rulesync 35.0.0 → 36.0.1

package/dist/{import-D11JFP84.cjs → import-DVcemXlR.cjs}

@@ -457,36 +457,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$420 } = node_path.posix;
+const { join: join$422 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$420(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$422(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$420(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$420(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$422(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$422(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$420(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -699,6 +699,7 @@ const commandsProcessorToolTargetTuple = [
 	"hermesagent",
 	"junie",
 	"kilo",
+	"kimi-code",
 	"kimi-code-plugin",
 	"kiro",
 	"kiro-cli",
@@ -8173,7 +8174,8 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * autonomy/sandbox controls with no canonical permission category — under
 * `tools` (`approvalMode` = plan/default/auto-edit/auto/yolo, `autoAccept`,
 * `sandbox`, `sandboxImage`, `disabled`, `visible`, `eager`, `listDirectory`,
-* `todoWrite`, `workflowsEnabled`, `workflowNameOnly`, `executionSandbox`) and
+* `todoWrite`, `codeModeOnly`, `freeform`, `workflowsEnabled`, `workflowNameOnly`,
+* `executionSandbox`) and
 * `security` (`folderTrust`, `allowedHttpHookUrls`, `allowPrivateNetworkHooks`,
 * `allowedInsecureVoiceBaseUrls`) and `skills` (the skill kill-switches
 * `disabled`, `defaultDisabled`, `enabled`, `disabledLevels`, each a list Qwen
@@ -8192,7 +8194,8 @@ const CursorPermissionsOverrideSchema = zod_mini.z.looseObject({
 * changes what the file said is reported in either scope, naming what that key
 * decides there — the autonomy and containment
 * controls (`approvalMode`, `autoAccept`, `sandbox`, `sandboxImage`), the
-* registry controls (`disabled`, `visible`, `listDirectory`, `todoWrite`, and `eager`, which
+* registry controls (`disabled`, `visible`, `listDirectory`, `todoWrite`,
+* `codeModeOnly`, `freeform`, and `eager`, which
 * demotes an omitted tool to deferred rather than removing it, replacing rather
 * than merging with the list a higher scope set), the Auto Mode
 * classifier config, the skill kill-switches, and, because these groups are
@@ -10885,13 +10888,15 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 		license: zod_mini.z.optional(zod_mini.z.unknown()),
 		compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
-		metadata: zod_mini.z.optional(zod_mini.z.unknown())
+		metadata: zod_mini.z.optional(zod_mini.z.unknown()),
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
 	})),
 	mimocode: zod_mini.z.optional(zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 		license: zod_mini.z.optional(zod_mini.z.unknown()),
 		compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
-		metadata: zod_mini.z.optional(zod_mini.z.unknown())
+		metadata: zod_mini.z.optional(zod_mini.z.unknown()),
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
 	})),
 	kilo: zod_mini.z.optional(zod_mini.z.looseObject({
 		"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
@@ -11344,7 +11349,7 @@ async function getLocalSkillDirNames(sourceTree) {
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, zed, pi, omp, qwencode, vibe, grokcli, factorydroid, dsh, reasonix,
-* commandcode, lettacode). Each tool's own section may override that
+* commandcode, lettacode, opencode, mimocode). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -13543,8 +13548,8 @@ function diffSharedConfigOwnedKeys({ fileKey, existingContent, newContent }) {
 	return operations;
 }
 const READ_TOOL_NAME = "Read";
-const isReadDenyEntry = (entry) => entry.startsWith(`${READ_TOOL_NAME}(`) && entry.endsWith(")");
-const buildReadDenyEntry = (pattern) => `${READ_TOOL_NAME}(${pattern})`;
+const isReadDenyEntry = (entry, readToolName = READ_TOOL_NAME) => entry.startsWith(`${readToolName}(`) && entry.endsWith(")");
+const buildReadDenyEntry = (pattern, readToolName = READ_TOOL_NAME) => `${readToolName}(${pattern})`;
 const parsePermissionsBlock = (settings) => {
 	const permissions = settings.permissions ?? {};
 	return {
@@ -13568,9 +13573,9 @@ const withPermissions = (settings, next) => {
 	};
 };
 const applyIgnoreReadDenies = (params) => {
-	const { settings, readDenies } = params;
+	const { settings, readDenies, readToolName = READ_TOOL_NAME } = params;
 	const current = parsePermissionsBlock(settings);
-	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry) || readDenies.includes(entry));
+	const preservedDeny = current.deny.filter((entry) => !isReadDenyEntry(entry, readToolName) || readDenies.includes(entry));
 	return withPermissions(settings, {
 		allow: current.allow,
 		ask: current.ask,
@@ -17897,6 +17902,7 @@ const ANTIGRAVITY_PLUGIN_AGENTS_DIR = "agents";
 const ANTIGRAVITY_PLUGIN_MCP_FILE_NAME = "mcp_config.json";
 const ANTIGRAVITY_PLUGIN_HOOKS_FILE_NAME = "hooks.json";
 const ANTIGRAVITY_PLUGIN_MANIFEST_FILE_NAME = "plugin.json";
+const ANTIGRAVITY_PLUGIN_MANIFEST_FOLDERS = [".antigravity-plugin", ".gemini-plugin"];
 const AUGMENTCODE_PLUGIN_RULES_DIR = "rules";
 const AUGMENTCODE_PLUGIN_COMMANDS_DIR = "commands";
 const AUGMENTCODE_PLUGIN_AGENTS_DIR = "agents";
@@ -19543,9 +19549,36 @@ function commandSlug(relativeFilePath) {
 * skill. Once the command is removed from every source tree's `commands/`
 * directory, the directory stops matching and the skills feature cleans
 * it up as a regular orphan.
+*
+* When `toolTarget` is given, only commands whose `targets` include it (or
+* `*`) count: a command aimed at other tools never reaches this tool's skills
+* tree, so it must not shadow a same-named skill there. Commands that cannot
+* be parsed are skipped, as the commands feature reports them itself.
 */
-async function rulesyncCommandSlugExists({ inputRoots, dirName }) {
-	return (await Promise.all(inputRoots.map((root) => findFilesByGlobs("**/*.md", { cwd: (0, node_path.join)(root, COMMANDS_FEATURE_SUBDIR) })))).flat().some((filePath) => commandSlug((0, node_path.basename)(filePath)) === dirName);
+async function rulesyncCommandSlugExists({ inputRoots, dirName, toolTarget }) {
+	const matching = (await Promise.all(inputRoots.map(async (root) => {
+		const commandsDirPath = (0, node_path.join)(root, COMMANDS_FEATURE_SUBDIR);
+		return (await findFilesByGlobs("**/*.md", { cwd: commandsDirPath })).map((filePath) => ({
+			root,
+			commandsDirPath,
+			filePath
+		}));
+	}))).flat().filter(({ filePath }) => commandSlug((0, node_path.basename)(filePath)) === dirName);
+	if (toolTarget === void 0) return matching.length > 0;
+	for (const { root, commandsDirPath, filePath } of matching) {
+		let targets;
+		try {
+			targets = (await RulesyncCommand.fromFile({
+				outputRoot: root,
+				relativeDirPath: COMMANDS_FEATURE_SUBDIR,
+				relativeFilePath: (0, node_path.relative)(commandsDirPath, filePath)
+			})).getFrontmatter().targets;
+		} catch {
+			continue;
+		}
+		if (targets.includes("*") || targets.includes(toolTarget)) return true;
+	}
+	return false;
 }
 //#endregion
 //#region src/features/commands/devin-command.ts
@@ -19563,7 +19596,7 @@ const DEVIN_COMMAND_SECTION_KEYS = [
 	"permissions",
 	"triggers"
 ];
-function commandSkillContent$1(rulesyncCommand) {
+function commandSkillContent$2(rulesyncCommand) {
 	const slug = commandSlug(rulesyncCommand.getRelativeFilePath());
 	const frontmatter = rulesyncCommand.getFrontmatter();
 	const description = frontmatter.description ?? `${slug} command`;
@@ -19637,7 +19670,7 @@ var DevinCommand = class DevinCommand extends ToolCommand {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: SKILL_FILE_NAME,
 			slug: commandSlug(rulesyncCommand.getRelativeFilePath()),
-			fileContent: commandSkillContent$1(rulesyncCommand)
+			fileContent: commandSkillContent$2(rulesyncCommand)
 		});
 	}
 	getFileContent() {
@@ -21457,6 +21490,180 @@ var KiloCommand = class KiloCommand extends ToolCommand {
 	}
 };
 //#endregion
+//#region src/constants/kimi-code-paths.ts
+const KIMI_CODE_DIR = ".kimi-code";
+const KIMI_CODE_RULE_FILE_NAME = "AGENTS.md";
+const KIMI_CODE_MCP_FILE_NAME = "mcp.json";
+const KIMI_CODE_CONFIG_FILE_NAME = "config.toml";
+const KIMI_CODE_SKILLS_DIR_NAME = "skills";
+const KIMI_CODE_AGENTS_DIR_NAME = "agents";
+const KIMI_CODE_SKILLS_DIR_PATH = (0, node_path.join)(KIMI_CODE_DIR, KIMI_CODE_SKILLS_DIR_NAME);
+(0, node_path.join)(KIMI_CODE_DIR, KIMI_CODE_AGENTS_DIR_NAME);
+const KIMI_CODE_SHARED_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
+const KIMI_CODE_SHARED_AGENTS_DIR_PATH = (0, node_path.join)(".agents", "agents");
+//#endregion
+//#region src/utils/kimi-code.ts
+function getKimiCodeHome() {
+	const configuredHome = process.env.KIMI_CODE_HOME?.trim();
+	return configuredHome ? (0, node_path.resolve)(configuredHome) : void 0;
+}
+function getKimiCodeRelativeDirPath({ global, relativeDirPath = "." }) {
+	return global && getKimiCodeHome() ? relativeDirPath : (0, node_path.join)(KIMI_CODE_DIR, relativeDirPath);
+}
+/**
+* Both spellings the shared user `config.toml` can take: under `.kimi-code/`,
+* or at the root of `KIMI_CODE_HOME` when that override names the profile dir.
+* Declared unconditionally so the derived shared-file keys — and the drift
+* guards checked against them — do not depend on the ambient environment.
+*/
+function getKimiCodeSharedConfigWritePaths() {
+	return [{
+		relativeDirPath: KIMI_CODE_DIR,
+		relativeFilePath: KIMI_CODE_CONFIG_FILE_NAME
+	}, {
+		relativeDirPath: ".",
+		relativeFilePath: KIMI_CODE_CONFIG_FILE_NAME
+	}];
+}
+/**
+* The `SHARED_CONFIG_OWNERSHIP` key of the `config.toml` actually being written.
+* Both spellings carry the same declaration, but passing the key of the file
+* being written keeps the write path and the drift guards on the same entry.
+*/
+function getKimiCodeConfigSharedFileKey({ global }) {
+	return sharedConfigFileKey({
+		relativeDirPath: getKimiCodeRelativeDirPath({ global }),
+		relativeFilePath: KIMI_CODE_CONFIG_FILE_NAME
+	});
+}
+function getKimiCodeRulesyncOutputRoot({ nativeOutputRoot, global }) {
+	return getToolRulesyncOutputRoot({
+		nativeOutputRoot,
+		global,
+		toolHome: getKimiCodeHome
+	});
+}
+//#endregion
+//#region src/features/commands/kimi-code-command.ts
+/**
+* Kimi Code SKILL.md frontmatter keys a command may author through its
+* `kimi-code:` section, each with the alias spellings Kimi also accepts. An
+* alias is normalized to the canonical key; the canonical spelling wins when
+* both are present.
+* @see https://moonshotai.github.io/kimi-code/en/customization/skills.html
+*/
+const KIMI_CODE_COMMAND_SECTION_KEYS = [
+	{
+		key: "type",
+		aliases: []
+	},
+	{
+		key: "whenToUse",
+		aliases: ["when-to-use", "when_to_use"]
+	},
+	{
+		key: "disableModelInvocation",
+		aliases: ["disable-model-invocation", "disable_model_invocation"]
+	},
+	{
+		key: "arguments",
+		aliases: []
+	}
+];
+function pickKimiCodeSectionKeys(section) {
+	const picked = {};
+	for (const { key, aliases } of KIMI_CODE_COMMAND_SECTION_KEYS) {
+		const spelling = [key, ...aliases].find((candidate) => section[candidate] !== void 0);
+		if (spelling !== void 0) picked[key] = section[spelling];
+	}
+	return picked;
+}
+function commandSkillContent$1(rulesyncCommand) {
+	const slug = commandSlug(rulesyncCommand.getRelativeFilePath());
+	const frontmatter = rulesyncCommand.getFrontmatter();
+	const description = frontmatter.description?.trim() || `${slug} command`;
+	return stringifyFrontmatter(rulesyncCommand.getBody().trim(), {
+		name: slug,
+		description,
+		disableModelInvocation: true,
+		...pickKimiCodeSectionKeys(frontmatter["kimi-code"] ?? {})
+	});
+}
+/**
+* Represents a Kimi Code slash command, emitted as a Kimi Code Skill.
+*
+* Kimi Code has no standalone custom-command directory outside plugins: every
+* external Skill is registered as a slash command (`/skill:<name>`, with a
+* `/<name>` shorthand when the bare name is free), and the Skill body supports
+* `$ARGUMENTS`, positional `$0` / `$1`, and named `$<name>` placeholders.
+* Commands are therefore emitted onto the native skills surface, one
+* `SKILL.md` per command: `.kimi-code/skills/<slug>/SKILL.md` (project) and
+* `~/.kimi-code/skills/<slug>/SKILL.md` (global; `$KIMI_CODE_HOME/skills/`
+* when `KIMI_CODE_HOME` is set). Directory-form `SKILL.md` requires both
+* `name` and `description`, so both are always written.
+*
+* Import and deletion are intentionally no-ops for this target: the skills
+* feature owns the `.kimi-code/skills/` tree, so importing it as commands
+* would double-import every skill (mirrors the Devin, Warp and Hermes Agent
+* commands targets).
+*
+* @see https://moonshotai.github.io/kimi-code/en/customization/skills.html
+* @see https://moonshotai.github.io/kimi-code/en/reference/slash-commands.html
+*/
+var KimiCodeCommand = class KimiCodeCommand extends ToolCommand {
+	static isTargetedByRulesyncCommand(rulesyncCommand) {
+		return this.isTargetedByRulesyncCommandDefault({
+			rulesyncCommand,
+			toolTarget: "kimi-code"
+		});
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: getKimiCodeRelativeDirPath({
+			global,
+			relativeDirPath: KIMI_CODE_SKILLS_DIR_NAME
+		}) };
+	}
+	constructor({ slug, ...params }) {
+		super({
+			...params,
+			...slug !== void 0 && {
+				relativeDirPath: (0, node_path.join)(params.relativeDirPath, slug),
+				relativeFilePath: "SKILL.md"
+			}
+		});
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	toRulesyncCommand() {
+		const slug = (0, node_path.basename)((0, node_path.dirname)(this.getRelativePathFromCwd()));
+		const { frontmatter, body } = parseFrontmatter(this.getFileContent(), this.getFilePath());
+		const description = typeof frontmatter.description === "string" ? frontmatter.description : void 0;
+		return new RulesyncCommand({
+			relativeDirPath: RULESYNC_COMMANDS_RELATIVE_DIR_PATH,
+			relativeFilePath: `${slug}.md`,
+			frontmatter: { description },
+			body: body.trimStart()
+		});
+	}
+	static fromRulesyncCommand({ outputRoot, rulesyncCommand, global = false }) {
+		const paths = KimiCodeCommand.getSettablePaths({ global });
+		return new KimiCodeCommand({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: SKILL_FILE_NAME,
+			slug: commandSlug(rulesyncCommand.getRelativeFilePath()),
+			fileContent: commandSkillContent$1(rulesyncCommand)
+		});
+	}
+	getFileContent() {
+		return this.fileContent;
+	}
+};
+//#endregion
 //#region src/features/commands/kimi-code-plugin-command.ts
 /**
 * Kimi Code reads only `name` and `description` from a plugin command. The
@@ -21611,6 +21818,14 @@ const KIRO_IDE_HOOKS_FILE_NAME = "rulesync.json";
 const KIRO_MCP_FILE_NAME = "mcp.json";
 const KIRO_IGNORE_FILE_NAME = ".kiroignore";
 const KIRO_GLOBAL_IGNORE_FILE_NAME = "kiroignore";
+/**
+* Kiro's capability-based permission rules (IDE 1.0, CLI V3). The user-level
+* file lives at `~/.kiro/settings/permissions.yaml`; the workspace-level file
+* sits under a hash-derived `~/.kiro/workspace-roots/<hash>/` directory outside
+* the repository, so only the user-level file is generated.
+* @see https://kiro.dev/docs/permissions/
+*/
+const KIRO_PERMISSIONS_FILE_NAME = "permissions.yaml";
 //#endregion
 //#region src/features/commands/kiro-command.ts
 var KiroCommand = class KiroCommand extends ToolCommand {
@@ -23653,6 +23868,11 @@ const TraeCommandFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.optional(zod_mini.z.string())
 });
 /**
+* Trae reads project commands only up to three directory levels below
+* `.trae/commands/`; a command file nested deeper is never picked up.
+*/
+const TRAE_MAX_PROJECT_COMMAND_DIR_DEPTH = 3;
+/**
 * Custom command for Trae.
 *
 * Trae reads Markdown command files under `.trae/commands/` (project, up to
@@ -23712,10 +23932,11 @@ var TraeCommand = class TraeCommand extends ToolCommand {
 	}
 	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
 		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
+		const { name: _name, ...traeFields } = rulesyncFrontmatter.trae ?? {};
 		const traeFrontmatter = {
-			name: (0, node_path.basename)(rulesyncCommand.getRelativeFilePath(), ".md"),
+			name: this.deriveName(rulesyncCommand),
 			description: rulesyncFrontmatter.description,
-			...rulesyncFrontmatter.trae
+			...traeFields
 		};
 		return new TraeCommand({
 			outputRoot,
@@ -23741,6 +23962,36 @@ var TraeCommand = class TraeCommand extends ToolCommand {
 			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
 		};
 	}
+	/**
+	* Warn about commands Trae will not load as written: Trae documents `name`
+	* as the command's unique identifier, so two commands deriving the same
+	* `name` (e.g. `a/review.md` and `b/review.md`) collide, and it reads
+	* project commands only up to three nested directory levels. Both files are
+	* still written, so this warns rather than failing the run.
+	*/
+	static validateRulesyncCommands({ rulesyncCommands, logger, global = false }) {
+		const pathsByName = /* @__PURE__ */ new Map();
+		for (const rulesyncCommand of rulesyncCommands) {
+			if (!this.isTargetedByRulesyncCommand(rulesyncCommand)) continue;
+			const relativeFilePath = toPosixPath(rulesyncCommand.getRelativeFilePath());
+			const name = this.deriveName(rulesyncCommand);
+			if (typeof name === "string") pathsByName.set(name, [...pathsByName.get(name) ?? [], relativeFilePath]);
+			const dirDepth = relativeFilePath.split("/").length - 1;
+			if (!global && dirDepth > TRAE_MAX_PROJECT_COMMAND_DIR_DEPTH) logger.warn(`Trae reads project commands only up to ${TRAE_MAX_PROJECT_COMMAND_DIR_DEPTH} nested directory levels, so ${quoteForLog(relativeFilePath)} is written but never loaded. Move it to a shallower directory.`);
+		}
+		for (const [name, paths] of pathsByName) {
+			if (paths.length < 2) continue;
+			logger.warn(`Trae command name ${quoteForLog(name)} is shared by ${paths.map(quoteForLog).join(", ")}, but Trae treats \`name\` as a unique identifier. Rename a file or set \`trae.name\` to tell them apart.`);
+		}
+	}
+	/**
+	* The `name` Trae sees for a command: the `trae` section's `name` when set,
+	* otherwise the file name stem. A non-string override is returned as is so
+	* frontmatter validation still rejects it.
+	*/
+	static deriveName(rulesyncCommand) {
+		return rulesyncCommand.getFrontmatter().trae?.name ?? (0, node_path.basename)(rulesyncCommand.getRelativeFilePath(), ".md");
+	}
 	static isTargetedByRulesyncCommand(rulesyncCommand) {
 		return this.isTargetedByRulesyncCommandDefault({
 			rulesyncCommand,
@@ -24324,6 +24575,17 @@ const toolCommandFactories = /* @__PURE__ */ new Map([
 			supportsSubdirectory: false
 		}
 	}],
+	["kimi-code", {
+		class: KimiCodeCommand,
+		meta: {
+			extension: "md",
+			supportsProject: true,
+			supportsGlobal: true,
+			isSimulated: false,
+			supportsSubdirectory: false,
+			skipToolFileScan: true
+		}
+	}],
 	["kimi-code-plugin", {
 		class: KimiCodePluginCommand,
 		meta: {
@@ -24577,7 +24839,8 @@ var CommandsProcessor = class extends FeatureProcessor {
 		await factory.class.validateRulesyncCommands?.({
 			inputRoots: this.inputRoots,
 			rulesyncCommands,
-			logger: this.logger
+			logger: this.logger,
+			global: this.global
 		});
 		const flattenedPathOrigins = /* @__PURE__ */ new Map();
 		const toolCommands = [];
@@ -26257,8 +26520,8 @@ function isSupportedHookType({ type, converterConfig }) {
 * side either way, so the value is dropped rather than carried into a config
 * the tool would ignore or refuse.
 */
-function isKeywordFieldApplicable({ spec, hookType, eventName, direction, warn }) {
-	const { canonical, tool, commandOnly, events } = spec;
+function isKeywordFieldApplicable({ spec, hookType, eventName, flags, direction, warn }) {
+	const { canonical, tool, commandOnly, hookTypes, events, ignoredEvents, ignoredWhenFlags } = spec;
 	const field = direction === "generated" ? canonical : tool;
 	if (!isFieldApplicable({
 		commandOnly,
@@ -26267,10 +26530,23 @@ function isKeywordFieldApplicable({ spec, hookType, eventName, direction, warn }
 		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not ${direction}.`);
 		return false;
 	}
+	if (hookTypes !== void 0 && !hookTypes.has(hookType)) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${[...hookTypes].map((type) => `"${type}"`).join(", ")} hooks only, so it is not ${direction}.`);
+		return false;
+	}
 	if (events !== void 0 && !events.has(eventName)) {
 		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
 		return false;
 	}
+	if (ignoredEvents?.has(eventName)) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool ignores "${tool}" on "${eventName}", so it is not ${direction}.`);
+		return false;
+	}
+	const setFlag = hookType === "command" ? ignoredWhenFlags?.find((flag) => flags[flag] === true) : void 0;
+	if (setFlag !== void 0) {
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool ignores "${tool}" on a hook that sets "${setFlag}", so it is not ${direction}.`);
+		return false;
+	}
 	return true;
 }
 /**
@@ -26287,6 +26563,7 @@ function emitKeywordFields({ def, hookType, eventName, fields, warn }) {
 			spec,
 			hookType,
 			eventName,
+			flags: def,
 			direction: "generated",
 			warn
 		})) emitted[spec.tool] = spec.trueValue;
@@ -26308,6 +26585,7 @@ function importKeywordFields({ h, hookType, eventName, fields, warn }) {
 			spec,
 			hookType,
 			eventName,
+			flags: h,
 			direction: "imported",
 			warn
 		})) continue;
@@ -28200,6 +28478,20 @@ const CLAUDE_SPEC = {
 				tool: "continueOnBlock"
 			}
 		],
+		keywordPassthroughFields: [{
+			canonical: "failClosed",
+			tool: "onFailure",
+			trueValue: "block",
+			falseValue: "continue",
+			hookTypes: /* @__PURE__ */ new Set(["command", "http"]),
+			ignoredEvents: /* @__PURE__ */ new Set([
+				"stop",
+				"subagentStop",
+				"taskCompleted",
+				"teammateIdle"
+			]),
+			ignoredWhenFlags: ["async", "asyncRewake"]
+		}],
 		arrayPassthroughFields: [{
 			canonical: "args",
 			tool: "args",
@@ -28922,18 +29214,20 @@ const CODEXCLI_CONVERTER_CONFIG = {
 	canonicalToToolEventNames: CANONICAL_TO_CODEXCLI_EVENT_NAMES,
 	toolToCanonicalEventNames: CODEXCLI_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	supportedHookTypes: /* @__PURE__ */ new Set(["command"]),
+	supportedHookTypes: /* @__PURE__ */ new Set(["command", "mcp_tool"]),
 	passthroughFields: ["name", "description"],
 	stringPassthroughFields: [{
 		canonical: "commandWindows",
-		tool: "commandWindows"
+		tool: "commandWindows",
+		commandOnly: true
 	}, {
 		canonical: "statusMessage",
 		tool: "statusMessage"
 	}],
 	numberPassthroughFields: [{
 		canonical: "additionalContextLimit",
-		tool: "additionalContextLimit"
+		tool: "additionalContextLimit",
+		commandOnly: true
 	}],
 	booleanPassthroughFields: [{
 		canonical: "async",
@@ -28942,6 +29236,74 @@ const CODEXCLI_CONVERTER_CONFIG = {
 	}]
 };
 /**
+* Whether a JSON value holds a `null` anywhere. Codex rejects an `mcp_tool`
+* hook `input` that cannot be represented as TOML (it hashes the handler as
+* TOML for trust review), and `null` is the one JSON value TOML lacks.
+*/
+function containsNull(value) {
+	if (value === null) return true;
+	if (Array.isArray(value)) return value.some(containsNull);
+	if (typeof value === "object") return Object.values(value).some(containsNull);
+	return false;
+}
+const WHOLE_FILE_FAILURE = "Codex fails to load the whole hooks file on such a handler";
+/**
+* Why this generated handler must not be written, or `undefined` when Codex
+* can load and run it. Codex deserializes `timeout` as `Option<u64>` on every
+* handler type, and `server` / `tool` as required strings plus `input` as a
+* TOML-representable map on `mcp_tool`; a handler that fails that stops the
+* whole hooks file from loading rather than just that one hook. An empty
+* `server` / `tool` string still loads but can never resolve to a tool.
+* https://github.com/openai/codex/blob/main/codex-rs/config/src/hook_config.rs
+*/
+function describeRejectedHandler(handler) {
+	const { timeout } = handler;
+	if (timeout !== void 0 && (typeof timeout !== "number" || !Number.isSafeInteger(timeout) || timeout < 0)) return `its "timeout" ${JSON.stringify(timeout) ?? String(timeout)} is not a non-negative integer, and ${WHOLE_FILE_FAILURE}`;
+	if (handler.type !== "mcp_tool") return;
+	for (const field of ["server", "tool"]) {
+		const value = handler[field];
+		if (typeof value !== "string") return `it has no "${field}", and ${WHOLE_FILE_FAILURE}`;
+		if (value === "") return `its "${field}" is empty, so it can never resolve to an MCP tool`;
+	}
+	if (containsNull(handler.input)) return `its "input" holds a null, which Codex cannot represent as TOML, and ${WHOLE_FILE_FAILURE}`;
+}
+/**
+* Drop the generated handlers Codex would refuse to load (or could never
+* run), and warn about the `mcp_tool` ones Codex loads but skips (`SessionEnd`
+* MCP hooks are skipped with a startup warning). Matcher groups left without
+* handlers are removed. https://learn.chatgpt.com/docs/hooks
+*/
+function filterCodexHandlers({ hooks, logger }) {
+	const result = {};
+	const skippedSessionEndTools = [];
+	for (const [eventName, groups] of Object.entries(hooks)) {
+		const kept = [];
+		for (const group of groups) {
+			const entry = group;
+			if (!Array.isArray(entry.hooks)) {
+				kept.push(group);
+				continue;
+			}
+			const handlers = entry.hooks.filter((handler) => {
+				const reason = describeRejectedHandler(handler);
+				if (reason !== void 0) {
+					logger?.warn(`Skipping a "${String(handler.type)}" hook on Codex CLI "${eventName}": ${reason}.`);
+					return false;
+				}
+				if (eventName === "SessionEnd" && handler.type === "mcp_tool") skippedSessionEndTools.push(`${String(handler.server)}/${String(handler.tool)}`);
+				return true;
+			});
+			if (handlers.length > 0) kept.push({
+				...entry,
+				hooks: handlers
+			});
+		}
+		if (kept.length > 0) result[eventName] = kept;
+	}
+	if (skippedSessionEndTools.length > 0) logger?.warn(`Codex CLI skips "mcp_tool" hooks on "SessionEnd" with a startup warning, so these are written but will not run: ${skippedSessionEndTools.join(", ")}.`);
+	return result;
+}
+/**
 * Build the content for `.codex/config.toml`, cleaning up the deprecated `codex_hooks` key.
 * Reads the existing file (if any), parses TOML, and returns the content without writing to
 * disk. The caller is responsible for writing via the normal write phase.
@@ -29034,10 +29396,13 @@ var CodexcliHooks = class CodexcliHooks extends ToolHooks {
 		const config = rulesyncHooks.getJson();
 		const merged = mergeGeneratedHookLists({
 			existingContent,
-			generatedHooks: canonicalToToolHooks({
-				config,
-				toolOverrideHooks: config.codexcli?.hooks,
-				converterConfig: CODEXCLI_CONVERTER_CONFIG,
+			generatedHooks: filterCodexHandlers({
+				hooks: canonicalToToolHooks({
+					config,
+					toolOverrideHooks: config.codexcli?.hooks,
+					converterConfig: CODEXCLI_CONVERTER_CONFIG,
+					logger
+				}),
 				logger
 			}),
 			shape: "matcher-groups",
@@ -32216,60 +32581,6 @@ var KiloHooks = class KiloHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/constants/kimi-code-paths.ts
-const KIMI_CODE_DIR = ".kimi-code";
-const KIMI_CODE_RULE_FILE_NAME = "AGENTS.md";
-const KIMI_CODE_MCP_FILE_NAME = "mcp.json";
-const KIMI_CODE_CONFIG_FILE_NAME = "config.toml";
-const KIMI_CODE_SKILLS_DIR_NAME = "skills";
-const KIMI_CODE_AGENTS_DIR_NAME = "agents";
-const KIMI_CODE_SKILLS_DIR_PATH = (0, node_path.join)(KIMI_CODE_DIR, KIMI_CODE_SKILLS_DIR_NAME);
-(0, node_path.join)(KIMI_CODE_DIR, KIMI_CODE_AGENTS_DIR_NAME);
-const KIMI_CODE_SHARED_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
-const KIMI_CODE_SHARED_AGENTS_DIR_PATH = (0, node_path.join)(".agents", "agents");
-//#endregion
-//#region src/utils/kimi-code.ts
-function getKimiCodeHome() {
-	const configuredHome = process.env.KIMI_CODE_HOME?.trim();
-	return configuredHome ? (0, node_path.resolve)(configuredHome) : void 0;
-}
-function getKimiCodeRelativeDirPath({ global, relativeDirPath = "." }) {
-	return global && getKimiCodeHome() ? relativeDirPath : (0, node_path.join)(KIMI_CODE_DIR, relativeDirPath);
-}
-/**
-* Both spellings the shared user `config.toml` can take: under `.kimi-code/`,
-* or at the root of `KIMI_CODE_HOME` when that override names the profile dir.
-* Declared unconditionally so the derived shared-file keys — and the drift
-* guards checked against them — do not depend on the ambient environment.
-*/
-function getKimiCodeSharedConfigWritePaths() {
-	return [{
-		relativeDirPath: KIMI_CODE_DIR,
-		relativeFilePath: KIMI_CODE_CONFIG_FILE_NAME
-	}, {
-		relativeDirPath: ".",
-		relativeFilePath: KIMI_CODE_CONFIG_FILE_NAME
-	}];
-}
-/**
-* The `SHARED_CONFIG_OWNERSHIP` key of the `config.toml` actually being written.
-* Both spellings carry the same declaration, but passing the key of the file
-* being written keeps the write path and the drift guards on the same entry.
-*/
-function getKimiCodeConfigSharedFileKey({ global }) {
-	return sharedConfigFileKey({
-		relativeDirPath: getKimiCodeRelativeDirPath({ global }),
-		relativeFilePath: KIMI_CODE_CONFIG_FILE_NAME
-	});
-}
-function getKimiCodeRulesyncOutputRoot({ nativeOutputRoot, global }) {
-	return getToolRulesyncOutputRoot({
-		nativeOutputRoot,
-		global,
-		toolHome: getKimiCodeHome
-	});
-}
-//#endregion
 //#region src/features/hooks/kimi-code-hooks.ts
 function runFromTrustedDirectory({ command, trustedDirectory }) {
 	if (process.platform === "win32") return `set "RULESYNC_KIMI_HOOK_CWD=1" && cd /d "${trustedDirectory.replaceAll("%", "%%").replaceAll("\"", "\"\"")}" && ${command}`;
@@ -35726,7 +36037,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		},
 		supportedEvents: CODEXCLI_HOOK_EVENTS,
-		supportedHookTypes: ["command"],
+		supportedHookTypes: ["command", "mcp_tool"],
 		supportsMatcher: true
 	}],
 	["commandcode", {
@@ -37988,6 +38299,23 @@ function toReasonixTable(value) {
 	if (!isPlainObject$1(value)) return {};
 	return { ...value };
 }
+/**
+* The tool name a Reasonix `[permissions]` rule must use to reach file reads.
+* Reasonix matches a rule's tool exactly against its registered tools
+* (`read_file`, `write_file`, `grep`, ...); only `Bash`, `Edit`, `Browser` and
+* `Computer` are Claude-Code-style aliases (`canonicalRuleTool` in
+* `internal/safety/permission/permission.go`), so a `Read(...)` rule matches
+* nothing. Shared by the `ignore` and `permissions` adapters, which both write
+* read denies into the same table.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/v2.41.0/internal/safety/permission/permission.go
+*/
+const REASONIX_READ_TOOL_NAME = "read_file";
+/**
+* The spelling rulesync wrote for read rules before it followed the Reasonix
+* tool vocabulary. Still accepted on import, and an entry spelled this way is
+* treated as rulesync-owned on generate so the dormant copy is replaced.
+*/
+const REASONIX_LEGACY_READ_TOOL_NAME = "Read";
 //#endregion
 //#region src/features/ignore/reasonix-ignore.ts
 const permissionsTableOf = (document) => toReasonixTable(document.permissions);
@@ -38006,10 +38334,15 @@ const asClaudeStyleSettings = (document) => {
 			...table,
 			allow: toReasonixStringArray(table.allow),
 			ask: toReasonixStringArray(table.ask),
-			deny: toReasonixStringArray(table.deny)
+			deny: toReasonixStringArray(table.deny).filter((entry) => !isReadDenyEntry(entry, REASONIX_LEGACY_READ_TOOL_NAME))
 		}
 	};
 };
+/** The pattern of a `read_file(...)` (or legacy `Read(...)`) deny, else null. */
+const readDenyPatternOf = (entry) => {
+	for (const toolName of [REASONIX_READ_TOOL_NAME, REASONIX_LEGACY_READ_TOOL_NAME]) if (isReadDenyEntry(entry, toolName)) return entry.slice(toolName.length + 1, -1);
+	return null;
+};
 /**
 * Drop a `[permissions]` table that ended up with nothing in it, so an empty
 * `.rulesyncignore` does not add a bare table header to a file that never had
@@ -38022,13 +38355,16 @@ const withoutEmptyPermissions = (settings) => {
 	return document;
 };
 /**
-* Writes `.rulesyncignore` patterns as `Read(<pattern>)` entries in the
+* Writes `.rulesyncignore` patterns as `read_file(<pattern>)` entries in the
 * `[permissions] deny` table of `reasonix.toml` (project) /
 * `~/.reasonix/config.toml` (global).
 *
 * `deny` is the right target rather than `[sandbox] forbid_read`: deny rules
 * take glob specifiers (`Edit(docs/**)`) and are "a hard block in every mode",
 * while `forbid_read` is documented as absolute paths with no glob support.
+* The tool is spelled `read_file` because Reasonix matches rule tools against
+* its registered tool names (see {@link REASONIX_READ_TOOL_NAME}); a legacy
+* `Read(...)` deny is still read back on import.
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
 */
 var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
@@ -38055,7 +38391,7 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 		return false;
 	}
 	toRulesyncIgnore() {
-		const rulesyncPatterns = this.patterns.filter((pattern) => isReadDenyEntry(pattern)).map((pattern) => pattern.slice(5, -1)).filter((pattern) => pattern.length > 0);
+		const rulesyncPatterns = (0, es_toolkit.uniq)(this.patterns.map((entry) => readDenyPatternOf(entry)).filter((pattern) => pattern !== null && pattern.length > 0));
 		return new RulesyncIgnore({
 			outputRoot: this.outputRoot,
 			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
@@ -38064,7 +38400,7 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 		});
 	}
 	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
-		const readDenies = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((pattern) => buildReadDenyEntry(pattern));
+		const readDenies = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((pattern) => buildReadDenyEntry(pattern, REASONIX_READ_TOOL_NAME));
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingDocument = parseSharedConfig({
@@ -38074,7 +38410,8 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 		});
 		const document = withoutEmptyPermissions(applyIgnoreReadDenies({
 			settings: asClaudeStyleSettings(existingDocument),
-			readDenies
+			readDenies,
+			readToolName: REASONIX_READ_TOOL_NAME
 		}));
 		return new ReasonixIgnore({
 			outputRoot,
@@ -45577,7 +45914,7 @@ var KiloMcp = class KiloMcp extends ToolMcp {
 				feature: "mcp",
 				existingContent: fileContent ?? "",
 				patch: {
-					mcp: convertedMcp,
+					mcp: undefinedWhenEmpty(convertedMcp),
 					...buildKiloMcpPermissionPatch({
 						existing: existingDocument,
 						managedServerNames: (0, es_toolkit.uniq)([...Object.keys(mcpServers), ...Object.keys(isRecord$1(existingDocument.mcp) ? existingDocument.mcp : {})]),
@@ -46437,7 +46774,7 @@ var OpencodeMcp = class extends ToolMcp {
 				feature: "mcp",
 				existingContent: fileContent ?? "",
 				patch: {
-					mcp: convertedMcp,
+					mcp: undefinedWhenEmpty(convertedMcp),
 					tools: Object.keys(mcpTools).length > 0 ? mcpTools : void 0
 				},
 				filePath: (0, node_path.join)(jsonDir, relativeFilePath),
@@ -46785,9 +47122,12 @@ function convertFromMusecodeFormat(musecodeMcp) {
 /**
 * Meta Muse Code MCP servers.
 *
-* Muse Code reads MCP servers only from the `mcp_servers` (or `mcpServers`)
-* block of the GLOBAL user settings file `~/.config/muse/settings.json`; no
-* project-scoped MCP location is documented. The settings file must carry
+* rulesync writes Muse Code MCP servers only to the `mcp_servers` (or
+* `mcpServers`) block of the GLOBAL user settings file
+* `~/.config/muse/settings.json`, the location extending.md documents. Muse
+* Code 1.4.0+ also loads a trusted project `.mcp.json` (changelog only), which
+* is not emitted here because the `claudecode` target already writes that
+* file. The settings file must carry
 * `"schema_version": 1` — a file that omits that key fails every command at
 * startup with `malformed settings file` — so the key is bootstrapped when the
 * file is created and preserved when it already exists. Other settings keys are
@@ -46795,6 +47135,7 @@ function convertFromMusecodeFormat(musecodeMcp) {
 *
 * @see https://dev.meta.ai/docs/muse-code/configuration.md
 * @see https://dev.meta.ai/docs/muse-code/extending.md
+* @see https://dev.meta.ai/docs/muse-code/changelog
 */
 var MusecodeMcp = class MusecodeMcp extends ToolMcp {
 	json;
@@ -48027,7 +48368,7 @@ var QwencodeMcp = class QwencodeMcp extends ToolMcp {
 				feature: "mcp",
 				existingContent,
 				patch: {
-					mcpServers: convertToQwencodeFormat(rulesyncMcp.getMcpServers()),
+					mcpServers: undefinedWhenEmpty(convertToQwencodeFormat(rulesyncMcp.getMcpServers())),
 					...mcpPatch !== void 0 && { mcp: mcpPatch }
 				},
 				filePath
@@ -55439,6 +55780,7 @@ const CLAUDECODE_USER_SCOPE_ONLY_KEYS = /* @__PURE__ */ new Set([
 	"dialogExpiry",
 	"feedbackDrafts",
 	"footerLinksRegexes",
+	"forceLoginGatewayUrl",
 	"modelPicker",
 	"pluginConfigs",
 	"prependPlugins",
@@ -55452,6 +55794,39 @@ const CLAUDECODE_USER_SCOPE_ONLY_KEYS = /* @__PURE__ */ new Set([
 	"vimInsertModeRemaps"
 ]);
 /**
+* Nested settings paths under an otherwise project-honored top-level key that
+* Claude Code reads only from user settings — the nested counterpart of
+* {@link CLAUDECODE_USER_SCOPE_ONLY_KEYS}. `worktree` is `Any file`, but
+* `worktree.location` (where Desktop SSH sessions create worktrees on the
+* remote machine) is documented with a `User` scope, so it is dropped from a
+* project `.claude/settings.json` and written only under `--global`, while its
+* siblings are kept.
+*
+* @see https://code.claude.com/docs/en/settings-reference#worktree-location
+*/
+const CLAUDECODE_USER_SCOPE_ONLY_NESTED_PATHS = [["worktree", "location"]];
+/**
+* Drops {@link CLAUDECODE_USER_SCOPE_ONLY_NESTED_PATHS} from the top-level
+* passthrough at project scope, in place, warning once per dropped path. The
+* authored subtree is copied before the deletion so the caller's config is not
+* mutated, and a parent the removal emptied is dropped with it.
+*/
+function stripUserScopeOnlyNestedPaths({ overrides, global, relativeFilePath, logger }) {
+	if (global) return;
+	for (const path of CLAUDECODE_USER_SCOPE_ONLY_NESTED_PATHS) {
+		const [topLevelKey] = path;
+		if (topLevelKey === void 0 || !isRecord$1(overrides[topLevelKey])) continue;
+		const copy = { [topLevelKey]: structuredClone(overrides[topLevelKey]) };
+		if (!deleteSandboxPath({
+			target: copy,
+			path
+		})) continue;
+		if (copy[topLevelKey] === void 0) delete overrides[topLevelKey];
+		else overrides[topLevelKey] = copy[topLevelKey];
+		logger?.warn(`Claude Code permissions: '${path.map((segment) => displayKey(segment)).join(".")}' is not honored in the project-scoped ${relativeFilePath}, so it is not written there — Claude Code reads it from user settings only. Author it in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+	}
+}
+/**
 * Top-level settings keys neither file rulesync writes can honor, with the file
 * that does. `Managed` keys are read only from the settings file an organization
 * deploys, and `Global config` keys only from `~/.claude.json` — rulesync writes
@@ -55489,7 +55864,6 @@ const CLAUDECODE_UNHONORED_KEY_SOURCES = {
 	disableMobileSimulatorTools: "managed settings",
 	disableSideloadFlags: "managed settings",
 	externalEditorContext: "~/.claude.json",
-	forceLoginGatewayUrl: "managed settings",
 	forceRemoteSettingsRefresh: "managed settings",
 	gatewayInternalNetworks: "managed settings",
 	leftArrowOpensAgents: "~/.claude.json",
@@ -55648,8 +56022,9 @@ const CLAUDECODE_ENV_IGNORED_IN_EVERY_FILE = /* @__PURE__ */ new Set([
 /**
 * `env` variables a project or local settings file cannot set, because a
 * checked-out repository should not control them: where Claude Code stores its
-* own files, what session content it exports, where telemetry goes, and how it
-* starts or syncs. Claude Code drops them there, so they are skipped at project scope and emitted only under `--global`.
+* own files, what session content it exports, where telemetry goes, how it
+* starts or syncs, the timers on an unanswered dialog, and whether it processes
+* attachments or expands `@` file mentions. Claude Code drops them there, so they are skipped at project scope and emitted only under `--global`.
 *
 * Only the names the settings reference lists are covered; its directory and
 * Windows groups are introduced with "such as", so an unlisted member of those
@@ -55660,6 +56035,10 @@ const CLAUDECODE_ENV_IGNORED_IN_EVERY_FILE = /* @__PURE__ */ new Set([
 */
 const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"BETA_TRACING_ENDPOINT",
+	"CLAUDE_AFK_COUNTDOWN_MS",
+	"CLAUDE_AFK_TIMEOUT_MS",
+	"CLAUDE_CODE_DISABLE_ATTACHMENTS",
+	"CLAUDE_CODE_DISABLE_FILE_MENTIONS",
 	"CLAUDE_CODE_ENABLE_TELEMETRY",
 	"CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
 	"CLAUDE_CODE_PLUGIN_CACHE_DIR",
@@ -55668,6 +56047,7 @@ const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"CLAUDE_CODE_SYNC_PLUGINS",
 	"CLAUDE_CODE_SYNC_SKILLS",
 	"CLAUDE_CODE_TMPDIR",
+	"CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS",
 	"CLAUDE_CONFIG_DIR",
 	"ENABLE_BETA_TRACING_DETAILED",
 	"ENABLE_ENHANCED_TELEMETRY_BETA",
@@ -55713,6 +56093,13 @@ const CLAUDECODE_ENV_CONTENT_OFF_VALUES = /* @__PURE__ */ new Set([
 * writing a value Claude Code ignores is the old behavior, while dropping an
 * opt-out it honors would remove a privacy setting. `OTEL_LOG_ASSISTANT_RESPONSES`
 * has no such exception and sits in the plain name table above.
+*
+* `CLAUDE_CODE_ENABLE_CFC` follows the same shape for a different reason: a
+* project cannot turn Claude in Chrome on, since a checked-out repository must
+* not be able to connect Claude to the user's browser, so only an off value is
+* kept at project scope.
+*
+* @see https://code.claude.com/docs/en/chrome#project-settings-cant-turn-on-chrome
 */
 const CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES = {
 	OTEL_LOGS_EXPORTER: CLAUDECODE_ENV_EXPORTER_OFF_VALUES,
@@ -55720,7 +56107,8 @@ const CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES = {
 	OTEL_TRACES_EXPORTER: CLAUDECODE_ENV_EXPORTER_OFF_VALUES,
 	OTEL_LOG_USER_PROMPTS: CLAUDECODE_ENV_CONTENT_OFF_VALUES,
 	OTEL_LOG_TOOL_CONTENT: CLAUDECODE_ENV_CONTENT_OFF_VALUES,
-	OTEL_LOG_TOOL_DETAILS: CLAUDECODE_ENV_CONTENT_OFF_VALUES
+	OTEL_LOG_TOOL_DETAILS: CLAUDECODE_ENV_CONTENT_OFF_VALUES,
+	CLAUDE_CODE_ENABLE_CFC: CLAUDECODE_ENV_CONTENT_OFF_VALUES
 };
 function isProjectIgnoredEnvVariable(name, value) {
 	if (CLAUDECODE_ENV_PROJECT_IGNORED_NAMES.has(name) || name.startsWith("XDG_")) return true;
@@ -55757,7 +56145,7 @@ function stripIgnoredEnvVariables({ env, global, relativeFilePath, logger }) {
 		kept[name] = value;
 	}
 	if (ignoredEverywhere.length > 0) logger?.warn(`Claude Code permissions: Claude Code ignores ${ignoredEverywhere.map((name) => `'env.${name}'`).join(", ")} in every settings file, so ${ignoredEverywhere.length === 1 ? "it is" : "they are"} not written to ${relativeFilePath}. Set ${ignoredEverywhere.length === 1 ? "it" : "them"} in the environment Claude Code starts from instead, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
-	if (ignoredAtProjectScope.length > 0) logger?.warn(`Claude Code permissions: ${ignoredAtProjectScope.map((name) => `'env.${name}'`).join(", ")} ${ignoredAtProjectScope.length === 1 ? "is" : "are"} not honored in the project-scoped ${relativeFilePath}, so ${ignoredAtProjectScope.length === 1 ? "it is" : "they are"} not written there — Claude Code ignores variables there that choose where it writes its files, export session content or telemetry, or change how it starts or syncs (a value that turns telemetry off, such as "none" or "0", is still written). Author ${ignoredAtProjectScope.length === 1 ? "it" : "them"} in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+	if (ignoredAtProjectScope.length > 0) logger?.warn(`Claude Code permissions: ${ignoredAtProjectScope.map((name) => `'env.${name}'`).join(", ")} ${ignoredAtProjectScope.length === 1 ? "is" : "are"} not honored in the project-scoped ${relativeFilePath}, so ${ignoredAtProjectScope.length === 1 ? "it is" : "they are"} not written there — Claude Code ignores variables there that choose where it writes its files, export session content or telemetry, change how it starts or syncs, set dialog timers, turn attachments or file mentions off, or turn Claude in Chrome on (a value that turns telemetry or Chrome off, such as "none" or "0", is still written). Author ${ignoredAtProjectScope.length === 1 ? "it" : "them"} in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
 	return kept;
 }
 /**
@@ -55988,6 +56376,12 @@ var ClaudecodePermissions = class ClaudecodePermissions extends ToolPermissions
 			relativeFilePath: paths.relativeFilePath,
 			logger
 		});
+		stripUserScopeOnlyNestedPaths({
+			overrides: overrideTopLevel,
+			global,
+			relativeFilePath: paths.relativeFilePath,
+			logger
+		});
 		const { filtered: scopedTopLevel, trustAffecting: trustAffectingTopLevel } = stripUnhonoredTopLevelKeys({
 			overrides: overrideTopLevel,
 			global,
@@ -56405,7 +56799,7 @@ const CODEBUDDY_RULE_LISTS = [
 	"ask",
 	"deny"
 ];
-const CATCH_ALL_PATTERN$11 = "*";
+const CATCH_ALL_PATTERN$12 = "*";
 const MCP_CATEGORY = "mcp";
 const MCP_RULE_PREFIX = "mcp__";
 const ALL_MCP_RULE = "mcp__*";
@@ -56478,7 +56872,7 @@ function categoryOfRule$2(rule) {
 *   and reach the `Bash` rules through `honorAllToolsOnBash`.
 */
 function buildCodebuddyRule({ category, pattern, action, logger }) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$11;
+	const catchAll = pattern === CATCH_ALL_PATTERN$12;
 	if (category === MCP_CATEGORY) {
 		if (catchAll && action === "allow") {
 			logger?.warn(`CodeBuddy permissions: skipping the 'mcp' allow rule '*' — CodeBuddy honors the all-MCP wildcard 'mcp__*' in deny and ask only. Allow servers by name instead (for example 'mcp__github').`);
@@ -56487,7 +56881,7 @@ function buildCodebuddyRule({ category, pattern, action, logger }) {
 		return catchAll ? ALL_MCP_RULE : `${MCP_RULE_PREFIX}${pattern}`;
 	}
 	if (category === "*") {
-		if (catchAll) return CATCH_ALL_PATTERN$11;
+		if (catchAll) return CATCH_ALL_PATTERN$12;
 		logger?.warn(`CodeBuddy permissions: skipping the all-tools '*' rule '${pattern}' — CodeBuddy's standalone '*' rule takes no specifier. Write it under the category it is meant for (for example 'bash' or 'read').`);
 		return null;
 	}
@@ -56505,7 +56899,7 @@ function parseCodebuddyRule(rule) {
 	const { specifier } = splitCodebuddyRule(rule);
 	if (specifier === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$11
+		pattern: CATCH_ALL_PATTERN$12
 	};
 	const trimmed = specifier.trim();
 	return trimmed === "" ? null : {
@@ -58756,7 +59150,7 @@ function mapBashActionToDecision(action) {
 //#region src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$10 = "*";
+const CATCH_ALL_PATTERN$11 = "*";
 const MCP_CANONICAL_PREFIX$6 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
@@ -58781,14 +59175,14 @@ const COMMANDCODE_TOOL_TO_CATEGORY = {
 	web_fetch: "webfetch",
 	web_search: "websearch"
 };
-const ACTION_RANK$4 = {
+const ACTION_RANK$5 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
 /** Whether `action` outranks `existing` (deny > ask > allow). */
 function isStricterAction({ action, existing }) {
-	return existing === void 0 || ACTION_RANK$4[action] > ACTION_RANK$4[existing];
+	return existing === void 0 || ACTION_RANK$5[action] > ACTION_RANK$5[existing];
 }
 /**
 * Why a padded `Shell( * )` cannot stand in for the bare `Shell` in `allow`:
@@ -58811,10 +59205,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$10 || pattern === "";
+	const catchAll = pattern === CATCH_ALL_PATTERN$11 || pattern === "";
 	if (category.startsWith(MCP_CANONICAL_PREFIX$6)) return catchAll ? category : `${category}(${pattern})`;
 	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$6}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$10 : null;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$11 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -58850,7 +59244,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$10;
+	return inner === "" || inner === CATCH_ALL_PATTERN$11;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -58884,34 +59278,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$10,
+		pattern: CATCH_ALL_PATTERN$11,
 		notInAllow: true
 	};
 	if (tool.startsWith(MCP_CANONICAL_PREFIX$6)) {
-		if (server === CATCH_ALL_PATTERN$10) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$10)) return null;
+		if (server === CATCH_ALL_PATTERN$11) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$11)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$10 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$10,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$11 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$11,
 			notInAllow: false
 		};
 	}
 	const category = `${MCP_CANONICAL_PREFIX$6}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$10);
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$11);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$10) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$10 && !server.includes(CATCH_ALL_PATTERN$10)) return {
+	if (remainder === CATCH_ALL_PATTERN$11) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$11 && !server.includes(CATCH_ALL_PATTERN$11)) return {
 		category: `${MCP_CANONICAL_PREFIX$6}${server}`,
-		pattern: CATCH_ALL_PATTERN$10,
+		pattern: CATCH_ALL_PATTERN$11,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$10,
+		pattern: CATCH_ALL_PATTERN$11,
 		notInAllow: false
 	} : null;
 }
@@ -58935,14 +59329,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$10,
+			pattern: CATCH_ALL_PATTERN$11,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$10,
+			pattern: CATCH_ALL_PATTERN$11,
 			notInAllow: true
 		} : {
 			category,
@@ -58952,7 +59346,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$10,
+		pattern: CATCH_ALL_PATTERN$11,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -58971,9 +59365,9 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$10) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$11) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$10,
+		pattern: CATCH_ALL_PATTERN$11,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
@@ -59043,7 +59437,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$10})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$11})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -59100,7 +59494,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$10);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$11);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -59371,7 +59765,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$9 = "*";
+const CATCH_ALL_PATTERN$10 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -59379,7 +59773,7 @@ const CATCH_ALL_PATTERN$9 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$9 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$10 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -59416,7 +59810,7 @@ function toCanonicalToolName$6(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$9 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$10 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -59430,7 +59824,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$9 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$10 : pattern
 	};
 }
 /**
@@ -59604,7 +59998,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$9) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$10) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -59972,14 +60366,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 };
 //#endregion
 //#region src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$8 = "*";
+const CATCH_ALL_PATTERN$9 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$8 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$9 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -60178,7 +60572,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$8) {
+		if (pattern === CATCH_ALL_PATTERN$9) {
 			catchAllAction = action;
 			continue;
 		}
@@ -60251,11 +60645,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$8] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$9] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$8] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$9] ??= "allow";
 	}
 	return { permission };
 }
@@ -62120,7 +62514,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 //#region src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$7 = "*";
+const CATCH_ALL_PATTERN$8 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
 const GOOSE_TO_RULESYNC_TOOL_NAMES = {
 	shell: ["bash"],
@@ -62132,7 +62526,7 @@ const ACTION_TO_GOOSE_LIST = {
 	ask: "ask_before",
 	deny: "never_allow"
 };
-const ACTION_RANK$3 = {
+const ACTION_RANK$4 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
@@ -62284,14 +62678,14 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
-			if (pattern !== CATCH_ALL_PATTERN$7) {
+			if (pattern !== CATCH_ALL_PATTERN$8) {
 				logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 				continue;
 			}
 			const previous = assigned.get(toolName);
 			if (previous === action) continue;
 			if (previous !== void 0) {
-				const stricter = ACTION_RANK$3[action] > ACTION_RANK$3[previous] ? action : previous;
+				const stricter = ACTION_RANK$4[action] > ACTION_RANK$4[previous] ? action : previous;
 				logger?.warn(`Goose maps "${category}" onto the "${toolName}" tool, which already has a conflicting permission ("${previous}"). Keeping the stricter "${stricter}" (deny > ask > allow).`);
 				if (stricter === previous) continue;
 				const previousList = lists[ACTION_TO_GOOSE_LIST[previous]];
@@ -62315,7 +62709,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$7] = action;
+			permission[category][CATCH_ALL_PATTERN$8] = action;
 		}
 	}
 	return { permission };
@@ -62326,7 +62720,7 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$6 = "*";
+const CATCH_ALL_PATTERN$7 = "*";
 const MCP_CANONICAL_PREFIX$3 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
@@ -62351,6 +62745,8 @@ const GROK_TOOL_TO_CATEGORY = {
 	...Object.fromEntries(["SendSubagentMessage", "SendAgentMessage"].map((tool) => [tool, "agent"]))
 };
 const GROK_MCP_TOOL = "MCPTool";
+const GROK_ALL_TOOLS_ENTRY = "*";
+const GROK_VERBOSE_ANY_TOOL = "any";
 const GROK_TOOL_TO_CATEGORY_LOWER = {
 	...Object.fromEntries(Object.entries(GROK_TOOL_TO_CATEGORY).map(([tool, category]) => [tool.toLowerCase(), category])),
 	agent_message: "agent"
@@ -62365,22 +62761,26 @@ const GROKCLI_PERMISSION_RULES_KEY = "rules";
 * Scoped MCP categories (`mcp__<remainder>`) fold their address into the
 * parentheses (`MCPTool(<remainder>)`); the bare `mcp` category becomes
 * `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
-* concrete pattern emits `Tool(pattern)`.
+* concrete pattern emits `Tool(pattern)`. The all-tools `*` category becomes
+* Grok's bare `*` rule for its catch-all pattern only; a narrower pattern
+* under it has no Grok spelling and returns `null`.
 */
 function buildGrokEntry(category, pattern) {
+	if (category === "*") return pattern === CATCH_ALL_PATTERN$7 ? GROK_ALL_TOOLS_ENTRY : null;
 	if (category.startsWith(MCP_CANONICAL_PREFIX$3)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$6 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$7 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$6 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$7 || pattern === "" ? tool : `${tool}(${pattern})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
-* pattern. Entries without parentheses are treated as catch-all (`*`). Returns
-* `null` for tool prefixes with no canonical equivalent (e.g. `any`).
+* pattern. Entries without parentheses are treated as catch-all (`*`), and the
+* bare `*` rule becomes the all-tools `*` category. Returns `null` for tool
+* prefixes with no canonical equivalent.
 */
 function parseGrokEntry(entry) {
 	const trimmed = entry.trim();
@@ -62394,19 +62794,23 @@ function parseGrokEntry(entry) {
 		tool = trimmed.slice(0, parenIndex);
 		inner = trimmed.slice(parenIndex + 1, -1).trim();
 	}
+	if (parenIndex === -1 && tool === GROK_ALL_TOOLS_ENTRY) return {
+		category: "*",
+		pattern: CATCH_ALL_PATTERN$7
+	};
 	if (parenIndex === -1 && tool.startsWith(MCP_CANONICAL_PREFIX$3)) return parseClaudeStyleMcpEntry(tool);
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
 		category: `${MCP_CANONICAL_PREFIX$3}${inner}`,
-		pattern: CATCH_ALL_PATTERN$6
+		pattern: CATCH_ALL_PATTERN$7
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$6
+		pattern: CATCH_ALL_PATTERN$7
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$6
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$7
 	};
 }
 /**
@@ -62423,14 +62827,14 @@ function parseGrokEntry(entry) {
 function parseClaudeStyleMcpEntry(entry) {
 	const rest = entry.slice(5);
 	if (rest.length === 0) return null;
-	if (rest === CATCH_ALL_PATTERN$6) return {
+	if (rest === CATCH_ALL_PATTERN$7) return {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$6
+		pattern: CATCH_ALL_PATTERN$7
 	};
 	const address = rest.includes("__") ? rest : `${rest}__*`;
 	return {
 		category: `${MCP_CANONICAL_PREFIX$3}${address}`,
-		pattern: CATCH_ALL_PATTERN$6
+		pattern: CATCH_ALL_PATTERN$7
 	};
 }
 /**
@@ -62451,15 +62855,20 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$6;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$7;
 	const lowerTool = tool.trim().toLowerCase();
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$6 ? {
+	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$7 ? {
+		category: "*",
+		pattern: CATCH_ALL_PATTERN$7,
+		action
+	} : null;
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$7 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		action
 	} : {
 		category: `${MCP_CANONICAL_PREFIX$3}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$6,
+		pattern: CATCH_ALL_PATTERN$7,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -62489,7 +62898,10 @@ function parseGrokRule(rule) {
 *     subagent rather than its launch, and whose pattern is a subagent id
 *     rather than a subagent type); `mcp__*` maps to `MCPTool(...)` (a scoped
 *     MCP category folds its address into the parentheses, so a non-`*`
-*     argument pattern on it is not represented). The one category with no Grok tool (`notebookedit`) is
+*     argument pattern on it is not represented); the all-tools `*` category
+*     maps to Grok's bare `*` rule (which matches every tool) for its
+*     catch-all pattern, while a narrower `*` pattern is skipped with a
+*     warning. The one category with no Grok tool (`notebookedit`) is
 *     skipped (with a warning when it carries a `deny` rule, to surface the
 *     gap). When two canonical rules collapse onto the same Grok
 *     entry with different actions (e.g. `edit` allow + `write` deny → `Edit`),
@@ -62500,7 +62912,9 @@ function parseGrokRule(rule) {
 *     verbose `[[permission.rules]]` tables
 *     (`{ action = "allow", tool = "bash", pattern = "git *" }`), whose `tool`
 *     field is matched case-insensitively against the same tool table, plus
-*     the documented `mcp` alias for the compact form's `MCPTool`. Rules
+*     the documented `mcp` alias for the compact form's `MCPTool`. A bare `*`
+*     entry and a tool-wide verbose `any` rule both import as the all-tools
+*     `*` category. Rules
 *     from the two forms are merged with the same `deny > ask > allow`
 *     precedence. When neither form carries a rule (older configs), the coarse
 *     `[ui] permission_mode` is used as a fallback. Generate always emits the
@@ -62525,7 +62939,7 @@ function parseGrokRule(rule) {
 * tools it models and (in global scope) the `[ui] permission_mode` value, while
 * every other key
 * (e.g. `[mcp_servers]`, `[permission] rules`, `[sandbox]`) and any user-authored
-* entries for tool prefixes rulesync cannot model (e.g. `any`) are preserved.
+* entries for tool prefixes rulesync cannot model (e.g. a pattern-only entry such as `src/**`) are preserved.
 * The file is never deleted.
 */
 var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
@@ -62607,7 +63021,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$6]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$7]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -62627,14 +63041,14 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		});
 	}
 };
-const ACTION_RANK$2 = {
+const ACTION_RANK$3 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
 /**
 * Collect user-authored entries from an existing `[permission]` array whose
-* tool prefix rulesync cannot model (e.g. `any`). Such entries are
+* tool prefix rulesync cannot model (e.g. a pattern-only entry such as `src/**`). Such entries are
 * preserved verbatim so replacing the arrays does not silently drop them
 * (mirrors the Cursor adapter's preservation of unmanaged types).
 */
@@ -62653,13 +63067,26 @@ function buildGrokPermissionArrays(config, existingPermission, logger) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) for (const [pattern, action] of Object.entries(rules)) {
 		const entry = buildGrokEntry(category, pattern);
 		if (entry === null) {
+			if (category === "*") {
+				logger?.warn(`Grok CLI permissions: skipping the all-tools '*' rule '${pattern}' — Grok's bare '*' rule takes no pattern. Write it under the categories it is meant for (for example 'bash' or 'read').`);
+				continue;
+			}
 			if (action === "deny" && logger) logger.warn(`Grok CLI has no permission tool for the '${category}' category; its 'deny' rule could not be represented and was skipped.`);
 			continue;
 		}
 		const existing = ranked.get(entry);
 		if (existing !== void 0 && existing !== action) logger?.warn(`Grok permission entry '${entry}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
-		if (existing === void 0 || ACTION_RANK$2[action] > ACTION_RANK$2[existing]) ranked.set(entry, action);
+		if (existing === void 0 || ACTION_RANK$3[action] > ACTION_RANK$3[existing]) ranked.set(entry, action);
 	}
+	warnRemovedAllToolsRestrictions({
+		existingPermission,
+		ranked,
+		logger
+	});
+	warnEntriesShadowedByAllTools({
+		ranked,
+		logger
+	});
 	const allow = unmanagedEntries(existingPermission, "allow");
 	const deny = unmanagedEntries(existingPermission, "deny");
 	const ask = unmanagedEntries(existingPermission, "ask");
@@ -62673,6 +63100,38 @@ function buildGrokPermissionArrays(config, existingPermission, logger) {
 	};
 }
 /**
+* Warn when generate drops an existing bare `*` `deny`/`ask` entry without
+* writing an equally strict one back. Such an entry is Rulesync-owned (it maps
+* to the all-tools `*` category), so a config without a matching canonical
+* rule removes it — which silently lifts a restriction on every tool.
+*/
+function warnRemovedAllToolsRestrictions({ existingPermission, ranked, logger }) {
+	if (!logger) return;
+	const generated = ranked.get(GROK_ALL_TOOLS_ENTRY);
+	for (const action of ["deny", "ask"]) {
+		const entries = existingPermission[action];
+		if (!isStringArray$2(entries)) continue;
+		if (!entries.some((entry) => parseGrokEntry(entry)?.category === "*")) continue;
+		if (generated !== void 0 && ACTION_RANK$3[generated] >= ACTION_RANK$3[action]) continue;
+		logger.warn(`Grok CLI permissions: removing the existing bare '*' entry from the '${action}' array — Rulesync now manages it through the all-tools '*' category, and the canonical config has no '*' '${action}' rule. Add "*": { "*": "${action}" } to keep restricting every tool.`);
+	}
+}
+/**
+* Warn about entries that a bare `*` `deny`/`ask` makes ineffective: Grok
+* evaluates by severity (`deny > ask > allow`), so a specific `allow` (and,
+* under a `*` deny, a specific `ask`) never takes effect next to it. Shell
+* rules are already folded by `honorAllToolsOnBash`, so this covers the other
+* tools.
+*/
+function warnEntriesShadowedByAllTools({ ranked, logger }) {
+	if (!logger) return;
+	const allTools = ranked.get(GROK_ALL_TOOLS_ENTRY);
+	if (allTools === void 0 || allTools === "allow") return;
+	const shadowed = [...ranked].filter(([entry, action]) => entry !== GROK_ALL_TOOLS_ENTRY && ACTION_RANK$3[action] < ACTION_RANK$3[allTools]).map(([entry]) => entry).toSorted();
+	if (shadowed.length === 0) return;
+	logger.warn(`Grok CLI permissions: the bare '*' '${allTools}' rule applies to every tool, and Grok evaluates deny > ask > allow, so these less strict entries never take effect: ${shadowed.join(", ")}.`);
+}
+/**
 * Parse Grok's `[permission]` section back into a canonical permission map,
 * reading both supported forms: the compact `allow`/`deny`/`ask` arrays of
 * Claude-style entries and the verbose `[[permission.rules]]` tables
@@ -62691,7 +63150,7 @@ function parseGrokPermissionArrays(permission) {
 	const record = ({ category, pattern, action }) => {
 		const bucket = result[category] ??= {};
 		const existing = bucket[pattern];
-		if (existing === void 0 || ACTION_RANK$2[action] > ACTION_RANK$2[existing]) bucket[pattern] = action;
+		if (existing === void 0 || ACTION_RANK$3[action] > ACTION_RANK$3[existing]) bucket[pattern] = action;
 	};
 	const applyEntries = (entries, action) => {
 		for (const entry of entries ?? []) {
@@ -63095,7 +63554,7 @@ const JUNIE_GROUP_TO_CANONICAL = {
 	mcpTools: "mcp",
 	readOutsideProject: "read"
 };
-function isPermissionAction$1(value) {
+function isPermissionAction$2(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
 /**
@@ -63281,7 +63740,7 @@ function convertJunieToRulesyncPermissions({ allowlist }) {
 		for (const rule of Array.isArray(ruleSet.rules) ? ruleSet.rules : []) {
 			if (!rule || typeof rule !== "object") continue;
 			const pattern = typeof rule.pattern === "string" ? rule.pattern : typeof rule.prefix === "string" ? rule.prefix : void 0;
-			if (pattern === void 0 || !isPermissionAction$1(rule.action)) continue;
+			if (pattern === void 0 || !isPermissionAction$2(rule.action)) continue;
 			(permission[category] ??= {})[pattern] = rule.action;
 		}
 	}
@@ -64240,6 +64699,367 @@ function rulesFromArrays(settings, allowKey, denyKey) {
 	return rules;
 }
 //#endregion
+//#region src/features/permissions/kiro-capability-permissions.ts
+const CATCH_ALL_PATTERN$6 = "*";
+const CANONICAL_TO_KIRO_CAPABILITY = {
+	bash: "shell",
+	read: "fs_read",
+	edit: "fs_write",
+	write: "fs_write",
+	webfetch: "web_fetch",
+	websearch: "web_search"
+};
+const KIRO_CAPABILITY_TO_CANONICAL = {
+	shell: "bash",
+	fs_read: "read",
+	fs_write: "write",
+	web_fetch: "webfetch",
+	web_search: "websearch"
+};
+const MANAGED_CAPABILITIES = new Set(Object.keys(KIRO_CAPABILITY_TO_CANONICAL));
+const ACTION_RANK$2 = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+function isPermissionAction$1(value) {
+	return value === "allow" || value === "ask" || value === "deny";
+}
+/**
+* Whether an existing `permissions.yaml` rule can be read back into the
+* canonical model: a rule for a capability rulesync maps, with no `exclude`
+* list (the canonical model has no exclusion). Used on import only.
+*/
+function isImportableRule(rule) {
+	return isRecord$1(rule) && typeof rule.capability === "string" && MANAGED_CAPABILITIES.has(rule.capability) && rule.exclude === void 0;
+}
+/**
+* Key identifying one (capability, pattern) pair. The catch-all `*` stands for
+* a match-less rule.
+*/
+function rulePatternKey(capability, pattern) {
+	return `${capability}\u0000${pattern}`;
+}
+/**
+* Classify one existing (capability, pattern, effect) entry against the
+* generated rules: an exact duplicate (same effect) is replaced by the
+* generated rule; a different effect is a conflict and is kept; anything
+* rulesync does not emit is unrelated and kept.
+*/
+function classifyExistingEntry({ emitted, capability, pattern, effect }) {
+	const effects = emitted.get(rulePatternKey(capability, pattern));
+	if (effects === void 0) return "unrelated";
+	return isPermissionAction$1(effect) && effects.has(effect) ? "duplicate" : "conflict";
+}
+/**
+* Merge one existing rule against the generated entries (see
+* {@link mergeKiroCapabilityRules}). Returns the rule to keep (possibly with a
+* narrowed `match`), or `undefined` when every entry is an exact duplicate, and
+* how many entries rulesync does not generate.
+*/
+function mergeExistingRule({ rule, emitted, logger }) {
+	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$2(rule.match)) return {
+		rule,
+		unrelatedEntries: 0
+	};
+	const capability = rule.capability;
+	const isCatchAll = rule.match === void 0;
+	const patterns = isStringArray$2(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
+	if (patterns.length === 0) return {
+		rule,
+		unrelatedEntries: 0
+	};
+	const remaining = [];
+	let unrelatedEntries = 0;
+	for (const pattern of patterns) {
+		const outcome = classifyExistingEntry({
+			emitted,
+			capability,
+			pattern,
+			effect: rule.effect
+		});
+		if (outcome === "duplicate") continue;
+		remaining.push(pattern);
+		if (outcome === "unrelated") {
+			unrelatedEntries++;
+			continue;
+		}
+		logger?.warn(`Kiro permissions.yaml already has a ${capability} rule for "${pattern}" with effect "${String(rule.effect)}"; keeping it alongside the generated rule. Kiro applies the stricter effect (deny > ask > allow).`);
+	}
+	if (remaining.length === 0) return {
+		rule: void 0,
+		unrelatedEntries
+	};
+	if (remaining.length === patterns.length || isCatchAll) return {
+		rule,
+		unrelatedEntries
+	};
+	return {
+		rule: {
+			...rule,
+			match: remaining
+		},
+		unrelatedEntries
+	};
+}
+/**
+* Merge the existing rules with the generated ones. Rulesync keeps no
+* ownership record in the file, so it only removes what it is about to write
+* again: an existing rule loses the `match` entries that exactly duplicate a
+* generated (capability, pattern, effect) — a match-less rule counts as the `*`
+* pattern — and is dropped only when no entry is left.
+*
+* Everything else is kept verbatim: rules Kiro saved ("Always allow/deny"),
+* hand-written rules, rules with `exclude`, rules for capabilities rulesync
+* does not map, malformed entries. An existing rule with the same pattern but a
+* different effect is kept too, with a warning: Kiro resolves deny > ask >
+* allow, so the stricter rule still wins and a user's `deny` is never loosened.
+* Rerunning generate is therefore idempotent.
+*/
+function mergeKiroCapabilityRules({ existingRules, generatedRules, logger }) {
+	const emitted = /* @__PURE__ */ new Map();
+	for (const rule of generatedRules) for (const pattern of rule.match ?? [CATCH_ALL_PATTERN$6]) {
+		const key = rulePatternKey(rule.capability, pattern);
+		const effects = emitted.get(key) ?? /* @__PURE__ */ new Set();
+		effects.add(rule.effect);
+		emitted.set(key, effects);
+	}
+	const kept = [];
+	let unrelatedManagedEntries = 0;
+	for (const rule of existingRules) {
+		const result = mergeExistingRule({
+			rule,
+			emitted,
+			logger
+		});
+		if (result.rule !== void 0) kept.push(result.rule);
+		unrelatedManagedEntries += result.unrelatedEntries;
+	}
+	if (unrelatedManagedEntries > 0) logger?.warn(`Kiro permissions.yaml keeps ${unrelatedManagedEntries} existing shell/fs_read/fs_write/web_fetch/web_search rule ${unrelatedManagedEntries === 1 ? "entry" : "entries"} that .rulesync/permissions.json does not generate. Rulesync never removes rules from this file and cannot tell which of these it wrote earlier; delete any stale ones by hand.`);
+	return [...kept, ...generatedRules];
+}
+const LOCATION_INDEPENDENT_FS_PATTERN = /^(?:\/|~|\*\*|[A-Za-z]:[\\/])/;
+/**
+* Permissions adapter for Kiro's capability-based `permissions.yaml` (Kiro IDE
+* 1.0, and the same engine in Kiro CLI V3). Used for the `kiro-cli` and
+* `kiro-ide` targets in **global** scope, where it writes the user-level
+* `~/.kiro/settings/permissions.yaml`. Project scope keeps writing the agent
+* config `.kiro/agents/default.json` through {@link KiroPermissions}: the
+* workspace-level `permissions.yaml` lives under a hash-derived directory in the
+* home directory, not in the repository, so it cannot be generated.
+*
+* Mapping (rulesync canonical -> Kiro rule):
+*   - Category -> `capability`: `bash` -> `shell`, `read` -> `fs_read`,
+*     `edit`/`write` -> `fs_write`, `webfetch` -> `web_fetch`, `websearch` ->
+*     `web_search`. Other categories are skipped with a warning.
+*   - Action -> `effect` 1:1, including `ask`.
+*   - Pattern -> `match` entry. The catch-all `*` becomes a rule with no `match`
+*     (the whole capability), because a filesystem `*` only matches one path
+*     component in Kiro.
+*
+* Kiro also writes into this file (consent decisions persisted globally), so it
+* is merged, never replaced or deleted: every top-level key other than `rules`
+* is preserved, and existing rules are kept except for entries that exactly
+* repeat a generated rule (see {@link mergeKiroCapabilityRules}). Rulesync
+* never retracts a rule an earlier run wrote; it warns instead. A run that
+* changes nothing returns the existing content verbatim; otherwise the file is
+* re-serialized and its YAML comments are lost.
+*
+* @see https://kiro.dev/docs/permissions/
+*/
+var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? ""
+		});
+	}
+	isDeletable() {
+		return false;
+	}
+	shouldSkipCreationWhenPayloadEmpty() {
+		return true;
+	}
+	static getSettablePaths(_options) {
+		return {
+			relativeDirPath: KIRO_SETTINGS_DIR_PATH,
+			relativeFilePath: KIRO_PERMISSIONS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+		const paths = this.getSettablePaths({ global: true });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new KiroCapabilityPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global: true
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, logger }) {
+		const paths = this.getSettablePaths({ global: true });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		let parsed;
+		try {
+			parsed = loadYaml(existingContent) ?? {};
+		} catch (error) {
+			throw new Error(`Failed to parse existing Kiro permissions.yaml at ${filePath}: ${formatError(error)}`, { cause: error });
+		}
+		if (!isRecord$1(parsed)) throw new Error(`Failed to parse existing Kiro permissions.yaml at ${filePath}: not a map`);
+		if (parsed.rules !== void 0 && !Array.isArray(parsed.rules)) throw new Error(`Failed to parse existing Kiro permissions.yaml at ${filePath}: 'rules' is not a list`);
+		const config = rulesyncPermissions.getJson();
+		if (config.kiro?.toolsSettings !== void 0) logger?.warn("Kiro permissions: 'kiro.toolsSettings' applies only to the project-scope agent config (.kiro/agents/default.json); ignoring it for ~/.kiro/settings/permissions.yaml.");
+		const generatedRules = buildKiroCapabilityRules({
+			config,
+			logger
+		});
+		const rules = mergeKiroCapabilityRules({
+			existingRules: parsed.rules ?? [],
+			generatedRules,
+			logger
+		});
+		const next = { ...parsed };
+		if (rules.length > 0 || parsed.rules !== void 0) next.rules = rules;
+		return new KiroCapabilityPermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: serializeKiroPermissions({
+				next,
+				parsed,
+				existingContent
+			}),
+			validate: true,
+			global: true
+		});
+	}
+	toRulesyncPermissions() {
+		let parsed;
+		try {
+			parsed = loadYaml(this.getFileContent()) ?? {};
+		} catch (error) {
+			throw new Error(`Failed to parse Kiro permissions content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
+		}
+		const rules = isRecord$1(parsed) && Array.isArray(parsed.rules) ? parsed.rules : [];
+		const permission = {};
+		for (const rule of rules) {
+			if (!isImportableRule(rule) || !isRecord$1(rule) || !isPermissionAction$1(rule.effect)) continue;
+			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
+			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$2(rule.match) ? rule.match : [];
+			const categoryRules = permission[category] ??= {};
+			for (const pattern of patterns) {
+				const previous = categoryRules[pattern];
+				if (previous === void 0 || ACTION_RANK$2[rule.effect] > ACTION_RANK$2[previous]) categoryRules[pattern] = rule.effect;
+			}
+		}
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new KiroCapabilityPermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global: true
+		});
+	}
+};
+/**
+* Convert the canonical `permission` block into Kiro capability rules: one rule
+* per (capability, effect) carrying every non-catch-all pattern as `match`, plus
+* a match-less rule when the catch-all `*` is set.
+*/
+function buildKiroCapabilityRules({ config, logger }) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
+		const capability = CANONICAL_TO_KIRO_CAPABILITY[category];
+		if (capability === void 0) {
+			logger?.warn(`Kiro permissions.yaml has no capability for category: ${category}. Skipping.`);
+			continue;
+		}
+		for (const [pattern, effect] of Object.entries(rules)) {
+			warnOnWorkspaceRelativeFsPattern({
+				capability,
+				category,
+				pattern,
+				logger
+			});
+			const key = `${capability}\u0000${effect}`;
+			const bucket = buckets.get(key) ?? {
+				capability,
+				effect,
+				patterns: /* @__PURE__ */ new Set()
+			};
+			bucket.patterns.add(pattern);
+			buckets.set(key, bucket);
+		}
+	}
+	const result = [];
+	for (const { capability, effect, patterns } of buckets.values()) {
+		if (patterns.has(CATCH_ALL_PATTERN$6)) result.push({
+			capability,
+			effect
+		});
+		const match = [...patterns].filter((pattern) => pattern !== CATCH_ALL_PATTERN$6);
+		if (match.length > 0) result.push({
+			capability,
+			match,
+			effect
+		});
+	}
+	return result;
+}
+/**
+* Serialize the merged config. When the merge changes nothing, the existing
+* content is returned verbatim so a run with nothing to change never rewrites
+* the file (and never drops its YAML comments).
+*/
+function serializeKiroPermissions({ next, parsed, existingContent }) {
+	if ((0, node_util.isDeepStrictEqual)(next, parsed)) return existingContent;
+	return Object.keys(next).length === 0 ? "" : (0, js_yaml.dump)(next);
+}
+/**
+* `~/.kiro/settings/permissions.yaml` applies to every workspace, so a relative
+* filesystem pattern such as `src/**` is not tied to the project it was written
+* for. Warn so the author can make it absolute, `~`-relative or `**`-prefixed.
+*/
+function warnOnWorkspaceRelativeFsPattern({ capability, category, pattern, logger }) {
+	if (capability !== "fs_read" && capability !== "fs_write") return;
+	if (pattern === CATCH_ALL_PATTERN$6 || LOCATION_INDEPENDENT_FS_PATTERN.test(pattern)) return;
+	logger?.warn(`Kiro permissions.yaml is user-level and applies to every workspace, but the ${category} pattern "${pattern}" is relative. Use an absolute, ~-relative or **-prefixed pattern to target a specific location.`);
+}
+/**
+* Permissions factory for the `kiro-cli` / `kiro-ide` targets: project scope
+* writes the agent config `.kiro/agents/default.json` ({@link KiroPermissions}),
+* global scope writes `~/.kiro/settings/permissions.yaml`
+* ({@link KiroCapabilityPermissions}). The deprecated `kiro` alias stays on
+* {@link KiroPermissions} only.
+*/
+const KiroScopedPermissions = {
+	getSettablePaths(options = {}) {
+		return options.global ? KiroCapabilityPermissions.getSettablePaths(options) : KiroPermissions.getSettablePaths(options);
+	},
+	fromFile(params) {
+		return params.global ? KiroCapabilityPermissions.fromFile(params) : KiroPermissions.fromFile(params);
+	},
+	fromRulesyncPermissions(params) {
+		return params.global ? KiroCapabilityPermissions.fromRulesyncPermissions(params) : KiroPermissions.fromRulesyncPermissions(params);
+	},
+	forDeletion(params) {
+		return params.global ? KiroCapabilityPermissions.forDeletion(params) : KiroPermissions.forDeletion(params);
+	}
+};
+//#endregion
 //#region src/features/permissions/lettacode-permissions.ts
 /** Top-level key of `.letta/settings.json` that rulesync owns. */
 const LETTACODE_PERMISSIONS_KEY = "permissions";
@@ -66267,6 +67087,8 @@ const QWEN_OVERRIDE_TOOLS_KEYS = [
 	"eager",
 	"listDirectory",
 	"todoWrite",
+	"codeModeOnly",
+	"freeform",
 	"workflowsEnabled",
 	"workflowNameOnly",
 	"executionSandbox"
@@ -66393,6 +67215,16 @@ const QWEN_SCOPED_TOOLS_KEYS = {
 		rule: "global-machine-wide",
 		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether the built-in \`todo_write\` tool is registered in this repository.`,
 		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether the built-in `todo_write` tool is registered for every project on this machine."
+	},
+	codeModeOnly: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether ordinary tools are reached only through Code Mode's \`exec\` tool in this repository.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether ordinary tools are reached only through Code Mode's `exec` tool for every project on this machine."
+	},
+	freeform: {
+		rule: "global-machine-wide",
+		projectNote: ({ qualifiedKey, quotedValue, filePath }) => `${qualifiedKey} = ${quotedValue} was written to the project-scoped ${filePath}, so it decides whether Code Mode's \`exec\` tool takes raw text input on OpenAI Responses models in this repository.`,
+		globalNote: "Qwen Code honors this key wherever it is written, so in the global scope this decides whether Code Mode's `exec` tool takes raw text input on OpenAI Responses models for every project on this machine."
 	}
 };
 /**
@@ -66856,22 +67688,42 @@ function convertQwenToRulesyncPermissions(params) {
 //#endregion
 //#region src/features/permissions/reasonix-permissions.ts
 /**
-* Mapping from rulesync canonical tool category names (lowercase) to Reasonix
-* permission-rule tool families (PascalCase).
-*
-* Reasonix's `[permissions]` rule syntax (SPEC.md §3.7) is explicitly
-* documented as "Claude Code-style": "Bash and file mutation approvals use
-* Claude Code-style families such as `Bash(npm run build)`, `Bash(npm run
-* test:*)`, and `Edit(docs/**)`." Reasonix also accepts legacy lowercase tool
-* IDs for compatibility, but new rules are saved using these PascalCase
-* families, so rulesync reuses the same mapping `claudecode-permissions.ts`
-* uses (the closest documented precedent for this syntax).
-* @see https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/SPEC.md
+* Mapping from rulesync canonical tool category names (lowercase) to the tool
+* names a Reasonix `[permissions]` rule must use.
+*
+* Reasonix matches a rule's tool exactly against its registered tools, which
+* are snake_case (`read_file`, `write_file`, `grep`, `glob`, `web_fetch`,
+* `web_search`, `notebook_edit`, `task`). Only `Bash`, `Edit` (every file
+* writer: `write_file`, `edit_file`, `multi_edit`, `notebook_edit`, ...),
+* `Browser` and `Computer` are Claude-Code-style family aliases
+* (`canonicalRuleTool` / `groupOf`), so a `Read(...)` or `Write(...)` rule
+* matches nothing and Reasonix v2.34.0+ reports it as dormant. Checked on both
+* release lines: v1.39.8 (`internal/permission/permission.go`) and v2.41.0
+* (`internal/safety/permission/permission.go`, `rule_group.go`).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/v2.41.0/internal/safety/permission/permission.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/v2.41.0/internal/safety/permission/rule_group.go
 */
 const CANONICAL_TO_REASONIX_TOOL_NAMES = {
 	bash: "Bash",
-	read: "Read",
+	read: REASONIX_READ_TOOL_NAME,
 	edit: "Edit",
+	write: "write_file",
+	webfetch: "web_fetch",
+	websearch: "web_search",
+	grep: "grep",
+	glob: "glob",
+	notebookedit: "notebook_edit",
+	agent: "task"
+};
+/**
+* The Claude-Code-style spellings rulesync emitted before it followed the
+* Reasonix tool vocabulary. None of them reaches a Reasonix tool, so they are
+* read back on import (a file generated by an older rulesync still imports)
+* and counted as managed on generate (the dormant copy is replaced rather than
+* kept beside the working rule).
+*/
+const CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES = {
+	read: REASONIX_LEGACY_READ_TOOL_NAME,
 	write: "Write",
 	webfetch: "WebFetch",
 	websearch: "WebSearch",
@@ -66881,9 +67733,16 @@ const CANONICAL_TO_REASONIX_TOOL_NAMES = {
 	agent: "Agent"
 };
 /**
-* Reverse mapping from Reasonix tool names to rulesync canonical names.
+* Reverse mapping from Reasonix tool names (current and legacy spellings) to
+* rulesync canonical names.
 */
-const REASONIX_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_REASONIX_TOOL_NAMES).map(([k, v]) => [v, k]));
+const REASONIX_TO_CANONICAL_TOOL_NAMES = Object.fromEntries([...Object.entries(CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES).map(([k, v]) => [v, k]), ...Object.entries(CANONICAL_TO_REASONIX_TOOL_NAMES).map(([k, v]) => [v, k])]);
+/** Every Reasonix tool name a canonical category owns on generate. */
+function reasonixToolNamesOf(canonical) {
+	const legacy = CANONICAL_TO_LEGACY_REASONIX_TOOL_NAMES[canonical];
+	const current = toReasonixToolName(canonical);
+	return legacy === void 0 ? [current] : [current, legacy];
+}
 function toReasonixToolName(canonical) {
 	return CANONICAL_TO_REASONIX_TOOL_NAMES[canonical] ?? canonical;
 }
@@ -67156,7 +68015,7 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const parsed = parseReasonixConfig(existingContent);
 		const config = rulesyncPermissions.getJson();
 		const { allow, ask, deny } = convertRulesyncToReasonixPermissions(config);
-		const managedToolNames = new Set(Object.keys(config.permission).map((category) => toReasonixToolName(category)));
+		const managedToolNames = new Set(Object.keys(config.permission).flatMap((category) => reasonixToolNamesOf(category)));
 		const override = config.reasonix;
 		const rawAllow = toReasonixStringArray(override?.rawAllow);
 		const rawAsk = toReasonixStringArray(override?.rawAsk);
@@ -67173,12 +68032,13 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			rawOwnedEntries,
 			logger
 		});
-		if (logger && managedToolNames.has("Read")) {
+		if (logger && managedToolNames.has("read_file")) {
+			const readToolNames = new Set(reasonixToolNamesOf("read"));
 			const droppedReadDenyEntries = toReasonixStringArray(existingPermissions.deny).filter((entry) => {
 				const { toolName } = parseReasonixPermissionEntry(entry);
-				return toolName === "Read";
+				return readToolNames.has(toolName);
 			});
-			if (droppedReadDenyEntries.length > 0) logger.warn(`Permissions feature manages 'Read' tool and will overwrite ${droppedReadDenyEntries.length} existing Read deny entries (possibly from ignore feature). Permissions take precedence.`);
+			if (droppedReadDenyEntries.length > 0) logger.warn(`Permissions feature manages '${REASONIX_READ_TOOL_NAME}' tool and will overwrite ${droppedReadDenyEntries.length} existing read deny entries (possibly from ignore feature). Permissions take precedence.`);
 		}
 		const mergedPermissions = { ...existingPermissions };
 		setOrDeleteEntries(mergedPermissions, "allow", [
@@ -72524,18 +73384,18 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 		}
 	}],
 	["kiro-cli", {
-		class: KiroPermissions,
+		class: KiroScopedPermissions,
 		meta: {
 			supportsProject: true,
-			supportsGlobal: false,
+			supportsGlobal: true,
 			supportsImport: true
 		}
 	}],
 	["kiro-ide", {
-		class: KiroPermissions,
+		class: KiroScopedPermissions,
 		meta: {
 			supportsProject: true,
-			supportsGlobal: false,
+			supportsGlobal: true,
 			supportsImport: true
 		}
 	}],
@@ -78522,6 +79382,24 @@ var KimiCodeSkill = class extends ToolSkill {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("kimi-code");
 	}
+	/**
+	* Commands are emitted into the Kimi-specific skills tree as
+	* `<slug>/SKILL.md` (see `KimiCodeCommand`), so a directory there matching a
+	* current rulesync command slug (of a command that targets `kimi-code`) is
+	* owned by the commands feature: it must not be imported as a skill nor
+	* deleted as an orphan skill. A command aimed only at other tools never
+	* reaches this tree, so it leaves a same-named skill alone. The import-only
+	* `.agents/skills/` root never receives Kimi Code commands, so a same-named
+	* skill in it stays a skill.
+	*/
+	static async isDirOwned({ relativeDirPath, dirName, inputRoots, global }) {
+		if (relativeDirPath !== this.getSettablePaths({ global }).relativeDirPath) return true;
+		return !await rulesyncCommandSlugExists({
+			inputRoots,
+			dirName,
+			toolTarget: "kimi-code"
+		});
+	}
 	static async fromDir(params) {
 		const loaded = await this.loadSkillDirContent({
 			...params,
@@ -78595,6 +79473,14 @@ var KimiCodePluginSkill = class extends KimiCodeSkill {
 		return { relativeDirPath: KIMI_CODE_PLUGIN_SKILLS_DIR };
 	}
 	/**
+	* Unlike `.kimi-code/skills/`, the plugin `skills/` tree is not shared with
+	* the commands feature (`kimi-code-plugin` writes commands to `commands/`),
+	* so every directory in it is a skill.
+	*/
+	static async isDirOwned() {
+		return true;
+	}
+	/**
 	* The bundle is read from `--output-root <plugin>`, but the imported rulesync
 	* file belongs to the project's `.rulesync/`, not to the plugin root.
 	*/
@@ -78946,7 +79832,8 @@ const OpenCodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	license: zod_mini.z.optional(zod_mini.z.unknown()),
 	compatibility: zod_mini.z.optional(zod_mini.z.unknown()),
 	metadata: zod_mini.z.optional(zod_mini.z.unknown()),
-	"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	"allowed-tools": zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
 });
 var OpenCodeSkill = class extends ToolSkill {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
@@ -79063,7 +79950,8 @@ var OpenCodeSkill = class extends ToolSkill {
 			...frontmatter["allowed-tools"] !== void 0 && { "allowed-tools": frontmatter["allowed-tools"] },
 			...frontmatter.license !== void 0 && { license: frontmatter.license },
 			...frontmatter.compatibility !== void 0 && { compatibility: frontmatter.compatibility },
-			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
+			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata },
+			...frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
 		};
 		const { toolTarget } = this.constructor.layout;
 		const rulesyncFrontmatter = {
@@ -79098,13 +79986,18 @@ var OpenCodeSkill = class extends ToolSkill {
 			rootFrontmatter: rulesyncFrontmatter,
 			section: opencodeSection
 		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: opencodeSection
+		});
 		const opencodeFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
 			...license !== void 0 && { license },
 			...compatibility !== void 0 && { compatibility },
 			...metadata !== void 0 && { metadata },
-			...opencodeSection?.["allowed-tools"] !== void 0 && { "allowed-tools": opencodeSection["allowed-tools"] }
+			...opencodeSection?.["allowed-tools"] !== void 0 && { "allowed-tools": opencodeSection["allowed-tools"] },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation }
 		};
 		const settablePaths = this.getSettablePaths({ global });
 		return new this({
@@ -79127,11 +80020,13 @@ var OpenCodeSkill = class extends ToolSkill {
 			...params,
 			getSettablePaths: (options) => this.getSettablePaths(options)
 		});
-		const result = OpenCodeSkillFrontmatterSchema.safeParse(loaded.frontmatter);
-		if (!result.success) {
-			const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
-			throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
-		}
+		const skillDirPath = (0, node_path.join)(loaded.outputRoot, loaded.relativeDirPath, loaded.dirName);
+		const frontmatter = normalizeDisableModelInvocation({
+			frontmatter: loaded.frontmatter,
+			skillFilePath: (0, node_path.join)(skillDirPath, SKILL_FILE_NAME)
+		});
+		const result = OpenCodeSkillFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(skillDirPath, SKILL_FILE_NAME)}: ${formatError(result.error)}`);
 		return new this({
 			outputRoot: loaded.outputRoot,
 			relativeDirPath: loaded.relativeDirPath,
@@ -79159,6 +80054,52 @@ var OpenCodeSkill = class extends ToolSkill {
 		});
 	}
 };
+const DISABLE_MODEL_INVOCATION_KEY = "disable-model-invocation";
+/**
+* Reads a `disable-model-invocation` value the way OpenCode V2 does
+* (`booleanValue` in `packages/core/src/config/plugin/skill-file.ts`): a
+* boolean, the numbers `1` / `0`, or a `true`/`yes`/`on`/`1` /
+* `false`/`no`/`off`/`0` string compared after trimming and case-folding.
+* Anything else is `undefined`, which OpenCode ignores.
+*/
+function parseOpencodeBoolean(value) {
+	if (typeof value === "boolean") return value;
+	if (typeof value === "number") return value === 1 ? true : value === 0 ? false : void 0;
+	if (typeof value !== "string") return;
+	const normalized = value.trim().toLowerCase();
+	if ([
+		"true",
+		"yes",
+		"on",
+		"1"
+	].includes(normalized)) return true;
+	if ([
+		"false",
+		"no",
+		"off",
+		"0"
+	].includes(normalized)) return false;
+}
+/**
+* Coerces an imported `disable-model-invocation` onto the boolean the schema
+* types. A spelling OpenCode cannot read is dropped with a warning instead of
+* failing the import, since OpenCode itself ignores it.
+*/
+function normalizeDisableModelInvocation({ frontmatter, skillFilePath }) {
+	if (!Object.hasOwn(frontmatter, DISABLE_MODEL_INVOCATION_KEY)) return frontmatter;
+	const raw = frontmatter[DISABLE_MODEL_INVOCATION_KEY];
+	const parsed = parseOpencodeBoolean(raw);
+	if (parsed === raw) return frontmatter;
+	const { [DISABLE_MODEL_INVOCATION_KEY]: _dropped, ...rest } = frontmatter;
+	if (parsed === void 0) {
+		warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ignoring unreadable "${DISABLE_MODEL_INVOCATION_KEY}" value ${stripControlCharacters(JSON.stringify(raw) ?? String(raw))}; OpenCode ignores it too.`);
+		return rest;
+	}
+	return {
+		...rest,
+		[DISABLE_MODEL_INVOCATION_KEY]: parsed
+	};
+}
 //#endregion
 //#region src/features/skills/mimocode-skill.ts
 /**
@@ -100664,13 +101605,15 @@ const ANTIGRAVITY_PLUGIN_NAME_PATTERN = /^[a-zA-Z0-9-_]+$/;
 * The manifest declares only `name` and `description`, and rejects anything
 * else, so the one required field is derived from the plugin directory's name.
 * An existing manifest is never read or rewritten: it may carry a
-* hand-authored `name` or `description` that rulesync has no source for.
+* hand-authored `name` or `description` that rulesync has no source for. A
+* manifest kept in one of the manifest folders counts as present too, so no
+* root stub is written next to it.
 */
 async function ensureAntigravityPluginManifests({ outputRoots, dryRun, logger }) {
 	const paths = [];
 	for (const outputRoot of outputRoots) {
 		const filePath = (0, node_path.join)(outputRoot, ANTIGRAVITY_PLUGIN_MANIFEST_FILE_NAME);
-		if (await fileExists(filePath)) continue;
+		if (await hasAntigravityPluginManifest(outputRoot)) continue;
 		if (await refusesWriteOutsideRoot({
 			logger,
 			rootPath: outputRoot,
@@ -100693,6 +101636,11 @@ async function ensureAntigravityPluginManifests({ outputRoots, dryRun, logger })
 		sourceLoadFailed: false
 	};
 }
+async function hasAntigravityPluginManifest(outputRoot) {
+	const candidates = [(0, node_path.join)(outputRoot, ANTIGRAVITY_PLUGIN_MANIFEST_FILE_NAME), ...ANTIGRAVITY_PLUGIN_MANIFEST_FOLDERS.map((folder) => (0, node_path.join)(outputRoot, folder, ANTIGRAVITY_PLUGIN_MANIFEST_FILE_NAME))];
+	for (const candidate of candidates) if (await fileExists(candidate)) return true;
+	return false;
+}
 //#endregion
 //#region src/features/shared/hermes-project-plugin-activation.ts
 function mergeEnabledPlugins({ existingContent, filePath, pluginNames }) {
@@ -103752,6 +104700,12 @@ Object.defineProperty(exports, "loadYaml", {
 		return loadYaml;
 	}
 });
+Object.defineProperty(exports, "mapWithConcurrency", {
+	enumerable: true,
+	get: function() {
+		return mapWithConcurrency;
+	}
+});
 Object.defineProperty(exports, "mergeInputRootConfigs", {
 	enumerable: true,
 	get: function() {