rulesync 36.0.2 → 37.0.0

package/dist/{import-DVcemXlR.cjs → import-S70XttcD.cjs}

@@ -457,36 +457,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$422 } = node_path.posix;
+const { join: join$423 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$422(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$423(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$422(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$422(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$423(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$423(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -4062,7 +4062,7 @@ function isPlainObject$1(value) {
 /**
 * Type guard to check if a value is an array of strings.
 */
-function isStringArray$2(value) {
+function isStringArray$1(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 //#endregion
@@ -12857,6 +12857,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 				kind: "replace-owned-keys",
 				ownedKeys: ["disableAllHooks"]
 			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["disabledMcpServers"]
+			},
 			permissions: {
 				kind: "replace-owned-keys",
 				ownedKeys: ["deniedUrls"]
@@ -12871,6 +12875,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 				kind: "replace-owned-keys",
 				ownedKeys: ["disableAllHooks"]
 			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["disabledMcpServers"]
+			},
 			permissions: {
 				kind: "replace-owned-keys",
 				ownedKeys: ["allowedUrls", "deniedUrls"]
@@ -22135,7 +22143,7 @@ function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 */
 function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	if (Array.isArray(config.skills)) {
-		if (!layout.readsV2ConfigSpellings || !isStringArray$2(config.skills)) return [];
+		if (!layout.readsV2ConfigSpellings || !isStringArray$1(config.skills)) return [];
 		return config.skills.filter((value) => !/^https?:\/\//i.test(value));
 	}
 	const skills = asOpencodeEntries(config.skills);
@@ -26381,7 +26389,7 @@ const isBooleanValue = ({ value }) => typeof value === "boolean";
 const isFiniteNumber = ({ value }) => Number.isFinite(value);
 const isNonEmptyString = (value) => typeof value === "string" && value !== "";
 const isEmittableString = ({ value }) => isNonEmptyString(value);
-const isEmittableArray = ({ value }) => isStringArray$1(value);
+const isEmittableArray = ({ value }) => isStringArray(value);
 const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
 const isImportableArray = ({ value }) => isSafeStringArray(value);
 const isEmittableObject = ({ value }) => isPlainObject$1(value);
@@ -26823,7 +26831,7 @@ function isStringRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	return Object.values(value).every((v) => typeof v === "string");
 }
-function isStringArray$1(value) {
+function isStringArray(value) {
 	return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
 /** Compare object values without letting key order decide the answer. */
@@ -26868,7 +26876,7 @@ function isSafeEnvEntry(entry) {
 * skipped wholesale when that read fails.
 */
 function isSafeStringArray(value) {
-	return isStringArray$1(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
+	return isStringArray(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
 }
 /**
 * A raw string kept only if the canonical field it would land in accepts it,
@@ -26910,7 +26918,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 		return {
 			...url !== void 0 && { url },
 			...isStringRecord(headers) && { headers },
-			...isStringArray$1(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
+			...isStringArray(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
 		};
 	}
 	if (hookType === "mcp_tool") {
@@ -28071,7 +28079,8 @@ function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned,
 			logger
 		})).map((handler) => cloneHandler(handler));
 		if (preserved.length === 0) continue;
-		const target = merged.find((candidate) => isMatcherGroup(candidate) && matcherKey(candidate.matcher) === matcher);
+		const attributes = groupAttributesKey(group);
+		const target = merged.find((candidate) => isMatcherGroup(candidate) && matcherKey(candidate.matcher) === matcher && groupAttributesKey(candidate) === attributes);
 		if (target !== void 0 && isMatcherGroup(target)) target.hooks.push(...preserved);
 		else merged.push({
 			...omitPrototypePollutionKeys(group),
@@ -28192,6 +28201,11 @@ function stableStringify$1(value) {
 function matcherKey(matcher) {
 	return matcher === void 0 ? "" : stableStringify$1(matcher);
 }
+/** The stable form of a matcher group's keys other than `matcher` and `hooks`. */
+function groupAttributesKey(group) {
+	const { matcher: _matcher, hooks: _hooks, ...attributes } = group;
+	return stableStringify$1(attributes);
+}
 function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
 }
@@ -28687,7 +28701,7 @@ const MANAGED_EVENT_NAMES = new Set(Object.values(CANONICAL_TO_CLINE_EVENT_NAMES
 function parseManifest(fileContent) {
 	try {
 		const parsed = JSON.parse(fileContent);
-		if (!isRecord$1(parsed) || !isStringArray$2(parsed.events)) return null;
+		if (!isRecord$1(parsed) || !isStringArray$1(parsed.events)) return null;
 		return {
 			generatedBy: "rulesync",
 			events: parsed.events.filter((event) => MANAGED_EVENT_NAMES.has(event))
@@ -30225,7 +30239,7 @@ function copilotCliHooksToCanonical(rawHooks, logger) {
 * see the CLI config dir reference:
 * https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
 */
-function copilotCliSettingsPaths({ global }) {
+function copilotCliSettingsPaths$1({ global }) {
 	return global ? {
 		relativeDirPath: COPILOT_DIR,
 		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
@@ -30240,7 +30254,7 @@ function copilotCliSettingsPaths({ global }) {
 * subject, and the permissions feature reports a broken settings file itself.
 */
 async function readDisableAllHooks({ outputRoot, global }) {
-	const paths = copilotCliSettingsPaths({ global });
+	const paths = copilotCliSettingsPaths$1({ global });
 	const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
 	if (fileContent === null) return;
 	try {
@@ -30270,7 +30284,7 @@ var CopilotcliHooksSettings = class CopilotcliHooksSettings extends ToolFile {
 		return false;
 	}
 	static async fromDisableAllHooks({ outputRoot = process.cwd(), global = false, disableAllHooks }) {
-		const paths = copilotCliSettingsPaths({ global });
+		const paths = copilotCliSettingsPaths$1({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
 		return new CopilotcliHooksSettings({
@@ -30300,7 +30314,7 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		this.disableAllHooks = disableAllHooks;
 	}
 	static getExtraSharedWritePaths({ global = false } = {}) {
-		return [copilotCliSettingsPaths({ global })];
+		return [copilotCliSettingsPaths$1({ global })];
 	}
 	static async getAuxiliaryFiles({ toolHooks } = {}) {
 		return toolHooks instanceof CopilotcliHooks && toolHooks.settingsFile ? [toolHooks.settingsFile] : [];
@@ -34744,12 +34758,21 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
 		const paths = QwencodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
-		const patch = { hooks: canonicalToQwencodeHooks(config, logger) };
+		const previouslyOwned = preserveUnowned ? parseHooksOwnershipLock(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0;
+		const merged = mergeGeneratedHookLists({
+			existingContent,
+			generatedHooks: canonicalToQwencodeHooks(config, logger),
+			shape: "matcher-groups",
+			preserveUnowned,
+			previouslyOwned,
+			logger
+		});
+		const patch = { hooks: merged.hooks };
 		const disableAllHooks = config.qwencode?.disableAllHooks;
 		if (typeof disableAllHooks === "boolean") patch.disableAllHooks = disableAllHooks;
 		const fileContent = applySharedConfigPatch({
@@ -34764,9 +34787,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
+			ownedHookRefs: preserveUnowned ? merged.owned : void 0,
 			validate
 		});
 	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+	static async getAuxiliaryFiles({ toolHooks } = {}) {
+		return toolHooks instanceof QwencodeHooks ? toolHooks.getOwnershipLockFiles() : [];
+	}
 	toRulesyncHooks() {
 		let settings;
 		try {
@@ -41166,7 +41196,7 @@ function isCodexStdioServer(config) {
 * @see https://learn.chatgpt.com/docs/extend/mcp
 */
 function isValidRenamedArray(key, value) {
-	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$2(value);
+	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$1(value);
 }
 /**
 * The keys of Codex's `McpServerOAuthConfig`. Anything else in a server's
@@ -42385,18 +42415,6 @@ function renameEnabledToolsToTools({ server, serverName, logger }) {
 	};
 }
 /**
-* Copilot CLI's `tools` accepts more than the canonical `enabledTools` shape:
-* `--tools` documents `*`, a comma-separated list, or `""`, so a hand-written or
-* CLI-written entry can be a bare string. Canonical `enabledTools` is
-* `string[]`, and `RulesyncMcp` throws on a schema failure — carrying a string
-* through would reject the WHOLE imported MCP file rather than one key. Anything
-* that is not a string array is therefore left under `tools` untouched, matching
-* `codexcli-mcp.ts`'s `isValidRenamedArray` guard on the same class of rename.
-*/
-function isStringArray(value) {
-	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
-}
-/**
 * Resolves and sets the transport type for each MCP server config.
 * GitHub Copilot CLI requires the "type" field for each server. A server it
 * cannot express — one that names no transport, or names one it carries no way
@@ -42438,7 +42456,7 @@ function addTypeField(mcpServers, logger) {
 				});
 				continue;
 			}
-			const { httpUrl: _httpUrl, ...rest } = parsed;
+			const { httpUrl: _httpUrl, disabled: _disabled, ...rest } = parsed;
 			result[name] = {
 				...renameEnabledToolsToTools({
 					server: rest,
@@ -42450,7 +42468,7 @@ function addTypeField(mcpServers, logger) {
 			};
 			continue;
 		}
-		const { httpUrl: _localHttpUrl, ...local } = parsed;
+		const { httpUrl: _localHttpUrl, disabled: _localDisabled, ...local } = parsed;
 		const [head, ...tail] = resolveLocalMcpCommand(parsed);
 		if (head === void 0) {
 			warnAndSkipMcpServer({
@@ -42481,7 +42499,7 @@ function removeTypeField(config) {
 	const result = {};
 	for (const [name, server] of Object.entries(config.mcpServers ?? {})) {
 		const { tools, ...withoutTools } = server;
-		const restored = isStringArray(tools) ? {
+		const restored = isStringArray$1(tools) ? {
 			...withoutTools,
 			enabledTools: tools
 		} : {
@@ -42497,6 +42515,99 @@ function removeTypeField(config) {
 	}
 	return result;
 }
+/**
+* The Copilot CLI settings file carrying `disabledMcpServers`:
+* `.github/copilot/settings.json` (project) / `~/.copilot/settings.json`
+* (global). Both scopes document the key ("MCP server names to disable. Listed
+* servers are configured but not started"); at repository scope it is
+* union-merged with the user value, so a repository can add names but never
+* remove them.
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+*/
+function copilotCliSettingsPaths({ global }) {
+	return global ? {
+		relativeDirPath: COPILOT_DIR,
+		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+	} : {
+		relativeDirPath: COPILOTCLI_PROJECT_SETTINGS_DIR_PATH,
+		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+	};
+}
+async function readCopilotCliSettings({ outputRoot, global }) {
+	const paths = copilotCliSettingsPaths({ global });
+	const existingContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+	try {
+		return {
+			paths,
+			existingContent,
+			document: parseSharedConfig({
+				format: "json",
+				fileContent: existingContent,
+				filePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath),
+				invalidRootPolicy: "error"
+			})
+		};
+	} catch (error) {
+		return {
+			paths,
+			existingContent,
+			document: null,
+			error
+		};
+	}
+}
+/**
+* The names of the servers rulesync actually writes for this target: one
+* `addTypeField` skips (no transport, WebSocket, missing url or command) is
+* not managed, so its name neither gains a toggle nor strips a same-named
+* user-authored entry from the settings file.
+*/
+function managedServerNames(mcpServers) {
+	return Object.keys(addTypeField(mcpServers) ?? {});
+}
+/**
+* Overlays `disabled: true` on the servers the scope's settings file lists in
+* `disabledMcpServers`, so import round-trips the toggle into the canonical
+* config. A settings file that exists but cannot be parsed throws
+* (fail-closed): importing past it would re-enable every disabled server.
+*/
+async function overlayDisabledServers({ mcpServers, outputRoot, global }) {
+	const settings = await readCopilotCliSettings({
+		outputRoot,
+		global
+	});
+	if (settings.document === null) throw new Error(`Cannot import Copilot CLI MCP servers: ${formatError(settings.error)}. Fix the file so disabledMcpServers can be read.`, { cause: settings.error });
+	const disabled = settings.document.disabledMcpServers;
+	if (!isStringArray$1(disabled) || disabled.length === 0) return mcpServers;
+	const servers = { ...mcpServers };
+	for (const name of disabled) {
+		if (!Object.hasOwn(servers, name)) continue;
+		const server = servers[name];
+		if (isPlainObject$1(server)) servers[name] = {
+			...server,
+			disabled: true
+		};
+	}
+	return servers;
+}
+/**
+* Auxiliary writer for `disabledMcpServers` in the Copilot CLI settings file.
+* Only that key is owned (through the shared-config gateway), so `deniedUrls`,
+* `disableAllHooks`, `model` and every other setting are preserved. It is a
+* shared, user-owned file and is never deleted.
+*/
+var CopilotcliMcpSettings = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	isDeletable() {
+		return false;
+	}
+};
 var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -42539,7 +42650,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 		const json = JSON.parse(fileContent);
 		const newJson = {
 			...json,
-			mcpServers: json.mcpServers ?? {}
+			mcpServers: await overlayDisabledServers({
+				mcpServers: json.mcpServers ?? {},
+				outputRoot,
+				global
+			})
 		};
 		return new CopilotcliMcp({
 			outputRoot,
@@ -42554,7 +42669,15 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ mcpServers: {} }, null, 2);
 		const json = JSON.parse(fileContent);
-		const copilotCliMcpServers = addTypeField(rulesyncMcp.getMcpServers(), logger);
+		const settings = await readCopilotCliSettings({
+			outputRoot,
+			global
+		});
+		const copilotCliMcpServers = addTypeField(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).filter(([name, server]) => {
+			if (server.disabled !== true || settings.document !== null) return true;
+			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${(0, node_path.join)(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} cannot be parsed, so disabledMcpServers cannot be written to switch it off.`);
+			return false;
+		})), logger);
 		const mcpJson = {
 			...json,
 			mcpServers: copilotCliMcpServers
@@ -42568,6 +42691,61 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			global
 		});
 	}
+	/**
+	* `disabledMcpServers` lives in the Copilot CLI settings file the hooks and
+	* permissions features also write. Declared here so the write-order
+	* derivation sees this feature as one of that file's writers — it is not a
+	* settable path, since the servers themselves live in the MCP file.
+	*/
+	static getExtraSharedWritePaths({ global = false } = {}) {
+		return [copilotCliSettingsPaths({ global })];
+	}
+	/**
+	* Routes the canonical `disabled: true` to `disabledMcpServers`, the key
+	* Copilot CLI actually consults: an MCP file entry has no `disabled` field.
+	* rulesync owns the toggle for the servers it writes; names it does not
+	* manage keep their existing state. The file is not created or touched when
+	* there is nothing to disable and nothing to retract.
+	*/
+	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
+		const servers = rulesyncMcp.forTarget({
+			toolTarget: "copilotcli",
+			global
+		}).getMcpServers();
+		const managedNames = managedServerNames(servers);
+		const disabledNames = managedNames.filter((name) => servers[name]?.disabled === true);
+		const settings = await readCopilotCliSettings({
+			outputRoot,
+			global
+		});
+		if (settings.document === null) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: ${formatError(settings.error)}`);
+			return [];
+		}
+		const existing = settings.document.disabledMcpServers;
+		const existingDisabled = isStringArray$1(existing) ? existing : [];
+		const managedNameSet = new Set(managedNames);
+		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
+		if (reEnabled.length > 0) logger?.warn(`Copilot CLI MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
+		const mergedDisabled = [...existingDisabled.filter((name) => !managedNameSet.has(name)), ...disabledNames].toSorted();
+		if (mergedDisabled.length === 0 && existing === void 0) return [];
+		if (isStringArray$1(existing) && existing.length === mergedDisabled.length && existing.toSorted().every((name, index) => name === mergedDisabled[index])) return [];
+		const { paths } = settings;
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		return [new CopilotcliMcpSettings({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent: settings.existingContent,
+				patch: { disabledMcpServers: mergedDisabled.length > 0 ? mergedDisabled : void 0 },
+				filePath
+			}),
+			global
+		})];
+	}
 	toRulesyncMcp() {
 		const mcpServers = removeTypeField(this.json);
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
@@ -42999,10 +43177,10 @@ function convertFromCrushFormat(crushServers) {
 					if (value === "http" || value === "sse") converted.type = value;
 					break;
 				case "disabled_tools":
-					if (isStringArray$2(value)) converted.disabledTools = value;
+					if (isStringArray$1(value)) converted.disabledTools = value;
 					break;
 				case "enabled_tools":
-					if (isStringArray$2(value)) converted.enabledTools = value;
+					if (isStringArray$1(value)) converted.enabledTools = value;
 					break;
 				case "oauth_token": break;
 				default: {
@@ -43989,7 +44167,7 @@ function convertRowsFromDsh(rows, logger) {
 		} else {
 			server.type = "stdio";
 			if (typeof config.command === "string") server.command = config.command;
-			if (isStringArray$2(config.args)) server.args = config.args;
+			if (isStringArray$1(config.args)) server.args = config.args;
 			const env = copyStringRecord(config.env);
 			if (env !== void 0) server.env = env;
 			if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -44420,11 +44598,11 @@ function applyGooseStdioFields(ext, config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") ext.cmd = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$2(config.args) ? config.args : [];
+		const args = isStringArray$1(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) ext.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		ext.cmd = command;
-		if (isStringArray$2(config.args)) ext.args = config.args;
+		if (isStringArray$1(config.args)) ext.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) ext.envs = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") ext.cwd = config.cwd;
@@ -44527,7 +44705,7 @@ function convertFromGooseFormat(extensions) {
 		else if (type === "streamable_http") server.type = "http";
 		else server.type = "stdio";
 		if (typeof ext.cmd === "string") server.command = ext.cmd;
-		if (isStringArray$2(ext.args)) server.args = ext.args;
+		if (isStringArray$1(ext.args)) server.args = ext.args;
 		if (isPlainObject$1(ext.envs)) server.env = omitPrototypePollutionKeys(ext.envs);
 		if (typeof ext.cwd === "string") server.cwd = ext.cwd;
 		if (typeof ext.uri === "string") server.url = ext.uri;
@@ -44549,11 +44727,11 @@ function buildGoosePluginStdioServer(config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") server.command = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$2(config.args) ? config.args : [];
+		const args = isStringArray$1(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) server.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		server.command = command;
-		if (isStringArray$2(config.args)) server.args = config.args;
+		if (isStringArray$1(config.args)) server.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -44961,7 +45139,7 @@ function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
 	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	if (typeof oauth.scope !== "string" && isStringArray$1(source.scopes)) oauth.scope = source.scopes.join(" ");
 	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
@@ -44988,7 +45166,7 @@ function copyHermesAdvancedFields(source, target) {
 		target.auth = source.auth;
 		copied = true;
 	}
-	if (typeof source.client_cert === "string" || isStringArray$2(source.client_cert)) {
+	if (typeof source.client_cert === "string" || isStringArray$1(source.client_cert)) {
 		target.client_cert = source.client_cert;
 		copied = true;
 	}
@@ -45060,8 +45238,8 @@ function copyHermesAdvancedFields(source, target) {
 */
 function buildHermesToolsBlock(config) {
 	const tools = {};
-	if (isStringArray$2(config.enabledTools)) tools.include = config.enabledTools;
-	if (isStringArray$2(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (isStringArray$1(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray$1(config.disabledTools)) tools.exclude = config.disabledTools;
 	if (typeof config.promptsEnabled === "boolean") tools.prompts = config.promptsEnabled;
 	if (typeof config.resourcesEnabled === "boolean") tools.resources = config.resourcesEnabled;
 	return tools;
@@ -45073,8 +45251,8 @@ function buildHermesToolsBlock(config) {
 * `promptsEnabled`/`resourcesEnabled` top-level toggles.
 */
 function applyHermesToolsBlock(hermesTools, server) {
-	if (isStringArray$2(hermesTools.include)) server.enabledTools = hermesTools.include;
-	if (isStringArray$2(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
+	if (isStringArray$1(hermesTools.include)) server.enabledTools = hermesTools.include;
+	if (isStringArray$1(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
 	if (typeof hermesTools.prompts === "boolean") server.promptsEnabled = hermesTools.prompts;
 	if (typeof hermesTools.resources === "boolean") server.resourcesEnabled = hermesTools.resources;
 }
@@ -45100,11 +45278,11 @@ function convertServerToHermes(config) {
 		if (Array.isArray(command)) {
 			if (typeof command[0] === "string") out.command = command[0];
 			const rest = command.slice(1).filter((c) => typeof c === "string");
-			const args = isStringArray$2(config.args) ? config.args : [];
+			const args = isStringArray$1(config.args) ? config.args : [];
 			if (rest.length > 0 || args.length > 0) out.args = [...rest, ...args];
 		} else if (typeof command === "string") {
 			out.command = command;
-			if (isStringArray$2(config.args)) out.args = config.args;
+			if (isStringArray$1(config.args)) out.args = config.args;
 		}
 		if (isPlainObject$1(config.env)) out.env = omitPrototypePollutionKeys(config.env);
 	} else if (url !== void 0) {
@@ -45154,7 +45332,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const server = {};
 		if (typeof config.command === "string") server.command = config.command;
-		if (isStringArray$2(config.args)) server.args = config.args;
+		if (isStringArray$1(config.args)) server.args = config.args;
 		if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 		if (typeof config.url === "string") server.url = config.url;
 		if (isPlainObject$1(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
@@ -46346,7 +46524,7 @@ function mergeToolLists(...lists) {
 function toKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		const { kiroAutoApprove, kiroAutoBlock, disabledTools, ...rest } = server;
-		const autoApprove = mergeToolLists(isStringArray$2(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
+		const autoApprove = mergeToolLists(isStringArray$1(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
 		const disabled = mergeToolLists(disabledTools, kiroAutoBlock);
 		return [name, {
 			...rest,
@@ -46370,7 +46548,7 @@ function fromKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		if (server === null || typeof server !== "object" || Array.isArray(server)) return [name, server];
 		const { autoApprove, ...rest } = server;
-		if (!isStringArray$2(autoApprove)) return [name, server];
+		if (!isStringArray$1(autoApprove)) return [name, server];
 		return [name, {
 			...rest,
 			kiroAutoApprove: autoApprove
@@ -47799,7 +47977,7 @@ function headersRecordToPoolList(headers) {
 	return Object.entries(headers).map(([name, value]) => `${name}: ${value}`);
 }
 function poolHeadersListToRecord(serverName, headers) {
-	if (!isStringArray$2(headers)) return void 0;
+	if (!isStringArray$1(headers)) return void 0;
 	const result = {};
 	for (const entry of headers) {
 		const separator = entry.indexOf(":");
@@ -47825,7 +48003,7 @@ const GLOB_METACHARACTERS = /[*?[]/;
 /** Patterns named in the glob warning before the rest collapse to `(+N more)`. */
 const MAX_LISTED_GLOB_PATTERNS = 10;
 function importPoolToolList({ serverName, poolKey, value, warnOnGlobs }) {
-	if (!isStringArray$2(value)) {
+	if (!isStringArray$1(value)) {
 		warnWithFallback(void 0, `Ignored malformed value for ${poolKey} in Pool MCP server ${quoteValueForWarning(serverName)}: expected a list of strings`);
 		return;
 	}
@@ -48035,7 +48213,7 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 			const poolAllow = isRecord$1(rawServer) ? rawServer.poolAllow : void 0;
 			return [serverName, {
 				...serverConfig,
-				...isStringArray$2(poolAllow) && { poolAllow }
+				...isStringArray$1(poolAllow) && { poolAllow }
 			}];
 		})), logger);
 		return new PoolMcp({
@@ -48266,7 +48444,7 @@ function pickServerLists(source) {
 	if (!isPlainObject$1(source)) return {};
 	return Object.fromEntries(QWENCODE_MCP_SERVER_LIST_KEYS.flatMap((key) => {
 		const value = source[key];
-		return isStringArray$2(value) ? [[key, value]] : [];
+		return isStringArray$1(value) ? [[key, value]] : [];
 	}));
 }
 /**
@@ -48959,7 +49137,7 @@ async function resolveRovodevMcpImportPath({ outputRoot, global, config, logger
 }
 function disabledNamesOf(config) {
 	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
-	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
+	return isStringArray$1(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
 * The value `mcp.mcpConfigPath` needs so Rovo Dev reads the `mcp.json` rulesync
@@ -49375,7 +49553,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			return [];
 		}
 		const existingMcp = isRecord$1(existingParsed.mcp) ? { ...existingParsed.mcp } : {};
-		const existingDisabled = isStringArray$2(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
+		const existingDisabled = isStringArray$1(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
 		if (reEnabled.length > 0) logger?.warn(`Rovo Dev MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
@@ -56534,8 +56712,9 @@ function convertClaudeToRulesyncPermissions(params) {
 //#endregion
 //#region src/features/permissions/cline-permissions.ts
 /**
-* Cline CLI loads command permissions from the `CLINE_COMMAND_PERMISSIONS` environment variable.
-* Cline supports only `allow` and `deny` (no `ask`), and only for shell commands.
+* The legacy Cline CLI loaded command permissions from the `CLINE_COMMAND_PERMISSIONS`
+* environment variable. It supported only `allow` and `deny` (no `ask`), and only for
+* shell commands.
 * Schema:
 * ```json
 * { "allow": ["pattern1", ...], "deny": ["pattern2", ...], "allowRedirects": false }
@@ -56543,7 +56722,14 @@ function convertClaudeToRulesyncPermissions(params) {
 *
 * Rulesync writes the JSON to `.cline/command-permissions.json` so users can do:
 * `export CLINE_COMMAND_PERMISSIONS=$(cat .cline/command-permissions.json)`
+*
+* Deprecated: no Cline CLI 3 release reads `CLINE_COMMAND_PERMISSIONS`. Upstream removed
+* it from the docs in cline/cline@6354d209, and the CLI reference now says the CLI has no
+* allow or deny list for shell commands and recommends a `PreToolUse` hook instead
+* (https://docs.cline.bot/cli/cli-reference). The output is still generated for
+* compatibility, with a deprecation warning on every generation.
 */
+const CLINE_PERMISSIONS_DEPRECATION_WARNING = "WARNING: The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. See https://docs.cline.bot/cli/cli-reference.";
 const ClineCommandPermissionsSchema = zod_mini.z.looseObject({
 	allow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
@@ -56661,6 +56847,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
+		logger?.warn(CLINE_PERMISSIONS_DEPRECATION_WARNING);
 		const paths = ClinePermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
@@ -56690,7 +56877,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		const mergedDeny = (0, es_toolkit.uniq)([...existing.deny ?? [], ...dedupedDeny]).toSorted();
 		const denySet = new Set(mergedDeny);
 		const collisions = dedupedAllow.filter((p) => denySet.has(p));
-		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline documents that deny rules always take precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
+		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. The legacy Cline CLI gave deny rules precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
 		const next = {
 			...existing,
 			allow: dedupedAllow,
@@ -59973,9 +60160,9 @@ function managedContinueToolNames(config) {
 */
 function parseContinuePermissionLists(parsed) {
 	return {
-		exclude: isStringArray$2(parsed.exclude) ? parsed.exclude : [],
-		ask: isStringArray$2(parsed.ask) ? parsed.ask : [],
-		allow: isStringArray$2(parsed.allow) ? parsed.allow : []
+		exclude: isStringArray$1(parsed.exclude) ? parsed.exclude : [],
+		ask: isStringArray$1(parsed.ask) ? parsed.ask : [],
+		allow: isStringArray$1(parsed.allow) ? parsed.allow : []
 	};
 }
 /**
@@ -60502,8 +60689,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			logger
 		});
 		const managedToolNames = managedCrushToolNames(config);
-		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
-		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
+		const preservedAllowed = (isStringArray$1(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
+		const preservedDisabled = (isStringArray$1(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
 		const allowedList = uniq$11([...preservedAllowed, ...generated.allowed]);
 		const disabledList = uniq$11([...preservedDisabled, ...generated.disabled]);
 		const patch = {};
@@ -60529,8 +60716,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 		const permissions = isRecord$1(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
 		const options = isRecord$1(this.json["options"]) ? this.json[CRUSH_OPTIONS_KEY] : {};
 		const rulesyncConfig = convertCrushListsToRulesync({
-			allowed: isStringArray$2(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
-			disabled: isStringArray$2(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+			allowed: isStringArray$1(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
+			disabled: isStringArray$1(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
 		});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
@@ -62705,7 +62892,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 function convertGoosePermissionConfigToRulesync(userPermission) {
 	const permission = {};
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
-		const toolNames = isStringArray$2(userPermission[key]) ? userPermission[key] : [];
+		const toolNames = isStringArray$1(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
@@ -63053,7 +63240,7 @@ const ACTION_RANK$3 = {
 * (mirrors the Cursor adapter's preservation of unmanaged types).
 */
 function unmanagedEntries(existingPermission, key) {
-	return (isStringArray$2(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+	return (isStringArray$1(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
 }
 /**
 * Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
@@ -63110,7 +63297,7 @@ function warnRemovedAllToolsRestrictions({ existingPermission, ranked, logger })
 	const generated = ranked.get(GROK_ALL_TOOLS_ENTRY);
 	for (const action of ["deny", "ask"]) {
 		const entries = existingPermission[action];
-		if (!isStringArray$2(entries)) continue;
+		if (!isStringArray$1(entries)) continue;
 		if (!entries.some((entry) => parseGrokEntry(entry)?.category === "*")) continue;
 		if (generated !== void 0 && ACTION_RANK$3[generated] >= ACTION_RANK$3[action]) continue;
 		logger.warn(`Grok CLI permissions: removing the existing bare '*' entry from the '${action}' array — Rulesync now manages it through the all-tools '*' category, and the canonical config has no '*' '${action}' rule. Add "*": { "*": "${action}" } to keep restricting every tool.`);
@@ -63141,9 +63328,9 @@ function warnEntriesShadowedByAllTools({ ranked, logger }) {
 * described more than once resolves to the strictest action.
 */
 function parseGrokPermissionArrays(permission) {
-	const allow = isStringArray$2(permission.allow) ? permission.allow : void 0;
-	const deny = isStringArray$2(permission.deny) ? permission.deny : void 0;
-	const ask = isStringArray$2(permission.ask) ? permission.ask : void 0;
+	const allow = isStringArray$1(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray$1(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray$1(permission.ask) ? permission.ask : void 0;
 	const rules = Array.isArray(permission[GROKCLI_PERMISSION_RULES_KEY]) ? permission[GROKCLI_PERMISSION_RULES_KEY] : void 0;
 	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
@@ -63351,20 +63538,20 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		const permission = clonePermissionBlock(provenance.permission);
 		reconcileCommandAllowlist({
 			permission,
-			commandAllowlist: isStringArray$2(config.command_allowlist) ? config.command_allowlist : []
+			commandAllowlist: isStringArray$1(config.command_allowlist) ? config.command_allowlist : []
 		});
 		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
 			category: SHELL_PERMISSION_CATEGORY,
-			patterns: isStringArray$2(approvals.deny) ? approvals.deny : []
+			patterns: isStringArray$1(approvals.deny) ? approvals.deny : []
 		});
 		const security = isRecord$1(config.security) ? config.security : {};
 		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
 			category: WEBFETCH_PERMISSION_CATEGORY,
-			patterns: websiteBlocklist.enabled === true && isStringArray$2(websiteBlocklist.domains) ? websiteBlocklist.domains : []
+			patterns: websiteBlocklist.enabled === true && isStringArray$1(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
 		const { permission: _permission, hermes: _hermes, ...otherProvenance } = provenance;
@@ -64758,13 +64945,13 @@ function classifyExistingEntry({ emitted, capability, pattern, effect }) {
 * how many entries rulesync does not generate.
 */
 function mergeExistingRule({ rule, emitted, logger }) {
-	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$2(rule.match)) return {
+	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$1(rule.match)) return {
 		rule,
 		unrelatedEntries: 0
 	};
 	const capability = rule.capability;
 	const isCatchAll = rule.match === void 0;
-	const patterns = isStringArray$2(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
+	const patterns = isStringArray$1(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
 	if (patterns.length === 0) return {
 		rule,
 		unrelatedEntries: 0
@@ -64948,7 +65135,7 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 		for (const rule of rules) {
 			if (!isImportableRule(rule) || !isRecord$1(rule) || !isPermissionAction$1(rule.effect)) continue;
 			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
-			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$2(rule.match) ? rule.match : [];
+			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$1(rule.match) ? rule.match : [];
 			const categoryRules = permission[category] ??= {};
 			for (const pattern of patterns) {
 				const previous = categoryRules[pattern];
@@ -66666,8 +66853,8 @@ function importPoolTool({ toolConfig, bucket }) {
 		bucket[CATCH_ALL_PATTERN$3] = "deny";
 		return;
 	}
-	const denied = isStringArray$2(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
-	const allowed = isStringArray$2(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
+	const denied = isStringArray$1(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
+	const allowed = isStringArray$1(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
 	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
 	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
 }
@@ -68872,7 +69059,7 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 		permission[category] ??= {};
 		permission[category][CATCH_ALL_PATTERN$1] = levels.reduce((strictest, level) => strictestAction(strictest, level ?? implicitLevel), permission[category][CATCH_ALL_PATTERN$1]);
 	}
-	if (isStringArray$2(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
+	if (isStringArray$1(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
 		permission.read[path] ??= "allow";
 	}
@@ -69128,7 +69315,7 @@ function stripRefusedOverridePaths(override) {
 */
 function collectTrustAffectingOverrideEntries({ tools, general }) {
 	const entries = [];
-	const allowed = isStringArray$2(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
+	const allowed = isStringArray$1(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
 	if (allowed.length > 0) entries.push({
 		label: `tools.allowed (${allowed.map(quoteValueForWarning).join(", ")})`,
 		reason: "auto-approves what it names as the override spells it; a non-shell entry is only checked against a whole-tool deny of its tool"
@@ -69279,7 +69466,7 @@ function withholdDeniedOverrideAllowed({ overrideVerbatimAllowed, exclude, logge
 * hand-written entry went.
 */
 function reportDroppedManagedEntries({ existingTools, allowedList, excludeList, logger }) {
-	const dropped = (key, list) => (0, es_toolkit.uniq)(isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+	const dropped = (key, list) => (0, es_toolkit.uniq)(isStringArray$1(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
 		if (list.includes(entry)) return false;
 		const toolName = parseTabnineEntry(entry)?.toolName;
 		return toolName === void 0 || !list.includes(toolName);
@@ -69361,7 +69548,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		}
 		const overrideList = (key) => {
 			const value = overrideTools[key];
-			if (value === void 0 || isStringArray$2(value)) return value ?? [];
+			if (value === void 0 || isStringArray$1(value)) return value ?? [];
 			warnWithFallback(logger, `Tabnine CLI permissions: ignored tools.${key} of the tabnine override (${quoteValueForWarning(value)}); it must be a list of tool names.`);
 			return [];
 		};
@@ -69399,7 +69586,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		if (ignoredOverrideKeys.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: ignored ${ignoredOverrideKeys.length} key(s) of the tabnine override (${ignoredOverrideKeys.map(quoteValueForWarning).join(", ")}); only 'tools' and 'general' are written through the permissions feature.`);
 		const existingTools = this.existingToolsGroup(existingContent);
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => category === "bash" || category === "*" ? SHELL_TOOL_NAME : toTabnineToolName(category)));
-		const preservedEntries = (key) => (isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+		const preservedEntries = (key) => (isStringArray$1(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
 			const toolName = parseTabnineEntry(entry)?.toolName;
 			return toolName === void 0 || !managedToolNames.has(toolName);
 		});
@@ -69477,7 +69664,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			if (rules !== void 0 && !Object.hasOwn(rules, pattern)) rules[pattern] = action;
 		};
 		for (const [key, action] of [[EXCLUDE_KEY, "deny"], [ALLOWED_KEY, "allow"]]) {
-			const entries = isStringArray$2(tools[key]) ? tools[key] : [];
+			const entries = isStringArray$1(tools[key]) ? tools[key] : [];
 			for (const entry of entries) {
 				const parsed = parseTabnineEntry(entry);
 				if (parsed === void 0) {
@@ -70345,12 +70532,12 @@ const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|\p{Emoji_Modifier_Base}|
 * The ranges are the `East_Asian_Width=A` property of Unicode 17.0, taken from
 * the table `get-east-asian-width` 1.6.0 carries and merged where two are
 * adjacent. The table is written out here rather than read from the package so
-* that the one lookup adds no dependency of its own, and the drift test in
-* `display-width.test.ts` is what keeps it honest: it loads the package through
-* the prompt renderer that already depends on it, walks every code point, and
-* fails when this table and the property disagree in either direction. When
-* the renderer's copy moves to a newer Unicode, that test is what fails, and
-* the table is regenerated from the new property — its ranges, marks aside,
+* that the one lookup adds no runtime dependency of its own, and the drift test
+* in `display-width.test.ts` is what keeps it honest: it loads the package,
+* pinned as a dev dependency, walks every code point, and fails when this
+* table and the property disagree in either direction. When that pin moves to
+* a newer Unicode, that test is what fails, and the table is regenerated from
+* the new property — its ranges, marks aside,
 * merged where adjacent and written as escapes — with the version named here.
 *
 * Three stretches of the property are left out because they never reach this
@@ -72099,8 +72286,8 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		const executionProfiles = isRecord$1(agents["execution_profiles"]) ? agents[EXECUTION_PROFILES_KEY] : void 0;
 		const defaultProfile = executionProfiles && isRecord$1(executionProfiles["default"]) ? executionProfiles[DEFAULT_PROFILE_KEY] : void 0;
 		const config = convertWarpToRulesyncPermissions({
-			allow: defaultProfile ? isStringArray$2(defaultProfile["command_allowlist"]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$2(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
-			deny: defaultProfile ? isStringArray$2(defaultProfile["command_denylist"]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$2(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
+			allow: defaultProfile ? isStringArray$1(defaultProfile["command_allowlist"]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$1(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
+			deny: defaultProfile ? isStringArray$1(defaultProfile["command_denylist"]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$1(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
 		const warpOverride = {};
 		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
@@ -72630,8 +72817,8 @@ var WarpcliPermissions = class WarpcliPermissions extends ToolPermissions {
 		const allowlist = defaultProfile[PROFILE_ALLOWLIST_KEY];
 		const denylist = defaultProfile[PROFILE_DENYLIST_KEY];
 		const config = convertWarpToRulesyncPermissions({
-			allow: isStringArray$2(allowlist) ? allowlist : [],
-			deny: isStringArray$2(denylist) ? denylist : []
+			allow: isStringArray$1(allowlist) ? allowlist : [],
+			deny: isStringArray$1(denylist) ? denylist : []
 		});
 		const executionProfileOverride = liftExecutionProfileOverride(defaultProfile);
 		const warpcliOverride = {};
@@ -84646,7 +84833,7 @@ var BobSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const bobSection = isRecord$1(frontmatter.bob) ? frontmatter.bob : {};
-		if (isStringArray$2(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
+		if (isStringArray$1(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
 		return mode;
 	}
 };
@@ -90101,7 +90288,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const zoocodeSection = isRecord$1(frontmatter.zoocode) ? frontmatter.zoocode : {};
-		if (isStringArray$2(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
+		if (isStringArray$1(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
 		return mode;
 	}
 	toRulesyncSubagents() {
@@ -90113,7 +90300,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 				targets: ["zoocode"],
 				roo: restRooSection
 			};
-			if (isStringArray$2(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
+			if (isStringArray$1(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
 			return new RulesyncSubagent({
 				outputRoot: ".",
 				frontmatter: rebuilt,
@@ -94054,7 +94241,8 @@ var NestedAgentsmdRule = class extends ToolRule {
 * `<subprojectPath>/AGENTS.md` (project scope only); every other non-root rule
 * folds into the root `AGENTS.md`, since Codex has no modular rules directory.
 * The project files on the root-to-cwd chain share one `project_doc_max_bytes`
-* budget (32 KiB by default), which the RulesProcessor warns about.
+* budget (32 KiB by default, or the value set in the project's
+* `.codex/config.toml`), which the RulesProcessor warns about.
 *
 * @see https://learn.chatgpt.com/docs/agent-configuration/agents-md
 */
@@ -94066,6 +94254,29 @@ var CodexcliRule = class extends NestedAgentsmdRule {
 		};
 	}
 };
+/**
+* Read the `project_doc_max_bytes` value set in the project's
+* `.codex/config.toml`, which Codex loads for trusted projects and which
+* overrides the 32 KiB default budget for project `AGENTS.md` files.
+*
+* Answers `undefined` when the file is missing, is not valid TOML, or does not
+* set the key to a positive integer, so the caller falls back to the default.
+*
+* @see https://learn.chatgpt.com/docs/config-file/config-reference
+*/
+async function readCodexcliProjectDocMaxBytes(outputRoot) {
+	const content = await readFileContentOrNull((0, node_path.join)(outputRoot, CODEXCLI_DIR, CODEXCLI_MCP_FILE_NAME));
+	if (content === null) return;
+	let parsed;
+	try {
+		parsed = smol_toml.parse(content);
+	} catch {
+		return;
+	}
+	if (!isPlainObject$1(parsed)) return;
+	const value = parsed.project_doc_max_bytes;
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
 //#endregion
 //#region src/features/rules/commandcode-rule.ts
 var CommandcodeRule = class CommandcodeRule extends ToolRule {
@@ -99440,7 +99651,9 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold",
 			projectInstructionBudget: {
 				bytes: CODEXCLI_PROJECT_DOC_MAX_BYTES,
-				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (ignore this warning if you already have)."
+				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml`.",
+				readConfiguredBytes: readCodexcliProjectDocMaxBytes,
+				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml`"
 			}
 		}
 	}],
@@ -99985,7 +100198,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			factory
 		});
 		await this.warnForWarpLegacyRootFile(toolRules);
-		this.warnForInstructionBudget({
+		await this.warnForInstructionBudget({
 			toolRules,
 			meta
 		});
@@ -100006,14 +100219,19 @@ var RulesProcessor = class extends FeatureProcessor {
 	* once, at its shallowest directory. With several output roots the warning
 	* names the root it refers to. An output root below the git root is measured
 	* without the parent directories' files Codex would also load, so the
-	* estimate can come out low there. The budget checked is the tool's default: a value
-	* raised by hand in the tool's own config is not read. Global scope is not
+	* estimate can come out low there. The budget checked is the value set in the
+	* output root's tool config when the tool supports one (Codex's
+	* `project_doc_max_bytes` in `.codex/config.toml`), else the tool's default;
+	* the warning names which one it used. Global scope is not
 	* checked because Codex loads the personal `~/.codex/AGENTS.md` outside the
 	* project budget.
 	*/
-	warnForInstructionBudget({ toolRules, meta }) {
+	async warnForInstructionBudget({ toolRules, meta }) {
 		const budget = meta.projectInstructionBudget;
 		if (budget === void 0 || this.global) return;
+		const configuredBytes = await budget.readConfiguredBytes?.(this.outputRoot);
+		const limitBytes = configuredBytes ?? budget.bytes;
+		const limitLabel = budget.readConfiguredBytes === void 0 ? `${limitBytes}-byte limit` : configuredBytes === void 0 ? `${limitBytes}-byte default limit` : `${limitBytes}-byte limit set by ${budget.configuredSource ?? "the tool config"}`;
 		const files = toolRules.map((rule) => ({
 			dir: normalizeRelativeDir(rule.getRelativeDirPath()),
 			path: toPosixPath((0, node_path.join)(rule.getRelativeDirPath(), rule.getRelativeFilePath())),
@@ -100023,8 +100241,8 @@ var RulesProcessor = class extends FeatureProcessor {
 		const location = this.outputRoot === process.cwd() ? "" : ` under '${this.outputRoot}'`;
 		const rootFiles = files.filter(({ dir }) => dir === ".");
 		const rootBytes = rootFiles.reduce((sum, { bytes }) => sum + bytes, 0);
-		if (rootBytes > budget.bytes) {
-			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${budget.bytes}-byte limit. ${budget.remedy}`);
+		if (rootBytes > limitBytes) {
+			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${budget.remedy}`);
 			return;
 		}
 		const reportedDirs = [];
@@ -100033,9 +100251,9 @@ var RulesProcessor = class extends FeatureProcessor {
 			if (reportedDirs.some((dir) => isAncestorOrSelf(dir, file.dir))) continue;
 			const chain = files.filter(({ dir }) => isAncestorOrSelf(dir, file.dir));
 			const chainBytes = chain.reduce((sum, { bytes }) => sum + bytes, 0);
-			if (chainBytes > budget.bytes) {
+			if (chainBytes > limitBytes) {
 				reportedDirs.push(file.dir);
-				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${budget.bytes}-byte limit (as is every directory below it). ${budget.remedy}`);
+				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${budget.remedy}`);
 			}
 		}
 	}