rulesync 36.0.2 → 37.1.0

package/dist/{import-Tya9qZRK.js → import-BsEFYJsg.js}

@@ -4040,7 +4040,7 @@ function isPlainObject$1(value) {
 /**
 * Type guard to check if a value is an array of strings.
 */
-function isStringArray$2(value) {
+function isStringArray$1(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 //#endregion
@@ -7895,14 +7895,53 @@ const COPILOT_DEFAULT_PERMISSION_MODES = [
 	"autoApprove",
 	"autopilot"
 ];
+/** `chat.agent.sandbox.enabled`: `"off"` or `"on"`. */
+const CopilotSandboxEnabledSchema = z.enum(["off", "on"]);
+/** `chat.agent.sandbox.fileSystem.userConfiguredPaths`. */
+const CopilotSandboxUserConfiguredPathsSchema = z.strictObject({
+	readwritePaths: z.optional(z.array(z.string())),
+	readonlyPaths: z.optional(z.array(z.string())),
+	deniedPaths: z.optional(z.array(z.string()))
+});
+/**
+* The Agent Host sandbox settings VS Code 1.141 settled on, as a nested object
+* whose path mirrors the dotted setting key under `chat.agent.sandbox.` — e.g.
+* `network.allowNetwork` writes `chat.agent.sandbox.network.allowNetwork`.
+* Only the documented, registered keys are accepted; the deprecated 1.138
+* shapes (`chat.agent.sandbox.allowNetwork`, `.fileSystem.linux|mac|windows`)
+* are not modeled, since the Agent Host ignores them.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const CopilotSandboxSchema = z.strictObject({
+	enabled: z.optional(CopilotSandboxEnabledSchema),
+	network: z.optional(z.strictObject({
+		allowNetwork: z.optional(z.boolean()),
+		allowLocalNetwork: z.optional(z.boolean())
+	})),
+	allowUnsandboxedCommands: z.optional(z.boolean()),
+	mcpServers: z.optional(z.boolean()),
+	lspServers: z.optional(z.boolean()),
+	credentials: z.optional(z.strictObject({
+		authenticategit: z.optional(z.boolean()),
+		authenticategh: z.optional(z.boolean())
+	})),
+	fileSystem: z.optional(z.strictObject({
+		allowDevToolAccess: z.optional(z.boolean()),
+		userConfiguredPaths: z.optional(CopilotSandboxUserConfiguredPathsSchema)
+	}))
+});
 /**
 * Tool-scoped override block for GitHub Copilot in VS Code.
 * `defaultPermissionMode` writes the workspace `chat.permissions.default`
-* setting, which has no canonical category.
+* setting, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
+* has a canonical category.
 */
 const CopilotPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
-	defaultPermissionMode: z.optional(z.enum(COPILOT_DEFAULT_PERMISSION_MODES))
+	defaultPermissionMode: z.optional(z.enum(COPILOT_DEFAULT_PERMISSION_MODES)),
+	sandbox: z.optional(CopilotSandboxSchema)
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
@@ -12835,6 +12874,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 				kind: "replace-owned-keys",
 				ownedKeys: ["disableAllHooks"]
 			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["disabledMcpServers"]
+			},
 			permissions: {
 				kind: "replace-owned-keys",
 				ownedKeys: ["deniedUrls"]
@@ -12849,6 +12892,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 				kind: "replace-owned-keys",
 				ownedKeys: ["disableAllHooks"]
 			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["disabledMcpServers"]
+			},
 			permissions: {
 				kind: "replace-owned-keys",
 				ownedKeys: ["allowedUrls", "deniedUrls"]
@@ -12866,6 +12913,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 				"chat.tools.edits.autoApprove",
 				"chat.tools.urls.autoApprove",
 				"chat.permissions.default",
+				"chat.agent.sandbox.enabled",
+				"chat.agent.sandbox.network.allowNetwork",
+				"chat.agent.sandbox.network.allowLocalNetwork",
+				"chat.agent.sandbox.allowUnsandboxedCommands",
+				"chat.agent.sandbox.mcpServers",
+				"chat.agent.sandbox.lspServers",
+				"chat.agent.sandbox.credentials.authenticategit",
+				"chat.agent.sandbox.credentials.authenticategh",
+				"chat.agent.sandbox.fileSystem.allowDevToolAccess",
+				"chat.agent.sandbox.fileSystem.userConfiguredPaths",
 				"zoo-code.allowedCommands",
 				"zoo-code.deniedCommands",
 				"roo-cline.allowedCommands",
@@ -22113,7 +22170,7 @@ function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 */
 function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	if (Array.isArray(config.skills)) {
-		if (!layout.readsV2ConfigSpellings || !isStringArray$2(config.skills)) return [];
+		if (!layout.readsV2ConfigSpellings || !isStringArray$1(config.skills)) return [];
 		return config.skills.filter((value) => !/^https?:\/\//i.test(value));
 	}
 	const skills = asOpencodeEntries(config.skills);
@@ -26359,7 +26416,7 @@ const isBooleanValue = ({ value }) => typeof value === "boolean";
 const isFiniteNumber = ({ value }) => Number.isFinite(value);
 const isNonEmptyString = (value) => typeof value === "string" && value !== "";
 const isEmittableString = ({ value }) => isNonEmptyString(value);
-const isEmittableArray = ({ value }) => isStringArray$1(value);
+const isEmittableArray = ({ value }) => isStringArray(value);
 const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
 const isImportableArray = ({ value }) => isSafeStringArray(value);
 const isEmittableObject = ({ value }) => isPlainObject$1(value);
@@ -26801,7 +26858,7 @@ function isStringRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	return Object.values(value).every((v) => typeof v === "string");
 }
-function isStringArray$1(value) {
+function isStringArray(value) {
 	return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
 /** Compare object values without letting key order decide the answer. */
@@ -26846,7 +26903,7 @@ function isSafeEnvEntry(entry) {
 * skipped wholesale when that read fails.
 */
 function isSafeStringArray(value) {
-	return isStringArray$1(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
+	return isStringArray(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
 }
 /**
 * A raw string kept only if the canonical field it would land in accepts it,
@@ -26888,7 +26945,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 		return {
 			...url !== void 0 && { url },
 			...isStringRecord(headers) && { headers },
-			...isStringArray$1(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
+			...isStringArray(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
 		};
 	}
 	if (hookType === "mcp_tool") {
@@ -28028,8 +28085,34 @@ function collectOwnedRefs({ generatedHooks, shape }) {
 	}
 	return owned;
 }
+/**
+* The merge keeps every unowned existing handler where it is. Some tools key
+* state by position — Codex CLI persists a hook's trust review under its event,
+* matcher group index and handler index — so moving a handler the user already
+* reviewed would silently change which hook that review belongs to. Hence:
+* - an unowned existing handler stays at its index;
+* - a newly generated handler is appended to the first existing group with its
+*   matcher and group-level keys, or in a new group after the existing ones;
+* - within a group, the slots rulesync's own handlers occupy (including the
+*   appended ones) are filled in generated order, so reordering the sources
+*   still reorders the generated handlers, which matters wherever handlers
+*   run in order (a Qwen Code `sequential` group, a Cursor list).
+*
+* A retracted handler, or a group left empty by retractions, is still removed,
+* which shifts whatever follows it in the same list; that is unavoidable
+* without leaving a placeholder behind.
+*/
 function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const merged = [...generated];
+	const pending = createPendingGenerated();
+	for (const group of generated) if (isMatcherGroup(group)) addPending({
+		pending,
+		handlers: group.hooks,
+		event,
+		matcher: matcherKey(group.matcher),
+		attributes: groupAttributesKey(group)
+	});
+	const merged = [];
+	const homes = /* @__PURE__ */ new Map();
 	for (const group of existing) {
 		if (!isMatcherGroup(group)) {
 			warnSkip({
@@ -28040,26 +28123,57 @@ function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned,
 			continue;
 		}
 		const matcher = matcherKey(group.matcher);
-		const preserved = group.hooks.filter((handler) => shouldPreserve({
-			handler,
+		const hooks = keepExistingHandlers({
+			handlers: group.hooks,
 			event,
 			matcher,
+			attributes: groupAttributesKey(group),
+			pending,
 			seen,
 			previouslyOwned,
 			logger
-		})).map((handler) => cloneHandler(handler));
-		if (preserved.length === 0) continue;
-		const target = merged.find((candidate) => isMatcherGroup(candidate) && matcherKey(candidate.matcher) === matcher);
-		if (target !== void 0 && isMatcherGroup(target)) target.hooks.push(...preserved);
-		else merged.push({
+		});
+		if (hooks.length === 0) continue;
+		const kept = {
 			...omitPrototypePollutionKeys(group),
-			hooks: preserved
+			hooks
+		};
+		merged.push(kept);
+		const home = groupSlotKey(group);
+		if (!homes.has(home)) homes.set(home, kept);
+	}
+	for (const group of generated) {
+		if (!isMatcherGroup(group)) {
+			merged.push(group);
+			continue;
+		}
+		const remaining = group.hooks.filter((handler) => !pending.placed.has(handler));
+		if (remaining.length === 0) continue;
+		const home = homes.get(groupSlotKey(group));
+		if (home === void 0) merged.push({
+			...group,
+			hooks: remaining
 		});
+		else home.hooks.push(...remaining);
 	}
+	const order = generatedOrder(generated.flatMap((group) => isMatcherGroup(group) ? group.hooks : []));
+	for (const group of merged) if (isMatcherGroup(group)) orderGeneratedSlots({
+		handlers: group.hooks,
+		order
+	});
 	return merged;
 }
+/** The flat-list counterpart of {@link mergeMatcherGroups}, with the same positional rules. */
 function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const preserved = [];
+	const pending = createPendingGenerated();
+	addPending({
+		pending,
+		handlers: generated,
+		event,
+		matcher: void 0,
+		attributes: ""
+	});
+	const flat = [];
 	for (const handler of existing) {
 		if (isMatcherGroup(handler)) {
 			warnSkip({
@@ -28069,17 +28183,93 @@ function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned,
 			});
 			continue;
 		}
-		if (!shouldPreserve({
+		flat.push(handler);
+	}
+	const merged = keepExistingHandlers({
+		handlers: flat,
+		event,
+		matcher: void 0,
+		attributes: "",
+		pending,
+		seen,
+		previouslyOwned,
+		logger
+	});
+	merged.push(...generated.filter((handler) => !pending.placed.has(handler)));
+	orderGeneratedSlots({
+		handlers: merged,
+		order: generatedOrder(generated)
+	});
+	return merged;
+}
+/** Each generated handler's position in the generated list, by object identity. */
+function generatedOrder(handlers) {
+	const order = /* @__PURE__ */ new Map();
+	for (const [index, handler] of handlers.entries()) if (isPlainObject$1(handler)) order.set(handler, index);
+	return order;
+}
+/**
+* Rewrite, in place, the slots of `handlers` that hold generated handlers so
+* they follow the generated order. Every other slot — an unowned handler — is
+* left at its index.
+*/
+function orderGeneratedSlots({ handlers, order }) {
+	const slots = [];
+	for (const [index, handler] of handlers.entries()) if (order.has(handler)) slots.push(index);
+	const sorted = slots.map((index) => handlers[index]).toSorted((left, right) => (order.get(left) ?? 0) - (order.get(right) ?? 0));
+	for (const [position, index] of slots.entries()) handlers[index] = sorted[position];
+}
+function createPendingGenerated() {
+	return {
+		byKey: /* @__PURE__ */ new Map(),
+		placed: /* @__PURE__ */ new Set()
+	};
+}
+function addPending({ pending, handlers, event, matcher, attributes }) {
+	for (const handler of handlers) {
+		if (!isPlainObject$1(handler)) continue;
+		const key = pendingKey({
+			event,
+			matcher,
+			attributes,
+			handler
+		});
+		const queue = pending.byKey.get(key);
+		if (queue === void 0) pending.byKey.set(key, [handler]);
+		else queue.push(handler);
+	}
+}
+/**
+* Walk one existing list in order and decide each handler: replaced in place
+* by its generated copy, kept as unowned, or dropped (retracted or duplicate).
+*/
+function keepExistingHandlers({ handlers, event, matcher, attributes, pending, seen, previouslyOwned, logger }) {
+	const kept = [];
+	for (const handler of handlers) {
+		if (isPlainObject$1(handler)) {
+			const key = pendingKey({
+				event,
+				matcher,
+				attributes,
+				handler
+			});
+			const generated = pending.byKey.get(key)?.shift();
+			if (generated !== void 0) {
+				pending.placed.add(generated);
+				kept.push(generated);
+				continue;
+			}
+		}
+		if (shouldPreserve({
 			handler,
 			event,
-			matcher: void 0,
+			matcher,
 			seen,
 			previouslyOwned,
 			logger
-		})) continue;
-		preserved.push(cloneHandler(handler));
+		})) kept.push(cloneHandler(handler));
 	}
-	return [...generated, ...preserved];
+	return kept;
 }
 function isMatcherGroup(value) {
 	return isPlainObject$1(value) && Array.isArray(value.hooks);
@@ -28170,6 +28360,36 @@ function stableStringify$1(value) {
 function matcherKey(matcher) {
 	return matcher === void 0 ? "" : stableStringify$1(matcher);
 }
+function pendingKey({ event, matcher, attributes, handler }) {
+	const key = ownedHookKey({
+		event,
+		matcher,
+		identity: handlerIdentity(handler)
+	});
+	return JSON.stringify([key, attributes]);
+}
+/** Groups that share a matcher and attributes are interchangeable homes for a handler. */
+function groupSlotKey(group) {
+	return JSON.stringify([matcherKey(group.matcher), groupAttributesKey(group)]);
+}
+/** Group-level keys whose default value is known, so an explicit default can be ignored. */
+const GROUP_ATTRIBUTE_DEFAULTS = Object.freeze({
+	__proto__: null,
+	sequential: false
+});
+/**
+* The stable form of a matcher group's keys other than `matcher` and `hooks`.
+*
+* A key set to its known default is the same group as one that omits it:
+* Qwen Code's `sequential` defaults to `false` and rulesync emits it only when
+* `true`, so an explicit `sequential: false` (or any `undefined` key) is
+* dropped before comparing. Other `false` values are kept, since their default
+* is not known here.
+*/
+function groupAttributesKey(group) {
+	const { matcher: _matcher, hooks: _hooks, ...attributes } = group;
+	return stableStringify$1(Object.fromEntries(Object.entries(attributes).filter(([key, value]) => value !== void 0 && GROUP_ATTRIBUTE_DEFAULTS[key] !== value)));
+}
 function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
 }
@@ -28665,7 +28885,7 @@ const MANAGED_EVENT_NAMES = new Set(Object.values(CANONICAL_TO_CLINE_EVENT_NAMES
 function parseManifest(fileContent) {
 	try {
 		const parsed = JSON.parse(fileContent);
-		if (!isRecord$1(parsed) || !isStringArray$2(parsed.events)) return null;
+		if (!isRecord$1(parsed) || !isStringArray$1(parsed.events)) return null;
 		return {
 			generatedBy: "rulesync",
 			events: parsed.events.filter((event) => MANAGED_EVENT_NAMES.has(event))
@@ -30203,7 +30423,7 @@ function copilotCliHooksToCanonical(rawHooks, logger) {
 * see the CLI config dir reference:
 * https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
 */
-function copilotCliSettingsPaths({ global }) {
+function copilotCliSettingsPaths$1({ global }) {
 	return global ? {
 		relativeDirPath: COPILOT_DIR,
 		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
@@ -30218,7 +30438,7 @@ function copilotCliSettingsPaths({ global }) {
 * subject, and the permissions feature reports a broken settings file itself.
 */
 async function readDisableAllHooks({ outputRoot, global }) {
-	const paths = copilotCliSettingsPaths({ global });
+	const paths = copilotCliSettingsPaths$1({ global });
 	const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
 	if (fileContent === null) return;
 	try {
@@ -30248,7 +30468,7 @@ var CopilotcliHooksSettings = class CopilotcliHooksSettings extends ToolFile {
 		return false;
 	}
 	static async fromDisableAllHooks({ outputRoot = process.cwd(), global = false, disableAllHooks }) {
-		const paths = copilotCliSettingsPaths({ global });
+		const paths = copilotCliSettingsPaths$1({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
 		return new CopilotcliHooksSettings({
@@ -30278,7 +30498,7 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		this.disableAllHooks = disableAllHooks;
 	}
 	static getExtraSharedWritePaths({ global = false } = {}) {
-		return [copilotCliSettingsPaths({ global })];
+		return [copilotCliSettingsPaths$1({ global })];
 	}
 	static async getAuxiliaryFiles({ toolHooks } = {}) {
 		return toolHooks instanceof CopilotcliHooks && toolHooks.settingsFile ? [toolHooks.settingsFile] : [];
@@ -34722,12 +34942,21 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
 		const paths = QwencodeHooks.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
-		const patch = { hooks: canonicalToQwencodeHooks(config, logger) };
+		const previouslyOwned = preserveUnowned ? parseHooksOwnershipLock(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0;
+		const merged = mergeGeneratedHookLists({
+			existingContent,
+			generatedHooks: canonicalToQwencodeHooks(config, logger),
+			shape: "matcher-groups",
+			preserveUnowned,
+			previouslyOwned,
+			logger
+		});
+		const patch = { hooks: merged.hooks };
 		const disableAllHooks = config.qwencode?.disableAllHooks;
 		if (typeof disableAllHooks === "boolean") patch.disableAllHooks = disableAllHooks;
 		const fileContent = applySharedConfigPatch({
@@ -34742,9 +34971,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
+			ownedHookRefs: preserveUnowned ? merged.owned : void 0,
 			validate
 		});
 	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+	static async getAuxiliaryFiles({ toolHooks } = {}) {
+		return toolHooks instanceof QwencodeHooks ? toolHooks.getOwnershipLockFiles() : [];
+	}
 	toRulesyncHooks() {
 		let settings;
 		try {
@@ -41144,7 +41380,7 @@ function isCodexStdioServer(config) {
 * @see https://learn.chatgpt.com/docs/extend/mcp
 */
 function isValidRenamedArray(key, value) {
-	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$2(value);
+	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$1(value);
 }
 /**
 * The keys of Codex's `McpServerOAuthConfig`. Anything else in a server's
@@ -42363,18 +42599,6 @@ function renameEnabledToolsToTools({ server, serverName, logger }) {
 	};
 }
 /**
-* Copilot CLI's `tools` accepts more than the canonical `enabledTools` shape:
-* `--tools` documents `*`, a comma-separated list, or `""`, so a hand-written or
-* CLI-written entry can be a bare string. Canonical `enabledTools` is
-* `string[]`, and `RulesyncMcp` throws on a schema failure — carrying a string
-* through would reject the WHOLE imported MCP file rather than one key. Anything
-* that is not a string array is therefore left under `tools` untouched, matching
-* `codexcli-mcp.ts`'s `isValidRenamedArray` guard on the same class of rename.
-*/
-function isStringArray(value) {
-	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
-}
-/**
 * Resolves and sets the transport type for each MCP server config.
 * GitHub Copilot CLI requires the "type" field for each server. A server it
 * cannot express — one that names no transport, or names one it carries no way
@@ -42416,7 +42640,7 @@ function addTypeField(mcpServers, logger) {
 				});
 				continue;
 			}
-			const { httpUrl: _httpUrl, ...rest } = parsed;
+			const { httpUrl: _httpUrl, disabled: _disabled, ...rest } = parsed;
 			result[name] = {
 				...renameEnabledToolsToTools({
 					server: rest,
@@ -42428,7 +42652,7 @@ function addTypeField(mcpServers, logger) {
 			};
 			continue;
 		}
-		const { httpUrl: _localHttpUrl, ...local } = parsed;
+		const { httpUrl: _localHttpUrl, disabled: _localDisabled, ...local } = parsed;
 		const [head, ...tail] = resolveLocalMcpCommand(parsed);
 		if (head === void 0) {
 			warnAndSkipMcpServer({
@@ -42459,7 +42683,7 @@ function removeTypeField(config) {
 	const result = {};
 	for (const [name, server] of Object.entries(config.mcpServers ?? {})) {
 		const { tools, ...withoutTools } = server;
-		const restored = isStringArray(tools) ? {
+		const restored = isStringArray$1(tools) ? {
 			...withoutTools,
 			enabledTools: tools
 		} : {
@@ -42475,6 +42699,99 @@ function removeTypeField(config) {
 	}
 	return result;
 }
+/**
+* The Copilot CLI settings file carrying `disabledMcpServers`:
+* `.github/copilot/settings.json` (project) / `~/.copilot/settings.json`
+* (global). Both scopes document the key ("MCP server names to disable. Listed
+* servers are configured but not started"); at repository scope it is
+* union-merged with the user value, so a repository can add names but never
+* remove them.
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+*/
+function copilotCliSettingsPaths({ global }) {
+	return global ? {
+		relativeDirPath: COPILOT_DIR,
+		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+	} : {
+		relativeDirPath: COPILOTCLI_PROJECT_SETTINGS_DIR_PATH,
+		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+	};
+}
+async function readCopilotCliSettings({ outputRoot, global }) {
+	const paths = copilotCliSettingsPaths({ global });
+	const existingContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+	try {
+		return {
+			paths,
+			existingContent,
+			document: parseSharedConfig({
+				format: "json",
+				fileContent: existingContent,
+				filePath: join(paths.relativeDirPath, paths.relativeFilePath),
+				invalidRootPolicy: "error"
+			})
+		};
+	} catch (error) {
+		return {
+			paths,
+			existingContent,
+			document: null,
+			error
+		};
+	}
+}
+/**
+* The names of the servers rulesync actually writes for this target: one
+* `addTypeField` skips (no transport, WebSocket, missing url or command) is
+* not managed, so its name neither gains a toggle nor strips a same-named
+* user-authored entry from the settings file.
+*/
+function managedServerNames(mcpServers) {
+	return Object.keys(addTypeField(mcpServers) ?? {});
+}
+/**
+* Overlays `disabled: true` on the servers the scope's settings file lists in
+* `disabledMcpServers`, so import round-trips the toggle into the canonical
+* config. A settings file that exists but cannot be parsed throws
+* (fail-closed): importing past it would re-enable every disabled server.
+*/
+async function overlayDisabledServers({ mcpServers, outputRoot, global }) {
+	const settings = await readCopilotCliSettings({
+		outputRoot,
+		global
+	});
+	if (settings.document === null) throw new Error(`Cannot import Copilot CLI MCP servers: ${formatError(settings.error)}. Fix the file so disabledMcpServers can be read.`, { cause: settings.error });
+	const disabled = settings.document.disabledMcpServers;
+	if (!isStringArray$1(disabled) || disabled.length === 0) return mcpServers;
+	const servers = { ...mcpServers };
+	for (const name of disabled) {
+		if (!Object.hasOwn(servers, name)) continue;
+		const server = servers[name];
+		if (isPlainObject$1(server)) servers[name] = {
+			...server,
+			disabled: true
+		};
+	}
+	return servers;
+}
+/**
+* Auxiliary writer for `disabledMcpServers` in the Copilot CLI settings file.
+* Only that key is owned (through the shared-config gateway), so `deniedUrls`,
+* `disableAllHooks`, `model` and every other setting are preserved. It is a
+* shared, user-owned file and is never deleted.
+*/
+var CopilotcliMcpSettings = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	isDeletable() {
+		return false;
+	}
+};
 var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -42517,7 +42834,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 		const json = JSON.parse(fileContent);
 		const newJson = {
 			...json,
-			mcpServers: json.mcpServers ?? {}
+			mcpServers: await overlayDisabledServers({
+				mcpServers: json.mcpServers ?? {},
+				outputRoot,
+				global
+			})
 		};
 		return new CopilotcliMcp({
 			outputRoot,
@@ -42532,7 +42853,17 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ mcpServers: {} }, null, 2);
 		const json = JSON.parse(fileContent);
-		const copilotCliMcpServers = addTypeField(rulesyncMcp.getMcpServers(), logger);
+		const settings = await readCopilotCliSettings({
+			outputRoot,
+			global
+		});
+		const existingDisabled = settings.document?.disabledMcpServers;
+		const offSwitchBlocker = settings.document === null ? "cannot be parsed" : existingDisabled !== void 0 && !isStringArray$1(existingDisabled) ? "has a disabledMcpServers value that is not an array of server names" : void 0;
+		const copilotCliMcpServers = addTypeField(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).filter(([name, server]) => {
+			if (server.disabled !== true || offSwitchBlocker === void 0) return true;
+			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${join(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} ${offSwitchBlocker}, so disabledMcpServers cannot be written to switch it off.`);
+			return false;
+		})), logger);
 		const mcpJson = {
 			...json,
 			mcpServers: copilotCliMcpServers
@@ -42546,6 +42877,66 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			global
 		});
 	}
+	/**
+	* `disabledMcpServers` lives in the Copilot CLI settings file the hooks and
+	* permissions features also write. Declared here so the write-order
+	* derivation sees this feature as one of that file's writers — it is not a
+	* settable path, since the servers themselves live in the MCP file.
+	*/
+	static getExtraSharedWritePaths({ global = false } = {}) {
+		return [copilotCliSettingsPaths({ global })];
+	}
+	/**
+	* Routes the canonical `disabled: true` to `disabledMcpServers`, the key
+	* Copilot CLI actually consults: an MCP file entry has no `disabled` field.
+	* rulesync owns the toggle for the servers it writes; names it does not
+	* manage keep their existing state. The file is not created or touched when
+	* there is nothing to disable and nothing to retract, nor when the existing
+	* `disabledMcpServers` is not a string array (left as is, with a warning).
+	*/
+	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
+		const servers = rulesyncMcp.forTarget({
+			toolTarget: "copilotcli",
+			global
+		}).getMcpServers();
+		const managedNames = managedServerNames(servers);
+		const disabledNames = managedNames.filter((name) => servers[name]?.disabled === true);
+		const settings = await readCopilotCliSettings({
+			outputRoot,
+			global
+		});
+		if (settings.document === null) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: ${formatError(settings.error)}`);
+			return [];
+		}
+		const existing = settings.document.disabledMcpServers;
+		if (existing !== void 0 && !isStringArray$1(existing)) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: the existing value is not an array of server names. Fix it in ${join(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} so rulesync can manage the toggle.`);
+			return [];
+		}
+		const existingDisabled = existing ?? [];
+		const managedNameSet = new Set(managedNames);
+		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
+		if (reEnabled.length > 0) logger?.warn(`Copilot CLI MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
+		const mergedDisabled = [...existingDisabled.filter((name) => !managedNameSet.has(name)), ...disabledNames].toSorted();
+		if (mergedDisabled.length === 0 && existing === void 0) return [];
+		if (isStringArray$1(existing) && existing.length === mergedDisabled.length && existing.toSorted().every((name, index) => name === mergedDisabled[index])) return [];
+		const { paths } = settings;
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		return [new CopilotcliMcpSettings({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent: settings.existingContent,
+				patch: { disabledMcpServers: mergedDisabled.length > 0 ? mergedDisabled : void 0 },
+				filePath
+			}),
+			global
+		})];
+	}
 	toRulesyncMcp() {
 		const mcpServers = removeTypeField(this.json);
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
@@ -42977,10 +43368,10 @@ function convertFromCrushFormat(crushServers) {
 					if (value === "http" || value === "sse") converted.type = value;
 					break;
 				case "disabled_tools":
-					if (isStringArray$2(value)) converted.disabledTools = value;
+					if (isStringArray$1(value)) converted.disabledTools = value;
 					break;
 				case "enabled_tools":
-					if (isStringArray$2(value)) converted.enabledTools = value;
+					if (isStringArray$1(value)) converted.enabledTools = value;
 					break;
 				case "oauth_token": break;
 				default: {
@@ -43967,7 +44358,7 @@ function convertRowsFromDsh(rows, logger) {
 		} else {
 			server.type = "stdio";
 			if (typeof config.command === "string") server.command = config.command;
-			if (isStringArray$2(config.args)) server.args = config.args;
+			if (isStringArray$1(config.args)) server.args = config.args;
 			const env = copyStringRecord(config.env);
 			if (env !== void 0) server.env = env;
 			if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -44398,11 +44789,11 @@ function applyGooseStdioFields(ext, config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") ext.cmd = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$2(config.args) ? config.args : [];
+		const args = isStringArray$1(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) ext.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		ext.cmd = command;
-		if (isStringArray$2(config.args)) ext.args = config.args;
+		if (isStringArray$1(config.args)) ext.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) ext.envs = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") ext.cwd = config.cwd;
@@ -44505,7 +44896,7 @@ function convertFromGooseFormat(extensions) {
 		else if (type === "streamable_http") server.type = "http";
 		else server.type = "stdio";
 		if (typeof ext.cmd === "string") server.command = ext.cmd;
-		if (isStringArray$2(ext.args)) server.args = ext.args;
+		if (isStringArray$1(ext.args)) server.args = ext.args;
 		if (isPlainObject$1(ext.envs)) server.env = omitPrototypePollutionKeys(ext.envs);
 		if (typeof ext.cwd === "string") server.cwd = ext.cwd;
 		if (typeof ext.uri === "string") server.url = ext.uri;
@@ -44527,11 +44918,11 @@ function buildGoosePluginStdioServer(config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") server.command = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$2(config.args) ? config.args : [];
+		const args = isStringArray$1(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) server.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		server.command = command;
-		if (isStringArray$2(config.args)) server.args = config.args;
+		if (isStringArray$1(config.args)) server.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -44939,7 +45330,7 @@ function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
 	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	if (typeof oauth.scope !== "string" && isStringArray$1(source.scopes)) oauth.scope = source.scopes.join(" ");
 	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
@@ -44966,7 +45357,7 @@ function copyHermesAdvancedFields(source, target) {
 		target.auth = source.auth;
 		copied = true;
 	}
-	if (typeof source.client_cert === "string" || isStringArray$2(source.client_cert)) {
+	if (typeof source.client_cert === "string" || isStringArray$1(source.client_cert)) {
 		target.client_cert = source.client_cert;
 		copied = true;
 	}
@@ -45038,8 +45429,8 @@ function copyHermesAdvancedFields(source, target) {
 */
 function buildHermesToolsBlock(config) {
 	const tools = {};
-	if (isStringArray$2(config.enabledTools)) tools.include = config.enabledTools;
-	if (isStringArray$2(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (isStringArray$1(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray$1(config.disabledTools)) tools.exclude = config.disabledTools;
 	if (typeof config.promptsEnabled === "boolean") tools.prompts = config.promptsEnabled;
 	if (typeof config.resourcesEnabled === "boolean") tools.resources = config.resourcesEnabled;
 	return tools;
@@ -45051,8 +45442,8 @@ function buildHermesToolsBlock(config) {
 * `promptsEnabled`/`resourcesEnabled` top-level toggles.
 */
 function applyHermesToolsBlock(hermesTools, server) {
-	if (isStringArray$2(hermesTools.include)) server.enabledTools = hermesTools.include;
-	if (isStringArray$2(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
+	if (isStringArray$1(hermesTools.include)) server.enabledTools = hermesTools.include;
+	if (isStringArray$1(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
 	if (typeof hermesTools.prompts === "boolean") server.promptsEnabled = hermesTools.prompts;
 	if (typeof hermesTools.resources === "boolean") server.resourcesEnabled = hermesTools.resources;
 }
@@ -45078,11 +45469,11 @@ function convertServerToHermes(config) {
 		if (Array.isArray(command)) {
 			if (typeof command[0] === "string") out.command = command[0];
 			const rest = command.slice(1).filter((c) => typeof c === "string");
-			const args = isStringArray$2(config.args) ? config.args : [];
+			const args = isStringArray$1(config.args) ? config.args : [];
 			if (rest.length > 0 || args.length > 0) out.args = [...rest, ...args];
 		} else if (typeof command === "string") {
 			out.command = command;
-			if (isStringArray$2(config.args)) out.args = config.args;
+			if (isStringArray$1(config.args)) out.args = config.args;
 		}
 		if (isPlainObject$1(config.env)) out.env = omitPrototypePollutionKeys(config.env);
 	} else if (url !== void 0) {
@@ -45132,7 +45523,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const server = {};
 		if (typeof config.command === "string") server.command = config.command;
-		if (isStringArray$2(config.args)) server.args = config.args;
+		if (isStringArray$1(config.args)) server.args = config.args;
 		if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 		if (typeof config.url === "string") server.url = config.url;
 		if (isPlainObject$1(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
@@ -46324,7 +46715,7 @@ function mergeToolLists(...lists) {
 function toKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		const { kiroAutoApprove, kiroAutoBlock, disabledTools, ...rest } = server;
-		const autoApprove = mergeToolLists(isStringArray$2(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
+		const autoApprove = mergeToolLists(isStringArray$1(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
 		const disabled = mergeToolLists(disabledTools, kiroAutoBlock);
 		return [name, {
 			...rest,
@@ -46348,7 +46739,7 @@ function fromKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		if (server === null || typeof server !== "object" || Array.isArray(server)) return [name, server];
 		const { autoApprove, ...rest } = server;
-		if (!isStringArray$2(autoApprove)) return [name, server];
+		if (!isStringArray$1(autoApprove)) return [name, server];
 		return [name, {
 			...rest,
 			kiroAutoApprove: autoApprove
@@ -47777,7 +48168,7 @@ function headersRecordToPoolList(headers) {
 	return Object.entries(headers).map(([name, value]) => `${name}: ${value}`);
 }
 function poolHeadersListToRecord(serverName, headers) {
-	if (!isStringArray$2(headers)) return void 0;
+	if (!isStringArray$1(headers)) return void 0;
 	const result = {};
 	for (const entry of headers) {
 		const separator = entry.indexOf(":");
@@ -47803,7 +48194,7 @@ const GLOB_METACHARACTERS = /[*?[]/;
 /** Patterns named in the glob warning before the rest collapse to `(+N more)`. */
 const MAX_LISTED_GLOB_PATTERNS = 10;
 function importPoolToolList({ serverName, poolKey, value, warnOnGlobs }) {
-	if (!isStringArray$2(value)) {
+	if (!isStringArray$1(value)) {
 		warnWithFallback(void 0, `Ignored malformed value for ${poolKey} in Pool MCP server ${quoteValueForWarning(serverName)}: expected a list of strings`);
 		return;
 	}
@@ -48013,7 +48404,7 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 			const poolAllow = isRecord$1(rawServer) ? rawServer.poolAllow : void 0;
 			return [serverName, {
 				...serverConfig,
-				...isStringArray$2(poolAllow) && { poolAllow }
+				...isStringArray$1(poolAllow) && { poolAllow }
 			}];
 		})), logger);
 		return new PoolMcp({
@@ -48244,7 +48635,7 @@ function pickServerLists(source) {
 	if (!isPlainObject$1(source)) return {};
 	return Object.fromEntries(QWENCODE_MCP_SERVER_LIST_KEYS.flatMap((key) => {
 		const value = source[key];
-		return isStringArray$2(value) ? [[key, value]] : [];
+		return isStringArray$1(value) ? [[key, value]] : [];
 	}));
 }
 /**
@@ -48937,7 +49328,7 @@ async function resolveRovodevMcpImportPath({ outputRoot, global, config, logger
 }
 function disabledNamesOf(config) {
 	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
-	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
+	return isStringArray$1(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
 * The value `mcp.mcpConfigPath` needs so Rovo Dev reads the `mcp.json` rulesync
@@ -49353,7 +49744,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			return [];
 		}
 		const existingMcp = isRecord$1(existingParsed.mcp) ? { ...existingParsed.mcp } : {};
-		const existingDisabled = isStringArray$2(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
+		const existingDisabled = isStringArray$1(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
 		if (reEnabled.length > 0) logger?.warn(`Rovo Dev MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
@@ -56512,8 +56903,9 @@ function convertClaudeToRulesyncPermissions(params) {
 //#endregion
 //#region src/features/permissions/cline-permissions.ts
 /**
-* Cline CLI loads command permissions from the `CLINE_COMMAND_PERMISSIONS` environment variable.
-* Cline supports only `allow` and `deny` (no `ask`), and only for shell commands.
+* The legacy Cline CLI loaded command permissions from the `CLINE_COMMAND_PERMISSIONS`
+* environment variable. It supported only `allow` and `deny` (no `ask`), and only for
+* shell commands.
 * Schema:
 * ```json
 * { "allow": ["pattern1", ...], "deny": ["pattern2", ...], "allowRedirects": false }
@@ -56521,7 +56913,14 @@ function convertClaudeToRulesyncPermissions(params) {
 *
 * Rulesync writes the JSON to `.cline/command-permissions.json` so users can do:
 * `export CLINE_COMMAND_PERMISSIONS=$(cat .cline/command-permissions.json)`
+*
+* Deprecated: no Cline CLI 3 release reads `CLINE_COMMAND_PERMISSIONS`. Upstream removed
+* it from the docs in cline/cline@6354d209, and the CLI reference now says the CLI has no
+* allow or deny list for shell commands and recommends a `PreToolUse` hook instead
+* (https://docs.cline.bot/cli/cli-reference). The output is still generated for
+* compatibility, with a deprecation warning on every generation.
 */
+const CLINE_PERMISSIONS_DEPRECATION_WARNING = "The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. Note that a hook returning `cancel: true` stops the whole Cline task, not just that one tool call (https://github.com/cline/cline/issues/14697). See https://docs.cline.bot/cli/cli-reference.";
 const ClineCommandPermissionsSchema = z.looseObject({
 	allow: z.optional(z.array(z.string())),
 	deny: z.optional(z.array(z.string())),
@@ -56639,6 +57038,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
+		logger?.warn(CLINE_PERMISSIONS_DEPRECATION_WARNING);
 		const paths = ClinePermissions.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
@@ -56668,7 +57068,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		const mergedDeny = uniq([...existing.deny ?? [], ...dedupedDeny]).toSorted();
 		const denySet = new Set(mergedDeny);
 		const collisions = dedupedAllow.filter((p) => denySet.has(p));
-		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline documents that deny rules always take precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
+		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. The legacy Cline CLI gave deny rules precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
 		const next = {
 			...existing,
 			allow: dedupedAllow,
@@ -59951,9 +60351,9 @@ function managedContinueToolNames(config) {
 */
 function parseContinuePermissionLists(parsed) {
 	return {
-		exclude: isStringArray$2(parsed.exclude) ? parsed.exclude : [],
-		ask: isStringArray$2(parsed.ask) ? parsed.ask : [],
-		allow: isStringArray$2(parsed.allow) ? parsed.allow : []
+		exclude: isStringArray$1(parsed.exclude) ? parsed.exclude : [],
+		ask: isStringArray$1(parsed.ask) ? parsed.ask : [],
+		allow: isStringArray$1(parsed.allow) ? parsed.allow : []
 	};
 }
 /**
@@ -60036,6 +60436,193 @@ const AUTO_APPROVE_KEYS = {
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
 const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+/**
+* The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
+* at path `a.b` is written to `chat.agent.sandbox.a.b`.
+*/
+const SANDBOX_KEY_PREFIX = "chat.agent.sandbox.";
+/**
+* The `copilot.sandbox` leaves rulesync manages, each a flat VS Code setting
+* (`SANDBOX_KEY_PREFIX` + the dotted path) with the value shape VS Code
+* registers for it. The shape is re-checked on import, so a hand-written value
+* VS Code would not accept is skipped instead of failing the whole import.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const SANDBOX_LEAVES = [
+	{
+		path: ["enabled"],
+		schema: CopilotSandboxEnabledSchema,
+		normalize: (value) => value === true ? "on" : value === false ? "off" : value
+	},
+	{
+		path: ["network", "allowNetwork"],
+		schema: z.boolean()
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		schema: z.boolean()
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		schema: z.boolean()
+	},
+	{
+		path: ["mcpServers"],
+		schema: z.boolean()
+	},
+	{
+		path: ["lspServers"],
+		schema: z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		schema: z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		schema: z.boolean()
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		schema: z.boolean()
+	},
+	{
+		path: ["fileSystem", "userConfiguredPaths"],
+		schema: CopilotSandboxUserConfiguredPathsSchema
+	}
+];
+const USER_CONFIGURED_PATHS_KEY = `${SANDBOX_KEY_PREFIX}fileSystem.userConfiguredPaths`;
+/**
+* `copilot.sandbox` values that loosen the Agent Host sandbox. They are still
+* written — a sandbox policy is the user's call — but never silently. Each
+* `widens` names the value that does *not* loosen anything and reports the
+* rest, so an unexpected value is reported rather than ignored.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+*/
+const COPILOT_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox off, so agent terminal commands run unconfined",
+		widens: (value) => value !== "on"
+	},
+	{
+		path: ["network", "allowNetwork"],
+		reason: "lets sandboxed commands reach the external network",
+		widens: isNotFalse
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		reason: "lets sandboxed commands reach local network resources",
+		widens: isNotFalse
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "lets the agent ask to run a blocked command outside the sandbox",
+		widens: isNotFalse
+	},
+	{
+		path: ["mcpServers"],
+		reason: "runs locally launched MCP servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["lspServers"],
+		reason: "runs language servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		reason: "hands your Git credentials to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		reason: "hands your GitHub CLI authentication to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		reason: "grants sandboxed commands developer-tool directories, which can hold credentials such as registry tokens",
+		widens: isNotFalse
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readwritePaths"
+		],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: isNonEmptyList
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readonlyPaths"
+		],
+		reason: "adds paths sandboxed commands may read, outside the working directory",
+		widens: isNonEmptyList
+	}
+];
+const COPILOT_TOOL_LABEL = "GitHub Copilot";
+function sandboxKey(path) {
+	return `${SANDBOX_KEY_PREFIX}${path.join(".")}`;
+}
+/**
+* Patch entries for every `copilot.sandbox` leaf the canonical config states.
+* Leaves it does not state are left as the file has them, so authoring only
+* `network.allowNetwork` never disturbs a hand-written `enabled`. The
+* `userConfiguredPaths` object merges per list for the same reason: authoring
+* `readwritePaths` keeps a hand-written `deniedPaths`, which would otherwise be
+* a restriction lost without a word.
+*/
+function buildSandboxPatch({ sandbox, existingSettings }) {
+	const patch = {};
+	for (const { path } of SANDBOX_LEAVES) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0 || value === UNREADABLE_SANDBOX_PATH) continue;
+		const key = sandboxKey(path);
+		if (key === USER_CONFIGURED_PATHS_KEY && isPlainObject$1(value)) {
+			const existing = existingSettings[key];
+			patch[key] = {
+				...isPlainObject$1(existing) ? existing : {},
+				...value
+			};
+			continue;
+		}
+		patch[key] = value;
+	}
+	return patch;
+}
+/**
+* Lift every managed `chat.agent.sandbox.*` key the file holds back into a
+* nested `copilot.sandbox` object. A value whose shape VS Code would reject is
+* skipped; the write path leaves it in place.
+*/
+function readSandboxFromSettings(settings) {
+	const sandbox = {};
+	for (const { path, schema, normalize } of SANDBOX_LEAVES) {
+		const value = settings[sandboxKey(path)];
+		const parsed = schema.safeParse(normalize === void 0 ? value : normalize(value));
+		if (!parsed.success) continue;
+		let cursor = sandbox;
+		for (const segment of path.slice(0, -1)) {
+			const next = cursor[segment];
+			const child = isPlainObject$1(next) ? next : {};
+			cursor[segment] = child;
+			cursor = child;
+		}
+		const leaf = path[path.length - 1];
+		if (leaf !== void 0) cursor[leaf] = parsed.data;
+	}
+	return Object.keys(sandbox).length > 0 ? sandbox : void 0;
+}
 function isCopilotDefaultPermissionMode(value) {
 	return COPILOT_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
 }
@@ -60080,7 +60667,9 @@ function buildAutoApproveValue(rules) {
 * hand-written edits or urls map.
 * The `copilot.defaultPermissionMode` override writes `chat.permissions.default`
 * (the starting permission level of new chat sessions); without it the key is
-* left untouched.
+* left untouched. The `copilot.sandbox` override writes the Agent Host sandbox
+* settings (`chat.agent.sandbox.*`, see {@link SANDBOX_LEAVES}) per key, and
+* warns about every value it writes that loosens the sandbox.
 * Only project scope is modeled: VS Code's user-scope settings.json lives at a
 * platform-dependent path outside rulesync's home-relative global model.
 */
@@ -60128,6 +60717,26 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
 		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		const sandbox = config.copilot?.sandbox;
+		if (sandbox !== void 0) {
+			Object.assign(patch, buildSandboxPatch({
+				sandbox,
+				existingSettings: parseSharedConfig({
+					format: "jsonc",
+					fileContent: existingContent,
+					filePath
+				})
+			}));
+			warnOnTrustAffectingEntries({
+				toolLabel: COPILOT_TOOL_LABEL,
+				entries: collectTrustAffectingSandboxPaths({
+					sandbox,
+					paths: COPILOT_TRUST_AFFECTING_SANDBOX_PATHS
+				}),
+				relativeFilePath: join(paths.relativeDirPath, paths.relativeFilePath),
+				logger
+			});
+		}
 		return new CopilotPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -60164,9 +60773,14 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const sandbox = readSandboxFromSettings(settings);
+		const copilot = {
+			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
+			...sandbox !== void 0 && { sandbox }
+		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
 			permission,
-			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { copilot: { defaultPermissionMode } }
+			...Object.keys(copilot).length > 0 && { copilot }
 		}, null, 2) });
 	}
 	validate() {
@@ -60480,8 +61094,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			logger
 		});
 		const managedToolNames = managedCrushToolNames(config);
-		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
-		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
+		const preservedAllowed = (isStringArray$1(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
+		const preservedDisabled = (isStringArray$1(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
 		const allowedList = uniq$1([...preservedAllowed, ...generated.allowed]);
 		const disabledList = uniq$1([...preservedDisabled, ...generated.disabled]);
 		const patch = {};
@@ -60507,8 +61121,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 		const permissions = isRecord$1(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
 		const options = isRecord$1(this.json["options"]) ? this.json[CRUSH_OPTIONS_KEY] : {};
 		const rulesyncConfig = convertCrushListsToRulesync({
-			allowed: isStringArray$2(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
-			disabled: isStringArray$2(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+			allowed: isStringArray$1(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
+			disabled: isStringArray$1(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
 		});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
@@ -62683,7 +63297,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 function convertGoosePermissionConfigToRulesync(userPermission) {
 	const permission = {};
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
-		const toolNames = isStringArray$2(userPermission[key]) ? userPermission[key] : [];
+		const toolNames = isStringArray$1(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
@@ -63031,7 +63645,7 @@ const ACTION_RANK$3 = {
 * (mirrors the Cursor adapter's preservation of unmanaged types).
 */
 function unmanagedEntries(existingPermission, key) {
-	return (isStringArray$2(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+	return (isStringArray$1(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
 }
 /**
 * Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
@@ -63088,7 +63702,7 @@ function warnRemovedAllToolsRestrictions({ existingPermission, ranked, logger })
 	const generated = ranked.get(GROK_ALL_TOOLS_ENTRY);
 	for (const action of ["deny", "ask"]) {
 		const entries = existingPermission[action];
-		if (!isStringArray$2(entries)) continue;
+		if (!isStringArray$1(entries)) continue;
 		if (!entries.some((entry) => parseGrokEntry(entry)?.category === "*")) continue;
 		if (generated !== void 0 && ACTION_RANK$3[generated] >= ACTION_RANK$3[action]) continue;
 		logger.warn(`Grok CLI permissions: removing the existing bare '*' entry from the '${action}' array — Rulesync now manages it through the all-tools '*' category, and the canonical config has no '*' '${action}' rule. Add "*": { "*": "${action}" } to keep restricting every tool.`);
@@ -63119,9 +63733,9 @@ function warnEntriesShadowedByAllTools({ ranked, logger }) {
 * described more than once resolves to the strictest action.
 */
 function parseGrokPermissionArrays(permission) {
-	const allow = isStringArray$2(permission.allow) ? permission.allow : void 0;
-	const deny = isStringArray$2(permission.deny) ? permission.deny : void 0;
-	const ask = isStringArray$2(permission.ask) ? permission.ask : void 0;
+	const allow = isStringArray$1(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray$1(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray$1(permission.ask) ? permission.ask : void 0;
 	const rules = Array.isArray(permission[GROKCLI_PERMISSION_RULES_KEY]) ? permission[GROKCLI_PERMISSION_RULES_KEY] : void 0;
 	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
@@ -63329,20 +63943,20 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		const permission = clonePermissionBlock(provenance.permission);
 		reconcileCommandAllowlist({
 			permission,
-			commandAllowlist: isStringArray$2(config.command_allowlist) ? config.command_allowlist : []
+			commandAllowlist: isStringArray$1(config.command_allowlist) ? config.command_allowlist : []
 		});
 		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
 			category: SHELL_PERMISSION_CATEGORY,
-			patterns: isStringArray$2(approvals.deny) ? approvals.deny : []
+			patterns: isStringArray$1(approvals.deny) ? approvals.deny : []
 		});
 		const security = isRecord$1(config.security) ? config.security : {};
 		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
 			category: WEBFETCH_PERMISSION_CATEGORY,
-			patterns: websiteBlocklist.enabled === true && isStringArray$2(websiteBlocklist.domains) ? websiteBlocklist.domains : []
+			patterns: websiteBlocklist.enabled === true && isStringArray$1(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
 		const { permission: _permission, hermes: _hermes, ...otherProvenance } = provenance;
@@ -64736,13 +65350,13 @@ function classifyExistingEntry({ emitted, capability, pattern, effect }) {
 * how many entries rulesync does not generate.
 */
 function mergeExistingRule({ rule, emitted, logger }) {
-	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$2(rule.match)) return {
+	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$1(rule.match)) return {
 		rule,
 		unrelatedEntries: 0
 	};
 	const capability = rule.capability;
 	const isCatchAll = rule.match === void 0;
-	const patterns = isStringArray$2(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
+	const patterns = isStringArray$1(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
 	if (patterns.length === 0) return {
 		rule,
 		unrelatedEntries: 0
@@ -64926,7 +65540,7 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 		for (const rule of rules) {
 			if (!isImportableRule(rule) || !isRecord$1(rule) || !isPermissionAction$1(rule.effect)) continue;
 			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
-			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$2(rule.match) ? rule.match : [];
+			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$1(rule.match) ? rule.match : [];
 			const categoryRules = permission[category] ??= {};
 			for (const pattern of patterns) {
 				const previous = categoryRules[pattern];
@@ -66644,8 +67258,8 @@ function importPoolTool({ toolConfig, bucket }) {
 		bucket[CATCH_ALL_PATTERN$3] = "deny";
 		return;
 	}
-	const denied = isStringArray$2(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
-	const allowed = isStringArray$2(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
+	const denied = isStringArray$1(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
+	const allowed = isStringArray$1(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
 	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
 	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
 }
@@ -68850,7 +69464,7 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 		permission[category] ??= {};
 		permission[category][CATCH_ALL_PATTERN$1] = levels.reduce((strictest, level) => strictestAction(strictest, level ?? implicitLevel), permission[category][CATCH_ALL_PATTERN$1]);
 	}
-	if (isStringArray$2(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
+	if (isStringArray$1(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
 		permission.read[path] ??= "allow";
 	}
@@ -69106,7 +69720,7 @@ function stripRefusedOverridePaths(override) {
 */
 function collectTrustAffectingOverrideEntries({ tools, general }) {
 	const entries = [];
-	const allowed = isStringArray$2(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
+	const allowed = isStringArray$1(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
 	if (allowed.length > 0) entries.push({
 		label: `tools.allowed (${allowed.map(quoteValueForWarning).join(", ")})`,
 		reason: "auto-approves what it names as the override spells it; a non-shell entry is only checked against a whole-tool deny of its tool"
@@ -69257,7 +69871,7 @@ function withholdDeniedOverrideAllowed({ overrideVerbatimAllowed, exclude, logge
 * hand-written entry went.
 */
 function reportDroppedManagedEntries({ existingTools, allowedList, excludeList, logger }) {
-	const dropped = (key, list) => uniq(isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+	const dropped = (key, list) => uniq(isStringArray$1(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
 		if (list.includes(entry)) return false;
 		const toolName = parseTabnineEntry(entry)?.toolName;
 		return toolName === void 0 || !list.includes(toolName);
@@ -69339,7 +69953,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		}
 		const overrideList = (key) => {
 			const value = overrideTools[key];
-			if (value === void 0 || isStringArray$2(value)) return value ?? [];
+			if (value === void 0 || isStringArray$1(value)) return value ?? [];
 			warnWithFallback(logger, `Tabnine CLI permissions: ignored tools.${key} of the tabnine override (${quoteValueForWarning(value)}); it must be a list of tool names.`);
 			return [];
 		};
@@ -69377,7 +69991,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		if (ignoredOverrideKeys.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: ignored ${ignoredOverrideKeys.length} key(s) of the tabnine override (${ignoredOverrideKeys.map(quoteValueForWarning).join(", ")}); only 'tools' and 'general' are written through the permissions feature.`);
 		const existingTools = this.existingToolsGroup(existingContent);
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => category === "bash" || category === "*" ? SHELL_TOOL_NAME : toTabnineToolName(category)));
-		const preservedEntries = (key) => (isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+		const preservedEntries = (key) => (isStringArray$1(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
 			const toolName = parseTabnineEntry(entry)?.toolName;
 			return toolName === void 0 || !managedToolNames.has(toolName);
 		});
@@ -69455,7 +70069,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			if (rules !== void 0 && !Object.hasOwn(rules, pattern)) rules[pattern] = action;
 		};
 		for (const [key, action] of [[EXCLUDE_KEY, "deny"], [ALLOWED_KEY, "allow"]]) {
-			const entries = isStringArray$2(tools[key]) ? tools[key] : [];
+			const entries = isStringArray$1(tools[key]) ? tools[key] : [];
 			for (const entry of entries) {
 				const parsed = parseTabnineEntry(entry);
 				if (parsed === void 0) {
@@ -70323,12 +70937,12 @@ const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|\p{Emoji_Modifier_Base}|
 * The ranges are the `East_Asian_Width=A` property of Unicode 17.0, taken from
 * the table `get-east-asian-width` 1.6.0 carries and merged where two are
 * adjacent. The table is written out here rather than read from the package so
-* that the one lookup adds no dependency of its own, and the drift test in
-* `display-width.test.ts` is what keeps it honest: it loads the package through
-* the prompt renderer that already depends on it, walks every code point, and
-* fails when this table and the property disagree in either direction. When
-* the renderer's copy moves to a newer Unicode, that test is what fails, and
-* the table is regenerated from the new property — its ranges, marks aside,
+* that the one lookup adds no runtime dependency of its own, and the drift test
+* in `display-width.test.ts` is what keeps it honest: it loads the package,
+* pinned as a dev dependency, walks every code point, and fails when this
+* table and the property disagree in either direction. When that pin moves to
+* a newer Unicode, that test is what fails, and the table is regenerated from
+* the new property — its ranges, marks aside,
 * merged where adjacent and written as escapes — with the version named here.
 *
 * Three stretches of the property are left out because they never reach this
@@ -72077,8 +72691,8 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		const executionProfiles = isRecord$1(agents["execution_profiles"]) ? agents[EXECUTION_PROFILES_KEY] : void 0;
 		const defaultProfile = executionProfiles && isRecord$1(executionProfiles["default"]) ? executionProfiles[DEFAULT_PROFILE_KEY] : void 0;
 		const config = convertWarpToRulesyncPermissions({
-			allow: defaultProfile ? isStringArray$2(defaultProfile["command_allowlist"]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$2(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
-			deny: defaultProfile ? isStringArray$2(defaultProfile["command_denylist"]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$2(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
+			allow: defaultProfile ? isStringArray$1(defaultProfile["command_allowlist"]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$1(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
+			deny: defaultProfile ? isStringArray$1(defaultProfile["command_denylist"]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$1(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
 		const warpOverride = {};
 		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
@@ -72608,8 +73222,8 @@ var WarpcliPermissions = class WarpcliPermissions extends ToolPermissions {
 		const allowlist = defaultProfile[PROFILE_ALLOWLIST_KEY];
 		const denylist = defaultProfile[PROFILE_DENYLIST_KEY];
 		const config = convertWarpToRulesyncPermissions({
-			allow: isStringArray$2(allowlist) ? allowlist : [],
-			deny: isStringArray$2(denylist) ? denylist : []
+			allow: isStringArray$1(allowlist) ? allowlist : [],
+			deny: isStringArray$1(denylist) ? denylist : []
 		});
 		const executionProfileOverride = liftExecutionProfileOverride(defaultProfile);
 		const warpcliOverride = {};
@@ -84624,7 +85238,7 @@ var BobSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const bobSection = isRecord$1(frontmatter.bob) ? frontmatter.bob : {};
-		if (isStringArray$2(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
+		if (isStringArray$1(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
 		return mode;
 	}
 };
@@ -90079,7 +90693,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const zoocodeSection = isRecord$1(frontmatter.zoocode) ? frontmatter.zoocode : {};
-		if (isStringArray$2(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
+		if (isStringArray$1(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
 		return mode;
 	}
 	toRulesyncSubagents() {
@@ -90091,7 +90705,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 				targets: ["zoocode"],
 				roo: restRooSection
 			};
-			if (isStringArray$2(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
+			if (isStringArray$1(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
 			return new RulesyncSubagent({
 				outputRoot: ".",
 				frontmatter: rebuilt,
@@ -94032,7 +94646,8 @@ var NestedAgentsmdRule = class extends ToolRule {
 * `<subprojectPath>/AGENTS.md` (project scope only); every other non-root rule
 * folds into the root `AGENTS.md`, since Codex has no modular rules directory.
 * The project files on the root-to-cwd chain share one `project_doc_max_bytes`
-* budget (32 KiB by default), which the RulesProcessor warns about.
+* budget (32 KiB by default, or the value set in the project's
+* `.codex/config.toml`), which the RulesProcessor warns about.
 *
 * @see https://learn.chatgpt.com/docs/agent-configuration/agents-md
 */
@@ -94044,6 +94659,29 @@ var CodexcliRule = class extends NestedAgentsmdRule {
 		};
 	}
 };
+/**
+* Read the `project_doc_max_bytes` value set in the project's
+* `.codex/config.toml`, which Codex loads for trusted projects and which
+* overrides the 32 KiB default budget for project `AGENTS.md` files.
+*
+* Answers `undefined` when the file is missing, is not valid TOML, or does not
+* set the key to a positive integer, so the caller falls back to the default.
+*
+* @see https://learn.chatgpt.com/docs/config-file/config-reference
+*/
+async function readCodexcliProjectDocMaxBytes(outputRoot) {
+	const content = await readFileContentOrNull(join(outputRoot, CODEXCLI_DIR, CODEXCLI_MCP_FILE_NAME));
+	if (content === null) return;
+	let parsed;
+	try {
+		parsed = smolToml.parse(content);
+	} catch {
+		return;
+	}
+	if (!isPlainObject$1(parsed)) return;
+	const value = parsed.project_doc_max_bytes;
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
 //#endregion
 //#region src/features/rules/commandcode-rule.ts
 var CommandcodeRule = class CommandcodeRule extends ToolRule {
@@ -99418,7 +100056,10 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold",
 			projectInstructionBudget: {
 				bytes: CODEXCLI_PROJECT_DOC_MAX_BYTES,
-				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (ignore this warning if you already have)."
+				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (Codex reads that file only if the project is trusted).",
+				readConfiguredBytes: readCodexcliProjectDocMaxBytes,
+				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml` (honored only if the project is trusted)",
+				defaultLimitHint: "Rulesync does not read `~/.codex/config.toml`; ignore this warning if you already raised `project_doc_max_bytes` there."
 			}
 		}
 	}],
@@ -99963,7 +100604,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			factory
 		});
 		await this.warnForWarpLegacyRootFile(toolRules);
-		this.warnForInstructionBudget({
+		await this.warnForInstructionBudget({
 			toolRules,
 			meta
 		});
@@ -99984,14 +100625,20 @@ var RulesProcessor = class extends FeatureProcessor {
 	* once, at its shallowest directory. With several output roots the warning
 	* names the root it refers to. An output root below the git root is measured
 	* without the parent directories' files Codex would also load, so the
-	* estimate can come out low there. The budget checked is the tool's default: a value
-	* raised by hand in the tool's own config is not read. Global scope is not
+	* estimate can come out low there. The budget checked is the value set in the
+	* output root's tool config when the tool supports one (Codex's
+	* `project_doc_max_bytes` in `.codex/config.toml`), else the tool's default;
+	* the warning names which one it used. Global scope is not
 	* checked because Codex loads the personal `~/.codex/AGENTS.md` outside the
 	* project budget.
 	*/
-	warnForInstructionBudget({ toolRules, meta }) {
+	async warnForInstructionBudget({ toolRules, meta }) {
 		const budget = meta.projectInstructionBudget;
 		if (budget === void 0 || this.global) return;
+		const configuredBytes = await budget.readConfiguredBytes?.(this.outputRoot);
+		const limitBytes = configuredBytes ?? budget.bytes;
+		const limitLabel = budget.readConfiguredBytes === void 0 ? `${limitBytes}-byte limit` : configuredBytes === void 0 ? `${limitBytes}-byte default limit` : `${limitBytes}-byte limit set by ${budget.configuredSource ?? "the tool config"}`;
+		const remedy = configuredBytes === void 0 && budget.defaultLimitHint !== void 0 ? `${budget.remedy} ${budget.defaultLimitHint}` : budget.remedy;
 		const files = toolRules.map((rule) => ({
 			dir: normalizeRelativeDir(rule.getRelativeDirPath()),
 			path: toPosixPath(join(rule.getRelativeDirPath(), rule.getRelativeFilePath())),
@@ -100001,8 +100648,8 @@ var RulesProcessor = class extends FeatureProcessor {
 		const location = this.outputRoot === process.cwd() ? "" : ` under '${this.outputRoot}'`;
 		const rootFiles = files.filter(({ dir }) => dir === ".");
 		const rootBytes = rootFiles.reduce((sum, { bytes }) => sum + bytes, 0);
-		if (rootBytes > budget.bytes) {
-			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${budget.bytes}-byte limit. ${budget.remedy}`);
+		if (rootBytes > limitBytes) {
+			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${remedy}`);
 			return;
 		}
 		const reportedDirs = [];
@@ -100011,9 +100658,9 @@ var RulesProcessor = class extends FeatureProcessor {
 			if (reportedDirs.some((dir) => isAncestorOrSelf(dir, file.dir))) continue;
 			const chain = files.filter(({ dir }) => isAncestorOrSelf(dir, file.dir));
 			const chainBytes = chain.reduce((sum, { bytes }) => sum + bytes, 0);
-			if (chainBytes > budget.bytes) {
+			if (chainBytes > limitBytes) {
 				reportedDirs.push(file.dir);
-				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${budget.bytes}-byte limit (as is every directory below it). ${budget.remedy}`);
+				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${remedy}`);
 			}
 		}
 	}
@@ -103918,4 +104565,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncHooks as $, removeDirectoryStrict as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, parseCommaSeparatedList as Bn, getFileSizeAndExecutableBit as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_IGNORE_RELATIVE_FILE_PATH as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, truncateText as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, ALL_FEATURES_WITH_WILDCARD as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as In, directoryExists as It, RulesyncRule as J, quoteForLog as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, hasDeceptiveHiddenCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_PERMISSIONS_SCHEMA_URL as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_RELATIVE_DIR_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_MCP_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_RULES_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectory as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, RULESYNC_USER_CONFIG_DIR_NAME as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_CONFIG_SCHEMA_URL as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, DEPRECATED_FEATURE_REPLACEMENTS as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, ALL_FEATURES as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, formatError as Wn, isSymlink as Wt, RulesyncPermissions as X, stripControlCharactersKeepingLineFeeds as Xn, readFileContent as Xt, RulesyncRuleFrontmatterSchema as Y, stripControlCharacters as Yn, posixRelativePathEscapesRoot as Yt, RulesyncMcp as Z, stripHiddenCharacters as Zn, readFileContentOrNull as Zt, LETTACODE_DIR as _, MAX_FILE_SIZE as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, runWithDirectoryRollback as an, RulesyncCheck as at, CommandsProcessor as b, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, writeFileBuffer as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ALL_TOOL_TARGETS as dn, ConfigResolver as dt, removeFile as en, getRulesyncSourceCandidates as et, displayWidthOf as f, ALL_TOOL_TARGETS_WITH_WILDCARD as fn, mergeInputRootConfigs as ft, HooksProcessor as g, FEATURE_SOURCE_TREE_ENTRIES as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, CURATED_RULES_FEATURE_SUBDIR as hn, ConfigFileSchema as ht, inspectInputRoots as i, resolvedRelativePath as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_MCP_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, writeFileContent as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, ToolTargetSchema as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, removeTempDirectory as nn, parseJsonc as nt, convertFromTool as o, splitPathSegments as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, PACKAGING_TOOL_TARGETS as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, hasEnclosingMarkOutsideKeycap as qn, listSubdirectoryNames as qt, generate as r, resolvePath as rn, RulesyncCommand as rt, isPackagingToolTarget as s, toPosixPath as sn, stringifyFrontmatter as st, importFromTool as t, removeFileStrict as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, mapWithConcurrency as un, SKILL_FILE_NAME as ut, LETTACODE_SETTINGS_LOCAL_FILE_NAME as v, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as wn, warnOnConflictingFlags as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, RULESYNC_CONFIG_RELATIVE_FILE_PATH as xn, JsonLogger as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_CHECKS_RELATIVE_DIR_PATH as yn, findControlCharacter as yt, QWENCODE_DIR as z, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as zn, findFilesByGlobs as zt };
 
-//# sourceMappingURL=import-Tya9qZRK.js.map
+//# sourceMappingURL=import-BsEFYJsg.js.map