical path categories a Codewhale file tool's rule can come from. */
+const CODEWHALE_TOOL_TO_PATH_CATEGORIES = {
+	read_file: ["read"],
+	write_file: ["write"],
+	edit_file: ["edit"],
+	apply_patch: ["edit", "write"],
+	grep_files: ["grep"],
+	file_search: ["glob"],
+	list_dir: ["list"]
+};
+const CODEWHALE_GLOBAL_ONLY_MESSAGE = "Codewhale permissions are global-only; use --global to sync ~/.codewhale/permissions.toml";
+const COMMAND_WILDCARD_CHARACTERS = /[*?[]/;
+const PATH_GLOB_CHARACTERS = /[*?[\]{}]/;
+function isCatchAllPattern(pattern) {
+	return pattern === "*" || pattern === "**";
+}
+/**
+* The literal command prefix a wildcard pattern pins down, cut back to a word
+* boundary so it never names a partial word (`git push* --force` pins down
+* `git`, not `git push`). Empty when the pattern starts with a wildcard.
+*/
+function literalCommandPrefix(pattern) {
+	const firstWildcard = pattern.search(COMMAND_WILDCARD_CHARACTERS);
+	const head = pattern.slice(0, firstWildcard);
+	if (/\s$/.test(head)) return head.trim();
+	const lastBoundary = head.search(/\s\S*$/);
+	return lastBoundary < 0 ? "" : head.slice(0, lastBoundary).trim();
+}
+/**
+* Convert one canonical `bash` rule. Codewhale matches `command` as a
+* word-boundary prefix of the invocation (or the whole invocation with
+* `command_exact = true`); it expands no wildcards.
+*
+* - `*` / `**` → a tool-wide rule.
+* - `git *` → the prefix `git`.
+* - A wildcard-free `allow` → an exact command, so it approves nothing more
+*   than the command it names. A wildcard-free `deny` / `ask` → a prefix, the
+*   way Codewhale's own deny rules are matched, so the restriction also covers
+*   the command with more arguments.
+* - Any other wildcard: a restricting rule is broadened to the literal prefix
+*   it pins down; an `allow` is skipped, since no prefix approves only what it
+*   names.
+*/
+function convertShellRule({ pattern, action, source = SHELL_PERMISSION_CATEGORY, logger }) {
+	const trimmed = pattern.trim();
+	if (isCatchAllPattern(trimmed)) return {
+		tool: CODEWHALE_SHELL_TOOL,
+		action
+	};
+	if (trimmed === "") {
+		logger?.warn(`Codewhale permissions: skipping empty ${source} ${action} pattern.`);
+		return null;
+	}
+	if (!COMMAND_WILDCARD_CHARACTERS.test(trimmed)) return action === "allow" ? {
+		tool: CODEWHALE_SHELL_TOOL,
+		command: trimmed,
+		command_exact: true,
+		action
+	} : {
+		tool: CODEWHALE_SHELL_TOOL,
+		command: trimmed,
+		action
+	};
+	const trailingPrefix = trimmed.endsWith(" *") ? trimmed.slice(0, -2).trim() : null;
+	if (trailingPrefix && !COMMAND_WILDCARD_CHARACTERS.test(trailingPrefix)) return {
+		tool: CODEWHALE_SHELL_TOOL,
+		command: trailingPrefix,
+		action
+	};
+	if (action === "allow") {
+		logger?.warn(`Codewhale permissions: skipping ${source} allow "${pattern}" because Codewhale matches commands by prefix and expands no wildcards.`);
+		return null;
+	}
+	const prefix = literalCommandPrefix(trimmed);
+	if (prefix === "") {
+		logger?.warn(`Codewhale permissions: skipping ${source} ${action} "${pattern}" because it pins down no literal command prefix Codewhale could match.`);
+		return null;
+	}
+	logger?.warn(`Codewhale permissions: broadening ${source} ${action} "${pattern}" to the command prefix "${prefix}" because Codewhale expands no wildcards.`);
+	return {
+		tool: CODEWHALE_SHELL_TOOL,
+		command: prefix,
+		action
+	};
+}
+/**
+* Convert one canonical path rule. Codewhale matches `path` exactly (after
+* normalizing it against the workspace) and expands no globs, so `*` / `**`
+* become a tool-wide rule and any other glob is skipped: narrowing it to a
+* single path would leave the rest of the glob unrestricted, and widening it to
+* the whole tool would restrict far more than written.
+*/
+function convertPathRules({ category, pattern, action, logger }) {
+	const tools = pathCategoryTools(category, action);
+	const trimmed = pattern.trim();
+	if (isCatchAllPattern(trimmed)) return tools.map((tool) => ({
+		tool,
+		action
+	}));
+	if (trimmed === "" || PATH_GLOB_CHARACTERS.test(trimmed)) {
+		logger?.warn(`Codewhale permissions: skipping ${category} ${action} "${pattern}" because Codewhale matches exact paths and expands no globs.`);
+		return [];
+	}
+	return tools.map((tool) => ({
+		tool,
+		path: trimmed,
+		action
+	}));
+}
+function ruleKey(rule) {
+	return JSON.stringify([
+		rule.tool,
+		rule.command ?? null,
+		rule.command_exact ?? false,
+		rule.path ?? null,
+		rule.workspace ?? null,
+		rule.action ?? "ask"
+	]);
+}
+function withExplicitAction(rule) {
+	return {
+		...rule,
+		action: rule.action ?? "ask"
+	};
+}
+/**
+* Codewhale picks the matching rule by action (`deny` > `ask` > `allow`) before
+* specificity, so file order never changes a decision. The rules are still
+* sorted that way, then by tool, so the output is stable and reads in the order
+* Codewhale applies it.
+*/
+function sortRules(rules) {
+	return rules.map((rule, index) => ({
+		rule,
+		index
+	})).toSorted((left, right) => {
+		const actionOrder = PERMISSION_ACTION_PRIORITY[right.rule.action] - PERMISSION_ACTION_PRIORITY[left.rule.action];
+		if (actionOrder !== 0) return actionOrder;
+		const toolOrder = left.rule.tool.localeCompare(right.rule.tool);
+		if (toolOrder !== 0) return toolOrder;
+		return left.index - right.index;
+	}).map(({ rule }) => rule);
+}
+function recordDroppedRestriction({ dropped, tools, glob }) {
+	for (const tool of tools) dropped.set(tool, [...dropped.get(tool) ?? [], glob]);
+}
+/**
+* A `[...]` class in a restriction widens to `?` (any one character): matched
+* after lowercasing, a negated or mixed-case class would otherwise narrow what
+* the restriction covers.
+*/
+function widenRestrictionClasses(pattern) {
+	return pattern.replace(/\[[!^]?\]?[^\]]*\]/g, "?");
+}
+/**
+* An `allow` rule names a literal command or path, so a `[` in it widens to `?`
+* rather than opening a class that would not even match the rule itself.
+*/
+function literalAsGlob(value) {
+	return value.replaceAll("[", "?");
+}
+/**
+* Codewhale matches commands case-insensitively and word by word, so commands
+* are compared lowercased with their whitespace collapsed.
+*/
+function normalizeCommandGlob(glob) {
+	return glob.trim().replace(/\s+/g, " ").toLowerCase();
+}
+/**
+* Codewhale normalizes a rule's path against the workspace, dropping empty and
+* `.` segments, so the same file can be spelled several ways. Paths are
+* compared lowercased (for case-insensitive file systems) with those segments
+* dropped, a `{a,b}` group widens to `*`, a `**` segment widens so it also
+* matches no directory at all (a leading `**` segment before `*.pem` reaches
+* `dev.pem`, and `secrets/**` reaches `secrets`), and a path that is absolute,
+* home-relative or climbs with `..` widens to `*` outright, since it cannot be
+* compared against a workspace-relative one. Every rewrite only widens a
+* pattern, so an inexact comparison withholds an `allow` rather than writing
+* one a dropped restriction overlaps.
+*/
+function normalizePathGlob(glob) {
+	const normalized = glob.trim().replaceAll("\\", "/").toLowerCase();
+	if (/^(?:\/|~|[a-z]:)/.test(normalized) || /(?:^|\/)\.\.(?:\/|$)/.test(normalized)) return "*";
+	return normalized.split("/").filter((segment) => segment !== "" && segment !== ".").join("/").replace(/\{.*\}/g, "*").replace(/\*\*\//g, "*").replace(/\/\*\*$/, "*");
+}
+/** A dropped `bash` (or all-tools) restriction, as a glob to compare `allow` rules against. */
+function shellRestrictionGlob(pattern) {
+	return normalizeCommandGlob(widenRestrictionClasses(pattern));
+}
+/** A dropped path restriction, as a glob to compare `allow` rules against. */
+function pathRestrictionGlob(pattern) {
+	return normalizePathGlob(widenRestrictionClasses(pattern));
+}
+/**
+* The file tools whose `path` is the directory a search or listing starts from,
+* so an `allow` on a directory reaches everything under it.
+*/
+const CODEWHALE_DIRECTORY_ROOTED_TOOLS = /* @__PURE__ */ new Set([
+	"grep_files",
+	"file_search",
+	"list_dir"
+]);
+/**
+* The globs a written `allow` rule approves, for comparison with dropped
+* restrictions. A path that normalizes to the workspace root (`.`) approves
+* everything, and a directory-rooted tool's path approves what lies under it.
+*/
+function allowRuleComparisonGlobs(rule) {
+	if (rule.tool === CODEWHALE_SHELL_TOOL) {
+		if (rule.command === void 0) return ["*"];
+		const command = normalizeCommandGlob(literalAsGlob(rule.command));
+		return rule.command_exact ? [command] : [command, `${command} *`];
+	}
+	const path = rule.path === void 0 ? "" : normalizePathGlob(literalAsGlob(rule.path));
+	if (path === "") return ["*"];
+	return CODEWHALE_DIRECTORY_ROOTED_TOOLS.has(rule.tool) ? [path, `${path}/*`] : [path];
+}
+/**
+* Drop every `allow` rule that a restriction which could not be written
+* overlaps (any one command or path matches both), so what the restriction
+* named reaches Codewhale's approval prompt instead of being auto-approved. An
+* `allow` no dropped restriction overlaps is kept. Comparisons share one budget;
+* once it runs out every comparison answers "overlaps", so the rule is withheld.
+*/
+function withholdShadowedAllowRules({ rules, dropped, logger }) {
+	const budget = createIntersectionBudget();
+	const tests = new Map([...dropped].map(([tool, globs]) => [tool, createShadowingRestrictionsTest(globs.map((pattern) => ({
+		pattern,
+		fromAllToolsCategory: false
+	})), { budget })]));
+	return rules.filter((rule) => {
+		const test = tests.get(rule.tool);
+		if ((rule.action ?? "ask") !== "allow" || test === void 0) return true;
+		const shadowing = [...new Set(allowRuleComparisonGlobs(rule).flatMap((glob) => test(glob)))];
+		if (shadowing.length === 0) return true;
+		logger?.warn(`Codewhale permissions: withholding ${rule.tool} allow ${JSON.stringify(rule.command ?? rule.path ?? "*")}${rule.workspace === void 0 ? "" : ` (workspace ${rule.workspace})`} because the deny/ask rule(s) ${shadowing.map((pattern) => JSON.stringify(pattern)).join(", ")} for ${rule.tool} could not be written; those calls keep Codewhale's approval prompt.`);
+		return false;
+	});
+}
+/**
+* An all-tools `deny` / `ask` names paths as much as commands (`secrets/**`
+* under `*` denies a path), so it is written for every file tool as well. A
+* pattern Codewhale cannot match as a path is recorded as dropped for every file
+* tool instead, the same way a skipped restriction of a path category is.
+*/
+function convertAllToolsPathRestriction({ pattern, action, converted, dropped, logger }) {
+	const categories = Object.keys(CODEWHALE_PATH_CATEGORY_TOOLS);
+	const pathRules = categories.flatMap((category) => convertPathRules({
+		category,
+		pattern,
+		action
+	}));
+	if (pathRules.length > 0) {
+		converted.push(...pathRules);
+		return;
+	}
+	logger?.warn(`Codewhale permissions: all-tools ${action} "${pattern}" cannot be written for Codewhale's file tools, which match exact paths and expand no globs.`);
+	for (const category of categories) recordDroppedRestriction({
+		dropped,
+		tools: pathCategoryTools(category, action),
+		glob: pathRestrictionGlob(pattern)
+	});
+}
+/**
+* Convert the rules that govern shell commands (`bash`, plus the restricting
+* rules of the all-tools `*` category) into `converted`, recording in
+* `dropped` each restriction that could not be written.
+*/
+function convertShellCommandRules({ config, converted, dropped, logger }) {
+	const { rules: shellRules, ignoredAllToolsAllowPatterns } = collectShellCommandRules(config.permission);
+	for (const { pattern, action, fromAllToolsCategory } of shellRules) {
+		const rule = convertShellRule({
+			pattern,
+			action,
+			source: fromAllToolsCategory ? "all-tools (as a shell command)" : SHELL_PERMISSION_CATEGORY,
+			logger
+		});
+		if (rule) converted.push(rule);
+		else if (action !== "allow") recordDroppedRestriction({
+			dropped,
+			tools: [CODEWHALE_SHELL_TOOL],
+			glob: shellRestrictionGlob(pattern)
+		});
+		if (fromAllToolsCategory) convertAllToolsPathRestriction({
+			pattern,
+			action,
+			converted,
+			dropped,
+			logger
+		});
+	}
+	if (ignoredAllToolsAllowPatterns.length > 0) logger?.warn(`Codewhale permissions: skipping all-tools allow rule(s) ${ignoredAllToolsAllowPatterns.map((pattern) => `"${pattern}"`).join(", ")}; an allow under "*" is never widened to Codewhale's tools.`);
+}
+/**
+* Convert the canonical block. The all-tools `*` category contributes its
+* restricting rules to shell commands (as every command-only adapter reads it,
+* see `collectShellCommandRules`), and its catch-all `*` restriction to every
+* file tool as well.
+*
+* A `deny` / `ask` Codewhale cannot express is not merely skipped: every
+* `allow` rule it overlaps for a tool it was meant to restrict is withheld too —
+* the generated ones and the preserved workspace-scoped grants alike — so the
+* commands or paths it named reach Codewhale's approval prompt instead of being
+* auto-approved by a broader `allow` (`{ "*": "allow", "secrets/**": "deny" }`
+* must not become a bare tool-wide allow). The `codewhale.rules` passthrough is
+* written as it stands.
+*/
+function canonicalToCodewhaleRules({ config, preservedRules, logger }) {
+	const converted = [];
+	const dropped = /* @__PURE__ */ new Map();
+	convertShellCommandRules({
+		config,
+		converted,
+		dropped,
+		logger
+	});
+	for (const [category, rules] of Object.entries(config.permission)) {
+		if (category === "bash" || category === "*") continue;
+		if (CODEWHALE_PATH_CATEGORY_TOOLS[category] === void 0) {
+			if (Object.keys(rules).length > 0) logger?.warn(`Codewhale permissions: skipping unsupported category "${category}"; Codewhale evaluates permission rules only for shell commands and file tools.`);
+			continue;
+		}
+		for (const [pattern, action] of Object.entries(rules)) {
+			const pathRules = convertPathRules({
+				category,
+				pattern,
+				action,
+				logger
+			});
+			converted.push(...pathRules);
+			if (pathRules.length === 0 && action !== "allow") recordDroppedRestriction({
+				dropped,
+				tools: pathCategoryTools(category, action),
+				glob: pathRestrictionGlob(pattern)
+			});
+		}
+	}
+	const kept = withholdShadowedAllowRules({
+		rules: converted,
+		dropped,
+		logger
+	});
+	const keptPreserved = withholdShadowedAllowRules({
+		rules: preservedRules,
+		dropped,
+		logger
+	});
+	return [
+		...(config.codewhale?.rules ?? []).map(withExplicitAction),
+		...sortRules(kept),
+		...keptPreserved
+	];
+}
+function parsePermissionsDocument({ fileContent, filePath }) {
+	if (fileContent.trim() === "") return {};
+	try {
+		return smol_toml.parse(fileContent);
+	} catch (error) {
+		throw new Error(`Failed to parse existing Codewhale permissions at ${filePath}: ${formatError(error)}`, { cause: error });
+	}
+}
+/**
+* The workspace-scoped rules already in the file. Codewhale's approval card
+* appends one ("Always allow this exact rule in this repo") with the absolute
+* `workspace` it was granted in, and rulesync never derives a `workspace` from
+* the canonical block, so these are remembered grants rather than earlier
+* rulesync output and survive a regenerate. A record Codewhale would reject is
+* not carried over, since it would make Codewhale refuse the whole file.
+*/
+function collectWorkspaceScopedRules({ document, logger }) {
+	const { valid, invalidCount } = partitionRuleRecords(document);
+	if (invalidCount > 0) logger?.warn(`Codewhale permissions: dropping ${invalidCount} existing rule record(s) Codewhale would reject (an unknown key or a wrong type).`);
+	return valid.filter((rule) => rule.workspace !== void 0);
+}
+/**
+* Codewhale reads `permissions.toml` next to the `config.toml` in use, which
+* `CODEWHALE_HOME` or `CODEWHALE_CONFIG_PATH` can move away from
+* `~/.codewhale/`. rulesync always writes `~/.codewhale/permissions.toml`, so
+* say so when either is set rather than let the rules go unread.
+*/
+function warnAboutRelocatedConfig(logger) {
+	for (const name of ["CODEWHALE_HOME", "CODEWHALE_CONFIG_PATH"]) if (process.env[name]) logger?.warn(`Codewhale permissions: ${name} is set, but rulesync only syncs ~/.codewhale/permissions.toml; Codewhale reads permissions.toml next to the config.toml in use.`);
+}
+/** The records of a parsed file that Codewhale itself would accept. */
+function partitionRuleRecords(document) {
+	const rawRules = Array.isArray(document.rules) ? document.rules : [];
+	const valid = [];
+	let invalidCount = 0;
+	for (const raw of rawRules) {
+		const parsed = CodewhalePermissionRuleSchema.safeParse(raw);
+		if (parsed.success) valid.push(parsed.data);
+		else invalidCount += 1;
+	}
+	return {
+		valid,
+		invalidCount
+	};
+}
+/**
+* The canonical `bash` pattern a native shell rule round-trips through, or
+* `null` when the next generate would not write the same rule back from it.
+*/
+function shellRuleToPattern(rule) {
+	if (rule.path !== void 0) return null;
+	if (rule.command === void 0) return rule.command_exact ? null : "*";
+	const command = rule.command.trim();
+	if (command === "" || COMMAND_WILDCARD_CHARACTERS.test(command)) return null;
+	if (rule.command_exact) return rule.action === "allow" ? command : null;
+	return `${command} *`;
+}
+function pathRuleToPattern(rule) {
+	if (rule.command !== void 0 || rule.command_exact) return null;
+	if (rule.path === void 0) return "*";
+	const path = rule.path.trim();
+	return path === "" || PATH_GLOB_CHARACTERS.test(path) ? null : path;
+}
+function toImportCandidates(rule) {
+	if (rule.workspace !== void 0) return [];
+	if (rule.tool === CODEWHALE_SHELL_TOOL) {
+		const pattern = shellRuleToPattern(rule);
+		return pattern === null ? [] : [{
+			category: SHELL_PERMISSION_CATEGORY,
+			pattern,
+			rule
+		}];
+	}
+	const pattern = pathRuleToPattern(rule);
+	if (pattern === null) return [];
+	return (CODEWHALE_TOOL_TO_PATH_CATEGORIES[rule.tool] ?? []).map((category) => ({
+		category,
+		pattern,
+		rule
+	}));
+}
+/**
+* Split the native rules into the canonical block and the `codewhale.rules`
+* passthrough so that the next generate writes the same file back. A canonical
+* pattern is taken only when every tool its category expands to carries the
+* same rule (`edit` needs both `edit_file` and `apply_patch`, a `write`
+* restriction both `write_file` and `apply_patch`). A rule no canonical pattern
+* claims — including the weaker of two rules for one pattern — stays native.
+*/
+function codewhaleRulesToCanonical(rules) {
+	const permission = {};
+	const claimedIndexes = /* @__PURE__ */ new Set();
+	const grouped = /* @__PURE__ */ new Map();
+	for (const [index, rule] of rules.entries()) for (const candidate of toImportCandidates(rule)) {
+		const key = JSON.stringify([
+			candidate.category,
+			candidate.pattern,
+			rule.action
+		]);
+		grouped.set(key, [...grouped.get(key) ?? [], {
+			...candidate,
+			index
+		}]);
+	}
+	const strongestFirst = [...grouped.values()].toSorted((left, right) => PERMISSION_ACTION_PRIORITY[right[0].rule.action] - PERMISSION_ACTION_PRIORITY[left[0].rule.action]);
+	for (const group of strongestFirst) {
+		const { category, pattern, rule } = group[0];
+		const expectedTools = category === "bash" ? [CODEWHALE_SHELL_TOOL] : pathCategoryTools(category, rule.action);
+		const presentTools = new Set(group.map((candidate) => candidate.rule.tool));
+		const complete = expectedTools.every((tool) => presentTools.has(tool));
+		const categoryRules = permission[category] ?? {};
+		if (!complete || Object.hasOwn(categoryRules, pattern)) continue;
+		permission[category] = {
+			...categoryRules,
+			[pattern]: rule.action
+		};
+		for (const candidate of group) if (expectedTools.includes(candidate.rule.tool)) claimedIndexes.add(candidate.index);
+	}
+	return {
+		permission,
+		nativeRules: rules.filter((_rule, index) => !claimedIndexes.has(index))
+	};
+}
+/**
+* Codewhale permission rules in `~/.codewhale/permissions.toml`.
+*
+* The file holds a `rules` array of typed records (`tool`, optional `command`
+* prefix or exact `path`, optional `command_exact`, optional absolute
+* `workspace`, and `action`). It is the only permission-rule source Codewhale
+* reads — the project `.codewhale/config.toml` overlay cannot carry rules — so
+* the feature is global-only.
+*
+* rulesync owns the file's rules, except for workspace-scoped ones: those are
+* the grants Codewhale's approval card remembers per repository, and they are
+* kept across a regenerate. Codewhale also appends plain `exec_shell` ask rules
+* from the approval card (`S`), which cannot be told apart from rulesync's own
+* output and are replaced; run an import first to keep them.
+*
+* @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
+* @see https://github.com/Hmbown/Codewhale/blob/main/docs/AUTHORIZATION_ORDER.md
+*/
+var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+	}
+	/**
+	* Codewhale's approval card writes to the same file, so this feature never
+	* deletes it.
+	*/
+	isDeletable() {
+		return false;
+	}
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths(_options) {
+		return {
+			relativeDirPath: CODEWHALE_DIR,
+			relativeFilePath: CODEWHALE_PERMISSIONS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
+		if (!global) throw new Error(CODEWHALE_GLOBAL_ONLY_MESSAGE);
+		warnAboutRelocatedConfig(logger);
+		const paths = CodewhalePermissions.getSettablePaths();
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const fileContent = await readFileContentOrNull(filePath) ?? "";
+		const { invalidCount } = partitionRuleRecords(parsePermissionsDocument({
+			fileContent,
+			filePath
+		}));
+		if (invalidCount > 0) logger?.warn(`Codewhale permissions: skipping ${invalidCount} rule record(s) in ${filePath} that Codewhale would reject (an unknown key or a wrong type).`);
+		return new CodewhalePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global: true
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		if (!global) throw new Error(CODEWHALE_GLOBAL_ONLY_MESSAGE);
+		warnAboutRelocatedConfig(logger);
+		const paths = CodewhalePermissions.getSettablePaths();
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existing = parsePermissionsDocument({
+			fileContent: await readFileContentOrNull(filePath) ?? "",
+			filePath
+		});
+		const generated = canonicalToCodewhaleRules({
+			config: rulesyncPermissions.getJson(),
+			preservedRules: collectWorkspaceScopedRules({
+				document: existing,
+				logger
+			}),
+			logger
+		});
+		const seen = /* @__PURE__ */ new Set();
+		const rules = [];
+		for (const rule of generated) {
+			const key = ruleKey(rule);
+			if (seen.has(key)) continue;
+			seen.add(key);
+			rules.push(rule);
+		}
+		return new CodewhalePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: rules.length > 0 ? smol_toml.stringify({ rules }) : "",
+			validate: true,
+			global: true
+		});
+	}
+	toRulesyncPermissions() {
+		const { permission, nativeRules } = codewhaleRulesToCanonical(partitionRuleRecords(parsePermissionsDocument({
+			fileContent: this.getFileContent(),
+			filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())
+		})).valid.map(withExplicitAction));
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...nativeRules.length > 0 && { codewhale: { rules: nativeRules } }
+		}, null, 2) });
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new CodewhalePermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global: true
+		});
+	}
+};
+//#endregion
 //#region src/features/permissions/codexcli-permissions.ts
 const RULESYNC_PROFILE_NAME = "rulesync";
 const CODEX_WORKSPACE_ROOTS_KEY = ":workspace_roots";
@@ -53192,7 +54081,7 @@ function mapBashActionToDecision(action) {
 //#region src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$9 = "*";
+const CATCH_ALL_PATTERN$10 = "*";
 const MCP_CANONICAL_PREFIX$6 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
@@ -53247,10 +54136,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$9 || pattern === "";
+	const catchAll = pattern === CATCH_ALL_PATTERN$10 || pattern === "";
 	if (category.startsWith(MCP_CANONICAL_PREFIX$6)) return catchAll ? category : `${category}(${pattern})`;
 	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$6}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$9 : null;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$10 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -53286,7 +54175,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$9;
+	return inner === "" || inner === CATCH_ALL_PATTERN$10;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -53320,34 +54209,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$9,
+		pattern: CATCH_ALL_PATTERN$10,
 		notInAllow: true
 	};
 	if (tool.startsWith(MCP_CANONICAL_PREFIX$6)) {
-		if (server === CATCH_ALL_PATTERN$9) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$9)) return null;
+		if (server === CATCH_ALL_PATTERN$10) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$10)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$9 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$9,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$10 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$10,
 			notInAllow: false
 		};
 	}
 	const category = `${MCP_CANONICAL_PREFIX$6}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$9);
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$10);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$9) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$9 && !server.includes(CATCH_ALL_PATTERN$9)) return {
+	if (remainder === CATCH_ALL_PATTERN$10) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$10 && !server.includes(CATCH_ALL_PATTERN$10)) return {
 		category: `${MCP_CANONICAL_PREFIX$6}${server}`,
-		pattern: CATCH_ALL_PATTERN$9,
+		pattern: CATCH_ALL_PATTERN$10,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$9,
+		pattern: CATCH_ALL_PATTERN$10,
 		notInAllow: false
 	} : null;
 }
@@ -53371,14 +54260,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$9,
+			pattern: CATCH_ALL_PATTERN$10,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$9,
+			pattern: CATCH_ALL_PATTERN$10,
 			notInAllow: true
 		} : {
 			category,
@@ -53388,7 +54277,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$9,
+		pattern: CATCH_ALL_PATTERN$10,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -53407,9 +54296,9 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$9) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$10) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$9,
+		pattern: CATCH_ALL_PATTERN$10,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
@@ -53479,7 +54368,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$9})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$10})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -53536,7 +54425,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$9);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$10);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -53807,7 +54696,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$8 = "*";
+const CATCH_ALL_PATTERN$9 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -53815,7 +54704,7 @@ const CATCH_ALL_PATTERN$8 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$8 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$9 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -53852,7 +54741,7 @@ function toCanonicalToolName$6(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$8 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$9 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -53866,7 +54755,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$8 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$9 : pattern
 	};
 }
 /**
@@ -54040,7 +54929,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$8) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$9) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -54389,14 +55278,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 };
 //#endregion
 //#region src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$7 = "*";
+const CATCH_ALL_PATTERN$8 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$7 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$8 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -54595,7 +55484,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$7) {
+		if (pattern === CATCH_ALL_PATTERN$8) {
 			catchAllAction = action;
 			continue;
 		}
@@ -54668,11 +55557,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$7] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$8] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$7] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$8] ??= "allow";
 	}
 	return { permission };
 }
@@ -56537,7 +57426,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 //#region src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$6 = "*";
+const CATCH_ALL_PATTERN$7 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
 const GOOSE_TO_RULESYNC_TOOL_NAMES = {
 	shell: ["bash"],
@@ -56701,7 +57590,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
-			if (pattern !== CATCH_ALL_PATTERN$6) {
+			if (pattern !== CATCH_ALL_PATTERN$7) {
 				logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 				continue;
 			}
@@ -56732,7 +57621,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$6] = action;
+			permission[category][CATCH_ALL_PATTERN$7] = action;
 		}
 	}
 	return { permission };
@@ -56743,7 +57632,7 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$5 = "*";
+const CATCH_ALL_PATTERN$6 = "*";
 const MCP_CANONICAL_PREFIX$3 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
@@ -56789,10 +57678,10 @@ function buildGrokEntry(category, pattern) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$5 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$6 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$5 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$6 || pattern === "" ? tool : `${tool}(${pattern})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
@@ -56813,16 +57702,16 @@ function parseGrokEntry(entry) {
 	}
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
 		category: `${MCP_CANONICAL_PREFIX$3}${inner}`,
-		pattern: CATCH_ALL_PATTERN$5
+		pattern: CATCH_ALL_PATTERN$6
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$5
+		pattern: CATCH_ALL_PATTERN$6
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$5
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$6
 	};
 }
 /**
@@ -56843,15 +57732,15 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$5;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$6;
 	const lowerTool = tool.trim().toLowerCase();
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$5 ? {
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$6 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$5,
+		pattern: CATCH_ALL_PATTERN$6,
 		action
 	} : {
 		category: `${MCP_CANONICAL_PREFIX$3}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$5,
+		pattern: CATCH_ALL_PATTERN$6,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -56999,7 +57888,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$5]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$6]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -57185,12 +58074,12 @@ function reconcileNativeDenies({ permission, category, patterns }) {
 	deleteRulesByAction(rules, "deny");
 	for (const pattern of patterns) rules[pattern] = "deny";
 }
-function withoutKey(record, key) {
+function withoutKey$1(record, key) {
 	return Object.fromEntries(Object.entries(record).filter(([entryKey]) => entryKey !== key));
 }
 function buildHermesOverride(config, provenance) {
 	const base = isRecord$1(provenance.hermes) ? { ...provenance.hermes } : {};
-	const approvalsOverride = withoutKey(isRecord$1(config.approvals) ? config.approvals : {}, "deny");
+	const approvalsOverride = withoutKey$1(isRecord$1(config.approvals) ? config.approvals : {}, "deny");
 	if (Object.keys(approvalsOverride).length > 0) base.approvals = approvalsOverride;
 	else delete base.approvals;
 	const security = isRecord$1(config.security) ? { ...config.security } : {};
@@ -57775,6 +58664,35 @@ function narrowSandboxToProjectScope({ authored, logger }) {
 	if (dropped.length > 0) logger?.warn(`Kilo honors these 'sandbox' keys from the global config only, so they were dropped from the project config: ${dropped.toSorted().join(", ")}. A project config may only tighten the sandbox ('enabled', 'network'); generate with --global to author the rest.`);
 	return emitted;
 }
+const KILO_MARKDOWN_SOURCE_KEY = "markdown_source";
+/**
+* Narrow an authored `markdown_source` rule to what a *project* `kilo.jsonc`
+* can mean. Kilo only grants it when the winning pattern came from the global
+* config with the action `allow` ("Project configuration cannot grant this
+* permission"). A project pattern that wins last-match-wins therefore never
+* grants: `deny` and `ask` both block (Kilo never prompts for it), so they
+* are kept — a project config may only tighten. A project `allow` would block
+* too, the opposite of what it says, so it is dropped with a warning pointing
+* at `--global`.
+* Returns `undefined` when nothing is left to write.
+* @see https://kilo.ai/docs/customize/workflows
+* @see https://github.com/Kilo-Org/kilocode/blob/main/packages/opencode/src/kilocode/config/external-markdown.ts
+*/
+function narrowMarkdownSourceToProjectScope({ authored, logger }) {
+	let emitted;
+	let dropped;
+	if (typeof authored === "string") {
+		emitted = authored === "allow" ? void 0 : authored;
+		dropped = authored === "allow" ? ["*"] : [];
+	} else {
+		const entries = Object.entries(asKiloRecord(authored));
+		const kept = entries.filter(([, action]) => action !== "allow");
+		emitted = kept.length > 0 ? Object.fromEntries(kept) : void 0;
+		dropped = entries.filter(([, action]) => action === "allow").map(([pattern]) => pattern);
+	}
+	if (dropped.length > 0) logger?.warn(`Kilo grants '${KILO_MARKDOWN_SOURCE_KEY}' from the global config only, so these 'allow' patterns were dropped from the project config: ${dropped.join(", ")}. A project config can only block it ('deny' or 'ask'); generate with --global to grant access.`);
+	return emitted;
+}
 var KiloPermissions = class KiloPermissions extends ToolPermissions {
 	json;
 	constructor(params) {
@@ -57861,6 +58779,13 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			...honorAllToolsOnBash(rulesyncJson.permission),
 			...kiloOverride?.permission
 		};
+		if (!global && Object.hasOwn(incomingPermission, KILO_MARKDOWN_SOURCE_KEY)) {
+			const narrowed = narrowMarkdownSourceToProjectScope({
+				authored: incomingPermission[KILO_MARKDOWN_SOURCE_KEY],
+				logger
+			});
+			incomingPermission[KILO_MARKDOWN_SOURCE_KEY] = narrowed;
+		}
 		const droppedDenyByKey = {};
 		for (const [key, value] of Object.entries(incomingPermission)) {
 			const previousDenyPatterns = collectKiloDenyPatterns(existingPermission[key]);
@@ -57876,6 +58801,7 @@ var KiloPermissions = class KiloPermissions extends ToolPermissions {
 			...existingPermission,
 			...incomingPermission
 		};
+		if (mergedPermission[KILO_MARKDOWN_SOURCE_KEY] === void 0) delete mergedPermission[KILO_MARKDOWN_SOURCE_KEY];
 		const nextJson = {
 			...parsed,
 			permission: mergedPermission
@@ -58552,7 +59478,7 @@ function rulesFromArrays(settings, allowKey, denyKey) {
 //#region src/features/permissions/lettacode-permissions.ts
 /** Top-level key of `.letta/settings.json` that rulesync owns. */
 const LETTACODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
 /** Letta Code's `Bash(prefix:*)` prefix-match suffix. */
 const PREFIX_SUFFIX = ":*";
 const CATEGORY_TO_LETTACODE_TOOL = {
@@ -58645,7 +59571,7 @@ function categoryOfRule$1(rule) {
 *   widening it would grant commands the source never allowed.
 */
 function toLettacodeBashPayload({ pattern, action, logger }) {
-	if (pattern === CATCH_ALL_PATTERN$4) return "";
+	if (pattern === CATCH_ALL_PATTERN$5) return "";
 	const firstStar = pattern.indexOf("*");
 	if (firstStar === -1) return pattern;
 	if (pattern.endsWith(PREFIX_SUFFIX) && firstStar === pattern.length - 1) return pattern;
@@ -58666,7 +59592,7 @@ function toLettacodeRule({ category, pattern, action, logger }) {
 		pattern,
 		action,
 		logger
-	}) : pattern === CATCH_ALL_PATTERN$4 ? "" : pattern;
+	}) : pattern === CATCH_ALL_PATTERN$5 ? "" : pattern;
 	if (payload === null) return null;
 	return payload === "" ? tool : `${tool}(${payload})`;
 }
@@ -58677,7 +59603,7 @@ function fromLettacodeRule(rule) {
 	const { payload } = splitLettacodeRule(rule);
 	if (payload === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$4
+		pattern: CATCH_ALL_PATTERN$5
 	};
 	const trimmed = payload.trim();
 	if (trimmed === "") return null;
@@ -58685,7 +59611,7 @@ function fromLettacodeRule(rule) {
 		const prefix = trimmed.slice(0, -2).trimEnd();
 		return {
 			category,
-			pattern: prefix === "" ? CATCH_ALL_PATTERN$4 : `${prefix} *`
+			pattern: prefix === "" ? CATCH_ALL_PATTERN$5 : `${prefix} *`
 		};
 	}
 	return {
@@ -59141,6 +60067,377 @@ var MimocodePermissions = class extends OpencodePermissions {
 	static layout = MIMOCODE_LAYOUT;
 };
 //#endregion
+//#region src/features/permissions/omp-permissions.ts
+const CATCH_ALL_PATTERN$4 = "*";
+const ACTION_TO_OMP_APPROVAL = {
+	allow: "allow",
+	ask: "prompt",
+	deny: "deny"
+};
+const OMP_APPROVAL_TO_ACTION = {
+	allow: "allow",
+	prompt: "ask",
+	deny: "deny"
+};
+const CATEGORY_TO_OMP_TOOL = {
+	websearch: "web_search",
+	agent: "task"
+};
+const OMP_TOOL_TO_CATEGORY = Object.fromEntries(Object.entries(CATEGORY_TO_OMP_TOOL).map(([category, tool]) => [tool, category]));
+const UNSUPPORTED_CATEGORIES = /* @__PURE__ */ new Set([
+	"webfetch",
+	"notebookedit",
+	"mcp"
+]);
+const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
+	"bash",
+	"read",
+	"edit",
+	"write",
+	"grep",
+	"glob",
+	"web_search",
+	"task"
+]);
+/**
+* Permissions adapter for oh-my-pi (`omp`).
+*
+* oh-my-pi reads approval policy from `config.yml`: `<cwd>/.omp/config.yml` in
+* project scope and `~/.omp/agent/config.yml` (default profile) globally.
+*
+* - `tools.approval.<tool>: allow | prompt | deny` is a per-tool policy honored
+*   in every approval mode. A category's catch-all `*` rule maps here
+*   (`ask` → `prompt`). oh-my-pi has no per-path matcher, so a non-bash category
+*   with pattern-specific rules collapses to one action (deny > ask > allow, with
+*   an implicit `ask` when there is no catch-all) and a warning.
+* - `bash.patterns: [{ match, approval }]` is an ordered, first-match-wins list
+*   of command globs (only `*` is a wildcard). Every `bash` rule except a
+*   catch-all `allow` is written there, ordered deny → prompt → allow so that
+*   the first match agrees with rulesync's deny > ask > allow precedence. A
+*   catch-all `allow` goes to `tools.approval.bash` instead, because by default
+*   (without `bash.allowCompoundCommands`) an `allow` pattern never approves a
+*   compound command line while the tool policy does — unless the category has
+*   an `ask` rule, which makes `tools.approval.bash` `prompt` (see
+*   `convertBashRules`) and the catch-all `allow` a trailing pattern. oh-my-pi
+*   expands no `?` or `[...]`, so a deny or ask pattern widens them to `*`.
+* - The all-tools `*` category has no key of its own: its rules restrict bash
+*   commands, and its deny / ask also restrict every other tool's policy (a
+*   catch-all one at its own strictness, a pattern-specific one as `prompt`).
+*
+* `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
+* (the keys rulesync manages) and `bash.patterns` are rewritten; sibling keys
+* such as `tools.approvalMode` and `bash.enabled` are kept, and the file is
+* never deleted.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/main/docs/settings.md
+* @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
+*/
+var OmpPermissions = class OmpPermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+	}
+	/** `config.yml` holds unrelated user settings, so it must not be deleted. */
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: global ? OMP_GLOBAL_DIR : OMP_DIR,
+			relativeFilePath: OMP_CONFIG_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = OmpPermissions.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new OmpPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
+		const paths = OmpPermissions.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parseSharedConfig({
+			format: "yaml",
+			fileContent: existingContent,
+			filePath
+		});
+		const { approval, patterns, floor } = convertRulesyncToOmp({
+			config: rulesyncPermissions.getJson(),
+			logger
+		});
+		const existingTools = isRecord$1(existing.tools) ? existing.tools : {};
+		const nextApproval = {
+			...isRecord$1(existingTools.approval) ? Object.fromEntries(Object.entries(existingTools.approval).filter(([tool]) => !MANAGED_OMP_TOOLS.has(tool) && !Object.hasOwn(approval, tool)).map(([tool, value]) => [tool, raisedApproval(value, floor)])) : {},
+			...approval
+		};
+		const toolsSiblings = withoutKey(existingTools, "approval");
+		const nextTools = Object.keys(nextApproval).length > 0 ? {
+			...toolsSiblings,
+			approval: nextApproval
+		} : toolsSiblings;
+		const bashSiblings = withoutKey(isRecord$1(existing.bash) ? existing.bash : {}, "patterns");
+		const nextBash = patterns.length > 0 ? {
+			...bashSiblings,
+			patterns
+		} : bashSiblings;
+		return new OmpPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: {
+					tools: Object.keys(nextTools).length > 0 ? nextTools : void 0,
+					bash: Object.keys(nextBash).length > 0 ? nextBash : void 0
+				},
+				filePath,
+				logger
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		let config;
+		try {
+			config = parseSharedConfig({
+				format: "yaml",
+				fileContent: this.getFileContent()
+			});
+		} catch (error) {
+			throw new Error(`Failed to parse oh-my-pi config in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+		}
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(convertOmpToRulesync(config), null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new OmpPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+function withoutKey(record, key) {
+	return Object.fromEntries(Object.entries(record).filter(([name]) => name !== key));
+}
+function renamed(map, name) {
+	return Object.hasOwn(map, name) ? map[name] ?? name : name;
+}
+function stricter(a, b) {
+	return a !== void 0 && PERMISSION_ACTION_PRIORITY[a] >= PERMISSION_ACTION_PRIORITY[b] ? a : b;
+}
+/**
+* The floor the all-tools `*` category puts under every tool's single policy:
+* a catch-all deny / ask at its own strictness, and a pattern-specific one as
+* `ask`, since some input of each tool may match it and a per-tool policy
+* cannot single that input out. `undefined` when `*` restricts nothing.
+*/
+function allToolsFloor(rules) {
+	let floor;
+	let patternSpecific = false;
+	for (const [pattern, action] of Object.entries(rules ?? {})) {
+		if (action === "allow" || isPrototypePollutionKey(pattern)) continue;
+		if (pattern === CATCH_ALL_PATTERN$4) floor = stricter(floor, action);
+		else {
+			patternSpecific = true;
+			floor = stricter(floor, "ask");
+		}
+	}
+	return {
+		floor,
+		patternSpecific
+	};
+}
+/**
+* oh-my-pi expands only `*`, so a `?` or `[...]` in a deny / ask pattern widens
+* to `*` (a literal match would restrict almost nothing). An allow pattern is
+* left as is: matched literally it approves less, never more.
+*/
+function widenRestrictionPattern(pattern) {
+	return pattern.replace(/\[!?\]?[^\]]*\]|\[|\?/gu, "*").replace(/\*{2,}/gu, "*");
+}
+/**
+* A `bash` category as `bash.patterns` entries (unsorted), plus the
+* `tools.approval.bash` policy it needs.
+*
+* oh-my-pi replaces a `prompt` (or `allow`) pattern match on a critical command
+* such as `rm -rf /` with an override that carries no policy, which yolo mode
+* then resolves by `tools.approval.bash` alone. So any `ask` rule sets the tool
+* policy to `prompt`, and a catch-all `allow` then becomes a trailing
+* `match: "*"` allow pattern (patterns beat the tool policy) instead of an
+* `allow` policy that would wave such a command through.
+*/
+function convertBashRules$1({ rules, logger }) {
+	const patterns = [];
+	const entries = Object.entries(rules).filter(([pattern]) => !isPrototypePollutionKey(pattern));
+	const hasAsk = entries.some(([, action]) => action === "ask");
+	let policy = hasAsk ? "ask" : void 0;
+	if (hasAsk && rules[CATCH_ALL_PATTERN$4] !== "ask") logger?.warn("oh-my-pi lets a critical command (such as `rm -rf /`) skip a bash prompt pattern unless the bash tool policy prompts, so `tools.approval.bash` was set to \"prompt\": a command no bash allow pattern matches now prompts in every approval mode.");
+	for (const [pattern, action] of entries) {
+		if (pattern === CATCH_ALL_PATTERN$4 && action === "allow") {
+			if (hasAsk) patterns.push({
+				match: CATCH_ALL_PATTERN$4,
+				approval: "allow"
+			});
+			else policy = "allow";
+			continue;
+		}
+		let match = pattern;
+		if (/[?[]/u.test(pattern)) {
+			if (action === "allow") logger?.warn(`oh-my-pi matches only "*" as a wildcard, so "?" and "[" in the bash allow pattern "${pattern}" are matched literally.`);
+			else {
+				match = widenRestrictionPattern(pattern);
+				logger?.warn(`oh-my-pi matches only "*" as a wildcard, so the bash ${action} pattern "${pattern}" was widened to "${match}".`);
+			}
+		}
+		patterns.push({
+			match,
+			approval: ACTION_TO_OMP_APPROVAL[action]
+		});
+	}
+	return {
+		patterns,
+		policy
+	};
+}
+/** Raise every non-bash tool policy to the all-tools floor (bash is handled by patterns). */
+function applyAllToolsFloor({ actions, allTools, logger }) {
+	const { floor } = allTools;
+	if (floor === void 0) return;
+	if (allTools.patternSpecific) logger?.warn(`oh-my-pi sets one approval policy per tool, so the pattern-specific "*" category restrictions were written as "${ACTION_TO_OMP_APPROVAL[floor]}" for every non-bash tool.`);
+	for (const tool of /* @__PURE__ */ new Set([...MANAGED_OMP_TOOLS, ...Object.keys(actions)])) if (tool !== "bash") actions[tool] = stricter(actions[tool], floor);
+}
+function convertRulesyncToOmp({ config, logger }) {
+	const actions = {};
+	const patterns = [];
+	const permission = config.permission;
+	const allTools = allToolsFloor(permission["*"]);
+	const categories = permission["*"] === void 0 ? permission : {
+		...permission,
+		bash: bashRulesHonoringAllTools(permission)
+	};
+	for (const [category, rules] of Object.entries(categories)) {
+		if (isPrototypePollutionKey(category) || Object.keys(rules).length === 0) continue;
+		if (category === "*") {
+			if (Object.values(rules).includes("allow")) logger?.warn("oh-my-pi has no all-tools approval key, so the \"*\" category allow rules were skipped.");
+			continue;
+		}
+		if (UNSUPPORTED_CATEGORIES.has(category)) {
+			logger?.warn(`oh-my-pi has no "${category}" tool to set an approval policy on, so its rules were skipped` + (category === "webfetch" ? " (oh-my-pi fetches web pages through `read`)." : "."));
+			continue;
+		}
+		if (category === "bash") {
+			const bash = convertBashRules$1({
+				rules,
+				logger
+			});
+			patterns.push(...bash.patterns);
+			if (bash.policy !== void 0) actions.bash = bash.policy;
+			continue;
+		}
+		const action = collapseRulesToSingleAction({ rules });
+		if (action === void 0) continue;
+		if (hasPatternSpecificRules(rules)) logger?.warn(`oh-my-pi sets one approval policy per tool, so the pattern-specific "${category}" rules were collapsed to "${ACTION_TO_OMP_APPROVAL[action]}" (deny > ask > allow).`);
+		const tool = renamed(CATEGORY_TO_OMP_TOOL, category);
+		if (/^mcp__.+__/u.test(tool)) logger?.warn(`oh-my-pi registers MCP tools as "mcp__<server>_<tool>", so "${tool}" may never match; write oh-my-pi's registered name under a tool-scoped \`omp.permission\` block.`);
+		actions[tool] = stricter(actions[tool], action);
+	}
+	applyAllToolsFloor({
+		actions,
+		allTools,
+		logger
+	});
+	const order = (pattern) => -PERMISSION_ACTION_PRIORITY[OMP_APPROVAL_TO_ACTION[pattern.approval]];
+	patterns.sort((a, b) => order(a) - order(b));
+	return {
+		approval: Object.fromEntries(Object.entries(actions).map(([tool, action]) => [tool, ACTION_TO_OMP_APPROVAL[action]])),
+		patterns,
+		floor: allTools.floor
+	};
+}
+/** An existing `tools.approval` value raised to the all-tools floor, if any. */
+function raisedApproval(value, floor) {
+	if (floor === void 0) return value;
+	const approval = toOmpApproval(value);
+	const current = approval === void 0 ? void 0 : OMP_APPROVAL_TO_ACTION[approval];
+	return ACTION_TO_OMP_APPROVAL[stricter(current, floor)];
+}
+function toOmpApproval(value) {
+	if (typeof value !== "string") return;
+	const normalized = value.trim().toLowerCase();
+	return Object.hasOwn(OMP_APPROVAL_TO_ACTION, normalized) ? normalized : void 0;
+}
+/**
+* Fold `tools.approval.bash` (`undefined` when unset) into the imported `bash`
+* rules. A user `deny` is absolute. Otherwise a `*` pattern beats the tool
+* policy, which then reaches only compound and critical command lines — so a
+* `*` allow pattern imports as `allow` only behind an explicit `allow` policy
+* or in the shape rulesync writes (a `prompt` policy next to `ask` patterns).
+* Any other `*` allow pattern still prompts for compound lines and imports as
+* `ask`, so a regenerate cannot widen it into an `allow` policy. A `prompt`
+* policy with no `*` pattern but an `ask` pattern is what rulesync writes for
+* ask rules (see `convertBashRules`), so it adds no catch-all.
+*/
+function importBashPolicy(bashRules, action) {
+	const catchAll = bashRules[CATCH_ALL_PATTERN$4];
+	const hasAskPattern = Object.values(bashRules).includes("ask");
+	if (action === "deny") bashRules[CATCH_ALL_PATTERN$4] = "deny";
+	else if (catchAll === void 0) {
+		if (action !== void 0 && !(action === "ask" && hasAskPattern)) bashRules[CATCH_ALL_PATTERN$4] = action;
+	} else if (catchAll === "allow" && action !== "allow" && !(action === "ask" && hasAskPattern)) bashRules[CATCH_ALL_PATTERN$4] = "ask";
+}
+/** `bash.patterns` as canonical `bash` rules, in first-match order. */
+function importBashPatterns(value) {
+	const bashRules = {};
+	if (!Array.isArray(value)) return bashRules;
+	for (const entry of value) {
+		if (!isRecord$1(entry) || typeof entry.match !== "string") continue;
+		const match = entry.match.trim().replace(/\s+/gu, " ");
+		const approval = toOmpApproval(entry.approval);
+		if (match === "" || approval === void 0 || Object.hasOwn(bashRules, match)) continue;
+		if (isPrototypePollutionKey(match)) continue;
+		bashRules[match] = OMP_APPROVAL_TO_ACTION[approval];
+	}
+	return bashRules;
+}
+function convertOmpToRulesync(config) {
+	const permission = {};
+	const tools = isRecord$1(config.tools) ? config.tools : {};
+	const bashRules = importBashPatterns((isRecord$1(config.bash) ? config.bash : {}).patterns);
+	const bashApproval = toOmpApproval((isRecord$1(tools.approval) ? tools.approval : {}).bash);
+	importBashPolicy(bashRules, bashApproval === void 0 ? void 0 : OMP_APPROVAL_TO_ACTION[bashApproval]);
+	if (isRecord$1(tools.approval)) for (const [tool, value] of Object.entries(tools.approval)) {
+		const approval = toOmpApproval(value);
+		if (approval === void 0 || tool.trim() === "" || isPrototypePollutionKey(tool)) continue;
+		const action = OMP_APPROVAL_TO_ACTION[approval];
+		if (tool === "bash") continue;
+		const category = renamed(OMP_TOOL_TO_CATEGORY, tool);
+		permission[category] = { [CATCH_ALL_PATTERN$4]: stricter(permission[category]?.[CATCH_ALL_PATTERN$4], action) };
+	}
+	if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
+	return { permission };
+}
+//#endregion
 //#region src/features/permissions/pi-permissions.ts
 /** The one `settings.json` key this feature owns. */
 const DEFAULT_TOOLS_KEY = "defaultTools";
@@ -60168,7 +61465,9 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"eager",
 	"listDirectory",
 	"todoWrite",
-	"workflowsEnabled"
+	"workflowsEnabled",
+	"workflowNameOnly",
+	"executionSandbox"
 ];
 const QWEN_OVERRIDE_SECURITY_KEYS = [
 	"folderTrust",
@@ -60237,6 +61536,16 @@ const QWEN_OVERRIDE_GROUPS = [{
 	overrideKeys: QWEN_OVERRIDE_TOOLS_KEYS,
 	scopedKeys: {
 		workflowsEnabled: { rule: "workspace-stripped" },
+		executionSandbox: {
+			rule: "workspace-stripped",
+			grants: () => true,
+			globalNote: "Qwen Code ignores this key in workspace settings so a repository cannot choose its own sandbox; in the global scope it sets the filesystem and network policy every tool command runs under for every project on this machine (a System value still replaces it, and Qwen Code needs a restart to pick it up)."
+		},
+		workflowNameOnly: {
+			rule: "global-machine-wide",
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code lets a workspace only turn this key on: \`true\` restricts the model to named workflows in this repository, while any other value cannot lift a restriction set in user or system settings.`,
+			globalNote: "Qwen Code honors this key in the global scope for every project on this machine, and a repository can only add the restriction, never lift it, so this decides whether the model may run inline or path-based workflow scripts anywhere a workspace does not turn the restriction on itself."
+		},
 		approvalMode: {
 			rule: "global-machine-wide",
 			projectNote: autonomyProjectNote
@@ -66055,6 +67364,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["codewhale", {
+		class: CodewhalePermissions,
+		meta: {
+			supportsProject: false,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["codexcli", {
 		class: CodexcliPermissions,
 		meta: {
@@ -66223,6 +67540,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["omp", {
+		class: OmpPermissions,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["opencode", {
 		class: OpencodePermissions,
 		meta: {
@@ -67102,6 +68427,10 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 				continue;
 			}
 			try {
+				await assertWritablePathInsideRoot({
+					rootPath: this.outputRoot,
+					targetPath: root
+				});
 				await assertWritablePathInsideRoot({
 					rootPath: this.outputRoot,
 					targetPath: dirPath
@@ -67133,7 +68462,7 @@ var DirFeatureProcessor = class extends RulesyncSourceConsumer {
 					this.logger.warn(`Refusing to delete ${quoteForLog(filePath)}: this run wrote a file whose path differs from it only in case, which on a case-insensitive filesystem is the very file it wrote`);
 					continue;
 				}
-				if (isClaimed(filePath)) continue;
+				if (await isClaimed(filePath)) continue;
 				orphanPaths.add(filePath);
 			}
 		}
@@ -75689,16 +77018,30 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 	* path and vetted as writable inside this run's output root. Shared by the
 	* two halves of the orphan sweep so both look in exactly the same places,
 	* under exactly the same guard.
+	*
+	* A root that fails the guard — a symbolic link, even one that stays inside
+	* the output root, such as a dotfiles checkout linked from the home
+	* directory — is left out with a warning rather than failing the run. The
+	* write path already wrote through such a link, and the sweep runs after
+	* those writes land, so throwing here would report a failure for a run whose
+	* output is in place. Sweeping through the link is not an option either: it
+	* can lead to a directory rulesync does not manage, and its entries would be
+	* deleted as orphans.
 	*/
 	async loadExistingSkillsRoots(paths) {
 		const existingRoots = [];
 		for (const root of toolSkillSearchRoots(paths)) {
 			const skillsDirPath = (0, node_path.join)(this.outputRoot, root);
 			if (!await directoryExists(skillsDirPath)) continue;
-			await assertWritablePathInsideRoot({
-				rootPath: this.outputRoot,
-				targetPath: skillsDirPath
-			});
+			try {
+				await assertWritablePathInsideRoot({
+					rootPath: this.outputRoot,
+					targetPath: skillsDirPath
+				});
+			} catch (error) {
+				this.logger.warn(`Skipping the orphan sweep for ${quoteForLog(skillsDirPath)}; nothing under it is deleted: ${stripControlCharacters(formatError(error))}`);
+				continue;
+			}
 			existingRoots.push({
 				root,
 				skillsDirPath
@@ -76805,6 +78148,288 @@ var AugmentcodePluginSubagent = class extends AugmentcodeSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/roo-subagent.ts
+/**
+* Default tool groups assigned to a generated mode when the rulesync source
+* does not specify a `roo.groups` override. Mirrors Roo's built-in code mode
+* (full read/edit/command/mcp access; browser is opt-in).
+*/
+const DEFAULT_GROUPS = [
+	"read",
+	"edit",
+	"command",
+	"mcp"
+];
+/**
+* One entry of a mode's `groups` array. Either a bare toolset name
+* (`"read"`, `"edit"`, `"command"`, `"mcp"`, `"browser"`) or a tuple pairing a
+* toolset (in practice `"edit"`) with a file restriction object.
+* @see https://roocodeinc.github.io/Roo-Code/features/custom-modes
+*/
+const RooModeGroupSchema = zod_mini.z.union([zod_mini.z.string(), zod_mini.z.tuple([zod_mini.z.string(), zod_mini.z.looseObject({})])]);
+/**
+* A single custom mode inside the `customModes` array of `.roomodes`.
+* @see https://roocodeinc.github.io/Roo-Code/features/custom-modes
+*/
+const RooModeSchema = zod_mini.z.looseObject({
+	slug: zod_mini.z.string(),
+	name: zod_mini.z.string(),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	roleDefinition: zod_mini.z.string(),
+	whenToUse: zod_mini.z.optional(zod_mini.z.string()),
+	groups: zod_mini.z.optional(zod_mini.z.array(RooModeGroupSchema)),
+	customInstructions: zod_mini.z.optional(zod_mini.z.string())
+});
+const RooModesFileSchema = zod_mini.z.looseObject({ customModes: zod_mini.z.array(RooModeSchema) });
+/**
+* Sanitize a string into a valid Roo mode slug (`^[a-zA-Z0-9-]+$`): lowercase,
+* non-alphanumeric runs collapsed to a single hyphen, leading/trailing hyphens
+* trimmed. Falls back to `"mode"` if nothing usable remains.
+*/
+function sanitizeRooSlug(raw) {
+	const slug = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	return slug.length > 0 ? slug : "mode";
+}
+function stringifyRooModes(modes) {
+	return (0, js_yaml.dump)({ customModes: modes }, {
+		lineWidth: -1,
+		noRefs: true
+	});
+}
+/**
+* Roo Code custom-modes adapter.
+*
+* Roo reads project-level custom modes from a single aggregated `.roomodes`
+* file at the workspace root (`docs.roocode.com` 301-redirects to the docs
+* below). Each rulesync subagent becomes one entry in the `customModes` array.
+* Because the native format aggregates N subagents into ONE file, every
+* `RooSubagent` instance carries the FULL `customModes` array and targets the
+* same `.roomodes` path; generation builds the aggregate once via
+* {@link RooSubagent.fromRulesyncSubagents}.
+*
+* @see https://roocodeinc.github.io/Roo-Code/features/custom-modes
+*/
+var RooSubagent = class extends ToolSubagent {
+	/** Name of the aggregated custom-modes file inside `getSettablePaths().relativeDirPath`. */
+	static modesFileName = ROO_MODES_FILE_NAME;
+	/** Frontmatter section of a rulesync subagent that carries the mode fields. */
+	static modeSectionKey = "roo";
+	/** Tool groups a generated mode gets when its section sets no `groups`. */
+	static defaultGroups = DEFAULT_GROUPS;
+	/** Tool target written into the frontmatter of imported subagents. */
+	static importTarget = "roo";
+	modes;
+	constructor({ modes, ...rest }) {
+		if (rest.validate !== false) {
+			const result = RooModesFileSchema.safeParse({ customModes: modes });
+			if (!result.success) throw new Error(`Invalid custom modes in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: stringifyRooModes(modes)
+		});
+		this.modes = modes;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: "." };
+	}
+	getModes() {
+		return this.modes;
+	}
+	getBody() {
+		return this.fileContent;
+	}
+	/**
+	* Map a single rulesync subagent to a Roo custom mode. The body becomes
+	* `roleDefinition`; the optional `roo:` frontmatter section (the
+	* {@link RooSubagent.modeSectionKey} section) supplies
+	* `groups`, `whenToUse`, `customInstructions`, an explicit `slug`, and may
+	* override `roleDefinition`. rulesync `name`/`description` are preferred,
+	* while tool-specific `roo:` values take precedence where defined.
+	*/
+	static toRooMode(rulesyncSubagent) {
+		const frontmatter = rulesyncSubagent.getFrontmatter();
+		const rawSection = frontmatter[this.modeSectionKey] ?? {};
+		const slug = typeof rawSection.slug === "string" && rawSection.slug.length > 0 ? sanitizeRooSlug(rawSection.slug) : sanitizeRooSlug((0, node_path.basename)(rulesyncSubagent.getRelativeFilePath()).replace(/\.[^.]+$/, ""));
+		const roleDefinition = typeof rawSection.roleDefinition === "string" ? rawSection.roleDefinition : rulesyncSubagent.getBody();
+		const groups = Array.isArray(rawSection.groups) ? rawSection.groups : [...this.defaultGroups];
+		const mode = {
+			slug,
+			name: frontmatter.name,
+			roleDefinition,
+			groups
+		};
+		if (frontmatter.description) mode.description = frontmatter.description;
+		if (typeof rawSection.whenToUse === "string") mode.whenToUse = rawSection.whenToUse;
+		if (typeof rawSection.customInstructions === "string") mode.customInstructions = rawSection.customInstructions;
+		return mode;
+	}
+	/**
+	* Aggregate every targeted rulesync subagent into a single `.roomodes` file.
+	* Modes are de-duplicated by `slug` (last one wins) to keep the array unique.
+	*/
+	static fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, validate = true }) {
+		const bySlug = /* @__PURE__ */ new Map();
+		for (const rulesyncSubagent of rulesyncSubagents) {
+			const mode = this.toRooMode(rulesyncSubagent);
+			bySlug.set(mode.slug, mode);
+		}
+		return new this({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.modesFileName,
+			modes: [...bySlug.values()],
+			validate
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true }) {
+		return this.fromRulesyncSubagents({
+			outputRoot,
+			rulesyncSubagents: [rulesyncSubagent],
+			validate
+		});
+	}
+	/**
+	* Convert every custom mode in the aggregated `.roomodes` file back into an
+	* individual rulesync subagent. The processor calls this in the import
+	* direction (one `.roomodes` tool file fans out to N rulesync files).
+	*/
+	toRulesyncSubagents() {
+		const { modeSectionKey, importTarget } = this.constructor;
+		return this.modes.map((mode) => {
+			const { slug, name, description, roleDefinition, whenToUse, groups, customInstructions, ...rest } = mode;
+			const modeSection = {
+				...rest,
+				slug,
+				...groups ? { groups } : {},
+				...whenToUse !== void 0 ? { whenToUse } : {},
+				...customInstructions !== void 0 ? { customInstructions } : {}
+			};
+			return new RulesyncSubagent({
+				outputRoot: ".",
+				frontmatter: {
+					targets: [importTarget],
+					name,
+					...description !== void 0 ? { description } : {},
+					[modeSectionKey]: modeSection
+				},
+				body: roleDefinition,
+				relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+				relativeFilePath: `${sanitizeRooSlug(slug)}.md`,
+				validate: true
+			});
+		});
+	}
+	toRulesyncSubagent() {
+		const first = this.toRulesyncSubagents()[0];
+		if (!first) throw new Error(`No custom modes found in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)} to convert.`);
+		return first;
+	}
+	validate() {
+		const result = RooModesFileSchema.safeParse({ customModes: this.modes });
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid custom modes in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "roo"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
+		const paths = this.getSettablePaths();
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		let parsed;
+		try {
+			parsed = loadYaml(fileContent);
+		} catch (error) {
+			throw new Error(`Failed to parse custom modes (${filePath}): ${formatError(error)}`, { cause: error });
+		}
+		const result = RooModesFileSchema.safeParse(parsed ?? { customModes: [] });
+		if (!result.success) throw new Error(`Invalid custom modes in ${filePath}: ${formatError(result.error)}`);
+		return new this({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: (0, node_path.basename)(relativeFilePath),
+			modes: result.data.customModes,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new this({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			modes: [],
+			validate: false
+		});
+	}
+};
+//#endregion
+//#region src/features/subagents/bob-subagent.ts
+/**
+* Subagent (custom-mode) generator for **IBM Bob** (Bob IDE and Bob Shell).
+*
+* Bob has no file-based subagents — its native subagents are the two fixed
+* presets `explore` and `general` — but it reads custom modes from an
+* aggregated `customModes` YAML file in Roo's format, so every targeted rulesync
+* subagent becomes one mode in `.bob/custom_modes.yaml`, exactly as the `roo`
+* target fills `.roomodes`. Only the project file is emitted: the Bob IDE and
+* Bob Shell docs name different global files.
+*
+* The mode fields ride a `bob:` frontmatter section rather than Roo's `roo:`
+* one, because Bob's tool groups are spelled differently (`execute` where Roo
+* says `command`, plus `skill`, `workflow`, `todo`, `subtask`, `subagent` and
+* `mode`), so a `roo.groups` list is not valid for Bob. A mode without
+* `bob.groups` gets `["read", "edit", "execute", "mcp"]`, Roo's default with
+* Bob IDE's spelling — the one Bob's shared approval settings use too. The Bob
+* Shell custom-modes page still lists Roo's `command` / `browser` groups, so a
+* mode meant for the Shell should spell its groups out in `bob.groups`.
+* `bob.allowedSubagents` (Bob IDE) is emitted when it is a string list, and
+* every other mode field is lifted back into `bob:` on import.
+*
+* @see https://bob.ibm.com/docs/ide/configuration/custom-modes
+* @see https://bob.ibm.com/docs/shell/configuration/custom-modes-bobshell
+* @see https://bob.ibm.com/docs/ide/features/subagents
+*/
+var BobSubagent = class extends RooSubagent {
+	static modesFileName = BOB_CUSTOM_MODES_FILE_NAME;
+	static modeSectionKey = "bob";
+	static defaultGroups = [
+		"read",
+		"edit",
+		"execute",
+		"mcp"
+	];
+	static importTarget = "bob";
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: BOB_DIR,
+			relativeFilePath: BOB_CUSTOM_MODES_FILE_NAME
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "bob"
+		});
+	}
+	static toRooMode(rulesyncSubagent) {
+		const mode = super.toRooMode(rulesyncSubagent);
+		const frontmatter = rulesyncSubagent.getFrontmatter();
+		const bobSection = isRecord$1(frontmatter.bob) ? frontmatter.bob : {};
+		if (isStringArray$2(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
+		return mode;
+	}
+};
+//#endregion
 //#region src/features/subagents/claudecode-subagent.ts
 const ClaudecodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -78552,15 +80177,14 @@ var DevinSubagent = class extends ToolSubagent {
 	toRulesyncSubagent() {
 		const { name, description, ...restFields } = this.frontmatter;
 		const devinSection = { ...restFields };
-		const rulesyncFrontmatter = {
-			targets: ["*"],
-			name,
-			description,
-			...Object.keys(devinSection).length > 0 && { devin: devinSection }
-		};
 		return new RulesyncSubagent({
-			outputRoot: this.getOutputRoot(),
-			frontmatter: rulesyncFrontmatter,
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name,
+				description,
+				...Object.keys(devinSection).length > 0 && { devin: devinSection }
+			},
 			body: this.body,
 			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
 			relativeFilePath: `${this.getSubagentName()}.md`,
@@ -81329,221 +82953,6 @@ var ReasonixSubagent = class ReasonixSubagent extends ToolSubagent {
 	}
 };
 //#endregion
-//#region src/features/subagents/roo-subagent.ts
-/**
-* Default tool groups assigned to a generated mode when the rulesync source
-* does not specify a `roo.groups` override. Mirrors Roo's built-in code mode
-* (full read/edit/command/mcp access; browser is opt-in).
-*/
-const DEFAULT_GROUPS = [
-	"read",
-	"edit",
-	"command",
-	"mcp"
-];
-/**
-* One entry of a mode's `groups` array. Either a bare toolset name
-* (`"read"`, `"edit"`, `"command"`, `"mcp"`, `"browser"`) or a tuple pairing a
-* toolset (in practice `"edit"`) with a file restriction object.
-* @see https://roocodeinc.github.io/Roo-Code/features/custom-modes
-*/
-const RooModeGroupSchema = zod_mini.z.union([zod_mini.z.string(), zod_mini.z.tuple([zod_mini.z.string(), zod_mini.z.looseObject({})])]);
-/**
-* A single custom mode inside the `customModes` array of `.roomodes`.
-* @see https://roocodeinc.github.io/Roo-Code/features/custom-modes
-*/
-const RooModeSchema = zod_mini.z.looseObject({
-	slug: zod_mini.z.string(),
-	name: zod_mini.z.string(),
-	description: zod_mini.z.optional(zod_mini.z.string()),
-	roleDefinition: zod_mini.z.string(),
-	whenToUse: zod_mini.z.optional(zod_mini.z.string()),
-	groups: zod_mini.z.optional(zod_mini.z.array(RooModeGroupSchema)),
-	customInstructions: zod_mini.z.optional(zod_mini.z.string())
-});
-const RooModesFileSchema = zod_mini.z.looseObject({ customModes: zod_mini.z.array(RooModeSchema) });
-/**
-* Sanitize a string into a valid Roo mode slug (`^[a-zA-Z0-9-]+$`): lowercase,
-* non-alphanumeric runs collapsed to a single hyphen, leading/trailing hyphens
-* trimmed. Falls back to `"mode"` if nothing usable remains.
-*/
-function sanitizeRooSlug(raw) {
-	const slug = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-	return slug.length > 0 ? slug : "mode";
-}
-function stringifyRooModes(modes) {
-	return (0, js_yaml.dump)({ customModes: modes }, {
-		lineWidth: -1,
-		noRefs: true
-	});
-}
-/**
-* Roo Code custom-modes adapter.
-*
-* Roo reads project-level custom modes from a single aggregated `.roomodes`
-* file at the workspace root (`docs.roocode.com` 301-redirects to the docs
-* below). Each rulesync subagent becomes one entry in the `customModes` array.
-* Because the native format aggregates N subagents into ONE file, every
-* `RooSubagent` instance carries the FULL `customModes` array and targets the
-* same `.roomodes` path; generation builds the aggregate once via
-* {@link RooSubagent.fromRulesyncSubagents}.
-*
-* @see https://roocodeinc.github.io/Roo-Code/features/custom-modes
-*/
-var RooSubagent = class extends ToolSubagent {
-	modes;
-	constructor({ modes, ...rest }) {
-		if (rest.validate !== false) {
-			const result = RooModesFileSchema.safeParse({ customModes: modes });
-			if (!result.success) throw new Error(`Invalid .roomodes in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
-		}
-		super({
-			...rest,
-			fileContent: stringifyRooModes(modes)
-		});
-		this.modes = modes;
-	}
-	static getSettablePaths(_options = {}) {
-		return { relativeDirPath: "." };
-	}
-	getModes() {
-		return this.modes;
-	}
-	getBody() {
-		return this.fileContent;
-	}
-	/**
-	* Map a single rulesync subagent to a Roo custom mode. The body becomes
-	* `roleDefinition`; the optional `roo:` frontmatter section supplies
-	* `groups`, `whenToUse`, `customInstructions`, an explicit `slug`, and may
-	* override `roleDefinition`. rulesync `name`/`description` are preferred,
-	* while tool-specific `roo:` values take precedence where defined.
-	*/
-	static toRooMode(rulesyncSubagent) {
-		const frontmatter = rulesyncSubagent.getFrontmatter();
-		const rawSection = frontmatter.roo ?? {};
-		const slug = typeof rawSection.slug === "string" && rawSection.slug.length > 0 ? sanitizeRooSlug(rawSection.slug) : sanitizeRooSlug((0, node_path.basename)(rulesyncSubagent.getRelativeFilePath()).replace(/\.[^.]+$/, ""));
-		const roleDefinition = typeof rawSection.roleDefinition === "string" ? rawSection.roleDefinition : rulesyncSubagent.getBody();
-		const groups = Array.isArray(rawSection.groups) ? rawSection.groups : [...DEFAULT_GROUPS];
-		const mode = {
-			slug,
-			name: frontmatter.name,
-			roleDefinition,
-			groups
-		};
-		if (frontmatter.description) mode.description = frontmatter.description;
-		if (typeof rawSection.whenToUse === "string") mode.whenToUse = rawSection.whenToUse;
-		if (typeof rawSection.customInstructions === "string") mode.customInstructions = rawSection.customInstructions;
-		return mode;
-	}
-	/**
-	* Aggregate every targeted rulesync subagent into a single `.roomodes` file.
-	* Modes are de-duplicated by `slug` (last one wins) to keep the array unique.
-	*/
-	static fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, validate = true }) {
-		const bySlug = /* @__PURE__ */ new Map();
-		for (const rulesyncSubagent of rulesyncSubagents) {
-			const mode = this.toRooMode(rulesyncSubagent);
-			bySlug.set(mode.slug, mode);
-		}
-		return new this({
-			outputRoot,
-			relativeDirPath: this.getSettablePaths().relativeDirPath,
-			relativeFilePath: ROO_MODES_FILE_NAME,
-			modes: [...bySlug.values()],
-			validate
-		});
-	}
-	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true }) {
-		return this.fromRulesyncSubagents({
-			outputRoot,
-			rulesyncSubagents: [rulesyncSubagent],
-			validate
-		});
-	}
-	/**
-	* Convert every custom mode in the aggregated `.roomodes` file back into an
-	* individual rulesync subagent. The processor calls this in the import
-	* direction (one `.roomodes` tool file fans out to N rulesync files).
-	*/
-	toRulesyncSubagents() {
-		return this.modes.map((mode) => {
-			const { slug, name, description, roleDefinition, whenToUse, groups, customInstructions, ...rest } = mode;
-			const rooSection = {
-				...rest,
-				slug,
-				...groups ? { groups } : {},
-				...whenToUse !== void 0 ? { whenToUse } : {},
-				...customInstructions !== void 0 ? { customInstructions } : {}
-			};
-			return new RulesyncSubagent({
-				outputRoot: ".",
-				frontmatter: {
-					targets: ["roo"],
-					name,
-					...description !== void 0 ? { description } : {},
-					roo: rooSection
-				},
-				body: roleDefinition,
-				relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
-				relativeFilePath: `${sanitizeRooSlug(slug)}.md`,
-				validate: true
-			});
-		});
-	}
-	toRulesyncSubagent() {
-		const first = this.toRulesyncSubagents()[0];
-		if (!first) throw new Error("No custom modes found in .roomodes to convert.");
-		return first;
-	}
-	validate() {
-		const result = RooModesFileSchema.safeParse({ customModes: this.modes });
-		if (result.success) return {
-			success: true,
-			error: null
-		};
-		return {
-			success: false,
-			error: /* @__PURE__ */ new Error(`Invalid .roomodes in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
-		};
-	}
-	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
-		return this.isTargetedByRulesyncSubagentDefault({
-			rulesyncSubagent,
-			toolTarget: "roo"
-		});
-	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true }) {
-		const paths = this.getSettablePaths();
-		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
-		const fileContent = await readFileContent(filePath);
-		let parsed;
-		try {
-			parsed = loadYaml(fileContent);
-		} catch (error) {
-			throw new Error(`Failed to parse .roomodes (${filePath}): ${formatError(error)}`, { cause: error });
-		}
-		const result = RooModesFileSchema.safeParse(parsed ?? { customModes: [] });
-		if (!result.success) throw new Error(`Invalid .roomodes in ${filePath}: ${formatError(result.error)}`);
-		return new this({
-			outputRoot,
-			relativeDirPath: paths.relativeDirPath,
-			relativeFilePath: (0, node_path.basename)(relativeFilePath),
-			modes: result.data.customModes,
-			validate
-		});
-	}
-	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new this({
-			outputRoot,
-			relativeDirPath,
-			relativeFilePath,
-			modes: [],
-			validate: false
-		});
-	}
-};
-//#endregion
 //#region src/features/subagents/tabnine-subagent.ts
 const TabnineSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -82041,20 +83450,19 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 		const resolvedBody = this.resolvedSystemPrompt ?? system_prompt;
 		const unresolvedPromptId = this.resolvedSystemPrompt === void 0 ? system_prompt_id : void 0;
 		const fileStem = (0, node_path.basename)(this.getRelativeFilePath(), ".toml");
-		const rulesyncFrontmatter = {
-			targets: ["vibe"],
-			name: display_name ?? fileStem,
-			...description !== void 0 && { description },
-			vibe: {
-				...display_name !== void 0 && { display_name },
-				...description !== void 0 && { description },
-				...unresolvedPromptId !== void 0 && { system_prompt_id: unresolvedPromptId },
-				...vibeSection
-			}
-		};
 		return new RulesyncSubagent({
-			outputRoot: this.outputRoot,
-			frontmatter: rulesyncFrontmatter,
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["vibe"],
+				name: display_name ?? fileStem,
+				...description !== void 0 && { description },
+				vibe: {
+					...display_name !== void 0 && { display_name },
+					...description !== void 0 && { description },
+					...unresolvedPromptId !== void 0 && { system_prompt_id: unresolvedPromptId },
+					...vibeSection
+				}
+			},
 			body: resolvedBody ?? "",
 			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
 			relativeFilePath: this.getRelativeFilePath().replace(/\.toml$/, ".md"),
@@ -82487,6 +83895,15 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.md"
 		}
 	}],
+	["bob", {
+		class: BobSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: false,
+			filePattern: "custom_modes.yaml"
+		}
+	}],
 	["claudecode", {
 		class: ClaudecodeSubagent,
 		meta: {
@@ -83109,10 +84526,15 @@ var SubagentsProcessor = class extends FeatureProcessor {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
 			const dirPath = typeof root === "string" ? root : root.relativeDirPath;
 			const baseDir = (0, node_path.join)(rootOutputRoot, dirPath);
-			if (forDeletion && await directoryExists(baseDir)) await assertWritablePathInsideRoot({
-				rootPath: rootOutputRoot,
-				targetPath: baseDir
-			});
+			if (forDeletion && await directoryExists(baseDir)) try {
+				await assertWritablePathInsideRoot({
+					rootPath: rootOutputRoot,
+					targetPath: baseDir
+				});
+			} catch (error) {
+				this.logger.warn(`Skipping the orphan sweep for ${quoteForLog(baseDir)}; nothing under it is deleted: ${stripControlCharacters(formatError(error))}`);
+				continue;
+			}
 			const subagentFilePaths = (await findFilesByGlobs(factory.meta.filePattern, {
 				cwd: baseDir,
 				followSymbolicLinks: !forDeletion
@@ -84074,6 +85496,16 @@ const AntigravityRuleFrontmatterSchema = zod_mini.z.looseObject({
 	description: zod_mini.z.optional(zod_mini.z.string())
 });
 /**
+* File name of a non-root rule in the shared global `~/.gemini/config/rules/`
+* directory. Antigravity reads only its top level, so a nested rulesync rule
+* (`frontend/style.md`) is flattened into a single file name
+* (`frontend-style.md`). The IDE and the CLI both use it so they write the
+* same file for the same rule.
+*/
+function toGlobalRuleFileName(relativeFilePath) {
+	return relativeFilePath.split(/[\\/]/).join("-");
+}
+/**
 * Converts a comma-separated globs string or array to an array of globs.
 * @param globs - Comma-separated globs string (e.g., "*.ts,*.js") or array of globs
 * @returns Array of glob patterns
@@ -84304,7 +85736,7 @@ var AntigravityCliRule = class AntigravityCliRule extends ToolRule {
 		});
 		return new AntigravityCliRule({
 			...params,
-			relativeFilePath: params.relativeFilePath.split(/[\\/]/).join("-"),
+			relativeFilePath: toGlobalRuleFileName(params.relativeFilePath),
 			fileContent,
 			global
 		});
@@ -84402,10 +85834,14 @@ var AntigravityCliRule = class AntigravityCliRule extends ToolRule {
 *
 * - Project scope: every rule is placed as a non-root file in
 *   `.agents/rules/` with Antigravity trigger frontmatter.
-* - Global scope: a single plain `~/.gemini/GEMINI.md` root file (shared with
-*   the Antigravity CLI), without frontmatter.
+* - Global scope: a plain `~/.gemini/GEMINI.md` root file without
+*   frontmatter, and non-root rules with trigger frontmatter in
+*   `~/.gemini/config/rules/`. Both are shared with the Antigravity CLI, which
+*   writes the same files for the same rules.
+*
+* @see https://antigravity.google/docs/rules
 */
-var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
+var AntigravityIdeRule = class extends ToolRule {
 	frontmatter;
 	body;
 	constructor({ frontmatter, body, ...rest }) {
@@ -84433,28 +85869,18 @@ var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
 		};
 	}
 	static getSettablePaths({ global = false, excludeToolDir } = {}) {
-		if (global) return { root: this.getGlobalRootPath(excludeToolDir) };
+		if (global) return {
+			root: this.getGlobalRootPath(excludeToolDir),
+			nonRoot: { relativeDirPath: buildToolPath(ANTIGRAVITY_IDE_GEMINI_DIR, ANTIGRAVITY_IDE_GLOBAL_RULES_SUBDIR, excludeToolDir) }
+		};
 		return {
 			root: this.getProjectRootPath(),
 			nonRoot: { relativeDirPath: buildToolPath(ANTIGRAVITY_IDE_AGENTS_DIR, "rules", excludeToolDir) }
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		if (global) {
-			const rootPath = paths.root;
-			const fileContent = await readFileContent((0, node_path.join)(outputRoot, rootPath.relativeDirPath, rootPath.relativeFilePath));
-			return new this({
-				outputRoot,
-				relativeDirPath: rootPath.relativeDirPath,
-				relativeFilePath: rootPath.relativeFilePath,
-				frontmatter: {},
-				body: fileContent,
-				validate,
-				root: true
-			});
-		}
-		if (relativeFilePath === paths.root.relativeFilePath) {
+		if (relativeFilePath === paths.root.relativeFilePath && (relativeDirPath === void 0 || relativeDirPath === paths.root.relativeDirPath)) {
 			const rootPath = paths.root;
 			const rootContent = await readFileContent((0, node_path.join)(outputRoot, rootPath.relativeDirPath, rootPath.relativeFilePath));
 			return new this({
@@ -84464,10 +85890,10 @@ var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
 				frontmatter: {},
 				body: rootContent,
 				validate,
-				root: true
+				root: true,
+				global
 			});
 		}
-		if (!("nonRoot" in paths) || !paths.nonRoot) throw new Error(`nonRoot path is not set for ${relativeFilePath}`);
 		const nonRootDirPath = paths.nonRoot.relativeDirPath;
 		const filePath = (0, node_path.join)(outputRoot, nonRootDirPath, relativeFilePath);
 		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
@@ -84484,23 +85910,12 @@ var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
 			body,
 			frontmatter: parsedFrontmatter,
 			validate,
-			root: false
+			root: false,
+			global
 		});
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
-		if (global) {
-			const rootPath = paths.root;
-			return new this({
-				outputRoot,
-				relativeDirPath: rootPath.relativeDirPath,
-				relativeFilePath: rootPath.relativeFilePath,
-				frontmatter: {},
-				body: rulesyncRule.getBody(),
-				validate,
-				root: true
-			});
-		}
 		if (rulesyncRule.getFrontmatter().root) {
 			const rootPath = paths.root;
 			return new this({
@@ -84510,7 +85925,8 @@ var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
 				frontmatter: {},
 				body: rulesyncRule.getBody(),
 				validate,
-				root: true
+				root: true,
+				global
 			});
 		}
 		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
@@ -84520,16 +85936,16 @@ var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
 		const strategy = STRATEGIES$1.find((s) => s.canHandle(storedTrigger));
 		if (!strategy) throw new Error(`No strategy found for trigger: ${storedTrigger}`);
 		const frontmatter = strategy.generateFrontmatter(normalized, rulesyncFrontmatter);
-		if (!("nonRoot" in paths) || !paths.nonRoot) throw new Error(`nonRoot path is not set for ${rulesyncRule.getRelativeFilePath()}`);
-		const kebabCaseFilename = toKebabCaseFilename(rulesyncRule.getRelativeFilePath());
+		const relativeFilePath = global ? toGlobalRuleFileName(rulesyncRule.getRelativeFilePath()) : toKebabCaseFilename(rulesyncRule.getRelativeFilePath());
 		return new this({
 			outputRoot,
 			relativeDirPath: paths.nonRoot.relativeDirPath,
-			relativeFilePath: kebabCaseFilename,
+			relativeFilePath,
 			frontmatter,
 			body: rulesyncRule.getBody(),
 			validate,
-			root: false
+			root: false,
+			global
 		});
 	}
 	toRulesyncRule() {
@@ -84574,15 +85990,26 @@ var AntigravityIdeRule = class AntigravityIdeRule extends ToolRule {
 			error: null
 		};
 	}
+	/**
+	* `~/.gemini/config/rules/` is shared with the Antigravity CLI and holds
+	* global rules the user created outside rulesync, which cannot be told apart
+	* from generated ones, so the orphan sweep never removes files there.
+	*/
+	isDeletable() {
+		return !this.global || this.root;
+	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
-		return new AntigravityIdeRule({
+		const rootPath = this.getSettablePaths({ global }).root;
+		const isRoot = relativeFilePath === rootPath.relativeFilePath && relativeDirPath === rootPath.relativeDirPath;
+		return new this({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
 			frontmatter: {},
 			body: "",
 			validate: false,
-			root: global || relativeFilePath === "AGENTS.md" && relativeDirPath === "."
+			root: isRoot,
+			global
 		});
 	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
@@ -91263,7 +92690,8 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 		meta: {
 			extension: "md",
 			supportsGlobal: true,
-			ruleDiscoveryMode: "auto"
+			ruleDiscoveryMode: "auto",
+			sharedGlobalNonRootDir: true
 		}
 	}],
 	["antigravity-plugin", {
@@ -91900,6 +93328,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			toolRules,
 			factory
 		});
+		await this.warnForWarpLegacyRootFile(toolRules);
 		this.warnForInstructionBudget({
 			toolRules,
 			meta
@@ -92313,6 +93742,24 @@ var RulesProcessor = class extends FeatureProcessor {
 		this.logger.warn(`Writing ${stripControlCharacters(rootFileRelativePath)} for ${this.toolTarget} means ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} will no longer be read. Run \`rulesync import --targets ${this.toolTarget}\` first to carry that content into ${RULESYNC_RULES_RELATIVE_DIR_PATH}, or delete ${listedNames.length === 1 ? "it" : "them"} once you have checked the content is already in the root file.`);
 	}
 	/**
+	* Warp still reads a legacy `WARP.md`, and when both `WARP.md` and
+	* `AGENTS.md` sit in the same directory, `WARP.md` takes priority — so the
+	* `AGENTS.md` this run writes would never be read. Rulesync neither writes
+	* nor deletes `WARP.md` (it is hand-authored), so the only thing it can do is
+	* say so. Project scope only: the documented precedence is about project
+	* rules, and Warp's global rule source is `~/.agents/AGENTS.md`.
+	* @see https://docs.warp.dev/agents/capabilities/rules/
+	*/
+	async warnForWarpLegacyRootFile(toolRules) {
+		if (this.toolTarget !== "warp" || this.global) return;
+		if (toolRules.length === 0) return;
+		const { root } = WarpRule.getSettablePaths();
+		const legacyRelativePath = (0, node_path.join)(root.relativeDirPath, WARP_LEGACY_RULE_FILE_NAME);
+		if (!await fileExists((0, node_path.join)(this.outputRoot, legacyRelativePath))) return;
+		const rootRelativePath = (0, node_path.join)(root.relativeDirPath, root.relativeFilePath);
+		this.logger.warn(`${legacyRelativePath} exists next to ${rootRelativePath}, and Warp reads WARP.md instead of AGENTS.md when both are present, so the generated ${rootRelativePath} is ignored by Warp. Move any content you still need into ${RULESYNC_RULES_RELATIVE_DIR_PATH}, then delete or rename ${legacyRelativePath}.`);
+	}
+	/**
 	* Handle localRoot rule generation based on tool target.
 	* - `separate-local-file`: writes a dedicated `*.local.md` root file
 	*   (claudecode/legacy: `./CLAUDE.local.md`, rovodev: `./AGENTS.local.md`)
@@ -93694,26 +95141,64 @@ function createFoldRootOverwriteWatch({ logger }) {
 }
 //#endregion
 //#region src/lib/orphan-sweep.ts
-function createOrphanSweepPlan() {
+function createOrphanSweepPlan({ logger } = {}) {
 	const generatedPaths = /* @__PURE__ */ new Set();
 	const generatedTrees = /* @__PURE__ */ new Set();
 	const deferredSweeps = [];
 	const deletedPathsByFeature = /* @__PURE__ */ new Map();
-	const isInsideGeneratedTree = (absolutePath) => {
-		let current = absolutePath;
+	const warnedUnresolvable = /* @__PURE__ */ new Set();
+	let landingClaims;
+	const isInsideTree = ({ path, trees }) => {
+		let current = path;
 		let parent = (0, node_path.dirname)(current);
 		while (parent !== current) {
-			if (generatedTrees.has(parent)) return true;
+			if (trees.has(parent)) return true;
 			current = parent;
 			parent = (0, node_path.dirname)(current);
 		}
 		return false;
 	};
+	const followLinks = async (path) => {
+		try {
+			return await writeLandingPath(path);
+		} catch {
+			return null;
+		}
+	};
+	const landingsOf = async (paths) => {
+		const landings = await Promise.all([...paths].map((path) => followLinks(path)));
+		return new Set(landings.filter((landing) => landing !== null));
+	};
+	const getLandingClaims = () => {
+		landingClaims ??= Promise.all([landingsOf(generatedPaths), landingsOf(generatedTrees)]).then(([paths, trees]) => ({
+			paths,
+			trees: new Set([...trees].filter((tree) => (0, node_path.dirname)(tree) !== tree))
+		}));
+		return landingClaims;
+	};
+	const landsOnClaim = async ({ path, exactly }) => {
+		const resolved = (0, node_path.resolve)(path);
+		const landing = await followLinks(resolved);
+		if (landing === null) {
+			if (!warnedUnresolvable.has(resolved)) {
+				warnedUnresolvable.add(resolved);
+				logger?.warn(`Refusing to sweep ${quoteForLog(resolved)}: its symbolic links cannot be followed (a link cycle or an unreadable directory)`);
+			}
+			return true;
+		}
+		const claims = await getLandingClaims();
+		return claims.paths.has(landing) || !exactly && isInsideTree({
+			path: landing,
+			trees: claims.trees
+		});
+	};
 	const plan = {
 		registerGenerated({ paths }) {
+			landingClaims = void 0;
 			for (const path of paths) generatedPaths.add((0, node_path.resolve)(path));
 		},
 		registerGeneratedTree({ paths }) {
+			landingClaims = void 0;
 			for (const path of paths) {
 				const resolved = (0, node_path.resolve)(path);
 				generatedPaths.add(resolved);
@@ -93722,13 +95207,26 @@ function createOrphanSweepPlan() {
 		},
 		isGenerated({ path }) {
 			const resolved = (0, node_path.resolve)(path);
-			return generatedPaths.has(resolved) || isInsideGeneratedTree(resolved);
+			return generatedPaths.has(resolved) || isInsideTree({
+				path: resolved,
+				trees: generatedTrees
+			});
 		},
-		isGeneratedExactly({ path }) {
-			return generatedPaths.has((0, node_path.resolve)(path));
+		async isGeneratedExactly({ path }) {
+			return generatedPaths.has((0, node_path.resolve)(path)) || await landsOnClaim({
+				path,
+				exactly: true
+			});
 		},
-		rejectClaimed({ items, getPath }) {
-			return items.filter((item) => !plan.isGenerated({ path: getPath(item) }));
+		async rejectClaimed({ items, getPath }) {
+			const claimed = await Promise.all(items.map(async (item) => {
+				const path = getPath(item);
+				return plan.isGenerated({ path }) || await landsOnClaim({
+					path,
+					exactly: false
+				});
+			}));
+			return items.filter((_, index) => !claimed[index]);
 		},
 		defer({ sweep, reportDeleted }) {
 			deferredSweeps.push({
@@ -93922,19 +95420,19 @@ function scheduleRetiredTargetSweeps({ config, logger, sweepPlan, sourceLoadFail
 	}
 }
 async function sweepFiles({ processor, sweepPlan, unownedPaths }) {
-	const candidates = sweepPlan.rejectClaimed({
+	const candidates = (await sweepPlan.rejectClaimed({
 		items: await processor.loadToolFiles({ forDeletion: true }),
 		getPath: (f) => f.getFilePath()
-	}).filter((f) => !unownedPaths.has((0, node_path.resolve)(f.getFilePath())));
+	})).filter((f) => !unownedPaths.has((0, node_path.resolve)(f.getFilePath())));
 	const present = await Promise.all(candidates.map((f) => fileExists(f.getFilePath())));
 	return await processor.removeOrphanAiFiles(candidates.filter((_, index) => present[index]), []) > 0;
 }
 async function sweepDirs({ processor, sweepPlan }) {
-	return await processor.removeOrphanAiDirs(sweepPlan.rejectClaimed({
+	return await processor.removeOrphanAiDirs(await sweepPlan.rejectClaimed({
 		items: await processor.loadToolDirsToDelete(),
 		getPath: (d) => d.getDirPath()
 	}), []) + await processor.removeOrphanFlatFiles({
-		existingFlatFiles: sweepPlan.rejectClaimed({
+		existingFlatFiles: await sweepPlan.rejectClaimed({
 			items: await processor.loadToolFlatFilesToDelete(),
 			getPath: (d) => d.getFlatFilePath() ?? d.getDirPath()
 		}),
@@ -94121,7 +95619,7 @@ async function processFeatureGeneration(params) {
 	if (config.getDelete() && !processor.hasRulesyncSourceLoadFailure()) sweepPlan.defer({
 		sweep: async () => {
 			const existingToolFiles = await processor.loadToolFiles({ forDeletion: true });
-			return await processor.removeOrphanAiFiles(sweepPlan.rejectClaimed({
+			return await processor.removeOrphanAiFiles(await sweepPlan.rejectClaimed({
 				items: existingToolFiles,
 				getPath: (f) => f.getFilePath()
 			}), toolFiles) > 0;
@@ -94135,6 +95633,16 @@ async function processFeatureGeneration(params) {
 		sourceLoadFailed: processor.hasRulesyncSourceLoadFailure()
 	};
 }
+/**
+* Whether a write to `targetPath` lands strictly below `rootPath` once every
+* link on the way to either is followed. A cycle on either side answers false.
+*/
+async function landsStrictlyBelowRoot({ rootPath, targetPath }) {
+	const [rootLanding, targetLanding] = await Promise.all([writeLandingPath(rootPath), writeLandingPath(targetPath)]);
+	if (rootLanding === null || targetLanding === null) return false;
+	const relativePath = (0, node_path.relative)(rootLanding, targetLanding);
+	return relativePath !== "" && !pathEscapesRoot(relativePath);
+}
 async function processDirFeatureGeneration(params) {
 	const { config, processor, toolDirs, sweepPlan } = params;
 	let totalCount = 0;
@@ -94145,7 +95653,11 @@ async function processDirFeatureGeneration(params) {
 	allPaths.push(...writeResult.paths);
 	if (writeResult.count > 0) hasDiff = true;
 	const ownedTrees = toolDirs.filter((d) => d.ownsDirTree());
-	sweepPlan.registerGeneratedTree({ paths: ownedTrees.map((d) => d.getDirPath()) });
+	const treesBelowRoot = await Promise.all(ownedTrees.map((d) => landsStrictlyBelowRoot({
+		rootPath: d.getOutputRoot(),
+		targetPath: d.getDirPath()
+	})));
+	sweepPlan.registerGeneratedTree({ paths: ownedTrees.filter((_, index) => treesBelowRoot[index]).map((d) => d.getDirPath()) });
 	sweepPlan.registerGenerated({ paths: toolDirs.flatMap((d) => {
 		const dirPath = d.getDirPath();
 		const mainFile = d.getMainFile();
@@ -94158,13 +95670,13 @@ async function processDirFeatureGeneration(params) {
 	if (config.getDelete() && !processor.hasRulesyncSourceLoadFailure()) sweepPlan.defer({
 		sweep: async () => {
 			const existingToolDirs = await processor.loadToolDirsToDelete();
-			const orphanDirCount = await processor.removeOrphanAiDirs(sweepPlan.rejectClaimed({
+			const orphanDirCount = await processor.removeOrphanAiDirs(await sweepPlan.rejectClaimed({
 				items: existingToolDirs,
 				getPath: (d) => d.getDirPath()
 			}), toolDirs);
 			const existingFlatFiles = await processor.loadToolFlatFilesToDelete();
 			const orphanFileCount = await processor.removeOrphanFlatFiles({
-				existingFlatFiles: sweepPlan.rejectClaimed({
+				existingFlatFiles: await sweepPlan.rejectClaimed({
 					items: existingFlatFiles,
 					getPath: (d) => d.getFlatFilePath() ?? d.getDirPath()
 				}),
@@ -94191,10 +95703,10 @@ async function processEmptyFeatureGeneration(params) {
 	if (config.getDelete() && !processor.hasRulesyncSourceLoadFailure()) sweepPlan.defer({
 		sweep: async () => {
 			const existingToolFiles = await processor.loadToolFiles({ forDeletion: true });
-			const filesToDelete = sweepPlan.rejectClaimed({
+			const filesToDelete = (await sweepPlan.rejectClaimed({
 				items: existingToolFiles,
 				getPath: (f) => f.getFilePath()
-			}).filter((f) => !skipFilePaths?.has(f.getRelativePathFromCwd()));
+			})).filter((f) => !skipFilePaths?.has(f.getRelativePathFromCwd()));
 			return await processor.removeOrphanAiFiles(filesToDelete, []) > 0;
 		},
 		reportDeleted: () => processor.getRemovedPaths()
@@ -94520,7 +96032,7 @@ async function generate(params) {
 		logger
 	});
 	let skillsResult;
-	const sweepPlan = createOrphanSweepPlan();
+	const sweepPlan = createOrphanSweepPlan({ logger });
 	const runners = {
 		ignore: () => generateIgnoreCore({
 			config,
@@ -95695,6 +97207,12 @@ Object.defineProperty(exports, "AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME", {
 		return AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME;
 	}
 });
+Object.defineProperty(exports, "CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME", {
+	enumerable: true,
+	get: function() {
+		return CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME;
+	}
+});
 Object.defineProperty(exports, "CLAUDECODE_DIR", {
 	enumerable: true,
 	get: function() {