rulesync 29.0.0 → 30.0.0

package/dist/{import--SCvWeDn.js → import-DBd2G6Eo.js}

@@ -7861,6 +7861,26 @@ const CopilotPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
 	defaultPermissionMode: z.optional(z.enum(COPILOT_DEFAULT_PERMISSION_MODES))
 });
+/**
+* oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
+* before prompting. `always-ask` auto-approves only read-only tools, `write`
+* also workspace writes, and `yolo` (oh-my-pi's default) every tier.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
+*/
+const OMP_APPROVAL_MODES = [
+	"always-ask",
+	"write",
+	"yolo"
+];
+/**
+* Tool-scoped override block for oh-my-pi (`omp`). `approvalMode` writes the
+* `tools.approvalMode` key of `config.yml`, which has no canonical category.
+*/
+const OmpPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	approvalMode: z.optional(z.enum(OMP_APPROVAL_MODES))
+});
 const KimiCodePermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
 	defaultPermissionMode: z.optional(z.enum([
@@ -7868,6 +7888,14 @@ const KimiCodePermissionsOverrideSchema = z.looseObject({
 		"yolo",
 		"auto"
 	])),
+	/**
+	* Kimi's `[permission] dangerous_command_guard` switch (Kimi Code 0.40.0,
+	* default `true`). `false` turns off the built-in dangerous-command policy
+	* (no confirmation for `rm -rf`, `shutdown` and the like).
+	*
+	* @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
+	*/
+	dangerousCommandGuard: z.optional(z.boolean()),
 	rules: z.optional(z.array(z.looseObject({
 		decision: PermissionActionSchema,
 		pattern: z.string(),
@@ -8083,7 +8111,10 @@ const CursorPermissionsOverrideSchema = z.looseObject({
 * `sandbox`, `sandboxImage`, `disabled`, `visible`, `eager`, `listDirectory`,
 * `todoWrite`, `workflowsEnabled`, `workflowNameOnly`, `executionSandbox`) and
 * `security` (`folderTrust`, `allowedHttpHookUrls`, `allowPrivateNetworkHooks`,
-* `allowedInsecureVoiceBaseUrls`). Qwen Code strips `tools.workflowsEnabled`,
+* `allowedInsecureVoiceBaseUrls`) and `skills` (the skill kill-switches
+* `disabled`, `defaultDisabled`, `enabled`, `disabledLevels`, each a list Qwen
+* Code unions across scopes) and `general` (`outputStyle`, the output style
+* that reshapes how responses are written). Qwen Code strips `tools.workflowsEnabled`,
 * `tools.executionSandbox`, `security.allowPrivateNetworkHooks` and
 * `security.allowedInsecureVoiceBaseUrls` out of workspace settings, so generate
 * skips those four in project scope and announces a granting value in global
@@ -8100,7 +8131,8 @@ const CursorPermissionsOverrideSchema = z.looseObject({
 * registry controls (`disabled`, `visible`, `listDirectory`, `todoWrite`, and `eager`, which
 * demotes an omitted tool to deferred rather than removing it, replacing rather
 * than merging with the list a higher scope set), the Auto Mode
-* classifier config, and, because these groups are loose objects, any key
+* classifier config, the skill kill-switches, and, because these groups are
+* loose objects, any key
 * rulesync does not model. Import flags a scope-dependent key only when it read
 * the project file, since that is the value a `--global` regenerate would
 * promote. It also
@@ -8111,11 +8143,13 @@ const CursorPermissionsOverrideSchema = z.looseObject({
 * matching `settings.json` group and emitted only for Qwen, while the shared
 * `permission` block continues to drive the `permissions.allow`/`ask`/`deny`
 * arrays. Kept `looseObject` (verbatim passthrough) so any current or future
-* `tools`/`security`/`autoMode` key can be authored.
+* `tools`/`security`/`skills`/`general`/`autoMode` key can be authored.
 *
 * @example
 * {
 *   "tools": { "approvalMode": "auto-edit" },
+*   "skills": { "disabled": ["pdf"], "disabledLevels": ["bundled"] },
+*   "general": { "outputStyle": "Concise" },
 *   "security": { "folderTrust": { "enabled": true } },
 *   "autoMode": { "hints": { "allow": ["Running tests"] }, "classifyAllShell": true }
 * }
@@ -8124,6 +8158,8 @@ const QwencodePermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
 	tools: z.optional(z.looseObject({})),
 	security: z.optional(z.looseObject({})),
+	skills: z.optional(z.looseObject({})),
+	general: z.optional(z.looseObject({})),
 	autoMode: z.optional(z.looseObject({}))
 });
 /**
@@ -8209,6 +8245,8 @@ const TabninePermissionsOverrideSchema = z.looseObject({
 * { "sandbox": { "bash": "enforce", "network": false }, "agent": { "plan_mode_read_only_commands": ["gh pr diff"] } }
 * @example
 * { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
+* @example
+* { "mode": "deny" }
 */
 const ReasonixPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
@@ -8217,7 +8255,12 @@ const ReasonixPermissionsOverrideSchema = z.looseObject({
 	rawAllow: z.optional(z.array(z.string())),
 	rawAsk: z.optional(z.array(z.string())),
 	rawDeny: z.optional(z.array(z.string())),
-	allowDynamicBash: z.optional(z.boolean())
+	allowDynamicBash: z.optional(z.boolean()),
+	mode: z.optional(z.enum([
+		"ask",
+		"allow",
+		"deny"
+	]))
 });
 /**
 * Tool-scoped override block for Factory Droid. Factory Droid's `settings.json`
@@ -8260,7 +8303,8 @@ const FactorydroidPermissionsOverrideSchema = z.looseObject({
 * {
 *   "agent_mode_coding_permissions": "always_allow_reading",
 *   "agent_mode_execute_readonly_commands": true,
-*   "execution_profile": { "read_files": "always_allow", "mcp_denylist": ["untrusted-server"] }
+*   "execution_profile": { "read_files": "always_allow", "mcp_denylist": ["untrusted-server"] },
+*   "auto_approve_bypasses_command_denylist": false
 * }
 */
 /**
@@ -8312,6 +8356,16 @@ const WarpExecutionProfileOverrideSchema = z.looseObject({
 	mcp_allowlist: z.optional(z.array(z.string())),
 	mcp_denylist: z.optional(z.array(z.string()))
 });
+/**
+* Whether auto-approve may run commands that match the command denylist
+* (Warp defaults to `true`). It is not an execution-profile field: it lives in
+* the sibling `[agents.warp_agent.other]` table of the same `settings.toml`,
+* shared by the Warp app and the Warp Agent CLI.
+*
+* @see https://docs.warp.dev/agents/cli/permissions-and-profiles/
+* @see https://github.com/warpdotdev/warp/blob/main/app/src/settings/ai.rs (`AutoApproveBypassesCommandDenylist`)
+*/
+const WarpAutoApproveBypassSchema = z.optional(z.boolean());
 const WarpPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
 	agent_mode_coding_permissions: z.optional(z.enum([
@@ -8321,7 +8375,8 @@ const WarpPermissionsOverrideSchema = z.looseObject({
 	])),
 	agent_mode_coding_file_read_allowlist: z.optional(z.array(z.string())),
 	agent_mode_execute_readonly_commands: z.optional(z.boolean()),
-	execution_profile: z.optional(WarpExecutionProfileOverrideSchema)
+	execution_profile: z.optional(WarpExecutionProfileOverrideSchema),
+	auto_approve_bypasses_command_denylist: WarpAutoApproveBypassSchema
 });
 /**
 * Tool-scoped override block for the standalone Warp Agent CLI. The CLI reads
@@ -8330,16 +8385,21 @@ const WarpPermissionsOverrideSchema = z.looseObject({
 * the app's legacy `[agents.profiles]` keys), so only the nested
 * `execution_profile` block is offered; it is merged into that record, and the
 * shared `permission.bash` block still drives `command_allowlist` /
-* `command_denylist`.
+* `command_denylist`. `auto_approve_bypasses_command_denylist` is written to
+* the sibling `[agents.warp_agent.other]` table.
 *
 * @example
-* { "execution_profile": { "apply_code_diffs": "always_ask", "run_agents": "never_allow" } }
+* {
+*   "execution_profile": { "apply_code_diffs": "always_ask", "run_agents": "never_allow" },
+*   "auto_approve_bypasses_command_denylist": false
+* }
 *
 * @see https://docs.warp.dev/agents/cli/permissions-and-profiles/
 */
 const WarpcliPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
-	execution_profile: z.optional(WarpExecutionProfileOverrideSchema)
+	execution_profile: z.optional(WarpExecutionProfileOverrideSchema),
+	auto_approve_bypasses_command_denylist: WarpAutoApproveBypassSchema
 });
 /**
 * deepagents-cli's approval-mode knobs under `[startup]` in
@@ -9035,7 +9095,7 @@ const PermissionsConfigSchema = z.looseObject({
 	copilotcli: z.optional(CanonicalPermissionsOverrideSchema),
 	crush: z.optional(CanonicalPermissionsOverrideSchema),
 	goose: z.optional(CanonicalPermissionsOverrideSchema),
-	omp: z.optional(CanonicalPermissionsOverrideSchema),
+	omp: z.optional(OmpPermissionsOverrideSchema),
 	pool: z.optional(CanonicalPermissionsOverrideSchema),
 	qoder: z.optional(CanonicalPermissionsOverrideSchema),
 	grokcli: z.optional(CanonicalPermissionsOverrideSchema),
@@ -12745,7 +12805,9 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"tools",
-					"security"
+					"security",
+					"skills",
+					"general"
 				]
 			}
 		}
@@ -13115,7 +13177,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 		features: {
 			mcp: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["mcp_servers"]
+				ownedKeys: ["mcp_servers", "disabled_mcp_tools"]
 			},
 			permissions: {
 				kind: "replace-owned-keys",
@@ -13250,6 +13312,14 @@ function serializeSharedConfigFile({ fileKey, document, existingContent, filePat
 	});
 }
 /**
+* A patch value for an owned key that holds a map of managed entries: the map
+* itself, or `undefined` when it is empty, which retracts the key instead of
+* leaving an empty object behind (`applySharedConfigPatch` deletes a key whose patch value is `undefined`).
+*/
+function undefinedWhenEmpty(entries) {
+	return Object.keys(entries).length > 0 ? entries : void 0;
+}
+/**
 * Execute a feature's declared write to a gateway-managed shared file: parse
 * the existing content, merge the patch under the feature's declared policy,
 * and serialize it back over the existing content (see
@@ -13736,14 +13806,23 @@ var FeatureProcessor = class extends RulesyncSourceConsumer {
 	async removeOrphanAiFiles(existingFiles, generatedFiles) {
 		const generatedPaths = new Set(generatedFiles.map((f) => caseFoldIdentity(f.getFilePath())));
 		const orphanFiles = existingFiles.filter((f) => !generatedPaths.has(caseFoldIdentity(f.getFilePath())));
+		const refusedDirs = /* @__PURE__ */ new Map();
 		let removedCount = 0;
 		for (const aiFile of orphanFiles) {
 			const filePath = aiFile.getFilePath();
-			if (await refusesDeleteOutsideRoot({
-				logger: this.logger,
-				rootPath: aiFile.getOutputRoot(),
-				filePath
-			})) continue;
+			const rootPath = aiFile.getOutputRoot();
+			const dirPath = dirname(filePath);
+			const cacheKey = JSON.stringify([rootPath, dirPath]);
+			let refused = refusedDirs.get(cacheKey);
+			if (refused === void 0) {
+				refused = await refusesDeleteOutsideRoot({
+					logger: this.logger,
+					rootPath,
+					dirPath
+				});
+				refusedDirs.set(cacheKey, refused);
+			}
+			if (refused) continue;
 			const loggedPath = stripControlCharacters(filePath);
 			if (this.dryRun) this.logger.info(`[DRY RUN] Would delete: ${loggedPath}`);
 			else {
@@ -13864,22 +13943,24 @@ async function refusesWriteOutsideRoot({ logger, rootPath, targetPath }) {
 	return true;
 }
 /**
-* Whether deleting `filePath` has to be refused because a link on the way to
-* the directory holding it leads out of `rootPath`, warning about the refusal.
+* Whether deleting the files in `dirPath` has to be refused because a link on
+* the way to that directory leads out of `rootPath`, warning about the refusal
+* once for the whole directory.
 *
 * Deletion candidates are enumerated without following links *inside* the
 * scanned directory, but the scanned directory itself is reached through
 * whatever links its path contains: a checked-out repository can carry
 * `.cursor/commands -> ~/notes`, and every file in `~/notes` would then read as
-* an orphan. Only the parent is judged, because removing a file that is itself
-* a link unlinks the link where it is spelled and never touches its target.
+* an orphan. Only the directory is judged, never the file in it, because
+* removing a file that is itself a link unlinks the link where it is spelled
+* and never touches its target.
 */
-async function refusesDeleteOutsideRoot({ logger, rootPath, filePath }) {
+async function refusesDeleteOutsideRoot({ logger, rootPath, dirPath }) {
 	if (!await writablePathEscapesRoot({
 		rootPath,
-		targetPath: dirname(filePath)
+		targetPath: dirPath
 	})) return false;
-	logger.warn(`Refusing to delete ${quoteForLog(filePath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
+	logger.warn(`Refusing to delete files in ${quoteForLog(dirPath)}: it resolves outside ${quoteForLog(rootPath)} through a symbolic link`);
 	return true;
 }
 /**
@@ -17202,7 +17283,7 @@ var AntigravitySharedCommand = class extends ToolCommand {
 	static getProjectRelativeDirPath() {
 		throw new Error("Please implement this method in the subclass.");
 	}
-	/** Global-scope workflows directory under `~/.gemini/` (e.g. `.gemini/antigravity/global_workflows`). */
+	/** Global-scope workflows directory under `~/.gemini/` (e.g. `.gemini/config/workflows`). */
 	static getGlobalRelativeDirPath() {
 		throw new Error("Please implement this method in the subclass.");
 	}
@@ -17365,7 +17446,8 @@ const ANTIGRAVITY_IDE_GEMINI_DIR = ".gemini";
 const ANTIGRAVITY_IDE_GLOBAL_RULE_FILE_NAME = "GEMINI.md";
 const ANTIGRAVITY_IDE_GLOBAL_CONFIG_SUBDIR = "config";
 const ANTIGRAVITY_IDE_GLOBAL_RULES_SUBDIR = join(ANTIGRAVITY_IDE_GLOBAL_CONFIG_SUBDIR, "rules");
-const ANTIGRAVITY_IDE_GLOBAL_WORKFLOWS_DIR_PATH = join(ANTIGRAVITY_IDE_GEMINI_DIR, "antigravity", "global_workflows");
+const ANTIGRAVITY_IDE_GLOBAL_WORKFLOWS_DIR_PATH = join(ANTIGRAVITY_IDE_GEMINI_DIR, ANTIGRAVITY_IDE_GLOBAL_CONFIG_SUBDIR, "workflows");
+const ANTIGRAVITY_IDE_PRE_V2_GLOBAL_WORKFLOWS_DIR_PATH = join(ANTIGRAVITY_IDE_GEMINI_DIR, "antigravity", "global_workflows");
 const ANTIGRAVITY_IDE_PERMISSIONS_DIR = ".antigravity";
 const ANTIGRAVITY_IDE_PERMISSIONS_FILE_NAME = "settings.json";
 //#endregion
@@ -17395,10 +17477,12 @@ var AntigravityIdeSkill = class extends AntigravitySharedSkill {
 * Emits each command as a skill in `.agents/skills/<name>/SKILL.md` (project
 * scope) and `~/.gemini/config/skills/<name>/SKILL.md` (global scope), the
 * IDE's skills directories. Legacy workflows are still imported from
-* `.agents/workflows/` and `~/.gemini/antigravity/global_workflows/`. All
-* body and frontmatter handling is shared with {@link AntigravitySharedCommand}.
+* `.agents/workflows/` and `~/.gemini/config/workflows/` (the global workflows
+* directory of Antigravity 2.0), and, in global scope only, from the pre-2.0
+* `~/.gemini/antigravity/global_workflows/`. All body and frontmatter handling
+* is shared with {@link AntigravitySharedCommand}.
 */
-var AntigravityIdeCommand = class extends AntigravitySharedCommand {
+var AntigravityIdeCommand = class AntigravityIdeCommand extends AntigravitySharedCommand {
 	static getProjectRelativeDirPath() {
 		return ANTIGRAVITY_IDE_COMMANDS_DIR_PATH;
 	}
@@ -17408,6 +17492,37 @@ var AntigravityIdeCommand = class extends AntigravitySharedCommand {
 	static getSkillsRelativeDirPath({ global }) {
 		return AntigravityIdeSkill.getSettablePaths({ global }).relativeDirPath;
 	}
+	/**
+	* Import-only, global scope: the workflows left in the pre-2.0
+	* `~/.gemini/antigravity/global_workflows/` directory, where rulesync also
+	* wrote IDE global commands before they were emitted as skills. The
+	* directory is never swept by `generate --delete`; a workflow with the same
+	* file name in `~/.gemini/config/workflows/` takes precedence.
+	*
+	* @see https://antigravity.google/docs/migration/workflows-to-skills
+	*/
+	static async loadAdditionalImportFiles({ outputRoot = process.cwd(), global = false, logger } = {}) {
+		if (!global) return [];
+		const filePaths = await findFilesByGlobs("*.md", { cwd: join(outputRoot, ANTIGRAVITY_IDE_PRE_V2_GLOBAL_WORKFLOWS_DIR_PATH) });
+		return (await Promise.all(filePaths.map(async (filePath) => {
+			const fileContent = await readFileContent(filePath);
+			const { frontmatter, body } = parseFrontmatter(fileContent, filePath);
+			const result = AntigravityCommandFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) {
+				logger?.warn(`Skipping ${filePath}: invalid frontmatter (${formatError(result.error)}).`);
+				return;
+			}
+			return new AntigravityIdeCommand({
+				outputRoot,
+				relativeDirPath: ANTIGRAVITY_IDE_PRE_V2_GLOBAL_WORKFLOWS_DIR_PATH,
+				relativeFilePath: basename(filePath),
+				frontmatter: result.data,
+				body: body.trim(),
+				fileContent,
+				global
+			});
+		}))).filter((command) => command !== void 0);
+	}
 	getToolTargetName() {
 		return "antigravity-ide";
 	}
@@ -25060,7 +25175,7 @@ function findCommandPaths({ command, scan }) {
 		} else {
 			if (path !== void 0) toAnchor.add(path);
 			state.owner = text.slice(text.lastIndexOf("/") + 1);
-			state.expecting = afterCommandWord(state.owner);
+			state.expecting = afterCommandWord$1(state.owner);
 			state.prefix = void 0;
 			state.shellCode = false;
 		}
@@ -25126,7 +25241,7 @@ function readOption({ state, text }) {
 	if (SHELL_NAME_PATTERN.test(state.owner) && SHELL_CODE_OPTION.test(text)) state.shellCode = true;
 }
 /** What follows a command word whose basename is `name`. */
-function afterCommandWord(name) {
+function afterCommandWord$1(name) {
 	if (Object.hasOwn(RUN_SUBCOMMANDS, name)) return "subcommand";
 	if (PACKAGE_RUNNERS.has(name)) return "wrapped";
 	return SCRIPT_RUNNER_PATTERN.test(name) ? "script" : "none";
@@ -33469,6 +33584,19 @@ function isQwencodeLegacyMillisecondTimeout(timeout) {
 	return typeof timeout === "number" && Number.isFinite(timeout) && timeout >= QWENCODE_LEGACY_MILLISECOND_TIMEOUT_THRESHOLD;
 }
 /**
+* Read a `timeout` the way Qwen Code does. Settings files are not type-checked
+* and Qwen Code coerces a numeric string such as `"60000"` with `Number()`, so
+* import accepts one too; a value that is not a finite number is dropped, since
+* Qwen Code falls back to the hook type's default for it.
+* https://github.com/QwenLM/qwen-code/blob/main/packages/core/src/hooks/hook-timeout.ts
+*/
+function readQwencodeTimeout(timeout) {
+	if (timeout === void 0) return void 0;
+	if (typeof timeout === "string" && timeout.trim() === "") return void 0;
+	const value = Number(timeout);
+	return Number.isFinite(value) ? value : void 0;
+}
+/**
 * Canonical `timeout` is seconds. A command hook value below the threshold is
 * already read as seconds; a larger one can only be expressed in milliseconds.
 */
@@ -33579,7 +33707,7 @@ const QwencodeHookEntrySchema = z.looseObject({
 	type: z.optional(z.string()),
 	command: z.optional(z.string()),
 	url: z.optional(z.string()),
-	timeout: z.optional(z.number()),
+	timeout: z.optional(z.union([z.number(), z.string()])),
 	name: z.optional(z.string()),
 	description: z.optional(z.string()),
 	statusMessage: z.optional(z.string()),
@@ -33612,12 +33740,13 @@ function qwencodeHookEntryToCanonical({ hook, sequential, matcher }) {
 	const isCommand = hookType === "command";
 	const isPrompt = hookType === "prompt";
 	const shell = h.shell === "bash" || h.shell === "powershell" ? h.shell : void 0;
+	const timeout = readQwencodeTimeout(h.timeout);
 	return {
 		type: hookType,
 		...compact({
 			command: h.command,
 			url: h.url,
-			timeout: isCommand ? qwencodeCommandTimeoutToCanonicalTimeout(h.timeout) : h.timeout,
+			timeout: isCommand ? qwencodeCommandTimeoutToCanonicalTimeout(timeout) : timeout,
 			name: h.name,
 			description: h.description,
 			statusMessage: h.statusMessage,
@@ -38119,7 +38248,7 @@ var AmpMcp = class AmpMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(basePaths),
 				feature: "mcp",
 				existingContent: fileContent ?? "",
-				patch: { [AMP_MCP_SERVERS_KEY]: filterMcpServers(rulesyncMcp.getMcpServers()) },
+				patch: { [AMP_MCP_SERVERS_KEY]: undefinedWhenEmpty(filterMcpServers(rulesyncMcp.getMcpServers())) },
 				filePath: join(jsonDir, relativeFilePath),
 				logger
 			}),
@@ -38417,6 +38546,7 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
+		const mcpServers = rulesyncMcp.getMcpServers();
 		return new AugmentcodeMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -38425,7 +38555,7 @@ var AugmentcodeMcp = class AugmentcodeMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { mcpServers: rulesyncMcp.getMcpServers() },
+				patch: { mcpServers: Object.keys(mcpServers).length > 0 ? mcpServers : void 0 },
 				filePath,
 				logger
 			}),
@@ -38981,6 +39111,229 @@ var ClaudecodeMcp = class ClaudecodeMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/claudecode-plugin-mcp.ts
+/**
+* The placeholder Claude Code substitutes with the installed plugin's own
+* directory in an MCP server's `command`, `args` and `env`.
+* @see https://code.claude.com/docs/en/plugins-reference
+*/
+const PLUGIN_ROOT_PLACEHOLDER = "${CLAUDE_PLUGIN_ROOT}";
+const PLUGIN_ROOT_PREFIX = /^(?:\$\{CLAUDE_PLUGIN_ROOT\}|"\$CLAUDE_PLUGIN_ROOT"|\$CLAUDE_PLUGIN_ROOT)\//;
+/**
+* Whether a server `command` names a file inside the plugin rather than an
+* executable found on `PATH`. The command is spawned without a shell, so a
+* name with a slash is a path, and one without (`npx`, `node`, `uvx`) is a
+* `PATH` lookup. An absolute path, a home path, one that leaves the plugin
+* (`../`), and one that already starts with a variable are left as written.
+*/
+function isPluginRelativeCommand(command) {
+	return /[\\/]/.test(command) && !command.startsWith("$") && !command.startsWith("%") && !command.startsWith("~") && !/^\.\.[\\/]/.test(command) && !posix.isAbsolute(command) && !win32.isAbsolute(command);
+}
+function anchorToPluginRoot(path) {
+	return `${PLUGIN_ROOT_PLACEHOLDER}/${path.replace(/^\.[\\/]/, "")}`;
+}
+/** The runner name of a command word: its basename without a `.exe` suffix. */
+function runnerName(command) {
+	return (command.split(/[\\/]/).pop() ?? command).replace(/\.exe$/i, "");
+}
+/** What follows a command word, as plugin hook commands read it. */
+function afterCommandWord(name) {
+	if (Object.hasOwn(RUN_SUBCOMMANDS, name)) return "subcommand";
+	if (PACKAGE_RUNNERS.has(name)) return "command";
+	return SCRIPT_RUNNER_PATTERN.test(name) ? "script" : "none";
+}
+/**
+* The positions in `args` that name a file the server runs, read with the
+* rules plugin hook commands follow (`hook-command-paths.ts`): the script of a
+* script runner (`node ./dist/server.js`), the command after a run subcommand
+* or package runner (`uv run ./server.py`, `npx tsx ./x.ts`), and the value of
+* an option that loads a file (`node -r ./register.js`). Only a position whose
+* value `isPath` accepts is returned. Everything else is data the server reads
+* relative to the consumer's project (`server-filesystem ./docs`), and the
+* scan stops at an option that runs inline code or standard input
+* (`node -e`, `python3 -m`, `sh -c`, `bash -s`).
+*/
+function fileArgumentIndices({ command, args, isPath }) {
+	const indices = /* @__PURE__ */ new Set();
+	let owner = runnerName(command);
+	let expecting = afterCommandWord(owner);
+	for (let index = 0; index < args.length && expecting !== "none"; index++) {
+		const arg = args[index];
+		if (typeof arg !== "string") break;
+		if (arg.startsWith("-") && arg !== "-") {
+			if (optionsFor({
+				table: CODE_OPTIONS,
+				name: owner
+			})?.has(arg) || SHELL_NAME_PATTERN.test(owner) && SHELL_CODE_OPTION.test(arg)) break;
+			if (optionsFor({
+				table: VALUE_OPTIONS,
+				name: owner
+			})?.has(arg)) {
+				const value = args[index + 1];
+				if (typeof value === "string" && isPath(value)) indices.add(index + 1);
+				index++;
+			}
+			continue;
+		}
+		if (expecting === "subcommand") {
+			if (RUN_SUBCOMMANDS[owner]?.has(arg)) {
+				expecting = "command";
+				continue;
+			}
+			if (!SCRIPT_RUNNER_PATTERN.test(owner)) break;
+			expecting = "script";
+		}
+		if (isPath(arg)) indices.add(index);
+		if (expecting === "script") break;
+		owner = runnerName(arg);
+		expecting = afterCommandWord(owner);
+	}
+	return indices;
+}
+function isDotRelative(value) {
+	return /^\.[\\/]/.test(value);
+}
+/** Turn a plugin-root path back into its `./` form, or return it unchanged. */
+function relativizeFromPluginRoot(value) {
+	return PLUGIN_ROOT_PREFIX.test(value) ? value.replace(PLUGIN_ROOT_PREFIX, "./") : value;
+}
+/** The command and arguments of a stdio server, with inline array arguments split out. */
+function splitCommand(server) {
+	if (Array.isArray(server.command)) {
+		const [first, ...rest] = server.command;
+		return {
+			command: typeof first === "string" ? first : void 0,
+			args: [...rest, ...Array.isArray(server.args) ? server.args : []]
+		};
+	}
+	return {
+		command: typeof server.command === "string" ? server.command : void 0,
+		args: Array.isArray(server.args) ? server.args : []
+	};
+}
+/**
+* Rewrite a server's command and the argument positions that name a file it
+* runs (see `fileArgumentIndices`), leaving every other argument as written.
+* Generate and import share this, so a position generate never anchors is
+* never relativized on import either, and a hand-written
+* `${CLAUDE_PLUGIN_ROOT}/…` data argument keeps its meaning.
+*/
+function rewriteServer({ server, rewriteCommand, isPath, rewritePath }) {
+	const { command, args } = splitCommand(server);
+	if (command === void 0) return server;
+	const indices = fileArgumentIndices({
+		command,
+		args,
+		isPath
+	});
+	const rewriteArgs = (values, offset) => values.map((value, index) => indices.has(index + offset) && typeof value === "string" ? rewritePath(value) : value);
+	const next = { ...server };
+	if (Array.isArray(server.command)) {
+		const inlineArgs = server.command.slice(1);
+		next.command = [rewriteCommand(command), ...rewriteArgs(inlineArgs, 0)];
+		if (Array.isArray(server.args)) next.args = rewriteArgs(server.args, inlineArgs.length);
+	} else {
+		next.command = rewriteCommand(command);
+		if (Array.isArray(server.args)) next.args = rewriteArgs(server.args, 0);
+	}
+	return next;
+}
+/** Anchor a server's plugin-relative command and the files its runner executes. */
+function anchorServer(server) {
+	return rewriteServer({
+		server,
+		rewriteCommand: (command) => isPluginRelativeCommand(command) ? anchorToPluginRoot(command) : command,
+		isPath: isDotRelative,
+		rewritePath: anchorToPluginRoot
+	});
+}
+/** Turn the plugin-root forms generate writes back into `./`. */
+function relativizeServer(server) {
+	return rewriteServer({
+		server,
+		rewriteCommand: relativizeFromPluginRoot,
+		isPath: (value) => PLUGIN_ROOT_PREFIX.test(value),
+		rewritePath: relativizeFromPluginRoot
+	});
+}
+/** Apply a per-server transform to every server entry that is an object. */
+function mapServers({ mcpServers, transform }) {
+	if (mcpServers === null || typeof mcpServers !== "object" || Array.isArray(mcpServers)) return mcpServers;
+	return Object.fromEntries(Object.entries(mcpServers).map(([name, server]) => server === null || typeof server !== "object" || Array.isArray(server) ? [name, server] : [name, transform(server)]));
+}
+/**
+* MCP servers bundled in a Claude Code plugin (`.mcp.json` at the plugin
+* root).
+*
+* Claude Code loads a plugin's `.mcp.json` with the consumer's project as the
+* working directory, so a relative `command` such as `./servers/db-server`
+* would be looked up in the consumer's repository, where the bundled binary
+* does not exist. Generate therefore rewrites a relative `command`, and the
+* `./` script a script runner executes (`node ./dist/server.js`,
+* `uv run ./server.py`), to `${CLAUDE_PLUGIN_ROOT}/…`, which Claude Code
+* substitutes with the installed plugin's directory. Other `./` arguments are
+* data the server reads relative to the consumer's project
+* (`server-filesystem ./docs`), so they are left as written, the same rule
+* plugin hook commands follow. Bare executables (`npx`, `node`), absolute paths
+* and values that already start with a variable pass through. `env` values and
+* the remote transports' `url` / `headers` are left as written, because
+* rulesync cannot tell a path from an opaque string there. Import turns the
+* plugin-root forms in `command` and `args` back into `./`, including the
+* shell-variable spellings a hand-written file may have copied from a hook
+* command (which Claude Code does not substitute in MCP config).
+*
+* @see https://code.claude.com/docs/en/plugins-reference
+*/
+var ClaudecodePluginMcp = class ClaudecodePluginMcp extends ClaudecodeMcp {
+	static async fromRulesyncMcp(params) {
+		const base = await super.fromRulesyncMcp(params);
+		const json = base.getJson();
+		const mcpServers = mapServers({
+			mcpServers: json.mcpServers,
+			transform: anchorServer
+		});
+		return new ClaudecodePluginMcp({
+			outputRoot: params.outputRoot ?? process.cwd(),
+			relativeDirPath: base.getRelativeDirPath(),
+			relativeFilePath: base.getRelativeFilePath(),
+			fileContent: JSON.stringify({
+				...json,
+				mcpServers
+			}, null, 2),
+			validate: params.validate ?? true,
+			global: params.global ?? false
+		});
+	}
+	static async fromFile(params) {
+		const base = await super.fromFile(params);
+		return new ClaudecodePluginMcp({
+			outputRoot: params.outputRoot ?? process.cwd(),
+			relativeDirPath: base.getRelativeDirPath(),
+			relativeFilePath: base.getRelativeFilePath(),
+			fileContent: base.getFileContent(),
+			validate: params.validate ?? true,
+			global: params.global ?? false
+		});
+	}
+	toRulesyncMcp() {
+		const mcpServers = mapServers({
+			mcpServers: this.getJson().mcpServers ?? {},
+			transform: relativizeServer
+		});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
+	}
+	static forDeletion(params) {
+		return new ClaudecodePluginMcp({
+			outputRoot: params.outputRoot ?? process.cwd(),
+			relativeDirPath: params.relativeDirPath,
+			relativeFilePath: params.relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global: params.global ?? false
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/cline-mcp.ts
 const CLINE_GLOBAL_ONLY_MESSAGE = "Cline MCP is global-only; use --global to sync ~/.cline/data/settings/cline_mcp_settings.json";
 function parseClineSettings(fileContent, relativeDirPath, relativeFilePath) {
@@ -41690,7 +42043,7 @@ var CrushMcp = class CrushMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(this.getSettablePaths({ global })),
 				feature: "mcp",
 				existingContent,
-				patch: { ["mcp"]: converted },
+				patch: { ["mcp"]: undefinedWhenEmpty(converted) },
 				filePath: location.filePath,
 				logger
 			}),
@@ -43270,13 +43623,23 @@ var GooseMcp = class GooseMcp extends ToolMcp {
 //#region src/features/mcp/grokcli-mcp.ts
 const MAX_REMOVE_EMPTY_ENTRIES_DEPTH = 32;
 /**
+* Grok keeps per-server MCP tool deny lists in a top-level
+* `[disabled_mcp_tools]` table (`map<server, string[]>` of unqualified tool
+* names), not inside `[mcp_servers.<name>]`. Grok reads it from the user
+* `~/.grok/config.toml` only: a project `.grok/config.toml` contributes just
+* `[mcp_servers]`, `[plugins]`, `[permission]` and `[mcp] max_output_bytes`.
+* https://github.com/xai-org/grok-build/blob/2bdd1d6a/crates/codegen/xai-grok-pager/docs/user-guide/26-config-reference.md
+*/
+const GROK_DISABLED_MCP_TOOLS_KEY = "disabled_mcp_tools";
+/**
 * Grok Build stores MCP servers in `config.toml` under a `[mcp_servers.<name>]`
 * table. Verified against `grok mcp add` (grok 0.2.54): a stdio server emits
 * `command`, `args`, `enabled = true`, and an `[mcp_servers.<name>.env]` table;
 * a remote server emits `url` and `enabled`. Unlike Codex CLI, Grok uses a
-* literal `env` table (not the `env_vars` passthrough list) and has no
-* per-server tool allow/deny lists, so the only field rename is
-* `disabled` (rulesync) ↔ `enabled = false` (grok).
+* literal `env` table (not the `env_vars` passthrough list), so the only field
+* rename is `disabled` (rulesync) ↔ `enabled = false` (grok). `disabledTools`
+* never lands in the server table: it is lifted into the top-level
+* `[disabled_mcp_tools]` table by `buildDisabledMcpTools`.
 */
 function convertToGrokFormat(mcpServers) {
 	const result = {};
@@ -43285,7 +43648,7 @@ function convertToGrokFormat(mcpServers) {
 		if (!isRecord$1(config)) continue;
 		const converted = {};
 		for (const [key, value] of Object.entries(config)) {
-			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+			if (PROTOTYPE_POLLUTION_KEYS.has(key) || key === "disabledTools") continue;
 			if (key === "disabled") {
 				if (value === true) converted["enabled"] = false;
 			} else converted[key] = value;
@@ -43309,6 +43672,38 @@ function convertFromGrokFormat(grokMcp) {
 	}
 	return result;
 }
+function toToolNameList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter((tool) => typeof tool === "string");
+}
+/**
+* Recompute the global `[disabled_mcp_tools]` table: every server Rulesync
+* declares gets its `disabledTools` (or loses a stale entry when it has none —
+* Grok itself removes an entry whose list empties), while entries for other
+* servers — ones toggled in Grok's `/mcps` UI, plugin or compat servers, and
+* the `__managed_gateway_connectors` sentinel — are carried over untouched.
+* Returns `undefined` when nothing is left, so the key is retracted.
+*/
+function buildDisabledMcpTools({ mcpServers, existingContent, filePath }) {
+	const existing = parseSharedConfig({
+		format: "toml",
+		fileContent: existingContent,
+		filePath
+	})[GROK_DISABLED_MCP_TOOLS_KEY];
+	const result = isRecord$1(existing) ? { ...existing } : {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const tools = toToolNameList(config.disabledTools);
+		if (tools.length > 0) result[name] = tools;
+		else delete result[name];
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function warnProjectDisabledTools(mcpServers, logger) {
+	const serverNames = Object.entries(mcpServers).filter(([, config]) => isRecord$1(config) && config.disabledTools !== void 0).map(([name]) => name);
+	if (serverNames.length === 0) return;
+	warnWithFallback(logger, `grokcli reads per-server \`disabledTools\` only from the user ~/.grok/config.toml ([disabled_mcp_tools]); dropping it from ${serverNames.join(", ")} in project mode. Generate with --global to apply it.`);
+}
 var GrokcliMcp = class GrokcliMcp extends ToolMcp {
 	toml;
 	constructor({ ...rest }) {
@@ -43345,16 +43740,19 @@ var GrokcliMcp = class GrokcliMcp extends ToolMcp {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
-			validate
+			validate,
+			global
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const configTomlFilePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const configTomlFileContent = await readFileContentOrNull(configTomlFilePath) ?? "";
-		const converted = convertToGrokFormat(rulesyncMcp.getMcpServers());
+		const strippedMcpServers = rulesyncMcp.getMcpServers();
+		const converted = convertToGrokFormat(strippedMcpServers);
 		const filteredMcpServers = this.removeEmptyEntries(converted);
-		for (const name of Object.keys(converted)) if (!Object.hasOwn(filteredMcpServers, name)) warnWithFallback(void 0, `MCP server "${name}" had no non-empty configuration and was dropped from the grok CLI config`);
+		if (!global) warnProjectDisabledTools(strippedMcpServers, logger);
+		for (const name of Object.keys(converted)) if (!Object.hasOwn(filteredMcpServers, name)) warnWithFallback(logger, `MCP server "${name}" had no non-empty configuration and was dropped from the grok CLI config`);
 		return new GrokcliMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -43363,14 +43761,31 @@ var GrokcliMcp = class GrokcliMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent: configTomlFileContent,
-				patch: { mcp_servers: filteredMcpServers },
+				patch: {
+					mcp_servers: Object.keys(filteredMcpServers).length > 0 ? filteredMcpServers : void 0,
+					...global && { [GROK_DISABLED_MCP_TOOLS_KEY]: buildDisabledMcpTools({
+						mcpServers: strippedMcpServers,
+						existingContent: configTomlFileContent,
+						filePath: configTomlFilePath
+					}) }
+				},
 				filePath: configTomlFilePath
 			}),
-			validate
+			validate,
+			global
 		});
 	}
 	toRulesyncMcp() {
 		const converted = convertFromGrokFormat(this.toml.mcp_servers ?? {});
+		const disabledMcpTools = this.toml[GROK_DISABLED_MCP_TOOLS_KEY];
+		if (this.global && isRecord$1(disabledMcpTools)) for (const [name, config] of Object.entries(converted)) {
+			if (!Object.hasOwn(disabledMcpTools, name)) continue;
+			const tools = toToolNameList(disabledMcpTools[name]);
+			if (tools.length > 0) converted[name] = {
+				...config,
+				disabledTools: tools
+			};
+		}
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers: converted }, null, 2) });
 	}
 	validate() {
@@ -46434,7 +46849,7 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { [POOL_MCP_SERVERS_KEY]: converted },
+				patch: { [POOL_MCP_SERVERS_KEY]: undefinedWhenEmpty(converted) },
 				filePath
 			}),
 			validate,
@@ -46564,7 +46979,7 @@ var QoderMcp = class QoderMcp extends ToolMcp {
 			fileKey: sharedConfigFileKey(paths),
 			feature: "mcp",
 			existingContent,
-			patch: { mcpServers },
+			patch: { mcpServers: undefinedWhenEmpty(mcpServers) },
 			filePath
 		}) : JSON.stringify({
 			...parseQoderMcpConfig({
@@ -46943,18 +47358,28 @@ function warnAboutRetiredFields({ name, serverRecord, logger }) {
 * `" Serial "` counts too and is written as authored.
 */
 const REASONIX_CONCURRENCY_VALUES = /* @__PURE__ */ new Set(["serial", "parallel"]);
-/**
-* The type Reasonix decodes each fixed-type scalar passthrough field into
-* (`PluginEntry` in `internal/config/plugin_entry.go`, and
-* `internal/contract/config/plugin_entry.go` on the CLI v2 line).
-*/
 const REASONIX_TYPED_PLUGIN_FIELDS = {
+	startup_timeout_seconds: "integer",
+	call_timeout_seconds: "integer",
+	tool_timeout_seconds: "integer table",
 	concurrency: "string",
 	auto_start: "boolean",
 	load: "string",
 	oauth_allow_missing_pkce_metadata: "boolean"
 };
 /**
+* Whether `value` is written as a TOML integer. smol-toml writes a JS number
+* outside the safe-integer range, or with a fraction, as a TOML float.
+*/
+function isTomlInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value);
+}
+function hasExpectedType(value, expected) {
+	if (expected === "integer") return isTomlInteger(value);
+	if (expected === "integer table") return isRecord$1(value) && Object.values(value).every(isTomlInteger);
+	return typeof value === expected;
+}
+/**
 * Why a passthrough value cannot be written, or `undefined` when it can (and
 * for every field without a fixed type). A wrong type is the case that matters:
 * a TOML type mismatch makes Reasonix refuse the whole config file. An unknown
@@ -46966,7 +47391,7 @@ const REASONIX_TYPED_PLUGIN_FIELDS = {
 */
 function invalidPassthroughFieldReason(field, value) {
 	const expected = REASONIX_TYPED_PLUGIN_FIELDS[field];
-	if (expected !== void 0 && typeof value !== expected) return `Reasonix expects a ${expected} and fails to load a config file holding any other type.`;
+	if (expected !== void 0 && !hasExpectedType(value, expected)) return `Reasonix expects ${expected === "integer" ? "an" : "a"} ${expected === "integer table" ? "table of integers" : expected} and fails to load a config file holding any other type.`;
 	if (field === "concurrency" && typeof value === "string" && !REASONIX_CONCURRENCY_VALUES.has(value.trim().toLowerCase())) return `Reasonix accepts only "serial" or "parallel" and ignores ${JSON.stringify(value)}, falling back to the server-name default.`;
 }
 /**
@@ -47988,7 +48413,7 @@ var TabnineMcp = class TabnineMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { mcpServers: convertToTabnineFormat(rulesyncMcp.getMcpServers(), logger) },
+				patch: { mcpServers: undefinedWhenEmpty(convertToTabnineFormat(rulesyncMcp.getMcpServers(), logger)) },
 				filePath
 			}),
 			validate,
@@ -49309,6 +49734,7 @@ var ZedMcp = class ZedMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const contextServers = convertServersToZedFormat(rulesyncMcp.getMcpServers(), logger);
 		return new ZedMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -49317,7 +49743,7 @@ var ZedMcp = class ZedMcp extends ToolMcp {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "mcp",
 				existingContent,
-				patch: { context_servers: convertServersToZedFormat(rulesyncMcp.getMcpServers(), logger) },
+				patch: { context_servers: Object.keys(contextServers).length > 0 ? contextServers : void 0 },
 				filePath
 			}),
 			validate
@@ -49450,7 +49876,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 		}
 	}],
 	["claudecode-plugin", {
-		class: ClaudecodeMcp,
+		class: ClaudecodePluginMcp,
 		meta: {
 			supportsProject: true,
 			supportsGlobal: false,
@@ -49626,7 +50052,7 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsGlobal: true,
 			supportsEnabledTools: false,
-			supportsDisabledTools: false
+			supportsDisabledTools: true
 		}
 	}],
 	["hermesagent", {
@@ -50792,6 +51218,8 @@ function parsedGlobsIntersect(left, right, budget) {
 * @see https://antigravity.google/docs/permissions?tab=cli
 */
 const REGEX_PREFIX = "regex:";
+const TRAILING_ANCHOR = /(?<!\\)\$$/;
+const PLAIN_TARGET_GLOB_CHARACTERS = /[*?[{\\]/;
 const REGEX_METACHARACTERS$1 = /[\\^$.|?*+()[\]{}]/;
 const WHITESPACE_CODES = [
 	9,
@@ -50932,6 +51360,7 @@ function replacePosixClasses(source) {
 function isInvalidRegex(source) {
 	const unquoted = source.replace(RE2_QUOTED, (match) => match === "\\\\" ? match : "q");
 	if (LOOKAROUND.test(unquoted) || hasRefusedEscape(unquoted)) return true;
+	if (hasClassEscapeRangeEnd(unquoted)) return true;
 	const withoutPosixClasses = replacePosixClasses(unquoted);
 	if (withoutPosixClasses === void 0 || hasRefusedRepeat(withoutPosixClasses)) return true;
 	const asJavaScript = withoutPosixClasses.replace(/\(\?P</g, "(?<").replace(/\(\?[imsU]*-?[imsU]*\)/g, "").replace(/\(\?[imsU]*-?[imsU]*:/g, "(?:").replace(/\\A/g, "^").replace(/\\z/g, "$");
@@ -50956,6 +51385,74 @@ function hasRefusedEscape(source) {
 	}
 	return false;
 }
+const CLASS_ESCAPE_LETTERS = /[dDsSwWpP]/;
+/** The length of the escape at `index`, braces (`\x{41}`, `\p{Greek}`) included. */
+function escapeLength(source, index) {
+	const escaped = source[index + 1] ?? "";
+	if (/[xpP]/.test(escaped) && source[index + 2] === "{") {
+		const close = source.indexOf("}", index + 3);
+		return close === -1 ? source.length - index : close - index + 1;
+	}
+	if (escaped === "p" || escaped === "P") return 3;
+	return escaped === "x" ? 4 : 2;
+}
+/** Step past `^` and a leading `]` (a member) after the `[` that ends at `index`. */
+function openClass(source, start) {
+	const index = source[start] === "^" ? start + 1 : start;
+	return source[index] === "]" ? {
+		index: index + 1,
+		afterCharacter: true
+	} : {
+		index,
+		afterCharacter: false
+	};
+}
+/**
+* Whether a bracket range ends in a class escape (`[a-\d]`, `[--\s]`). Go
+* reads the end of a range as one character and refuses such a regex, while
+* JavaScript without the `u` flag reads it as three members. A class escape
+* that starts the range (`[\d-z]`) is a member followed by `-`, which both
+* accept. The `u` flag cannot be used instead: it also refuses RE2 spellings
+* such as `\x{41}` and `\-` outside a class.
+*/
+function hasClassEscapeRangeEnd(source) {
+	let inClass = false;
+	let afterCharacter = false;
+	let index = 0;
+	while (index < source.length) {
+		const character = source[index] ?? "";
+		if (character === "\\") {
+			afterCharacter = inClass && !CLASS_ESCAPE_LETTERS.test(source[index + 1] ?? "");
+			index += escapeLength(source, index);
+			continue;
+		}
+		if (!inClass) {
+			inClass = character === "[";
+			({index, afterCharacter} = inClass ? openClass(source, index + 1) : {
+				index: index + 1,
+				afterCharacter: false
+			});
+			continue;
+		}
+		const posixEnd = source.startsWith("[:", index) ? source.indexOf(":]", index + 2) : -1;
+		if (character === "]" || posixEnd !== -1) {
+			inClass = character !== "]";
+			afterCharacter = false;
+			index = posixEnd === -1 ? index + 1 : posixEnd + 2;
+			continue;
+		}
+		if (character === "-" && afterCharacter && source[index + 1] !== "]") {
+			const end = index + 1;
+			if (source[end] === "\\" && CLASS_ESCAPE_LETTERS.test(source[end + 1] ?? "")) return true;
+			afterCharacter = false;
+			index = end + (source[end] === "\\" ? escapeLength(source, end) : 1);
+			continue;
+		}
+		afterCharacter = true;
+		index += 1;
+	}
+	return false;
+}
 /**
 * Whether a repeat count is over Go's limit. Braces inside a bracket class
 * (`[a{1001}]`) and in `\x{2003}` or `\p{Greek}` are not repeats, so those
@@ -51103,7 +51600,7 @@ function toAntigravityCommandLiteralPrefix(pattern) {
 * the rule a regex.
 */
 function regexWordToGlob(word) {
-	const body = word.replace(/^\^/, "").replace(/(?<!\\)\$$/, "");
+	const body = word.replace(/^\^/, "").replace(TRAILING_ANCHOR, "");
 	const characters = Array.from(body);
 	if (characters.length === 0) return;
 	let glob = "";
@@ -51144,12 +51641,61 @@ function regexToGlob(source) {
 function fromAntigravityCommandTarget(target) {
 	if (target.startsWith(REGEX_PREFIX)) return regexToGlob(target.slice(6)) ?? target;
 	if (target === "*") return target;
-	if (/[*?[{\\]/.test(target)) {
+	if (PLAIN_TARGET_GLOB_CHARACTERS.test(target)) {
 		const words = splitWords(target);
 		return `${REGEX_PREFIX}${words.map((word) => `^${[...word].map(escapeRegexCharacter).join("")}$`).join(" ")}`;
 	}
 	return `${target} *`;
 }
+/**
+* Whether a regex word means the same anchored or not: each end is either
+* anchored (`^`, an unescaped `$`) or open-ended (`.*`).
+*/
+function isAnchoredWord(word) {
+	const startAnchored = word.startsWith("^") || word.startsWith(".*");
+	const endAnchored = TRAILING_ANCHOR.test(word) || word.endsWith(".*");
+	return startAnchored && endAnchored;
+}
+/**
+* Explain what importing an Antigravity `command` target may lose, or return
+* `undefined` when the import is faithful.
+*
+* - A `regex:` target with a word that is not anchored is imported as a glob
+*   that assumes anchoring. If Antigravity matches such a word unanchored,
+*   the imported rule is narrower (`regex:rm` also matches `rmdir`).
+* - A plain target holding characters that are special in a glob is most
+*   likely the verbatim output of an older rulesync (`command(rm -rf *)`).
+*   Antigravity matches it literally, so it imports as a regex that matches a
+*   literal `*` word and is inert in the other tools it is exported to.
+*/
+function describeAntigravityCommandImportLoss(target) {
+	if (target.startsWith(REGEX_PREFIX)) {
+		const source = target.slice(6);
+		if (splitWords(source).some((word) => !isAnchoredWord(word)) && regexToGlob(source) !== void 0) return {
+			reason: "it has a regex word without `^...$` anchors and is imported as a glob that assumes Antigravity anchors every word, so the imported rule may be narrower than the original",
+			denyConsequence: "The imported deny may block less than it does in Antigravity."
+		};
+		return;
+	}
+	if (target !== "*" && PLAIN_TARGET_GLOB_CHARACTERS.test(target)) return {
+		reason: "it holds characters that are special in a glob (`*`, `?`, `[`, `{` or `\\`), which Antigravity matches literally (likely output of an older rulesync), so it is imported as a literal-match regex that no other tool enforces",
+		denyConsequence: "This deny is NOT enforced by the other tools it is generated for."
+	};
+}
+/**
+* Import one Antigravity `command` target as a canonical bash pattern, warning
+* when the result may differ from what Antigravity enforces. Shared by the
+* Antigravity CLI and IDE importers.
+*/
+function importAntigravityCommandTarget({ target, entry, decision, logger, toolLabel }) {
+	const pattern = fromAntigravityCommandTarget(target);
+	const loss = describeAntigravityCommandImportLoss(target);
+	if (loss !== void 0) {
+		const consequence = decision === "deny" ? ` ${loss.denyConsequence}` : "";
+		logger.warn(`${toolLabel} permissions: importing ${entry} as "${pattern}": ${loss.reason}.${consequence}`);
+	}
+	return pattern;
+}
 //#endregion
 //#region src/features/permissions/antigravity-targets.ts
 /**
@@ -51180,6 +51726,7 @@ const MATCH_ALL_PATH_GLOBS = /* @__PURE__ */ new Set([
 	"**/*"
 ]);
 const DIRECTORY_CONTENTS_SUFFIX = /\/\*\*(?:\/\*)?$/;
+const HOME_OR_VARIABLE_PATH = /^~(?:\/|$)|^\$[A-Za-z_]|\$\{[A-Za-z_]/;
 const HOSTNAME = /^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/;
 const DENY_HINTS = {
 	read_file: "deny a directory or file path instead",
@@ -51262,6 +51809,10 @@ function buildAntigravityPermissionEntry({ action, category, pattern, decision,
 		return;
 	}
 	if (result.note !== void 0 && decision !== "deny") logger.warn(`${toolLabel} permissions: ${rule}: ${result.note}.`);
+	if (PATH_ACTIONS.has(action) && HOME_OR_VARIABLE_PATH.test(result.target)) {
+		const consequence = decision === "deny" ? "this deny may block nothing" : `${toolLabel} may fall back to its default`;
+		logger.warn(`${toolLabel} permissions: ${rule}: \`~\` and environment variables may not be expanded in Antigravity path targets, so ${action}(${result.target}) may match nothing and ${consequence}; use an absolute path instead.`);
+	}
 	return result.target === "*" ? action : `${action}(${result.target})`;
 }
 //#endregion
@@ -51828,9 +52379,9 @@ function convertRulesyncToAntigravityCliPermissions({ config, logger }) {
 		}
 	}
 	return {
-		allow,
-		ask,
-		deny
+		allow: [...new Set(allow)],
+		ask: [...new Set(ask)],
+		deny: [...new Set(deny)]
 	};
 }
 /**
@@ -51842,7 +52393,13 @@ function convertAntigravityCliToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { toolName, pattern: target } = parsePermissionEntry$1(entry);
 			const canonical = toCanonicalToolName$9(toolName);
-			const pattern = toolName === "command" && target !== "*" ? fromAntigravityCommandTarget(target) : target;
+			const pattern = toolName === "command" ? importAntigravityCommandTarget({
+				target,
+				entry,
+				decision: action,
+				logger: moduleLogger$4,
+				toolLabel: "Antigravity CLI"
+			}) : target;
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -52046,9 +52603,9 @@ function convertRulesyncToAntigravityIdePermissions({ config, logger }) {
 		}
 	}
 	return {
-		allow,
-		ask,
-		deny
+		allow: [...new Set(allow)],
+		ask: [...new Set(ask)],
+		deny: [...new Set(deny)]
 	};
 }
 /**
@@ -52060,7 +52617,13 @@ function convertAntigravityIdeToRulesyncPermissions(params) {
 		for (const entry of entries) {
 			const { action: ideAction, pattern: target } = parsePermissionEntry(entry);
 			const canonical = toCanonicalCategory$2(ideAction);
-			const pattern = ideAction === "command" && target !== "*" ? fromAntigravityCommandTarget(target) : target;
+			const pattern = ideAction === "command" ? importAntigravityCommandTarget({
+				target,
+				entry,
+				decision: action,
+				logger: fallbackLogger,
+				toolLabel: "Antigravity IDE"
+			}) : target;
 			if (!permission[canonical]) permission[canonical] = {};
 			permission[canonical][pattern] = action;
 		}
@@ -54042,7 +54605,6 @@ const CLAUDECODE_UNHONORED_KEY_SOURCES = {
 	managedSourcesBehavior: "managed settings",
 	modelPricing: "managed settings",
 	parentSettingsBehavior: "managed settings",
-	permissionExplainerEnabled: "~/.claude.json",
 	pluginSuggestionMarketplaces: "managed settings",
 	pluginTrustMessage: "managed settings",
 	prStatusFooterEnabled: "~/.claude.json",
@@ -54051,10 +54613,24 @@ const CLAUDECODE_UNHONORED_KEY_SOURCES = {
 	sshHostAllowlist: "managed settings",
 	strictKnownMarketplaces: "managed settings",
 	strictPluginOnlyCustomization: "managed settings",
-	teammateDefaultModel: "~/.claude.json",
 	wslInheritsWindowsSettings: "managed settings"
 };
 /**
+* Top-level settings keys Claude Code has removed, with the version that
+* removed each. Current versions ignore them wherever they are set, so they
+* are dropped in **both** scopes, and the warning names the version so the
+* author knows to delete the key rather than move it to another file.
+*
+* Derived from the "Removed in" notes of the settings reference.
+*
+* @see https://code.claude.com/docs/en/settings-reference
+*/
+const CLAUDECODE_REMOVED_KEYS = {
+	permissionExplainerEnabled: "v2.1.257",
+	taskOutputMaxChars: "v2.1.277",
+	teammateDefaultModel: "v2.1.234"
+};
+/**
 * Top-level settings keys whose value Claude Code **executes**. The generic
 * passthrough refuses them outright rather than warning: `.rulesync/*` files
 * are shareable — `rulesync fetch` copies a third party's `permissions.jsonc`
@@ -54334,6 +54910,15 @@ const CLAUDECODE_SETTINGS_KEY_ALIASES = {
 	allowedMarketplaces: "strictKnownMarketplaces"
 };
 /**
+* The warning for a key that neither scope can honor — one Claude Code has
+* removed, or one read only from a file rulesync does not generate — or
+* `undefined` when the key may be written in at least one scope.
+*/
+function neverHonoredKeyWarning({ canonicalKey, shown, relativeFilePath }) {
+	if (Object.hasOwn(CLAUDECODE_REMOVED_KEYS, canonicalKey)) return `Claude Code permissions: '${shown}' was removed in Claude Code ${CLAUDECODE_REMOVED_KEYS[canonicalKey]} and has no effect on current versions, so it is not written to ${relativeFilePath}. Delete it from .rulesync/permissions.jsonc, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`;
+	if (Object.hasOwn(CLAUDECODE_UNHONORED_KEY_SOURCES, canonicalKey)) return `Claude Code permissions: '${shown}' is only honored in ${CLAUDECODE_UNHONORED_KEY_SOURCES[canonicalKey]}, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in that file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`;
+}
+/**
 * Copy of the authored top-level passthrough with the keys the target file
 * cannot honor removed, warning once per dropped key. Like
 * `stripSandboxPaths`, only the override copy is filtered — a value
@@ -54350,8 +54935,13 @@ function stripUnhonoredTopLevelKeys({ overrides, global, relativeFilePath, logge
 			logger?.warn(`Claude Code permissions: '${shown}' ${CLAUDECODE_COMMAND_EXECUTING_KEYS[canonicalKey]}, so rulesync does not write it to ${relativeFilePath}. A permissions file is shareable — 'rulesync fetch' copies one into a project — and is not where a reviewer looks for a command to run; author commands in .rulesync/hooks.jsonc, or set this key in ${relativeFilePath} by hand.`);
 			continue;
 		}
-		if (Object.hasOwn(CLAUDECODE_UNHONORED_KEY_SOURCES, canonicalKey)) {
-			logger?.warn(`Claude Code permissions: '${shown}' is only honored in ${CLAUDECODE_UNHONORED_KEY_SOURCES[canonicalKey]}, which rulesync does not generate, so it is not written to ${relativeFilePath}. Set it in that file by hand, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
+		const neverHonored = neverHonoredKeyWarning({
+			canonicalKey,
+			shown,
+			relativeFilePath
+		});
+		if (neverHonored !== void 0) {
+			logger?.warn(neverHonored);
 			continue;
 		}
 		if (!global && CLAUDECODE_USER_SCOPE_ONLY_KEYS.has(canonicalKey)) {
@@ -62042,8 +62632,10 @@ function mergeKimiCodeToolsSection({ existingContent, patch }) {
 * table. The gateway replaces the owned `permission` key wholesale and rulesync
 * only ever authors `rules`, so a hand-written sibling such as
 * `dangerous_command_guard = false` (Kimi Code 0.40.0) would otherwise be
-* deleted on every generate. Rulesync does not model these keys; they pass
-* through verbatim and `rules` always comes from the patch.
+* deleted on every generate. Unmodeled keys pass through verbatim; `rules`
+* always comes from the patch, and so does `dangerous_command_guard` when the
+* `kimi-code.dangerousCommandGuard` override sets it. Leaving the override out
+* keeps whatever the file already has.
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
 */
@@ -62286,14 +62878,18 @@ var KimiCodePermissions = class KimiCodePermissions extends ToolPermissions {
 	static fromRulesyncPermissions({ outputRoot, rulesyncPermissions, logger }) {
 		const config = rulesyncPermissions.getJson();
 		const defaultPermissionMode = config["kimi-code"]?.defaultPermissionMode;
+		const dangerousCommandGuard = config["kimi-code"]?.dangerousCommandGuard;
 		const tools = buildKimiCodeToolsSection(config["kimi-code"]?.tools);
 		const document = {
 			...defaultPermissionMode && { default_permission_mode: defaultPermissionMode },
 			...tools && { tools },
-			permission: { rules: canonicalToKimiCodeRules({
-				config,
-				logger
-			}) }
+			permission: {
+				...typeof dangerousCommandGuard === "boolean" && { dangerous_command_guard: dangerousCommandGuard },
+				rules: canonicalToKimiCodeRules({
+					config,
+					logger
+				})
+			}
 		};
 		let fileContent;
 		try {
@@ -62315,11 +62911,14 @@ var KimiCodePermissions = class KimiCodePermissions extends ToolPermissions {
 			format: "toml",
 			fileContent: this.getFileContent()
 		});
-		const { permission, nativeRules } = preserveKimiCodeRules((isRecord$1(config.permission) ? config.permission : {}).rules);
+		const permissionConfig = isRecord$1(config.permission) ? config.permission : {};
+		const { permission, nativeRules } = preserveKimiCodeRules(permissionConfig.rules);
 		const defaultPermissionMode = config.default_permission_mode;
+		const dangerousCommandGuard = permissionConfig.dangerous_command_guard;
 		const tools = buildKimiCodeToolsSection(config.tools);
 		const toolOverride = {
 			...defaultPermissionMode === "manual" || defaultPermissionMode === "yolo" || defaultPermissionMode === "auto" ? { defaultPermissionMode } : {},
+			...typeof dangerousCommandGuard === "boolean" && { dangerousCommandGuard },
 			...nativeRules.length > 0 && { rules: nativeRules },
 			...tools && { tools }
 		};
@@ -63201,6 +63800,7 @@ var MimocodePermissions = class extends OpencodePermissions {
 //#endregion
 //#region src/features/permissions/omp-permissions.ts
 const CATCH_ALL_PATTERN$4 = "*";
+const APPROVAL_MODE_KEY = "approvalMode";
 const ACTION_TO_OMP_APPROVAL = {
 	allow: "allow",
 	ask: "prompt",
@@ -63256,10 +63856,14 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *   commands, and its deny / ask also restrict every other tool's policy (a
 *   catch-all one at its own strictness, a pattern-specific one as `prompt`).
 *
+* The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
+* `write` or `yolo`); without it the key is left as it is in the file, and on
+* import a recognized value is read back into the override.
+*
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
-* (the keys rulesync manages) and `bash.patterns` are rewritten; sibling keys
-* such as `tools.approvalMode` and `bash.enabled` are kept, and the file is
-* never deleted.
+* (the keys rulesync manages), `bash.patterns` and an authored
+* `tools.approvalMode` are rewritten; sibling keys such as `bash.enabled` are
+* kept, and the file is never deleted.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/settings.md
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
@@ -63302,16 +63906,19 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 			fileContent: existingContent,
 			filePath
 		});
+		const config = rulesyncPermissions.getJson();
 		const { approval, patterns, floor } = convertRulesyncToOmp({
-			config: rulesyncPermissions.getJson(),
+			config,
 			logger
 		});
+		const approvalMode = config.omp?.approvalMode;
 		const existingTools = isRecord$1(existing.tools) ? existing.tools : {};
 		const nextApproval = {
 			...isRecord$1(existingTools.approval) ? Object.fromEntries(Object.entries(existingTools.approval).filter(([tool]) => !MANAGED_OMP_TOOLS.has(tool) && !Object.hasOwn(approval, tool)).map(([tool, value]) => [tool, raisedApproval(value, floor)])) : {},
 			...approval
 		};
 		const toolsSiblings = withoutKey(existingTools, "approval");
+		if (approvalMode !== void 0) toolsSiblings[APPROVAL_MODE_KEY] = approvalMode;
 		const nextTools = Object.keys(nextApproval).length > 0 ? {
 			...toolsSiblings,
 			approval: nextApproval
@@ -63567,7 +64174,14 @@ function convertOmpToRulesync(config) {
 		permission[category] = { [CATCH_ALL_PATTERN$4]: stricter(permission[category]?.[CATCH_ALL_PATTERN$4], action) };
 	}
 	if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
-	return { permission };
+	const approvalMode = tools[APPROVAL_MODE_KEY];
+	return {
+		permission,
+		...isOmpApprovalMode(approvalMode) && { omp: { approvalMode } }
+	};
+}
+function isOmpApprovalMode(value) {
+	return OMP_APPROVAL_MODES.some((mode) => mode === value);
 }
 //#endregion
 //#region src/features/permissions/pi-permissions.ts
@@ -64607,6 +65221,13 @@ const QWEN_OVERRIDE_SECURITY_KEYS = [
 	"allowPrivateNetworkHooks",
 	"allowedInsecureVoiceBaseUrls"
 ];
+const QWEN_OVERRIDE_SKILLS_KEYS = [
+	"disabled",
+	"defaultDisabled",
+	"enabled",
+	"disabledLevels"
+];
+const QWEN_OVERRIDE_GENERAL_KEYS = ["outputStyle"];
 /**
 * What each rule means for the two directions, so a key's behavior is declared
 * once beside its rule rather than spelled out at every branch.
@@ -64663,77 +65284,125 @@ const QWEN_SCOPE_RULES = {
 		globalNote: "This is not a key rulesync models, so it cannot say what Qwen Code does with it — and some settings in these groups are potent (`tools.discoveryCommand` and `tools.callCommand` are spawned as commands when Qwen Code starts). Check what it now says for every project on this machine."
 	}
 };
-const QWEN_OVERRIDE_GROUPS = [{
-	groupName: "tools",
-	overrideKeys: QWEN_OVERRIDE_TOOLS_KEYS,
-	scopedKeys: {
-		workflowsEnabled: { rule: "workspace-stripped" },
-		executionSandbox: {
-			rule: "workspace-stripped",
-			grants: () => true,
-			globalNote: "Qwen Code ignores this key in workspace settings so a repository cannot choose its own sandbox; in the global scope it sets the filesystem and network policy every tool command runs under for every project on this machine (a System value still replaces it, and Qwen Code needs a restart to pick it up)."
-		},
-		workflowNameOnly: {
-			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code lets a workspace only turn this key on: \`true\` restricts the model to named workflows in this repository, while any other value cannot lift a restriction set in user or system settings.`,
-			globalNote: "Qwen Code honors this key in the global scope for every project on this machine, and a repository can only add the restriction, never lift it, so this decides whether the model may run inline or path-based workflow scripts anywhere a workspace does not turn the restriction on itself."
-		},
-		approvalMode: {
-			rule: "global-machine-wide",
-			projectNote: autonomyProjectNote
-		},
-		autoAccept: {
-			rule: "global-machine-wide",
-			projectNote: autonomyProjectNote
-		},
-		sandbox: {
-			rule: "global-machine-wide",
-			projectNote: autonomyProjectNote
-		},
-		sandboxImage: {
-			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so a sandboxed run in this repository executes inside the named image — check that it is one you trust to run your code.`,
-			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope every sandboxed run on this machine executes inside the named image — check that it is one you trust to run your code."
-		},
-		disabled: {
-			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so a name that is gone is a tool the model can call again in this repository unless another scope still disables it.`,
-			globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the list in this file rather than adding to it, so in the global scope this decides which tools stay out of the registry for every project on this machine — dropping a name hands that tool back to the model unless another scope still disables it."
-		},
-		visible: {
-			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides which deferred tools are visible at startup in this repository.`,
-			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides which deferred tools are visible at startup for every project on this machine."
-		},
-		eager: {
-			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so in this repository every non-exempt eager-by-default tool it does not name is demoted to deferred — still callable, but only after \`tool_search\` loads it, and out of reach for the session if \`tool_search\` is not registered. A name added back is a tool whose schema is in the initial request again.`,
-			globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the list in this file rather than adding to it, so in the global scope it decides which eager-by-default tools keep their schemas in the initial request for every project on this machine — the ones it does not name are demoted to deferred, reachable only through `tool_search`, and out of reach entirely for a session where `tool_search` is not registered, while a name it adds back is a tool declared up front again."
-		},
-		listDirectory: {
-			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
-			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
-		},
-		todoWrite: {
+const QWEN_SCOPED_TOOLS_KEYS = {
+	workflowsEnabled: { rule: "workspace-stripped" },
+	executionSandbox: {
+		rule: "workspace-stripped",
+		grants: () => true,
+		globalNote: "Qwen Code ignores this key in workspace settings so a repository cannot choose its own sandbox; in the global scope it sets the filesystem and network policy every tool command runs under for every project on this machine (a System value still replaces it, and Qwen Code needs a restart to pick it up)."
+	},
+	workflowNameOnly: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}. Qwen Code lets a workspace only turn this key on: \`true\` restricts the model to named workflows in this repository, while any other value cannot lift a restriction set in user or system settings.`,
+		globalNote: "Qwen Code honors this key in the global scope for every project on this machine, and a repository can only add the restriction, never lift it, so this decides whether the model may run inline or path-based workflow scripts anywhere a workspace does not turn the restriction on itself."
+	},
+	approvalMode: {
+		rule: "global-machine-wide",
+		projectNote: autonomyProjectNote
+	},
+	autoAccept: {
+		rule: "global-machine-wide",
+		projectNote: autonomyProjectNote
+	},
+	sandbox: {
+		rule: "global-machine-wide",
+		projectNote: autonomyProjectNote
+	},
+	sandboxImage: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so a sandboxed run in this repository executes inside the named image — check that it is one you trust to run your code.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope every sandboxed run on this machine executes inside the named image — check that it is one you trust to run your code."
+	},
+	disabled: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so a name that is gone is a tool the model can call again in this repository unless another scope still disables it.`,
+		globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the list in this file rather than adding to it, so in the global scope this decides which tools stay out of the registry for every project on this machine — dropping a name hands that tool back to the model unless another scope still disables it."
+	},
+	visible: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides which deferred tools are visible at startup in this repository.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides which deferred tools are visible at startup for every project on this machine."
+	},
+	eager: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so in this repository every non-exempt eager-by-default tool it does not name is demoted to deferred — still callable, but only after \`tool_search\` loads it, and out of reach for the session if \`tool_search\` is not registered. A name added back is a tool whose schema is in the initial request again.`,
+		globalNote: "Qwen Code honors this key wherever it is written, and the override replaces the list in this file rather than adding to it, so in the global scope it decides which eager-by-default tools keep their schemas in the initial request for every project on this machine — the ones it does not name are demoted to deferred, reachable only through `tool_search`, and out of reach entirely for a session where `tool_search` is not registered, while a name it adds back is a tool declared up front again."
+	},
+	listDirectory: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`list_directory\` tool is registered in this repository.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `list_directory` tool is registered for every project on this machine."
+	},
+	todoWrite: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`todo_write\` tool is registered in this repository.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `todo_write` tool is registered for every project on this machine."
+	}
+};
+/**
+* The notes for a skills list that hides something. Qwen Code unions the list
+* across scopes, but the override replaces the one in the file it writes, so
+* the consequence worth naming is what dropping an entry hands back.
+*/
+function skillsHidingListNotes(hides) {
+	return {
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, replacing the list in that file rather than adding to it, so it decides which ${hides} in this repository — an entry that is gone is one the model can load again unless another scope still names it.`,
+		globalNote: `Qwen Code honors this key wherever it is written and unions it across scopes, but the override replaces the list in this file rather than adding to it, so in the global scope this decides which ${hides} for every project on this machine — an entry that is gone is one the model can load again unless another scope still names it.`
+	};
+}
+const QWEN_SCOPED_SKILLS_KEYS = {
+	disabled: {
+		rule: "global-machine-wide",
+		...skillsHidingListNotes("skills are hidden")
+	},
+	defaultDisabled: {
+		rule: "global-machine-wide",
+		...skillsHidingListNotes("skills start disabled until `skills.enabled` opts into them")
+	},
+	disabledLevels: {
+		rule: "global-machine-wide",
+		...skillsHidingListNotes("skill discovery levels (`project`, `user`, `extension`, `bundled`) are skipped")
+	},
+	enabled: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so in this repository it opts the model into the skills it names that \`skills.defaultDisabled\` would otherwise keep off in any scope (it cannot override \`skills.disabled\` or a skipped \`skills.disabledLevels\` level). Check it if the override arrived with a repository you cloned.`,
+		globalNote: "Qwen Code honors this key wherever it is written and unions it across scopes, so in the global scope it opts the model into the skills it names that `skills.defaultDisabled` would otherwise keep off, for every project on this machine (it cannot override `skills.disabled` or a skipped `skills.disabledLevels` level)."
+	}
+};
+const QWEN_OVERRIDE_GROUPS = [
+	{
+		groupName: "tools",
+		overrideKeys: QWEN_OVERRIDE_TOOLS_KEYS,
+		scopedKeys: QWEN_SCOPED_TOOLS_KEYS
+	},
+	{
+		groupName: "security",
+		overrideKeys: QWEN_OVERRIDE_SECURITY_KEYS,
+		scopedKeys: {
+			allowPrivateNetworkHooks: { rule: "workspace-stripped" },
+			allowedInsecureVoiceBaseUrls: {
+				rule: "workspace-stripped",
+				grants: isNonEmptyArray
+			},
+			allowedHttpHookUrls: { rule: "workspace-non-overriding" },
+			folderTrust: { rule: "user-scope-trust-check" }
+		}
+	},
+	{
+		groupName: "skills",
+		overrideKeys: QWEN_OVERRIDE_SKILLS_KEYS,
+		scopedKeys: QWEN_SCOPED_SKILLS_KEYS
+	},
+	{
+		groupName: "general",
+		overrideKeys: QWEN_OVERRIDE_GENERAL_KEYS,
+		scopedKeys: { outputStyle: {
 			rule: "global-machine-wide",
-			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`todo_write\` tool is registered in this repository.`,
-			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `todo_write` tool is registered for every project on this machine."
-		}
-	}
-}, {
-	groupName: "security",
-	overrideKeys: QWEN_OVERRIDE_SECURITY_KEYS,
-	scopedKeys: {
-		allowPrivateNetworkHooks: { rule: "workspace-stripped" },
-		allowedInsecureVoiceBaseUrls: {
-			rule: "workspace-stripped",
-			grants: isNonEmptyArray
-		},
-		allowedHttpHookUrls: { rule: "workspace-non-overriding" },
-		folderTrust: { rule: "user-scope-trust-check" }
+			projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it picks the output style for this repository. A custom style adds the instructions in its style file to the system prompt and can drop the built-in coding guidance (\`keep-coding-instructions\`) — a project style file is read only when the workspace is trusted. Check it if the override arrived with a repository you cloned.`,
+			globalNote: "Qwen Code honors this key wherever it is written, so in the global scope it picks the output style for every project on this machine that does not choose its own. A custom style adds the instructions in its style file to the system prompt and can drop the built-in coding guidance (`keep-coding-instructions`)."
+		} }
 	}
-}];
+];
 const QWEN_OVERRIDE_PERMISSIONS_KEYS = ["autoMode"];
 const QWEN_SCOPED_PERMISSIONS_KEYS = { autoMode: {
 	rule: "global-machine-wide",
@@ -64864,7 +65533,7 @@ function scopeOverrideGroup(overrideGroup, { groupName, scopedKeys, existingGrou
 	return scoped;
 }
 /**
-* Build the `tools`/`security` patch groups contributed by the `qwencode`
+* Build the `tools`/`security`/`skills`/`general` patch groups contributed by the `qwencode`
 * override. Each group is shallow-merged over what `settings.json` already has,
 * after the scope gate has handled the keys Qwen Code honors in one scope only.
 */
@@ -65033,7 +65702,9 @@ var QwencodePermissions = class QwencodePermissions extends ToolPermissions {
 		});
 		const overrideGroups = {
 			tools: pickQwenOverrideKeys(settings.tools, QWEN_OVERRIDE_TOOLS_KEYS),
-			security: pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS)
+			security: pickQwenOverrideKeys(settings.security, QWEN_OVERRIDE_SECURITY_KEYS),
+			skills: pickQwenOverrideKeys(settings.skills, QWEN_OVERRIDE_SKILLS_KEYS),
+			general: pickQwenOverrideKeys(settings.general, QWEN_OVERRIDE_GENERAL_KEYS)
 		};
 		if (!this.global) warnAboutImportedScopedKeys(overrideGroups);
 		const overridePermissions = pickQwenOverrideKeys(settings.permissions, QWEN_OVERRIDE_PERMISSIONS_KEYS);
@@ -65336,6 +66007,37 @@ function applyAllowDynamicBash({ permissions, authored }) {
 		reason: "lets an Allow fallback, Auto included, run the nested and indirect Bash that otherwise needs a human or an exact-literal grant — command and process substitution, a dynamic command name, 'eval', 'source', 'sh -c' and their kind"
 	}];
 }
+/** The writer fallbacks `[permissions] mode` accepts. */
+const REASONIX_PERMISSION_MODES = /* @__PURE__ */ new Set([
+	"ask",
+	"allow",
+	"deny"
+]);
+/**
+* Writes the override's `mode` into `[permissions]`. Reasonix honors the key
+* only in the user config and ignores a project value as user-scope only, so a
+* project-scope generate skips it with a warning and leaves whatever the file
+* had. A global `allow` is reported when it is newly written: it lets every
+* writer call that no rule matches run without a prompt.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+*/
+function applyPermissionsMode({ permissions, authored, global, relativeFilePath, logger }) {
+	if (authored === void 0) return [];
+	if (!global) {
+		logger?.warn(`Reasonix permissions: skipping reasonix.mode = ${quoteValueForWarning(authored)} for the project-scoped ${relativeFilePath}; Reasonix honors [permissions] mode only in the user config and ignores a project value, so generate it with --global instead.`);
+		return [];
+	}
+	const previous = permissions.mode;
+	permissions.mode = authored;
+	const normalize = (value) => typeof value === "string" ? value.trim().toLowerCase() : void 0;
+	const mode = normalize(authored);
+	if (mode === "ask" || mode === "deny" || normalize(previous) === mode) return [];
+	return [{
+		label: "permissions.mode",
+		reason: "lets every writer call that no rule matches run without a prompt"
+	}];
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -65386,7 +66088,8 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
-			validate
+			validate,
+			global
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
@@ -65441,6 +66144,13 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			permissions: mergedPermissions,
 			authored: override?.allowDynamicBash
 		});
+		trustAffecting.push(...applyPermissionsMode({
+			permissions: mergedPermissions,
+			authored: override?.mode,
+			global,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		}));
 		const patch = { permissions: mergedPermissions };
 		if (override?.sandbox !== void 0) {
 			const mergedSandbox = {
@@ -65482,7 +66192,8 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 				patch,
 				filePath
 			}),
-			validate
+			validate,
+			global
 		});
 	}
 	toRulesyncPermissions() {
@@ -65507,6 +66218,7 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const reasonixOverride = {};
 		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
 		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
+		if (this.global && typeof permissions.mode === "string" && REASONIX_PERMISSION_MODES.has(permissions.mode)) reasonixOverride.mode = permissions.mode;
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;
@@ -69226,6 +69938,9 @@ const WARP_OVERRIDE_KEYS = [
 	"agent_mode_execute_readonly_commands"
 ];
 const WARP_EXECUTION_PROFILE_OVERRIDE_KEY = "execution_profile";
+const WARP_AUTO_APPROVE_BYPASS_KEY = "auto_approve_bypasses_command_denylist";
+const WARP_AGENT_KEY = "warp_agent";
+const WARP_AGENT_OTHER_KEY = "other";
 const WARP_EXECUTION_PROFILE_KEYS = [
 	"read_files",
 	"apply_code_diffs",
@@ -69374,7 +70089,7 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		const override = config.warp;
 		const executionProfileOverride = isRecord$1(override) && isRecord$1(override["execution_profile"]) ? override[WARP_EXECUTION_PROFILE_OVERRIDE_KEY] : void 0;
 		if (isRecord$1(override)) {
-			const { [WARP_EXECUTION_PROFILE_OVERRIDE_KEY]: _executionProfile, ...legacyOverride } = override;
+			const { [WARP_EXECUTION_PROFILE_OVERRIDE_KEY]: _executionProfile, [WARP_AUTO_APPROVE_BYPASS_KEY]: _autoApproveBypass, ...legacyOverride } = override;
 			Object.assign(profiles, legacyOverride);
 		}
 		const mergedAllow = uniq(allow.toSorted());
@@ -69384,9 +70099,15 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		if (mergedDeny.length > 0) profiles[DENYLIST_KEY] = mergedDeny;
 		else delete profiles[DENYLIST_KEY];
 		agents.profiles = profiles;
+		applyAutoApproveBypassOverride({
+			agents,
+			override
+		});
 		warnAboutDenylistReplacement({
 			toolLabel: "Warp",
+			overrideKey: "warp",
 			denyCount: mergedDeny.length,
+			autoApproveBypassesDenylist: readAutoApproveBypass(agents),
 			logger
 		});
 		mergeIntoDefaultExecutionProfile({
@@ -69425,6 +70146,8 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
 		const executionProfileOverride = defaultProfile ? liftExecutionProfileOverride(defaultProfile) : void 0;
 		if (executionProfileOverride) warpOverride[WARP_EXECUTION_PROFILE_OVERRIDE_KEY] = executionProfileOverride;
+		const autoApproveBypass = readAutoApproveBypass(agents);
+		if (autoApproveBypass !== void 0) warpOverride[WARP_AUTO_APPROVE_BYPASS_KEY] = autoApproveBypass;
 		const result = { ...config };
 		if (Object.keys(warpOverride).length > 0) result.warp = warpOverride;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
@@ -69448,12 +70171,40 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 };
 /**
 * Writing `command_denylist` at all replaces Warp's built-in default denylist,
-* so any non-empty list rulesync writes deserves a heads-up.
+* so any non-empty list rulesync writes deserves a heads-up. Unless
+* `auto_approve_bypasses_command_denylist` is `false`, auto-approve also runs
+* commands that match the list, so the warning says so.
 * https://docs.warp.dev/agents/cli/permissions-and-profiles/
 */
-function warnAboutDenylistReplacement({ toolLabel, denyCount, logger }) {
+function warnAboutDenylistReplacement({ toolLabel, overrideKey, denyCount, autoApproveBypassesDenylist, logger }) {
 	if (denyCount === 0 || !logger) return;
-	logger.warn(`${toolLabel}'s command_denylist replaces its built-in default denylist, which covers rm, curl, wget, eval, ssh, shells, and other risky command patterns. The ${denyCount} deny rule(s) from .rulesync/permissions.jsonc are now the whole denylist — add equivalents for the built-in patterns you want to keep.`);
+	const bypassNote = autoApproveBypassesDenylist === false ? "" : ` Auto-approve also runs commands that match the denylist unless ${overrideKey}.${WARP_AUTO_APPROVE_BYPASS_KEY} is set to false.`;
+	logger.warn(`${toolLabel}'s command_denylist replaces its built-in default denylist, which covers rm, curl, wget, eval, ssh, shells, and other risky command patterns. The ${denyCount} deny rule(s) from .rulesync/permissions.jsonc are now the whole denylist — add equivalents for the built-in patterns you want to keep.${bypassNote}`);
+}
+/**
+* Write the override's `auto_approve_bypasses_command_denylist` into
+* `[agents.warp_agent.other]`, keeping every sibling key of `agents.warp_agent`
+* and of its `other` table. Nothing is written when the override omits it.
+*/
+function applyAutoApproveBypassOverride({ agents, override }) {
+	if (!isRecord$1(override)) return;
+	const value = override[WARP_AUTO_APPROVE_BYPASS_KEY];
+	if (typeof value !== "boolean") return;
+	const warpAgent = isRecord$1(agents[WARP_AGENT_KEY]) ? { ...agents[WARP_AGENT_KEY] } : {};
+	const other = isRecord$1(warpAgent[WARP_AGENT_OTHER_KEY]) ? { ...warpAgent[WARP_AGENT_OTHER_KEY] } : {};
+	other[WARP_AUTO_APPROVE_BYPASS_KEY] = value;
+	warpAgent[WARP_AGENT_OTHER_KEY] = other;
+	agents[WARP_AGENT_KEY] = warpAgent;
+}
+/**
+* Read `[agents.warp_agent.other] auto_approve_bypasses_command_denylist`, or
+* `undefined` when it is unset (Warp then defaults to `true`).
+*/
+function readAutoApproveBypass(agents) {
+	const warpAgent = agents[WARP_AGENT_KEY];
+	const other = isRecord$1(warpAgent) ? warpAgent[WARP_AGENT_OTHER_KEY] : void 0;
+	const value = isRecord$1(other) ? other[WARP_AUTO_APPROVE_BYPASS_KEY] : void 0;
+	return typeof value === "boolean" ? value : void 0;
 }
 /**
 * On migrated installs the legacy `[agents.profiles]` keys are inert: runtime
@@ -69807,6 +70558,9 @@ const WARPCLI_GLOBAL_ONLY_MESSAGE = "Warp Agent CLI permissions are global-only;
 *   (`read_files`, `apply_code_diffs`, `run_agents`, ...), merged first so the
 *   rulesync-owned command lists always win.
 *
+* The `warpcli.auto_approve_bypasses_command_denylist` override is written to
+* the sibling `[agents.warp_agent.other]` table.
+*
 * Unlike the `warp` target, the CLI never read the app's legacy
 * `[agents.profiles]` keys, so none are written, and there is no settings
 * migration to wait for: the CLI's settings file "is created the first time you
@@ -69873,11 +70627,6 @@ var WarpcliPermissions = class WarpcliPermissions extends ToolPermissions {
 		});
 		const mergedAllow = uniq(allow.toSorted());
 		const mergedDeny = uniq(deny.toSorted());
-		warnAboutDenylistReplacement({
-			toolLabel: "Warp Agent CLI",
-			denyCount: mergedDeny.length,
-			logger
-		});
 		const override = config.warpcli;
 		const executionProfileOverride = isRecord$1(override) && isRecord$1(override["execution_profile"]) ? override[WARP_EXECUTION_PROFILE_OVERRIDE_KEY] : void 0;
 		const agents = isRecord$1(settings.agents) ? { ...settings.agents } : {};
@@ -69887,7 +70636,18 @@ var WarpcliPermissions = class WarpcliPermissions extends ToolPermissions {
 			mergedDeny,
 			executionProfileOverride
 		});
+		applyAutoApproveBypassOverride({
+			agents,
+			override
+		});
 		settings.agents = agents;
+		warnAboutDenylistReplacement({
+			toolLabel: "Warp Agent CLI",
+			overrideKey: "warpcli",
+			denyCount: mergedDeny.length,
+			autoApproveBypassesDenylist: readAutoApproveBypass(agents),
+			logger
+		});
 		return new WarpcliPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -69914,8 +70674,12 @@ var WarpcliPermissions = class WarpcliPermissions extends ToolPermissions {
 			deny: isStringArray$2(denylist) ? denylist : []
 		});
 		const executionProfileOverride = liftExecutionProfileOverride(defaultProfile);
+		const warpcliOverride = {};
+		if (executionProfileOverride) warpcliOverride[WARP_EXECUTION_PROFILE_OVERRIDE_KEY] = executionProfileOverride;
+		const autoApproveBypass = readAutoApproveBypass(agents);
+		if (autoApproveBypass !== void 0) warpcliOverride[WARP_AUTO_APPROVE_BYPASS_KEY] = autoApproveBypass;
 		const result = { ...config };
-		if (executionProfileOverride) result.warpcli = { [WARP_EXECUTION_PROFILE_OVERRIDE_KEY]: executionProfileOverride };
+		if (Object.keys(warpcliOverride).length > 0) result.warpcli = warpcliOverride;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
@@ -81989,9 +82753,8 @@ var CodebuddySubagent = class CodebuddySubagent extends ToolSubagent {
 * Keys of the rulesync `codewhale` section copied into the profile. Codewhale
 * parses agent profiles with `deny_unknown_fields`, so an unknown key would
 * make the whole profile fail to load; anything else in the section is dropped
-* with a warning. `[tools]` and `[permissions]` are left out on purpose:
-* Codewhale only accepts values there that narrow the defaults, and rejects a
-* profile that tries to widen them.
+* with a warning. The `[tools]` and `[permissions]` tables are handled
+* separately (see `CODEWHALE_NARROWING_TABLES`).
 */
 const CODEWHALE_SECTION_KEYS = [
 	"role_hint",
@@ -82012,6 +82775,48 @@ const CODEWHALE_SECTION_KEY_ALIASES = {
 	reasoning_effort: ["thinking", "reasoning"]
 };
 const CODEWHALE_SECTION_ALIAS_TO_KEY = new Map(Object.entries(CODEWHALE_SECTION_KEY_ALIASES).flatMap(([key, aliases]) => (aliases ?? []).map((alias) => [alias, key])));
+/**
+* The `[tools]` and `[permissions]` tables of an agent profile, with the only
+* values Codewhale accepts in each key. Codewhale rejects a profile that tries
+* to widen access through them (`reject_permission_expansion` in
+* `fleet/profile.rs`), and both tables deny unknown fields, so any other key
+* or value is dropped with a warning.
+*/
+const CODEWHALE_NARROWING_TABLES = {
+	tools: { posture: (value) => typeof value === "string" && [
+		"read-only",
+		"readonly",
+		"read_only"
+	].includes(value) },
+	permissions: {
+		allow_shell: (value) => value === false,
+		trust: (value) => value === false,
+		approval_required: (value) => value === true
+	}
+};
+/**
+* Keeps the narrowing-only entries of a `[tools]` / `[permissions]` table and
+* reports every other entry by its dotted path. A non-table value is dropped
+* as a whole.
+*/
+function filterNarrowingTable(tableName, value) {
+	const allowed = CODEWHALE_NARROWING_TABLES[tableName] ?? {};
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {
+		kept: void 0,
+		dropped: [tableName]
+	};
+	const kept = {};
+	const dropped = [];
+	for (const [key, entry] of Object.entries(value)) {
+		const normalized = typeof entry === "string" ? entry.trim() : entry;
+		if (Object.hasOwn(allowed, key) && allowed[key]?.(normalized)) kept[key] = normalized;
+		else dropped.push(`${tableName}.${key}`);
+	}
+	return {
+		kept: Object.keys(kept).length > 0 ? kept : void 0,
+		dropped
+	};
+}
 const CodewhaleSubagentTomlSchema = z.looseObject({
 	id: z.optional(z.string()),
 	name: z.optional(z.string()),
@@ -82038,7 +82843,8 @@ function stringifyCodewhaleSubagentToml(fields, instructions) {
 *
 * Generation writes `id` (the file stem), `display_name` (the rulesync name),
 * `description`, and the body as `[instructions] text`, plus the allowlisted
-* keys of the rulesync `codewhale` section.
+* keys of the rulesync `codewhale` section and its narrowing-only `[tools]` /
+* `[permissions]` entries.
 *
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/SUBAGENTS.md
 * @see https://github.com/Hmbown/Codewhale/blob/main/crates/tui/src/fleet/profile.rs
@@ -82073,6 +82879,10 @@ var CodewhaleSubagent = class CodewhaleSubagent extends ToolSubagent {
 			const spelling = [key, ...CODEWHALE_SECTION_KEY_ALIASES[key] ?? []].find((candidate) => record[candidate] !== void 0);
 			if (spelling !== void 0) codewhaleSection[key] = record[spelling];
 		}
+		for (const tableName of Object.keys(CODEWHALE_NARROWING_TABLES)) if (record[tableName] !== void 0) {
+			const { kept } = filterNarrowingTable(tableName, record[tableName]);
+			if (kept !== void 0) codewhaleSection[tableName] = kept;
+		}
 		return new RulesyncSubagent({
 			outputRoot: ".",
 			frontmatter: {
@@ -82095,6 +82905,12 @@ var CodewhaleSubagent = class CodewhaleSubagent extends ToolSubagent {
 		const droppedKeys = [];
 		const sectionSpellings = /* @__PURE__ */ new Map();
 		for (const [rawKey, value] of Object.entries(rawSection)) {
+			if (Object.hasOwn(CODEWHALE_NARROWING_TABLES, rawKey)) {
+				const { kept, dropped } = filterNarrowingTable(rawKey, value);
+				if (kept !== void 0) sectionFields[rawKey] = kept;
+				droppedKeys.push(...dropped);
+				continue;
+			}
 			const key = CODEWHALE_SECTION_ALIAS_TO_KEY.get(rawKey) ?? rawKey;
 			if (CODEWHALE_SECTION_KEYS.includes(key) && typeof value === "string") {
 				if (key === rawKey || sectionFields[key] === void 0) {
@@ -82104,7 +82920,7 @@ var CodewhaleSubagent = class CodewhaleSubagent extends ToolSubagent {
 				} else droppedKeys.push(rawKey);
 			} else droppedKeys.push(rawKey);
 		}
-		if (droppedKeys.length > 0) logger?.warn(`Dropping unsupported or duplicate codewhale subagent keys in ${rulesyncSubagent.getRelativeFilePath()}: ${droppedKeys.join(", ")}. Codewhale rejects agent profiles with unknown fields, non-string values there, or two spellings of one key; supported keys are ${CODEWHALE_SECTION_KEYS.join(", ")}, each a string (the canonical spelling wins over an alias).`);
+		if (droppedKeys.length > 0) logger?.warn(`Dropping unsupported or duplicate codewhale subagent keys in ${rulesyncSubagent.getRelativeFilePath()}: ${droppedKeys.join(", ")}. Codewhale rejects agent profiles with unknown fields, non-string values there, [tools] / [permissions] values that would widen access, or two spellings of one key; supported keys are ${CODEWHALE_SECTION_KEYS.join(", ")}, each a string (the canonical spelling wins over an alias), plus the narrowing-only tools.posture = "read-only" and permissions.allow_shell = false, permissions.trust = false, permissions.approval_required = true.`);
 		const body = stringifyCodewhaleSubagentToml({
 			id: toProfileId(relativeFilePath),
 			display_name: frontmatter.name,
@@ -88601,6 +89417,99 @@ const AntigravityRuleFrontmatterSchema = z.looseObject({
 function toGlobalRuleFileName(relativeFilePath) {
 	return relativeFilePath.split(/[\\/]/).join("-");
 }
+/** The project rules directory both Antigravity targets share, as a POSIX path. */
+const PROJECT_RULES_DIR = `${ANTIGRAVITY_IDE_AGENTS_DIR}/rules`;
+/**
+* The subproject directory a rule is scoped to, or `undefined` when it goes to
+* the project-root `.agents/rules/`. Antigravity reads a `.agents/rules/`
+* directory in any subdirectory and loads it for files under that directory,
+* so a non-root rule carrying `agentsmd.subprojectPath` is written there. Project
+* scope only: there is no workspace tree to nest under in global scope.
+*
+* @see https://antigravity.google/docs/rules
+*/
+function resolveAntigravitySubprojectPath({ rulesyncRule, global }) {
+	const { root, agentsmd } = rulesyncRule.getFrontmatter();
+	const subprojectPath = !global && root !== true ? agentsmd?.subprojectPath : void 0;
+	return subprojectPath && ![
+		"",
+		".",
+		"./"
+	].includes(subprojectPath) ? subprojectPath : void 0;
+}
+/**
+* File name of a rule in a subproject's `.agents/rules/`. Antigravity reads
+* only the direct children of a rules directory, so a nested rulesync rule
+* (`frontend/style.md`) is flattened (`frontend-style.md`), and the name keeps
+* its case so the IDE and the CLI write the same file and an imported
+* `codeStyle.md` is written back to the same place.
+*/
+function toNestedRuleFileName(relativeFilePath) {
+	return toGlobalRuleFileName(relativeFilePath);
+}
+/** The `.agents/rules/` directory of a subproject. */
+function toAntigravityNestedRulesDirPath(subprojectPath) {
+	return join(subprojectPath, ANTIGRAVITY_IDE_AGENTS_DIR, "rules");
+}
+/**
+* Split a nested rule directory such as `packages/api/.agents/rules/sub` into
+* the subproject (`packages/api`) and the folder inside its rules directory
+* (`sub`). Returns `undefined` for the project-root `.agents/rules/`, for a
+* path with no `.agents/rules` segment, and for one under a hidden directory —
+* another tool's output or a worktree, not a subproject.
+*/
+function extractAntigravitySubprojectPath(relativeDirPath) {
+	const segments = toPosixPath(relativeDirPath).split("/");
+	const index = segments.findIndex((segment, i) => segment === ".agents" && segments[i + 1] === "rules");
+	if (index <= 0) return;
+	const subprojectSegments = segments.slice(0, index);
+	if (subprojectSegments.some((segment) => segment === "" || segment.startsWith("."))) return;
+	return {
+		subprojectPath: subprojectSegments.join("/"),
+		innerDirPath: segments.slice(index + 2).join("/")
+	};
+}
+/**
+* The `.agents/rules/` folders of project subdirectories. Only their direct
+* `.md` children are read, because Antigravity ignores files nested in
+* subfolders of a rules directory. The shared nested
+* scan ignores every hidden directory, which would skip `.agents` itself, so
+* only a `.agents/rules/` below another hidden directory is ignored here
+* (`extractAntigravitySubprojectPath` rejects one again on import). Import-only,
+* like every other nested scan: these files sit outside the rulesync-owned root
+* `.agents/rules/`, so `--delete` never sweeps them.
+*/
+function getAntigravityNestedFilePatterns() {
+	return {
+		include: [`**/${PROJECT_RULES_DIR}/*.md`],
+		ignore: [
+			`${PROJECT_RULES_DIR}/**`,
+			`**/.*/**/${PROJECT_RULES_DIR}/**`,
+			...NESTED_SCAN_EXCLUDED_DIRS_ANY_DEPTH.map((dir) => `**/${dir}/**`),
+			...NESTED_SCAN_EXCLUDED_ROOT_DIRS.map((dir) => `${dir}/**`)
+		],
+		ownedDirPath: PROJECT_RULES_DIR
+	};
+}
+/**
+* Resolve where a non-root project rule file read from disk lives. A file
+* discovered by `getNestedFilePatterns` arrives as its own directory plus its
+* basename; it is re-split into the subproject's rules directory and the path
+* inside it, matching how the root `.agents/rules/` is read.
+*/
+function resolveAntigravityNonRootFile({ relativeDirPath, relativeFilePath, defaultDirPath }) {
+	const nested = relativeDirPath === void 0 ? void 0 : extractAntigravitySubprojectPath(relativeDirPath);
+	if (nested === void 0) return {
+		relativeDirPath: defaultDirPath,
+		relativeFilePath
+	};
+	return {
+		relativeDirPath: toAntigravityNestedRulesDirPath(nested.subprojectPath),
+		relativeFilePath: join(nested.innerDirPath, relativeFilePath)
+	};
+}
+/** The targets a nested rule is imported with: the two that read the shared tree. */
+const ANTIGRAVITY_NESTED_RULE_TARGETS = ["antigravity-ide", "antigravity-cli"];
 /**
 * Converts a comma-separated globs string or array to an array of globs.
 * @param globs - Comma-separated globs string (e.g., "*.ts,*.js") or array of globs
@@ -88788,12 +89697,17 @@ var AntigravityCliRule = class AntigravityCliRule extends ToolRule {
 			});
 		}
 		if (!paths.nonRoot) throw new Error(`nonRoot path is not set for ${relativeFilePath}`);
-		const relativePath = join(paths.nonRoot.relativeDirPath, relativeFilePath);
+		const nonRoot = resolveAntigravityNonRootFile({
+			relativeDirPath,
+			relativeFilePath,
+			defaultDirPath: paths.nonRoot.relativeDirPath
+		});
+		const relativePath = join(nonRoot.relativeDirPath, nonRoot.relativeFilePath);
 		const fileContent = await readFileContent(join(outputRoot, relativePath));
 		const rule = new AntigravityCliRule({
 			outputRoot,
-			relativeDirPath: paths.nonRoot.relativeDirPath,
-			relativeFilePath,
+			relativeDirPath: nonRoot.relativeDirPath,
+			relativeFilePath: nonRoot.relativeFilePath,
 			fileContent,
 			validate,
 			root: false,
@@ -88825,11 +89739,21 @@ var AntigravityCliRule = class AntigravityCliRule extends ToolRule {
 		if (!strategy) throw new Error(`No strategy found for trigger: ${storedTrigger}`);
 		const frontmatter = strategy.generateFrontmatter(normalizeStoredAntigravity(storedAntigravity), rulesyncFrontmatter);
 		const fileContent = stringifyFrontmatter(rulesyncRule.getBody(), frontmatter);
-		if (!global) return new AntigravityCliRule({
-			...params,
-			fileContent,
-			global
-		});
+		if (!global) {
+			const subprojectPath = resolveAntigravitySubprojectPath({
+				rulesyncRule,
+				global
+			});
+			return new AntigravityCliRule({
+				...params,
+				...subprojectPath !== void 0 && {
+					relativeDirPath: toAntigravityNestedRulesDirPath(subprojectPath),
+					relativeFilePath: toNestedRuleFileName(params.relativeFilePath)
+				},
+				fileContent,
+				global
+			});
+		}
 		return new AntigravityCliRule({
 			...params,
 			relativeFilePath: toGlobalRuleFileName(params.relativeFilePath),
@@ -88845,22 +89769,32 @@ var AntigravityCliRule = class AntigravityCliRule extends ToolRule {
 			globs: [],
 			antigravity: frontmatter
 		};
+		const subprojectPath = this.global ? void 0 : extractAntigravitySubprojectPath(this.getRelativeDirPath())?.subprojectPath;
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
 			relativeFilePath: this.getRelativeFilePath(),
 			frontmatter: {
 				root: false,
-				targets: ["*"],
+				targets: subprojectPath === void 0 ? ["*"] : [...ANTIGRAVITY_NESTED_RULE_TARGETS],
 				...rulesyncData,
 				antigravity: {
 					...rulesyncData.antigravity,
 					globs: frontmatter.globs ? parseGlobsString$1(frontmatter.globs) : void 0
-				}
+				},
+				...subprojectPath !== void 0 && { agentsmd: { subprojectPath } }
 			},
 			body
 		});
 	}
+	/**
+	* The `.agents/rules/` folders of project subdirectories, imported back as
+	* directory-scoped rules.
+	* @see https://antigravity.google/docs/rules
+	*/
+	static getNestedFilePatterns() {
+		return getAntigravityNestedFilePatterns();
+	}
 	validate() {
 		if (this.root) return {
 			success: true,
@@ -88990,8 +89924,15 @@ var AntigravityIdeRule = class extends ToolRule {
 				global
 			});
 		}
-		const nonRootDirPath = paths.nonRoot.relativeDirPath;
-		const filePath = join(outputRoot, nonRootDirPath, relativeFilePath);
+		const nonRoot = this.supportsSubprojectRules() ? resolveAntigravityNonRootFile({
+			relativeDirPath,
+			relativeFilePath,
+			defaultDirPath: paths.nonRoot.relativeDirPath
+		}) : {
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath
+		};
+		const filePath = join(outputRoot, nonRoot.relativeDirPath, nonRoot.relativeFilePath);
 		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
 		let parsedFrontmatter;
 		if (validate) {
@@ -89001,8 +89942,8 @@ var AntigravityIdeRule = class extends ToolRule {
 		} else parsedFrontmatter = frontmatter;
 		return new this({
 			outputRoot,
-			relativeDirPath: nonRootDirPath,
-			relativeFilePath,
+			relativeDirPath: nonRoot.relativeDirPath,
+			relativeFilePath: nonRoot.relativeFilePath,
 			body,
 			frontmatter: parsedFrontmatter,
 			validate,
@@ -89010,6 +89951,25 @@ var AntigravityIdeRule = class extends ToolRule {
 			global
 		});
 	}
+	/**
+	* Whether a rule scoped to a subproject goes to that subproject's own
+	* `.agents/rules/`. A subclass that writes somewhere other than a project
+	* tree (the plugin bundle) turns it off.
+	*/
+	static supportsSubprojectRules() {
+		return true;
+	}
+	/**
+	* The `.agents/rules/` folders of project subdirectories, imported back as
+	* directory-scoped rules.
+	* @see https://antigravity.google/docs/rules
+	*/
+	static getNestedFilePatterns() {
+		return this.supportsSubprojectRules() ? getAntigravityNestedFilePatterns() : {
+			include: [],
+			ignore: []
+		};
+	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		if (rulesyncRule.getFrontmatter().root) {
@@ -89032,10 +89992,14 @@ var AntigravityIdeRule = class extends ToolRule {
 		const strategy = STRATEGIES$1.find((s) => s.canHandle(storedTrigger));
 		if (!strategy) throw new Error(`No strategy found for trigger: ${storedTrigger}`);
 		const frontmatter = strategy.generateFrontmatter(normalized, rulesyncFrontmatter);
-		const relativeFilePath = global ? toGlobalRuleFileName(rulesyncRule.getRelativeFilePath()) : toKebabCaseFilename(rulesyncRule.getRelativeFilePath());
+		const subprojectPath = this.supportsSubprojectRules() ? resolveAntigravitySubprojectPath({
+			rulesyncRule,
+			global
+		}) : void 0;
+		const relativeFilePath = global || subprojectPath !== void 0 ? toNestedRuleFileName(rulesyncRule.getRelativeFilePath()) : toKebabCaseFilename(rulesyncRule.getRelativeFilePath());
 		return new this({
 			outputRoot,
-			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeDirPath: subprojectPath === void 0 ? paths.nonRoot.relativeDirPath : toAntigravityNestedRulesDirPath(subprojectPath),
 			relativeFilePath,
 			frontmatter,
 			body: rulesyncRule.getBody(),
@@ -89056,15 +90020,17 @@ var AntigravityIdeRule = class extends ToolRule {
 			...rulesyncData.antigravity,
 			globs: this.frontmatter.globs ? parseGlobsString$1(this.frontmatter.globs) : void 0
 		};
+		const subprojectPath = this.global ? void 0 : extractAntigravitySubprojectPath(this.getRelativeDirPath())?.subprojectPath;
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RulesyncRule.getSettablePaths().recommended.relativeDirPath,
 			relativeFilePath: this.getRelativeFilePath(),
 			frontmatter: {
 				root: false,
-				targets: ["*"],
+				targets: subprojectPath === void 0 ? ["*"] : [...ANTIGRAVITY_NESTED_RULE_TARGETS],
 				...rulesyncData,
-				antigravity: antigravityForRulesync
+				antigravity: antigravityForRulesync,
+				...subprojectPath !== void 0 && { agentsmd: { subprojectPath } }
 			},
 			body: this.body
 		});
@@ -89118,6 +90084,9 @@ var AntigravityIdeRule = class extends ToolRule {
 //#endregion
 //#region src/features/rules/antigravity-plugin-rule.ts
 var AntigravityPluginRule = class extends AntigravityIdeRule {
+	static supportsSubprojectRules() {
+		return false;
+	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
 		const targets = rulesyncRule.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("antigravity-plugin");
@@ -95467,6 +96436,12 @@ var VibeRule = class extends NestedAgentsmdRule {
 * file, so every non-root rule without `agentsmd.subprojectPath` folds into
 * the root `./AGENTS.md`.
 *
+* A legacy root `WARP.md` is read on import when the root `AGENTS.md` is
+* absent, so a repository that has not moved to `AGENTS.md` yet imports its
+* rules. It is never written or deleted. When both exist, Warp reads
+* `WARP.md`, so import keeps reading the `AGENTS.md` rulesync manages and warns
+* that Warp ignores it, as generate already does.
+*
 * In global mode, Warp reads a third rule source from `~/.agents/AGENTS.md`
 * (the cross-tool agent config directory), indexed like project rules and also
 * used from remote hosts in SSH sessions. The same root-fold policy applies.
@@ -95481,6 +96456,31 @@ var WarpRule = class extends NestedAgentsmdRule {
 			toolTarget: "warp"
 		};
 	}
+	static getSettablePaths(options = {}) {
+		const paths = super.getSettablePaths(options);
+		if (options.global) return paths;
+		return {
+			...paths,
+			importOnlyRoots: [{
+				relativeDirPath: ".",
+				relativeFilePath: WARP_LEGACY_RULE_FILE_NAME,
+				onlyWhenRootAbsent: true,
+				outranksRoot: true
+			}]
+		};
+	}
+	static async fromFile(params) {
+		const { outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true } = params;
+		if (!params.global && relativeFilePath === "WARP.md" && (relativeDirPath === void 0 || relativeDirPath === ".")) return new this({
+			outputRoot,
+			relativeDirPath: ".",
+			relativeFilePath: WARP_LEGACY_RULE_FILE_NAME,
+			fileContent: await readFileContent(join(outputRoot, WARP_LEGACY_RULE_FILE_NAME)),
+			validate,
+			root: true
+		});
+		return super.fromFile(params);
+	}
 };
 //#endregion
 //#region src/features/rules/zcode-rule.ts
@@ -96783,7 +97783,7 @@ var RulesProcessor = class extends FeatureProcessor {
 		if (!importOnlyRoots || importOnlyRoots.length === 0) return;
 		const existingPaths = [];
 		for (const importOnlyRoot of importOnlyRoots) {
-			if (importOnlyRoot.onlyWhenRootAbsent !== true) continue;
+			if (importOnlyRoot.onlyWhenRootAbsent !== true || importOnlyRoot.outranksRoot === true) continue;
 			const matchedPaths = await findFilesByGlobs(rootRelativeGlob(importOnlyRoot.relativeDirPath, importOnlyRoot.relativeFilePath ?? `*.${factory.meta.extension}`), {
 				cwd: this.outputRoot,
 				type: "file"
@@ -97484,13 +98484,14 @@ As this project's AI coding tool, you must follow the additional conventions bel
 				const rootFilePath = primaryRootFilePaths[0];
 				const scannedPaths = [];
 				const skippedPaths = [];
+				const skippedOutrankingPaths = [];
 				for (const importOnlyRoot of importOnlyRoots) {
 					const matchedPaths = await findFilesByGlobs(rootRelativeGlob(importOnlyRoot.relativeDirPath, importOnlyRoot.relativeFilePath ?? `*.${factory.meta.extension}`), {
 						cwd: this.outputRoot,
 						type: "file"
 					});
 					if (importOnlyRoot.onlyWhenRootAbsent === true && rootFilePath !== void 0) {
-						skippedPaths.push(...matchedPaths);
+						(importOnlyRoot.outranksRoot === true ? skippedOutrankingPaths : skippedPaths).push(...matchedPaths);
 						continue;
 					}
 					scannedPaths.push(...matchedPaths);
@@ -97501,6 +98502,13 @@ As this project's AI coding tool, you must follow the additional conventions bel
 					const remainingCount = skippedNames.length - listedNames.length;
 					this.logger.warn(`Not importing ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} for ${this.toolTarget}: ${stripControlCharacters(relative(this.outputRoot, rootFilePath))} exists, and the tool reads that file exclusively. Delete them once you have checked that content is in the root file, or move it into ${RULESYNC_RULES_RELATIVE_DIR_PATH} if it is not.`);
 				}
+				if (skippedOutrankingPaths.length > 0 && rootFilePath !== void 0) {
+					const rootName = stripControlCharacters(relative(this.outputRoot, rootFilePath));
+					const skippedNames = skippedOutrankingPaths.map((filePath) => stripControlCharacters(relative(this.outputRoot, filePath)));
+					const listedNames = skippedNames.slice(0, MAX_LISTED_SKIPPED_IMPORT_ONLY_PATHS);
+					const remainingCount = skippedNames.length - listedNames.length;
+					this.logger.warn(`Not importing ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} for ${this.toolTarget}: ${rootName} is imported instead, but ${this.toolTarget} reads ${listedNames.length === 1 ? "that file" : "those files"} in place of ${rootName} when both exist. Move any content only it has into ${RULESYNC_RULES_RELATIVE_DIR_PATH} and delete it, so the generated ${rootName} takes effect.`);
+				}
 				return await buildImportRulesFromPaths(scannedPaths);
 			})();
 			this.logger.debug(`Found ${importOnlyToolRules.length} import-only tool rule files`);
@@ -100321,4 +101329,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncHooks as $, removeFile as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_RELATIVE_DIR_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, DEPRECATED_FEATURE_REPLACEMENTS as Bn, getFileSize as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_MCP_SCHEMA_URL as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_USER_CONFIG_DIR_NAME as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, quoteForLog as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, truncateText as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as In, directoryExists as It, RulesyncRule as J, stripHiddenCharacters as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, stripControlCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, parseCommaSeparatedList as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectoryStrict as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, ALL_FEATURES as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_MCP_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, hasDeceptiveHiddenCharacters as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, formatError as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, hasEnclosingMarkOutsideKeycap as Wn, isSymlink as Wt, RulesyncPermissions as X, readFileContentOrNull as Xt, RulesyncRuleFrontmatterSchema as Y, readFileContent as Yt, RulesyncMcp as Z, removeDirectory as Zt, LETTACODE_DIR as _, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, toPosixPath as an, RulesyncCheck as at, CommandsProcessor as b, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, ALL_TOOL_TARGETS as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ToolTargetSchema as dn, ConfigResolver as dt, removeFileStrict as en, getRulesyncSourceCandidates as et, displayWidthOf as f, CURATED_RULES_FEATURE_SUBDIR as fn, mergeInputRootConfigs as ft, HooksProcessor as g, RULESYNC_CHECKS_RELATIVE_DIR_PATH as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as hn, ConfigFileSchema as ht, inspectInputRoots as i, splitPathSegments as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_RULES_RELATIVE_DIR_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_PERMISSIONS_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, ALL_TOOL_TARGETS_WITH_WILDCARD as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, MAX_FILE_SIZE as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, resolvePath as nn, parseJsonc as nt, convertFromTool as o, writeFileBuffer as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, FEATURE_SOURCE_TREE_ENTRIES as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, stripControlCharactersKeepingLineFeeds as qn, listSubdirectoryNames as qt, generate as r, runWithDirectoryRollback as rn, RulesyncCommand as rt, isPackagingToolTarget as s, writeFileContent as sn, stringifyFrontmatter as st, importFromTool as t, removeTempDirectory as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, PACKAGING_TOOL_TARGETS as un, SKILL_FILE_NAME as ut, LETTACODE_SETTINGS_LOCAL_FILE_NAME as v, RULESYNC_CONFIG_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as wn, warnOnConflictingFlags as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as xn, JsonLogger as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_CONFIG_SCHEMA_URL as yn, findControlCharacter as yt, QWENCODE_DIR as z, ALL_FEATURES_WITH_WILDCARD as zn, findFilesByGlobs as zt };
 
-//# sourceMappingURL=import--SCvWeDn.js.map
+//# sourceMappingURL=import-DBd2G6Eo.js.map