rulesync 30.0.0 → 32.0.0

package/dist/{import-DBd2G6Eo.js → import-DgKWnDni.js}

@@ -913,6 +913,7 @@ const checksProcessorToolTargetTuple = [
 	"cursor",
 	"factorydroid",
 	"gitlabduo",
+	"goose",
 	"hermesagent",
 	"kilo",
 	"qwencode",
@@ -4822,13 +4823,11 @@ const PI_HOOK_EVENTS = [
 /**
 * Hook events supported by oh-my-pi (`omp`), Pi's fork, through the same
 * generated TypeScript extension. oh-my-pi keeps Pi's names for every event
-* listed here, but it has neither `agent_before_settle` nor `ui_prompt_start`,
-* so `stop` and `notification` are not mapped yet. oh-my-pi's stop surface is
-* `session_stop`, which takes a Claude-compatible `{ decision: "block", reason }`
-* result; it needs its own handler in the generator and is left for a
-* follow-up. See CANONICAL_TO_OMP_EVENT_NAMES.
+* listed here except `stop`: it has no `agent_before_settle`, so `stop` maps to
+* its own `session_stop` event instead. It has no `ui_prompt_start` either, so
+* `notification` is not mapped. See CANONICAL_TO_OMP_EVENT_NAMES.
 *
-* @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
 */
 const OMP_HOOK_EVENTS = [
 	"sessionStart",
@@ -4839,6 +4838,7 @@ const OMP_HOOK_EVENTS = [
 	"preModelInvocation",
 	"postModelInvocation",
 	"beforeSubmitPrompt",
+	"stop",
 	"preCompact",
 	"postCompact"
 ];
@@ -6260,9 +6260,10 @@ const CANONICAL_TO_PI_EVENT_NAMES = {
 /**
 * Map canonical camelCase event names to oh-my-pi extension event names. They
 * are Pi's names (see CANONICAL_TO_PI_EVENT_NAMES) for the events oh-my-pi
-* kept. Note that oh-my-pi runs `session_shutdown` handlers with a 2-second
-* budget, and fails a `tool_call` closed when its handler exceeds
-* `extensionHandlers.toolCallTimeoutMs` (30 seconds by default).
+* kept, plus `session_stop` for `stop`. Note that oh-my-pi runs
+* `session_shutdown` handlers with a 2-second budget, and fails a `tool_call`
+* closed when its handler exceeds `extensionHandlers.toolCallTimeoutMs`
+* (30 seconds by default).
 *
 * @see https://github.com/can1357/oh-my-pi/blob/40e9368ef0458fd9073329cdff4174895f91bc6b/docs/extensions.md
 */
@@ -6275,6 +6276,7 @@ const CANONICAL_TO_OMP_EVENT_NAMES = {
 	preModelInvocation: "context",
 	postModelInvocation: "message_end",
 	beforeSubmitPrompt: "input",
+	stop: "session_stop",
 	preCompact: "session_before_compact",
 	postCompact: "session_compact"
 };
@@ -12932,10 +12934,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 	[CODEWHALE_CONFIG_SHARED_FILE_KEY]: {
 		format: "toml",
 		invalidRootPolicy: "error",
-		features: { hooks: {
-			kind: "replace-owned-keys",
-			ownedKeys: ["hooks"]
-		} }
+		features: {
+			hooks: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["hooks"]
+			},
+			permissions: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["allow_shell"]
+			}
+		}
 	},
 	".letta/settings.json": {
 		format: "json",
@@ -14199,12 +14207,12 @@ const AmpCheckFrontmatterSchema = z.looseObject({
 * this format continue to apply.
 * @see https://ampcode.com/docs/review
 */
-var AmpCheck = class AmpCheck extends ToolCheck {
+var AmpCheck = class extends ToolCheck {
 	frontmatter;
 	body;
 	constructor({ frontmatter, body, fileContent, ...rest }) {
 		if (rest.validate !== false) {
-			const result = AmpCheckFrontmatterSchema.safeParse(frontmatter);
+			const result = new.target.getFrontmatterSchema().safeParse(frontmatter);
 			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
 		}
 		super({
@@ -14214,6 +14222,26 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		this.frontmatter = frontmatter;
 		this.body = body;
 	}
+	/**
+	* The tool target this check format belongs to, which is also the name of
+	* its tool-specific frontmatter section. Goose reads the same per-file
+	* format with a few extra keys, so `GooseCheck` reuses this class through
+	* these hooks.
+	*/
+	static getCheckToolTarget() {
+		return "amp";
+	}
+	/** The frontmatter schema a check file of this tool is validated against. */
+	static getFrontmatterSchema() {
+		return AmpCheckFrontmatterSchema;
+	}
+	/**
+	* Frontmatter keys only this tool reads. Import moves them into the tool's
+	* own section so they are not passed on to every other checks target.
+	*/
+	static getToolOnlyKeys() {
+		return [];
+	}
 	static getSettablePaths({ global = false } = {}) {
 		return { relativeDirPath: global ? AMP_CHECKS_GLOBAL_DIR : AMP_CHECKS_PROJECT_DIR };
 	}
@@ -14225,6 +14253,10 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 	}
 	toRulesyncCheck() {
 		const { name: _name, description, "severity-default": severityDefault, tools, ...restFields } = this.frontmatter;
+		const checkClass = this.constructor;
+		const toolOnlyKeys = new Set(checkClass.getToolOnlyKeys());
+		const sharedFields = Object.fromEntries(Object.entries(restFields).filter(([key]) => !toolOnlyKeys.has(key)));
+		const toolSection = Object.fromEntries(Object.entries(restFields).filter(([key]) => toolOnlyKeys.has(key)));
 		return new RulesyncCheck({
 			outputRoot: ".",
 			frontmatter: {
@@ -14232,7 +14264,8 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 				...description !== void 0 && { description },
 				...severityDefault !== void 0 && { severity: severityDefault },
 				...tools !== void 0 && { tools },
-				...restFields
+				...sharedFields,
+				...Object.keys(toolSection).length > 0 && { [checkClass.getCheckToolTarget()]: toolSection }
 			},
 			body: this.body,
 			relativeDirPath: RULESYNC_CHECKS_RELATIVE_DIR_PATH,
@@ -14247,22 +14280,24 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		const { targets: _targets, description, severity, tools, ...restFields } = rulesyncFrontmatter;
 		const toolTargetKeys = new Set(ALL_TOOL_TARGETS);
 		const passthroughFields = Object.fromEntries(Object.entries(restFields).filter(([key]) => !toolTargetKeys.has(key) && key !== "name"));
-		const ampSection = this.filterToolSpecificSection(rulesyncFrontmatter.amp ?? {}, ["name"]);
+		const toolTarget = this.getCheckToolTarget();
+		const rawSection = rulesyncFrontmatter[toolTarget];
+		const toolSection = this.filterToolSpecificSection(rawSection !== null && typeof rawSection === "object" && !Array.isArray(rawSection) ? rawSection : {}, ["name"]);
 		const rawAmpFrontmatter = {
 			name,
 			...description !== void 0 && { description },
 			...severity !== void 0 && { "severity-default": severity },
 			...tools !== void 0 && { tools },
 			...passthroughFields,
-			...ampSection
+			...toolSection
 		};
-		const result = AmpCheckFrontmatterSchema.safeParse(rawAmpFrontmatter);
-		if (!result.success) throw new Error(`Invalid amp check frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
+		const result = this.getFrontmatterSchema().safeParse(rawAmpFrontmatter);
+		if (!result.success) throw new Error(`Invalid ${toolTarget} check frontmatter in ${relativeFilePath}: ${formatError(result.error)}`);
 		const ampFrontmatter = result.data;
 		const body = rulesyncCheck.getBody();
 		const fileContent = stringifyFrontmatter(body, ampFrontmatter);
 		const paths = this.getSettablePaths({ global });
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			frontmatter: ampFrontmatter,
 			body,
@@ -14277,7 +14312,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 			success: true,
 			error: null
 		};
-		const result = AmpCheckFrontmatterSchema.safeParse(this.frontmatter);
+		const result = this.constructor.getFrontmatterSchema().safeParse(this.frontmatter);
 		if (result.success) return {
 			success: true,
 			error: null
@@ -14290,7 +14325,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 	static isTargetedByRulesyncCheck(rulesyncCheck) {
 		return this.isTargetedByRulesyncCheckDefault({
 			rulesyncCheck,
-			toolTarget: "amp"
+			toolTarget: this.getCheckToolTarget()
 		});
 	}
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
@@ -14298,9 +14333,9 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
 		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
-		const result = AmpCheckFrontmatterSchema.safeParse(frontmatter);
+		const result = this.getFrontmatterSchema().safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath,
@@ -14311,7 +14346,7 @@ var AmpCheck = class AmpCheck extends ToolCheck {
 		});
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
-		return new AmpCheck({
+		return new this({
 			outputRoot,
 			relativeDirPath,
 			relativeFilePath,
@@ -15411,6 +15446,60 @@ var GitlabduoCheck = class GitlabduoCheck extends ToolCheck {
 	}
 };
 //#endregion
+//#region src/constants/goose-paths.ts
+const GOOSE_DIR = ".goose";
+const GOOSE_GLOBAL_DIR = join(".config", "goose");
+const GOOSE_RULE_FILE_NAME = ".goosehints";
+const GOOSE_MCP_FILE_NAME = "config.yaml";
+const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
+const GOOSE_HOOKS_DIR_PATH = join(".agents", "plugins", "rulesync", "hooks");
+const GOOSE_HOOKS_FILE_NAME = "hooks.json";
+const GOOSE_PLUGIN_MCP_DIR_PATH = join(".agents", "plugins", "rulesync");
+const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
+const GOOSE_SKILLS_DIR_PATH = join(GOOSE_DIR, "skills");
+const GOOSE_GLOBAL_SKILLS_DIR_PATH = join(GOOSE_GLOBAL_DIR, "skills");
+const GOOSE_RECIPES_DIR_PATH = join(GOOSE_DIR, "recipes");
+const GOOSE_GLOBAL_RECIPES_DIR_PATH = join(GOOSE_GLOBAL_DIR, "recipes");
+const GOOSE_AGENTS_DIR_PATH = join(GOOSE_DIR, "agents");
+const GOOSE_GLOBAL_AGENTS_DIR_PATH = join(GOOSE_GLOBAL_DIR, "agents");
+const GOOSE_CHECKS_PROJECT_DIR = join(".agents", "checks");
+const GOOSE_CHECKS_GLOBAL_DIR = join(GOOSE_GLOBAL_DIR, "checks");
+//#endregion
+//#region src/features/checks/goose-check.ts
+const GooseCheckFrontmatterSchema = z.extend(AmpCheckFrontmatterSchema, {
+	model: z.optional(z.string()),
+	"turn-limit": z.optional(z.int().check(z.nonnegative()))
+});
+/**
+* Represents a Goose review check (`goose review`), written to the user-wide
+* `~/.config/goose/checks/` (global scope only).
+*
+* Goose discovers repository checks in `.agents/checks/*.md`, the same
+* cross-tool directory the `amp` checks target already writes (Goose's
+* `tools` and `severity-default` fields exist for parity with Amp's), so the
+* project scope is left to `amp` rather than having two targets own the same
+* files. Its global discovery reads `~/.config/goose/checks/` first, then
+* `~/.config/agents/checks/`. The file format is Amp's, so this class reuses
+* `AmpCheck` and adds Goose's `model` and `turn-limit`, which live in the
+* `goose:` section of a rulesync check; `name` is derived from the file name.
+*
+* @see https://github.com/aaif-goose/goose/blob/main/crates/goose/src/checks/mod.rs
+*/
+var GooseCheck = class extends AmpCheck {
+	static getCheckToolTarget() {
+		return "goose";
+	}
+	static getFrontmatterSchema() {
+		return GooseCheckFrontmatterSchema;
+	}
+	static getToolOnlyKeys() {
+		return ["model", "turn-limit"];
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? GOOSE_CHECKS_GLOBAL_DIR : GOOSE_CHECKS_PROJECT_DIR };
+	}
+};
+//#endregion
 //#region src/constants/hermesagent-paths.ts
 /**
 * Hermes Agent configuration-layout conventions.
@@ -16139,6 +16228,14 @@ const toolCheckFactories = /* @__PURE__ */ new Map([
 			committedOutput: true
 		}
 	}],
+	["goose", {
+		class: GooseCheck,
+		meta: {
+			supportsGlobal: true,
+			supportsProject: false,
+			filePattern: "*.md"
+		}
+	}],
 	["hermesagent", {
 		class: HermesagentCheck,
 		meta: {
@@ -16184,7 +16281,9 @@ const defaultGetFactory$6 = (target) => {
 	return factory;
 };
 const allToolTargetKeys$5 = [...toolCheckFactories.keys()];
-const checksProcessorToolTargets = allToolTargetKeys$5;
+const checksProcessorToolTargets = allToolTargetKeys$5.filter((target) => {
+	return toolCheckFactories.get(target)?.meta.supportsProject !== false;
+});
 const checksProcessorToolTargetsGlobal = allToolTargetKeys$5.filter((target) => {
 	return toolCheckFactories.get(target)?.meta.supportsGlobal ?? false;
 });
@@ -16355,23 +16454,6 @@ var ChecksProcessor = class extends FeatureProcessor {
 	}
 };
 //#endregion
-//#region src/constants/goose-paths.ts
-const GOOSE_DIR = ".goose";
-const GOOSE_GLOBAL_DIR = join(".config", "goose");
-const GOOSE_RULE_FILE_NAME = ".goosehints";
-const GOOSE_MCP_FILE_NAME = "config.yaml";
-const GOOSE_PERMISSIONS_FILE_NAME = "permission.yaml";
-const GOOSE_HOOKS_DIR_PATH = join(".agents", "plugins", "rulesync", "hooks");
-const GOOSE_HOOKS_FILE_NAME = "hooks.json";
-const GOOSE_PLUGIN_MCP_DIR_PATH = join(".agents", "plugins", "rulesync");
-const GOOSE_PLUGIN_MCP_FILE_NAME = ".mcp.json";
-const GOOSE_SKILLS_DIR_PATH = join(GOOSE_DIR, "skills");
-const GOOSE_GLOBAL_SKILLS_DIR_PATH = join(GOOSE_GLOBAL_DIR, "skills");
-const GOOSE_RECIPES_DIR_PATH = join(GOOSE_DIR, "recipes");
-const GOOSE_GLOBAL_RECIPES_DIR_PATH = join(GOOSE_GLOBAL_DIR, "recipes");
-const GOOSE_AGENTS_DIR_PATH = join(GOOSE_DIR, "agents");
-const GOOSE_GLOBAL_AGENTS_DIR_PATH = join(GOOSE_GLOBAL_DIR, "agents");
-//#endregion
 //#region src/utils/tool-home.ts
 /**
 * Where the rulesync-side source files of a tool with a home override belong.
@@ -18093,27 +18175,71 @@ const CLINE_HOOKS_GLOBAL_DIR_PATH = join("Documents", "Cline", "Hooks");
 const CLINE_HOOKS_MANIFEST_FILE_NAME = "rulesync-hooks.json";
 //#endregion
 //#region src/features/commands/cline-command.ts
+const CLINE_WORKFLOW_FIELD_TYPES = {
+	name: "string",
+	disabled: "boolean",
+	enabled: "boolean"
+};
+function sanitizeClineWorkflowFrontmatter({ cline, relativeFilePath, logger }) {
+	if (!isRecord$1(cline)) return {};
+	return Object.fromEntries(Object.entries(cline).filter(([key, value]) => {
+		const expected = Object.hasOwn(CLINE_WORKFLOW_FIELD_TYPES, key) ? CLINE_WORKFLOW_FIELD_TYPES[key] : void 0;
+		if (expected === void 0 || typeof value === expected) return true;
+		warnWithFallback(logger, `Cline commands: dropping cline.${key} from ${relativeFilePath}: Cline rejects the whole workflow unless it is a ${expected}.`);
+		return false;
+	}));
+}
+/**
+* Cline workflows (commands). A workflow may carry YAML frontmatter that Cline
+* reads: `name` (the slash-command name) and a `disabled` / `enabled` switch
+* (`parseWorkflowConfigFromMarkdown` in Cline's
+* `user-instruction-config-loader.ts`). The `cline:` section of a
+* `.rulesync/commands/*.md` file is written as that frontmatter, and every key
+* of an imported workflow's frontmatter is lifted back into `cline:`, so
+* hand-written workflow frontmatter survives an import → generate round trip.
+* Cline's own UI toggle is kept in Cline's state, not in the file. A workflow
+* without a `cline:` section is written as a bare body, as before.
+*
+* @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/extensions/config/user-instruction-config-loader.ts
+*/
 var ClineCommand = class ClineCommand extends ToolCommand {
 	static getSettablePaths({ global } = {}) {
 		if (global) return { relativeDirPath: CLINE_COMMANDS_GLOBAL_DIR_PATH };
 		return { relativeDirPath: CLINE_COMMANDS_DIR_PATH };
 	}
+	/** The workflow's own frontmatter, or an empty object for a bare body. */
+	getClineFrontmatter() {
+		const { frontmatter } = parseFrontmatter(this.getFileContent(), this.getFilePath());
+		return isRecord$1(frontmatter) ? frontmatter : {};
+	}
 	toRulesyncCommand() {
+		const cline = this.getClineFrontmatter();
+		const rulesyncFrontmatter = {
+			targets: ["*"],
+			...Object.keys(cline).length > 0 && { cline }
+		};
+		const body = this.getBody();
 		return new RulesyncCommand({
 			outputRoot: process.cwd(),
-			frontmatter: { targets: ["*"] },
-			body: this.getFileContent(),
+			frontmatter: rulesyncFrontmatter,
+			body,
 			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
 			relativeFilePath: this.relativeFilePath,
-			fileContent: this.getFileContent(),
+			fileContent: stringifyFrontmatter(body, rulesyncFrontmatter),
 			validate: true
 		});
 	}
-	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
+		const cline = sanitizeClineWorkflowFrontmatter({
+			cline: rulesyncCommand.getFrontmatter().cline,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
+			logger
+		});
+		const body = rulesyncCommand.getBody();
 		return new ClineCommand({
 			outputRoot,
-			fileContent: rulesyncCommand.getBody(),
+			fileContent: Object.keys(cline).length > 0 ? stringifyFrontmatter(body, cline) : body,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
 			validate
@@ -18126,7 +18252,7 @@ var ClineCommand = class ClineCommand extends ToolCommand {
 		};
 	}
 	getBody() {
-		return this.getFileContent();
+		return parseFrontmatter(this.getFileContent(), this.getFilePath()).body.trim();
 	}
 	static isTargetedByRulesyncCommand(rulesyncCommand) {
 		return this.isTargetedByRulesyncCommandDefault({
@@ -18137,12 +18263,13 @@ var ClineCommand = class ClineCommand extends ToolCommand {
 	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
-		const { body: content } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const cline = isRecord$1(frontmatter) ? frontmatter : {};
 		return new ClineCommand({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath,
-			fileContent: content.trim(),
+			fileContent: Object.keys(cline).length > 0 ? stringifyFrontmatter(body.trim(), cline) : body.trim(),
 			validate
 		});
 	}
@@ -32715,6 +32842,31 @@ const PI_PROMPT_BLOCKING_EVENT = "input";
 * @see https://github.com/earendil-works/pi/blob/v0.87.1/packages/coding-agent/src/core/extensions/types.ts
 */
 const PI_SETTLE_BLOCKING_EVENT = "agent_before_settle";
+/**
+* `session_stop` is oh-my-pi's stop surface (it has no `agent_before_settle`).
+* It fires when a main-session run is about to settle (never for subagents,
+* nor for a run the user aborted), and a handler returning
+* `{ continue: true, additionalContext }` queues one more turn with that text
+* as hidden model-visible context. As on Pi, only a stop command exiting with
+* code 2 asks for that, the feedback of every such command is combined, and
+* any other failure is rethrown for oh-my-pi to report. The generated handler
+* continues only when `event.stop_hook_active` is false, which oh-my-pi sets
+* after a continuation and clears once a stop pass lets the run settle, so the
+* agent is continued at most once per stop (the flag is shared by every
+* extension, so another extension's continuation also suppresses ours);
+* oh-my-pi additionally caps these
+* advisory continuations at 8 in a row. A run that ended on a provider error
+* (`stopReason: "error"`) is not continued, matching Pi's `completed`-only
+* gate. The advisory form is used rather than `{ decision: "block", reason }`,
+* which oh-my-pi keeps enforcing without that cap. oh-my-pi gives
+* `session_stop` handlers the 30-second extension handler budget: stop
+* commands running longer time the handler out, the run settles without a
+* continuation, and the command is not killed.
+*
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/docs/extensions.md
+* @see https://github.com/can1357/oh-my-pi/blob/fa5ff4a3a977a28b93d025f4cf50f046e019f18c/packages/coding-agent/src/session/agent-session.ts
+*/
+const OMP_SESSION_STOP_BLOCKING_EVENT = "session_stop";
 const PI_EXTENSION_DIALECT = {
 	overrideKey: "pi",
 	typesPackage: "@earendil-works/pi-coding-agent",
@@ -32736,7 +32888,8 @@ const OMP_EXTENSION_DIALECT = {
 const PI_BLOCKING_MODE_BY_EVENT = {
 	[PI_BLOCKING_EVENT]: "tool",
 	[PI_PROMPT_BLOCKING_EVENT]: "prompt",
-	[PI_SETTLE_BLOCKING_EVENT]: "settle"
+	[PI_SETTLE_BLOCKING_EVENT]: "settle",
+	[OMP_SESSION_STOP_BLOCKING_EVENT]: "sessionStop"
 };
 /**
 * The body emitted inside a blocking handler's `catch`, per gate. `tool_call`
@@ -32749,7 +32902,8 @@ function failureLinesByMode(dialect) {
 		none: [],
 		tool: ["return { block: true, reason: toBlockReason(error) };"],
 		prompt: ["reportPromptGateFailure(ctx, toBlockReason(error));", dialect.promptCancelLine],
-		settle: ["stopHookFailures.push(error);"]
+		settle: ["stopHookFailures.push(error);"],
+		sessionStop: ["stopHookFailures.push(error);"]
 	};
 }
 /**
@@ -32841,6 +32995,12 @@ const PROMPT_GATE_HELPER_LINES = [
 	"  console.error(reason);",
 	"}"
 ];
+/** Helper emitted alongside every stop gate (Pi's settle gate and oh-my-pi's `session_stop`). */
+const STOP_HOOK_BLOCK_HELPER_LINES = [
+	"function isStopHookBlock(error: unknown): boolean {",
+	"  return (error as { code?: unknown } | null)?.code === 2;",
+	"}"
+];
 /**
 * Helper emitted alongside the stop hook's settle gate. `event.entries` holds
 * the drafts earlier extensions proposed at this boundary, so they are kept and
@@ -32851,10 +33011,6 @@ const PROMPT_GATE_HELPER_LINES = [
 * appended message is committed, and Pi re-validates the final context itself.
 */
 const STOP_HOOK_HELPER_LINES = [
-	"function isStopHookBlock(error: unknown): boolean {",
-	"  return (error as { code?: unknown } | null)?.code === 2;",
-	"}",
-	"",
 	"function continueAfterStopHook(",
 	"  event: AgentBeforeSettleEvent,",
 	"  reason: string,",
@@ -32937,14 +33093,16 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 		const blocking = PI_BLOCKING_MODE_BY_EVENT[piEvent] ?? "none";
 		const isPromptGate = blocking === "prompt";
 		const isSettleGate = blocking === "settle";
+		const isSessionStopGate = blocking === "sessionStop";
+		const collectsStopFailures = isSettleGate || isSessionStopGate;
 		const usesToolName = PI_TOOL_EVENTS.has(piEvent) && handlers.some((h) => h.matcher);
 		const usesErrorFlag = handlers.some((h) => h.onlyOnError);
 		const gatesOnAssistant = PI_ASSISTANT_MESSAGE_EVENTS.has(piEvent);
-		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || isSettleGate ? "event" : "";
+		const params = isPromptGate ? "event, ctx" : usesToolName || usesErrorFlag || gatesOnAssistant || isPromptGate || collectsStopFailures ? "event" : "";
 		lines.push(`  pi.on(${JSON.stringify(piEvent)}, async (${params}) => {`);
 		if (gatesOnAssistant) lines.push(`    if (event.message.role !== "assistant") return;`);
 		if (isPromptGate) lines.push(`    if (event.source === "extension") ${dialect.promptPassLine}`);
-		if (isSettleGate) lines.push("    const stopHookFailures: unknown[] = [];");
+		if (collectsStopFailures) lines.push("    const stopHookFailures: unknown[] = [];");
 		for (const handler of handlers) lines.push(...buildCommandLines({
 			handler,
 			usesToolName,
@@ -32960,6 +33118,17 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 			lines.push("    }");
 			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
 		}
+		if (isSessionStopGate) {
+			lines.push("    const blocks = stopHookFailures.filter(isStopHookBlock);");
+			lines.push("    const endedOnError = (event.last_assistant_message as { stopReason?: unknown } | undefined)?.stopReason === \"error\";");
+			lines.push("    if (blocks.length > 0 && !event.stop_hook_active && !endedOnError) {");
+			lines.push("      return {");
+			lines.push("        continue: true,");
+			lines.push("        additionalContext: `Stop hook feedback:\\n${blocks.map(toBlockReason).join(\"\\n\\n\")}`,");
+			lines.push("      };");
+			lines.push("    }");
+			lines.push("    if (stopHookFailures.length > 0) throw stopHookFailures[0];");
+		}
 		lines.push("  });");
 		if (isSettleGate) {
 			lines.push(`  pi.on("agent_settled", async () => {`);
@@ -32978,8 +33147,9 @@ function buildSubscriptionLines(handlerGroups, dialect) {
 * `{ block: true, reason }`, and on `input` — Pi's prompt-submission gate —
 * where a non-zero exit cancels the prompt with the dialect's cancel result
 * (`{ action: "handled" }` for Pi, `{ handled: true }` for oh-my-pi), and
-* on `agent_before_settle`, where a stop command exiting with code 2 asks the
-* agent to continue once with the command's output as feedback.
+* on `agent_before_settle` (Pi) / `session_stop` (oh-my-pi), where a stop
+* command exiting with code 2 asks the agent to continue once with the
+* command's output as feedback.
 * `postToolUse` and `postToolUseFailure` share Pi's `tool_result` event; the
 * latter's commands run only when `event.isError` is set.
 *
@@ -33000,7 +33170,8 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 	const subscriptionLines = buildSubscriptionLines(handlerGroups, dialect);
 	const hasPromptGate = Boolean(handlerGroups[PI_PROMPT_BLOCKING_EVENT]);
 	const hasSettleGate = Boolean(handlerGroups[PI_SETTLE_BLOCKING_EVENT]);
-	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate;
+	const hasSessionStopGate = Boolean(handlerGroups[OMP_SESSION_STOP_BLOCKING_EVENT]);
+	const needsBlockReasonHelper = Boolean(handlerGroups[PI_BLOCKING_EVENT]) || hasPromptGate || hasSettleGate || hasSessionStopGate;
 	const lines = ["// Generated by rulesync. Do not edit manually."];
 	if (subscriptionLines.length === 0) {
 		lines.push("export default function () {}");
@@ -33027,6 +33198,10 @@ function generatePiExtensionCode({ config, supportedEvents, eventMap, dialect =
 		lines.push(...PROMPT_GATE_HELPER_LINES);
 		lines.push("");
 	}
+	if (hasSettleGate || hasSessionStopGate) {
+		lines.push(...STOP_HOOK_BLOCK_HELPER_LINES);
+		lines.push("");
+	}
 	if (hasSettleGate) {
 		lines.push(...STOP_HOOK_HELPER_LINES);
 		lines.push("");
@@ -40522,6 +40697,35 @@ function convertFromCodexFormat(codexMcp) {
 	}
 	return result;
 }
+/**
+* Keys Codex refuses on each transport. Its `McpServerConfig` deserializer
+* calls `throw_if_set` for these, and the error fails the whole `config.toml`,
+* not just the one server, so they are dropped with a warning instead of
+* written. Checked against `codex-rs/config/src/mcp_types.rs` at rust-v0.162.1.
+*/
+const CODEX_STDIO_REJECTED_KEYS = [
+	"url",
+	"bearer_token_env_var",
+	"bearer_token",
+	"http_headers_helper",
+	"http_headers",
+	"env_http_headers",
+	"oauth",
+	"oauth_resource",
+	"auth"
+];
+const CODEX_HTTP_REJECTED_KEYS = [
+	"args",
+	"env",
+	"env_vars",
+	"cwd",
+	"bearer_token"
+];
+function dropTransportRejectedKeys({ converted, isStdio, serverName }) {
+	const dropped = (isStdio ? CODEX_STDIO_REJECTED_KEYS : CODEX_HTTP_REJECTED_KEYS).filter((key) => converted[key] !== void 0);
+	for (const key of dropped) delete converted[key];
+	if (dropped.length > 0) warnWithFallback(void 0, `[CodexCliMcp] Dropping ${dropped.map((key) => `'${key}'`).join(", ")} from ${isStdio ? "stdio" : "url-based"} MCP server "${serverName}": Codex rejects ${dropped.length === 1 ? "this key" : "these keys"} on a ${isStdio ? "stdio" : "url-based"} server and would fail to load the whole config.toml.`);
+}
 function convertToCodexFormat(mcpServers) {
 	const result = {};
 	const originalNames = /* @__PURE__ */ new Map();
@@ -40564,6 +40768,11 @@ function convertToCodexFormat(mcpServers) {
 			converted,
 			serverName: name
 		});
+		dropTransportRejectedKeys({
+			converted,
+			isStdio,
+			serverName: name
+		});
 		const previousName = originalNames.get(codexName);
 		if (previousName !== void 0) warnWithFallback(void 0, `Codex MCP server name collision: "${previousName}" and "${name}" both normalize to "${codexName}"; "${name}" (processed last) overwrites "${previousName}".`);
 		originalNames.set(codexName, name);
@@ -55789,6 +55998,124 @@ function parseCodebuddySettings({ fileContent, relativePath }) {
 	}
 }
 //#endregion
+//#region src/features/permissions/codewhale-project-config.ts
+/**
+* The top-level key of the per-project `.codewhale/config.toml` overlay that
+* hides Codewhale's shell tools. The overlay only tightens: `false` disables
+* shell for the session, while `true` is ignored with a warning.
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/docs/CONFIGURATION.md#per-project-overlay-485
+* @see https://github.com/Hmbown/Codewhale/blob/fead51eeea0fb6038ea3e30923751b1a1c765b25/crates/tui/src/lib.rs
+*/
+const CODEWHALE_ALLOW_SHELL_KEY = "allow_shell";
+const CODEWHALE_PROJECT_CONFIG_PATHS = {
+	relativeDirPath: CODEWHALE_DIR,
+	relativeFilePath: CODEWHALE_CONFIG_FILE_NAME
+};
+/** The project `.codewhale/config.toml` overlay, as written by the permissions feature. */
+var CodewhaleProjectConfigFile = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+/**
+* Whether the canonical config denies every shell command: a `deny` on the
+* catch-all `*` (or `**`) pattern of `bash` or of the all-tools `*` category.
+* Codewhale decides by action before specificity, so such a deny already
+* blocks every command in global scope too, whatever `allow` rules sit beside
+* it.
+*/
+function deniesEveryShellCommand(permission) {
+	return collectShellCommandRules(permission).rules.some(({ pattern, action }) => action === "deny" && isShellCatchAll(pattern));
+}
+/** Whether a canonical shell pattern names every command. */
+function isShellCatchAll(pattern) {
+	const trimmed = pattern.trim();
+	return trimmed === "*" || trimmed === "**";
+}
+function projectConfigFilePath(outputRoot) {
+	return join(outputRoot, CODEWHALE_PROJECT_CONFIG_PATHS.relativeDirPath, CODEWHALE_PROJECT_CONFIG_PATHS.relativeFilePath);
+}
+function parseProjectConfig({ fileContent, filePath }) {
+	return parseSharedConfig({
+		format: "toml",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+/**
+* Whether an overlay disables shell (`allow_shell = false`). A file that
+* cannot be read as TOML is reported and treated as not disabling shell.
+*/
+function disablesShell({ fileContent, filePath, logger }) {
+	try {
+		return parseProjectConfig({
+			fileContent,
+			filePath
+		})[CODEWHALE_ALLOW_SHELL_KEY] === false;
+	} catch (error) {
+		logger?.warn(`Codewhale permissions: not reading "allow_shell" from ${filePath}, so a shell deny set there is not taken into account: ${formatError(error)}`);
+		return false;
+	}
+}
+/**
+* Whether the project overlay at `outputRoot` disables shell
+* (`allow_shell = false`), for import.
+*/
+async function readCodewhaleProjectShellDisabled({ outputRoot, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const fileContent = await readFileContentOrNull(filePath);
+	if (fileContent === null) return false;
+	return disablesShell({
+		fileContent,
+		filePath,
+		logger
+	});
+}
+/**
+* The project `.codewhale/config.toml` overlay carrying `allow_shell = false`
+* when the canonical config denies every shell command, or `null` when the
+* file needs no change.
+*
+* Only `allow_shell` is written; every other overlay key (`model`,
+* `approval_policy`, ...) is kept, and an existing file that is not valid TOML
+* is an error only when it has to be written. An existing
+* `allow_shell = false` is never removed: the overlay cannot widen access, and
+* a hand-written value cannot be told apart from one rulesync wrote, so it is
+* reported instead.
+*/
+async function createCodewhaleProjectConfigFile({ outputRoot = process.cwd(), config, logger }) {
+	const filePath = projectConfigFilePath(outputRoot);
+	const existingContent = await readFileContentOrNull(filePath);
+	if (!deniesEveryShellCommand(config.permission)) {
+		if (existingContent !== null && disablesShell({
+			fileContent: existingContent,
+			filePath,
+			logger
+		})) logger?.warn(`Codewhale permissions: keeping "allow_shell = false" in ${filePath}; rulesync does not remove it. Delete it by hand to re-enable shell tools in this project, or add bash: { "*": "deny" } to the rulesync permissions to match it.`);
+		return null;
+	}
+	if (parseProjectConfig({
+		fileContent: existingContent ?? "",
+		filePath
+	})[CODEWHALE_ALLOW_SHELL_KEY] === false) return null;
+	return new CodewhaleProjectConfigFile({
+		outputRoot,
+		...CODEWHALE_PROJECT_CONFIG_PATHS,
+		fileContent: applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(CODEWHALE_PROJECT_CONFIG_PATHS),
+			feature: "permissions",
+			existingContent: existingContent ?? "",
+			patch: { [CODEWHALE_ALLOW_SHELL_KEY]: false },
+			filePath,
+			logger
+		})
+	});
+}
+//#endregion
 //#region src/features/permissions/codewhale-repo-law.ts
 /**
 * Project-scope Codewhale permissions: the enforced `protected_invariants` of
@@ -55939,7 +56266,8 @@ function collectRestrictions({ config, logger }) {
 	let skippedAllowCount = 0;
 	for (const [category, rules] of Object.entries(config.permission)) {
 		if (!REPO_LAW_CATEGORIES.includes(category)) {
-			if (Object.keys(rules).length > 0) skippedCategories.push(category);
+			const entries = Object.entries(rules);
+			if ((category === "bash" && entries.some(([pattern, action]) => action === "deny" && isShellCatchAll(pattern)) ? entries.filter(([, action]) => action === "allow") : entries).length > 0) skippedCategories.push(category);
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -56665,17 +56993,32 @@ async function warnOnShadowedConstitution({ outputRoot, logger }) {
 * Project scope manages the enforced `protected_invariants` of the repo
 * constitution `.codewhale/constitution.json` (see `codewhale-repo-law.ts`):
 * the project `.codewhale/config.toml` overlay cannot carry rules, but repo
-* law can hold writes to protected paths.
+* law can hold writes to protected paths. A deny on every shell command also
+* sets `allow_shell = false` in that overlay (see
+* `codewhale-project-config.ts`), which import reads back here.
 *
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/CONFIGURATION.md
 * @see https://github.com/Hmbown/Codewhale/blob/main/docs/AUTHORIZATION_ORDER.md
 */
 var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
-	constructor(params) {
+	/**
+	* Whether the project `.codewhale/config.toml` overlay disables shell
+	* (`allow_shell = false`); read on import in project scope only.
+	*/
+	projectShellDisabled;
+	constructor({ projectShellDisabled = false, ...params }) {
 		super({
 			...params,
 			fileContent: params.fileContent ?? ""
 		});
+		this.projectShellDisabled = projectShellDisabled;
+	}
+	/**
+	* The project `.codewhale/config.toml` overlay, where a deny on every shell
+	* command becomes `allow_shell = false` beside the user's other overlay keys.
+	*/
+	static getExtraSharedWritePaths(options) {
+		return options?.global ? [] : [{ ...CODEWHALE_PROJECT_CONFIG_PATHS }];
 	}
 	/**
 	* Codewhale's approval card writes to the global file, and the constitution
@@ -56712,7 +57055,11 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			projectShellDisabled: global ? false : await readCodewhaleProjectShellDisabled({
+				outputRoot,
+				logger
+			})
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger, global = false }) {
@@ -56774,11 +57121,15 @@ var CodewhalePermissions = class CodewhalePermissions extends ToolPermissions {
 	toRulesyncPermissions() {
 		const filePath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
 		if (!this.global) {
-			const document = parseCodewhaleConstitution({
+			const permission = codewhaleConstitutionToCanonical(parseCodewhaleConstitution({
 				fileContent: this.getFileContent(),
 				filePath
-			});
-			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission: codewhaleConstitutionToCanonical(document) }, null, 2) });
+			}));
+			if (this.projectShellDisabled) permission.bash = {
+				...permission.bash,
+				"*": "deny"
+			};
+			return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 		}
 		const { permission, nativeRules } = codewhaleRulesToCanonical(partitionRuleRecords(parsePermissionsDocument({
 			fileContent: this.getFileContent(),
@@ -67784,10 +68135,15 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 			outputRoot,
 			logger
 		});
+		const inheritedProvider = global ? void 0 : await readGlobalTaktProvider({
+			projectFilePath: filePath,
+			logger
+		});
 		const rulesyncJson = rulesyncPermissions.getJson();
 		const provider = resolveActiveProvider({
 			config,
-			runtime: runtime.active ? runtime.config : void 0
+			runtime: runtime.active ? runtime.config : void 0,
+			inheritedProvider
 		});
 		const mode = deriveTaktPermissionMode(rulesyncJson);
 		const override = isPlainObject$1(rulesyncJson.takt) ? rulesyncJson.takt : void 0;
@@ -67897,10 +68253,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 * `provider_profiles` (unless that key is the pre-0.68.0 `claude` fallback),
 * else the `claude-sdk` default (Takt 0.68.0+).
 */
-function resolveActiveProvider({ config, runtime }) {
+function resolveActiveProvider({ config, runtime, inheritedProvider }) {
 	const fromRuntime = runtime === void 0 ? void 0 : resolveRuntimeProvider(runtime);
 	if (fromRuntime !== void 0) return fromRuntime;
-	if (typeof config[TAKT_PROVIDER_KEY] === "string" && config[TAKT_PROVIDER_KEY].trim() !== "") return config[TAKT_PROVIDER_KEY];
+	const local = readProviderName(config);
+	if (local !== void 0) return local;
+	if (inheritedProvider !== void 0) return inheritedProvider;
 	const profiles = config[TAKT_PROVIDER_PROFILES_KEY];
 	if (isPlainObject$1(profiles)) {
 		const keys = Object.keys(profiles);
@@ -67908,6 +68266,43 @@ function resolveActiveProvider({ config, runtime }) {
 	}
 	return TAKT_DEFAULT_PROVIDER;
 }
+/**
+* The top-level `provider:` of a Takt `config.yaml`, when it names one: either
+* the plain name or the block form `provider: { type: <name>, ... }` Takt also
+* accepts (`ConfigProviderReference`).
+*/
+function readProviderName(config) {
+	const raw = config[TAKT_PROVIDER_KEY];
+	const provider = isPlainObject$1(raw) ? raw.type : raw;
+	return typeof provider === "string" && provider.trim() !== "" ? provider : void 0;
+}
+/**
+* The top-level `provider:` of the global `~/.takt/config.yaml`, read for a
+* project-scope generate. An unresolvable home directory, a missing or
+* unparsable file, or one that names no provider all mean "nothing inherited".
+*/
+async function readGlobalTaktProvider({ projectFilePath, logger }) {
+	let globalPath;
+	try {
+		globalPath = join(getHomeDirectory(), TAKT_DIR, TAKT_CONFIG_FILE_NAME);
+	} catch {
+		return;
+	}
+	if (globalPath === projectFilePath) return;
+	try {
+		const content = await readFileContentOrNull(globalPath);
+		if (content === null) return;
+		return readProviderName(parseSharedConfig({
+			format: "yaml",
+			fileContent: content,
+			filePath: globalPath,
+			invalidRootPolicy: "error"
+		}));
+	} catch (error) {
+		logger?.warn(`Takt permissions: could not read the provider from ${globalPath} (${formatError(error)}); falling back to the project config alone.`);
+		return;
+	}
+}
 /** A plain object carrying at least one entry (Takt's "assignment" test). */
 function hasEntries(value) {
 	return isPlainObject$1(value) && Object.keys(value).length > 0;
@@ -71663,6 +72058,14 @@ var PermissionsProcessor = class extends FeatureProcessor {
 			logger: this.logger,
 			global: this.global
 		});
+		if (this.toolTarget === "codewhale" && !this.global) {
+			const projectConfigFile = await createCodewhaleProjectConfigFile({
+				outputRoot: this.outputRoot,
+				config: effectivePermissions.getJson(),
+				logger: this.logger
+			});
+			return projectConfigFile ? [toolPermissions, projectConfigFile] : [toolPermissions];
+		}
 		if (this.toolTarget !== "codexcli") return [toolPermissions];
 		return [toolPermissions, createCodexcliBashRulesFile({
 			outputRoot: this.outputRoot,
@@ -101329,4 +101732,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncHooks as $, removeFile as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_RELATIVE_DIR_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, DEPRECATED_FEATURE_REPLACEMENTS as Bn, getFileSize as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_MCP_SCHEMA_URL as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_USER_CONFIG_DIR_NAME as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, quoteForLog as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, truncateText as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as In, directoryExists as It, RulesyncRule as J, stripHiddenCharacters as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, stripControlCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, parseCommaSeparatedList as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectoryStrict as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, ALL_FEATURES as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_MCP_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, hasDeceptiveHiddenCharacters as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, formatError as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, hasEnclosingMarkOutsideKeycap as Wn, isSymlink as Wt, RulesyncPermissions as X, readFileContentOrNull as Xt, RulesyncRuleFrontmatterSchema as Y, readFileContent as Yt, RulesyncMcp as Z, removeDirectory as Zt, LETTACODE_DIR as _, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, toPosixPath as an, RulesyncCheck as at, CommandsProcessor as b, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, ALL_TOOL_TARGETS as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ToolTargetSchema as dn, ConfigResolver as dt, removeFileStrict as en, getRulesyncSourceCandidates as et, displayWidthOf as f, CURATED_RULES_FEATURE_SUBDIR as fn, mergeInputRootConfigs as ft, HooksProcessor as g, RULESYNC_CHECKS_RELATIVE_DIR_PATH as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as hn, ConfigFileSchema as ht, inspectInputRoots as i, splitPathSegments as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_RULES_RELATIVE_DIR_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_PERMISSIONS_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, ALL_TOOL_TARGETS_WITH_WILDCARD as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, MAX_FILE_SIZE as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, resolvePath as nn, parseJsonc as nt, convertFromTool as o, writeFileBuffer as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, FEATURE_SOURCE_TREE_ENTRIES as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, stripControlCharactersKeepingLineFeeds as qn, listSubdirectoryNames as qt, generate as r, runWithDirectoryRollback as rn, RulesyncCommand as rt, isPackagingToolTarget as s, writeFileContent as sn, stringifyFrontmatter as st, importFromTool as t, removeTempDirectory as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, PACKAGING_TOOL_TARGETS as un, SKILL_FILE_NAME as ut, LETTACODE_SETTINGS_LOCAL_FILE_NAME as v, RULESYNC_CONFIG_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as wn, warnOnConflictingFlags as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as xn, JsonLogger as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_CONFIG_SCHEMA_URL as yn, findControlCharacter as yt, QWENCODE_DIR as z, ALL_FEATURES_WITH_WILDCARD as zn, findFilesByGlobs as zt };
 
-//# sourceMappingURL=import-DBd2G6Eo.js.map
+//# sourceMappingURL=import-DgKWnDni.js.map