rulesync 36.0.2 → 37.1.0

package/dist/{import-DVcemXlR.cjs → import-DYYG88Rs.cjs}

@@ -457,36 +457,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$422 } = node_path.posix;
+const { join: join$423 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$422(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$423(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$422(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$422(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$423(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$423(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$422(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -4062,7 +4062,7 @@ function isPlainObject$1(value) {
 /**
 * Type guard to check if a value is an array of strings.
 */
-function isStringArray$2(value) {
+function isStringArray$1(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
 //#endregion
@@ -7917,14 +7917,53 @@ const COPILOT_DEFAULT_PERMISSION_MODES = [
 	"autoApprove",
 	"autopilot"
 ];
+/** `chat.agent.sandbox.enabled`: `"off"` or `"on"`. */
+const CopilotSandboxEnabledSchema = zod_mini.z.enum(["off", "on"]);
+/** `chat.agent.sandbox.fileSystem.userConfiguredPaths`. */
+const CopilotSandboxUserConfiguredPathsSchema = zod_mini.z.strictObject({
+	readwritePaths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	readonlyPaths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	deniedPaths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+});
+/**
+* The Agent Host sandbox settings VS Code 1.141 settled on, as a nested object
+* whose path mirrors the dotted setting key under `chat.agent.sandbox.` — e.g.
+* `network.allowNetwork` writes `chat.agent.sandbox.network.allowNetwork`.
+* Only the documented, registered keys are accepted; the deprecated 1.138
+* shapes (`chat.agent.sandbox.allowNetwork`, `.fileSystem.linux|mac|windows`)
+* are not modeled, since the Agent Host ignores them.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const CopilotSandboxSchema = zod_mini.z.strictObject({
+	enabled: zod_mini.z.optional(CopilotSandboxEnabledSchema),
+	network: zod_mini.z.optional(zod_mini.z.strictObject({
+		allowNetwork: zod_mini.z.optional(zod_mini.z.boolean()),
+		allowLocalNetwork: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
+	allowUnsandboxedCommands: zod_mini.z.optional(zod_mini.z.boolean()),
+	mcpServers: zod_mini.z.optional(zod_mini.z.boolean()),
+	lspServers: zod_mini.z.optional(zod_mini.z.boolean()),
+	credentials: zod_mini.z.optional(zod_mini.z.strictObject({
+		authenticategit: zod_mini.z.optional(zod_mini.z.boolean()),
+		authenticategh: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
+	fileSystem: zod_mini.z.optional(zod_mini.z.strictObject({
+		allowDevToolAccess: zod_mini.z.optional(zod_mini.z.boolean()),
+		userConfiguredPaths: zod_mini.z.optional(CopilotSandboxUserConfiguredPathsSchema)
+	}))
+});
 /**
 * Tool-scoped override block for GitHub Copilot in VS Code.
 * `defaultPermissionMode` writes the workspace `chat.permissions.default`
-* setting, which has no canonical category.
+* setting, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
+* has a canonical category.
 */
 const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum(COPILOT_DEFAULT_PERMISSION_MODES))
+	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum(COPILOT_DEFAULT_PERMISSION_MODES)),
+	sandbox: zod_mini.z.optional(CopilotSandboxSchema)
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
@@ -12857,6 +12896,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 				kind: "replace-owned-keys",
 				ownedKeys: ["disableAllHooks"]
 			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["disabledMcpServers"]
+			},
 			permissions: {
 				kind: "replace-owned-keys",
 				ownedKeys: ["deniedUrls"]
@@ -12871,6 +12914,10 @@ const SHARED_CONFIG_OWNERSHIP = {
 				kind: "replace-owned-keys",
 				ownedKeys: ["disableAllHooks"]
 			},
+			mcp: {
+				kind: "replace-owned-keys",
+				ownedKeys: ["disabledMcpServers"]
+			},
 			permissions: {
 				kind: "replace-owned-keys",
 				ownedKeys: ["allowedUrls", "deniedUrls"]
@@ -12888,6 +12935,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 				"chat.tools.edits.autoApprove",
 				"chat.tools.urls.autoApprove",
 				"chat.permissions.default",
+				"chat.agent.sandbox.enabled",
+				"chat.agent.sandbox.network.allowNetwork",
+				"chat.agent.sandbox.network.allowLocalNetwork",
+				"chat.agent.sandbox.allowUnsandboxedCommands",
+				"chat.agent.sandbox.mcpServers",
+				"chat.agent.sandbox.lspServers",
+				"chat.agent.sandbox.credentials.authenticategit",
+				"chat.agent.sandbox.credentials.authenticategh",
+				"chat.agent.sandbox.fileSystem.allowDevToolAccess",
+				"chat.agent.sandbox.fileSystem.userConfiguredPaths",
 				"zoo-code.allowedCommands",
 				"zoo-code.deniedCommands",
 				"roo-cline.allowedCommands",
@@ -22135,7 +22192,7 @@ function getOpencodeCommandEntries({ config, layout = OPENCODE_LAYOUT }) {
 */
 function getOpencodeSkillPaths({ config, layout = OPENCODE_LAYOUT }) {
 	if (Array.isArray(config.skills)) {
-		if (!layout.readsV2ConfigSpellings || !isStringArray$2(config.skills)) return [];
+		if (!layout.readsV2ConfigSpellings || !isStringArray$1(config.skills)) return [];
 		return config.skills.filter((value) => !/^https?:\/\//i.test(value));
 	}
 	const skills = asOpencodeEntries(config.skills);
@@ -26381,7 +26438,7 @@ const isBooleanValue = ({ value }) => typeof value === "boolean";
 const isFiniteNumber = ({ value }) => Number.isFinite(value);
 const isNonEmptyString = (value) => typeof value === "string" && value !== "";
 const isEmittableString = ({ value }) => isNonEmptyString(value);
-const isEmittableArray = ({ value }) => isStringArray$1(value);
+const isEmittableArray = ({ value }) => isStringArray(value);
 const isEmittableRecord = ({ value }) => isSafeStringRecord(value);
 const isImportableArray = ({ value }) => isSafeStringArray(value);
 const isEmittableObject = ({ value }) => isPlainObject$1(value);
@@ -26823,7 +26880,7 @@ function isStringRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	return Object.values(value).every((v) => typeof v === "string");
 }
-function isStringArray$1(value) {
+function isStringArray(value) {
 	return Array.isArray(value) && value.every((v) => typeof v === "string");
 }
 /** Compare object values without letting key order decide the answer. */
@@ -26868,7 +26925,7 @@ function isSafeEnvEntry(entry) {
 * skipped wholesale when that read fails.
 */
 function isSafeStringArray(value) {
-	return isStringArray$1(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
+	return isStringArray(value) && value.every((entry) => !CONTROL_CHARS.some((char) => entry.includes(char)));
 }
 /**
 * A raw string kept only if the canonical field it would land in accepts it,
@@ -26910,7 +26967,7 @@ function importTypePayloadFields({ h, hookType, warn }) {
 		return {
 			...url !== void 0 && { url },
 			...isStringRecord(headers) && { headers },
-			...isStringArray$1(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
+			...isStringArray(h.allowedEnvVars) && { allowedEnvVars: h.allowedEnvVars }
 		};
 	}
 	if (hookType === "mcp_tool") {
@@ -28050,8 +28107,34 @@ function collectOwnedRefs({ generatedHooks, shape }) {
 	}
 	return owned;
 }
+/**
+* The merge keeps every unowned existing handler where it is. Some tools key
+* state by position — Codex CLI persists a hook's trust review under its event,
+* matcher group index and handler index — so moving a handler the user already
+* reviewed would silently change which hook that review belongs to. Hence:
+* - an unowned existing handler stays at its index;
+* - a newly generated handler is appended to the first existing group with its
+*   matcher and group-level keys, or in a new group after the existing ones;
+* - within a group, the slots rulesync's own handlers occupy (including the
+*   appended ones) are filled in generated order, so reordering the sources
+*   still reorders the generated handlers, which matters wherever handlers
+*   run in order (a Qwen Code `sequential` group, a Cursor list).
+*
+* A retracted handler, or a group left empty by retractions, is still removed,
+* which shifts whatever follows it in the same list; that is unavoidable
+* without leaving a placeholder behind.
+*/
 function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const merged = [...generated];
+	const pending = createPendingGenerated();
+	for (const group of generated) if (isMatcherGroup(group)) addPending({
+		pending,
+		handlers: group.hooks,
+		event,
+		matcher: matcherKey(group.matcher),
+		attributes: groupAttributesKey(group)
+	});
+	const merged = [];
+	const homes = /* @__PURE__ */ new Map();
 	for (const group of existing) {
 		if (!isMatcherGroup(group)) {
 			warnSkip({
@@ -28062,26 +28145,57 @@ function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned,
 			continue;
 		}
 		const matcher = matcherKey(group.matcher);
-		const preserved = group.hooks.filter((handler) => shouldPreserve({
-			handler,
+		const hooks = keepExistingHandlers({
+			handlers: group.hooks,
 			event,
 			matcher,
+			attributes: groupAttributesKey(group),
+			pending,
 			seen,
 			previouslyOwned,
 			logger
-		})).map((handler) => cloneHandler(handler));
-		if (preserved.length === 0) continue;
-		const target = merged.find((candidate) => isMatcherGroup(candidate) && matcherKey(candidate.matcher) === matcher);
-		if (target !== void 0 && isMatcherGroup(target)) target.hooks.push(...preserved);
-		else merged.push({
+		});
+		if (hooks.length === 0) continue;
+		const kept = {
 			...omitPrototypePollutionKeys(group),
-			hooks: preserved
+			hooks
+		};
+		merged.push(kept);
+		const home = groupSlotKey(group);
+		if (!homes.has(home)) homes.set(home, kept);
+	}
+	for (const group of generated) {
+		if (!isMatcherGroup(group)) {
+			merged.push(group);
+			continue;
+		}
+		const remaining = group.hooks.filter((handler) => !pending.placed.has(handler));
+		if (remaining.length === 0) continue;
+		const home = homes.get(groupSlotKey(group));
+		if (home === void 0) merged.push({
+			...group,
+			hooks: remaining
 		});
+		else home.hooks.push(...remaining);
 	}
+	const order = generatedOrder(generated.flatMap((group) => isMatcherGroup(group) ? group.hooks : []));
+	for (const group of merged) if (isMatcherGroup(group)) orderGeneratedSlots({
+		handlers: group.hooks,
+		order
+	});
 	return merged;
 }
+/** The flat-list counterpart of {@link mergeMatcherGroups}, with the same positional rules. */
 function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const preserved = [];
+	const pending = createPendingGenerated();
+	addPending({
+		pending,
+		handlers: generated,
+		event,
+		matcher: void 0,
+		attributes: ""
+	});
+	const flat = [];
 	for (const handler of existing) {
 		if (isMatcherGroup(handler)) {
 			warnSkip({
@@ -28091,17 +28205,93 @@ function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned,
 			});
 			continue;
 		}
-		if (!shouldPreserve({
+		flat.push(handler);
+	}
+	const merged = keepExistingHandlers({
+		handlers: flat,
+		event,
+		matcher: void 0,
+		attributes: "",
+		pending,
+		seen,
+		previouslyOwned,
+		logger
+	});
+	merged.push(...generated.filter((handler) => !pending.placed.has(handler)));
+	orderGeneratedSlots({
+		handlers: merged,
+		order: generatedOrder(generated)
+	});
+	return merged;
+}
+/** Each generated handler's position in the generated list, by object identity. */
+function generatedOrder(handlers) {
+	const order = /* @__PURE__ */ new Map();
+	for (const [index, handler] of handlers.entries()) if (isPlainObject$1(handler)) order.set(handler, index);
+	return order;
+}
+/**
+* Rewrite, in place, the slots of `handlers` that hold generated handlers so
+* they follow the generated order. Every other slot — an unowned handler — is
+* left at its index.
+*/
+function orderGeneratedSlots({ handlers, order }) {
+	const slots = [];
+	for (const [index, handler] of handlers.entries()) if (order.has(handler)) slots.push(index);
+	const sorted = slots.map((index) => handlers[index]).toSorted((left, right) => (order.get(left) ?? 0) - (order.get(right) ?? 0));
+	for (const [position, index] of slots.entries()) handlers[index] = sorted[position];
+}
+function createPendingGenerated() {
+	return {
+		byKey: /* @__PURE__ */ new Map(),
+		placed: /* @__PURE__ */ new Set()
+	};
+}
+function addPending({ pending, handlers, event, matcher, attributes }) {
+	for (const handler of handlers) {
+		if (!isPlainObject$1(handler)) continue;
+		const key = pendingKey({
+			event,
+			matcher,
+			attributes,
+			handler
+		});
+		const queue = pending.byKey.get(key);
+		if (queue === void 0) pending.byKey.set(key, [handler]);
+		else queue.push(handler);
+	}
+}
+/**
+* Walk one existing list in order and decide each handler: replaced in place
+* by its generated copy, kept as unowned, or dropped (retracted or duplicate).
+*/
+function keepExistingHandlers({ handlers, event, matcher, attributes, pending, seen, previouslyOwned, logger }) {
+	const kept = [];
+	for (const handler of handlers) {
+		if (isPlainObject$1(handler)) {
+			const key = pendingKey({
+				event,
+				matcher,
+				attributes,
+				handler
+			});
+			const generated = pending.byKey.get(key)?.shift();
+			if (generated !== void 0) {
+				pending.placed.add(generated);
+				kept.push(generated);
+				continue;
+			}
+		}
+		if (shouldPreserve({
 			handler,
 			event,
-			matcher: void 0,
+			matcher,
 			seen,
 			previouslyOwned,
 			logger
-		})) continue;
-		preserved.push(cloneHandler(handler));
+		})) kept.push(cloneHandler(handler));
 	}
-	return [...generated, ...preserved];
+	return kept;
 }
 function isMatcherGroup(value) {
 	return isPlainObject$1(value) && Array.isArray(value.hooks);
@@ -28192,6 +28382,36 @@ function stableStringify$1(value) {
 function matcherKey(matcher) {
 	return matcher === void 0 ? "" : stableStringify$1(matcher);
 }
+function pendingKey({ event, matcher, attributes, handler }) {
+	const key = ownedHookKey({
+		event,
+		matcher,
+		identity: handlerIdentity(handler)
+	});
+	return JSON.stringify([key, attributes]);
+}
+/** Groups that share a matcher and attributes are interchangeable homes for a handler. */
+function groupSlotKey(group) {
+	return JSON.stringify([matcherKey(group.matcher), groupAttributesKey(group)]);
+}
+/** Group-level keys whose default value is known, so an explicit default can be ignored. */
+const GROUP_ATTRIBUTE_DEFAULTS = Object.freeze({
+	__proto__: null,
+	sequential: false
+});
+/**
+* The stable form of a matcher group's keys other than `matcher` and `hooks`.
+*
+* A key set to its known default is the same group as one that omits it:
+* Qwen Code's `sequential` defaults to `false` and rulesync emits it only when
+* `true`, so an explicit `sequential: false` (or any `undefined` key) is
+* dropped before comparing. Other `false` values are kept, since their default
+* is not known here.
+*/
+function groupAttributesKey(group) {
+	const { matcher: _matcher, hooks: _hooks, ...attributes } = group;
+	return stableStringify$1(Object.fromEntries(Object.entries(attributes).filter(([key, value]) => value !== void 0 && GROUP_ATTRIBUTE_DEFAULTS[key] !== value)));
+}
 function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
 }
@@ -28687,7 +28907,7 @@ const MANAGED_EVENT_NAMES = new Set(Object.values(CANONICAL_TO_CLINE_EVENT_NAMES
 function parseManifest(fileContent) {
 	try {
 		const parsed = JSON.parse(fileContent);
-		if (!isRecord$1(parsed) || !isStringArray$2(parsed.events)) return null;
+		if (!isRecord$1(parsed) || !isStringArray$1(parsed.events)) return null;
 		return {
 			generatedBy: "rulesync",
 			events: parsed.events.filter((event) => MANAGED_EVENT_NAMES.has(event))
@@ -30225,7 +30445,7 @@ function copilotCliHooksToCanonical(rawHooks, logger) {
 * see the CLI config dir reference:
 * https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
 */
-function copilotCliSettingsPaths({ global }) {
+function copilotCliSettingsPaths$1({ global }) {
 	return global ? {
 		relativeDirPath: COPILOT_DIR,
 		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
@@ -30240,7 +30460,7 @@ function copilotCliSettingsPaths({ global }) {
 * subject, and the permissions feature reports a broken settings file itself.
 */
 async function readDisableAllHooks({ outputRoot, global }) {
-	const paths = copilotCliSettingsPaths({ global });
+	const paths = copilotCliSettingsPaths$1({ global });
 	const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
 	if (fileContent === null) return;
 	try {
@@ -30270,7 +30490,7 @@ var CopilotcliHooksSettings = class CopilotcliHooksSettings extends ToolFile {
 		return false;
 	}
 	static async fromDisableAllHooks({ outputRoot = process.cwd(), global = false, disableAllHooks }) {
-		const paths = copilotCliSettingsPaths({ global });
+		const paths = copilotCliSettingsPaths$1({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
 		return new CopilotcliHooksSettings({
@@ -30300,7 +30520,7 @@ var CopilotcliHooks = class CopilotcliHooks extends ToolHooks {
 		this.disableAllHooks = disableAllHooks;
 	}
 	static getExtraSharedWritePaths({ global = false } = {}) {
-		return [copilotCliSettingsPaths({ global })];
+		return [copilotCliSettingsPaths$1({ global })];
 	}
 	static async getAuxiliaryFiles({ toolHooks } = {}) {
 		return toolHooks instanceof CopilotcliHooks && toolHooks.settingsFile ? [toolHooks.settingsFile] : [];
@@ -34744,12 +34964,21 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
 		const paths = QwencodeHooks.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? JSON.stringify({}, null, 2);
 		const config = rulesyncHooks.getJson();
-		const patch = { hooks: canonicalToQwencodeHooks(config, logger) };
+		const previouslyOwned = preserveUnowned ? parseHooksOwnershipLock(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0;
+		const merged = mergeGeneratedHookLists({
+			existingContent,
+			generatedHooks: canonicalToQwencodeHooks(config, logger),
+			shape: "matcher-groups",
+			preserveUnowned,
+			previouslyOwned,
+			logger
+		});
+		const patch = { hooks: merged.hooks };
 		const disableAllHooks = config.qwencode?.disableAllHooks;
 		if (typeof disableAllHooks === "boolean") patch.disableAllHooks = disableAllHooks;
 		const fileContent = applySharedConfigPatch({
@@ -34764,9 +34993,16 @@ var QwencodeHooks = class QwencodeHooks extends ToolHooks {
 			relativeDirPath: paths.relativeDirPath,
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
+			ownedHookRefs: preserveUnowned ? merged.owned : void 0,
 			validate
 		});
 	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+	static async getAuxiliaryFiles({ toolHooks } = {}) {
+		return toolHooks instanceof QwencodeHooks ? toolHooks.getOwnershipLockFiles() : [];
+	}
 	toRulesyncHooks() {
 		let settings;
 		try {
@@ -41166,7 +41402,7 @@ function isCodexStdioServer(config) {
 * @see https://learn.chatgpt.com/docs/extend/mcp
 */
 function isValidRenamedArray(key, value) {
-	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$2(value);
+	return key === "env_vars" || key === "envVars" ? isEnvVarEntryArray(value) : isStringArray$1(value);
 }
 /**
 * The keys of Codex's `McpServerOAuthConfig`. Anything else in a server's
@@ -42385,18 +42621,6 @@ function renameEnabledToolsToTools({ server, serverName, logger }) {
 	};
 }
 /**
-* Copilot CLI's `tools` accepts more than the canonical `enabledTools` shape:
-* `--tools` documents `*`, a comma-separated list, or `""`, so a hand-written or
-* CLI-written entry can be a bare string. Canonical `enabledTools` is
-* `string[]`, and `RulesyncMcp` throws on a schema failure — carrying a string
-* through would reject the WHOLE imported MCP file rather than one key. Anything
-* that is not a string array is therefore left under `tools` untouched, matching
-* `codexcli-mcp.ts`'s `isValidRenamedArray` guard on the same class of rename.
-*/
-function isStringArray(value) {
-	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
-}
-/**
 * Resolves and sets the transport type for each MCP server config.
 * GitHub Copilot CLI requires the "type" field for each server. A server it
 * cannot express — one that names no transport, or names one it carries no way
@@ -42438,7 +42662,7 @@ function addTypeField(mcpServers, logger) {
 				});
 				continue;
 			}
-			const { httpUrl: _httpUrl, ...rest } = parsed;
+			const { httpUrl: _httpUrl, disabled: _disabled, ...rest } = parsed;
 			result[name] = {
 				...renameEnabledToolsToTools({
 					server: rest,
@@ -42450,7 +42674,7 @@ function addTypeField(mcpServers, logger) {
 			};
 			continue;
 		}
-		const { httpUrl: _localHttpUrl, ...local } = parsed;
+		const { httpUrl: _localHttpUrl, disabled: _localDisabled, ...local } = parsed;
 		const [head, ...tail] = resolveLocalMcpCommand(parsed);
 		if (head === void 0) {
 			warnAndSkipMcpServer({
@@ -42481,7 +42705,7 @@ function removeTypeField(config) {
 	const result = {};
 	for (const [name, server] of Object.entries(config.mcpServers ?? {})) {
 		const { tools, ...withoutTools } = server;
-		const restored = isStringArray(tools) ? {
+		const restored = isStringArray$1(tools) ? {
 			...withoutTools,
 			enabledTools: tools
 		} : {
@@ -42497,6 +42721,99 @@ function removeTypeField(config) {
 	}
 	return result;
 }
+/**
+* The Copilot CLI settings file carrying `disabledMcpServers`:
+* `.github/copilot/settings.json` (project) / `~/.copilot/settings.json`
+* (global). Both scopes document the key ("MCP server names to disable. Listed
+* servers are configured but not started"); at repository scope it is
+* union-merged with the user value, so a repository can add names but never
+* remove them.
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+*/
+function copilotCliSettingsPaths({ global }) {
+	return global ? {
+		relativeDirPath: COPILOT_DIR,
+		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+	} : {
+		relativeDirPath: COPILOTCLI_PROJECT_SETTINGS_DIR_PATH,
+		relativeFilePath: COPILOTCLI_SETTINGS_FILE_NAME
+	};
+}
+async function readCopilotCliSettings({ outputRoot, global }) {
+	const paths = copilotCliSettingsPaths({ global });
+	const existingContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+	try {
+		return {
+			paths,
+			existingContent,
+			document: parseSharedConfig({
+				format: "json",
+				fileContent: existingContent,
+				filePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath),
+				invalidRootPolicy: "error"
+			})
+		};
+	} catch (error) {
+		return {
+			paths,
+			existingContent,
+			document: null,
+			error
+		};
+	}
+}
+/**
+* The names of the servers rulesync actually writes for this target: one
+* `addTypeField` skips (no transport, WebSocket, missing url or command) is
+* not managed, so its name neither gains a toggle nor strips a same-named
+* user-authored entry from the settings file.
+*/
+function managedServerNames(mcpServers) {
+	return Object.keys(addTypeField(mcpServers) ?? {});
+}
+/**
+* Overlays `disabled: true` on the servers the scope's settings file lists in
+* `disabledMcpServers`, so import round-trips the toggle into the canonical
+* config. A settings file that exists but cannot be parsed throws
+* (fail-closed): importing past it would re-enable every disabled server.
+*/
+async function overlayDisabledServers({ mcpServers, outputRoot, global }) {
+	const settings = await readCopilotCliSettings({
+		outputRoot,
+		global
+	});
+	if (settings.document === null) throw new Error(`Cannot import Copilot CLI MCP servers: ${formatError(settings.error)}. Fix the file so disabledMcpServers can be read.`, { cause: settings.error });
+	const disabled = settings.document.disabledMcpServers;
+	if (!isStringArray$1(disabled) || disabled.length === 0) return mcpServers;
+	const servers = { ...mcpServers };
+	for (const name of disabled) {
+		if (!Object.hasOwn(servers, name)) continue;
+		const server = servers[name];
+		if (isPlainObject$1(server)) servers[name] = {
+			...server,
+			disabled: true
+		};
+	}
+	return servers;
+}
+/**
+* Auxiliary writer for `disabledMcpServers` in the Copilot CLI settings file.
+* Only that key is owned (through the shared-config gateway), so `deniedUrls`,
+* `disableAllHooks`, `model` and every other setting are preserved. It is a
+* shared, user-owned file and is never deleted.
+*/
+var CopilotcliMcpSettings = class extends ToolFile {
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	isDeletable() {
+		return false;
+	}
+};
 var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -42539,7 +42856,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 		const json = JSON.parse(fileContent);
 		const newJson = {
 			...json,
-			mcpServers: json.mcpServers ?? {}
+			mcpServers: await overlayDisabledServers({
+				mcpServers: json.mcpServers ?? {},
+				outputRoot,
+				global
+			})
 		};
 		return new CopilotcliMcp({
 			outputRoot,
@@ -42554,7 +42875,17 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? JSON.stringify({ mcpServers: {} }, null, 2);
 		const json = JSON.parse(fileContent);
-		const copilotCliMcpServers = addTypeField(rulesyncMcp.getMcpServers(), logger);
+		const settings = await readCopilotCliSettings({
+			outputRoot,
+			global
+		});
+		const existingDisabled = settings.document?.disabledMcpServers;
+		const offSwitchBlocker = settings.document === null ? "cannot be parsed" : existingDisabled !== void 0 && !isStringArray$1(existingDisabled) ? "has a disabledMcpServers value that is not an array of server names" : void 0;
+		const copilotCliMcpServers = addTypeField(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).filter(([name, server]) => {
+			if (server.disabled !== true || offSwitchBlocker === void 0) return true;
+			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${(0, node_path.join)(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} ${offSwitchBlocker}, so disabledMcpServers cannot be written to switch it off.`);
+			return false;
+		})), logger);
 		const mcpJson = {
 			...json,
 			mcpServers: copilotCliMcpServers
@@ -42568,6 +42899,66 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			global
 		});
 	}
+	/**
+	* `disabledMcpServers` lives in the Copilot CLI settings file the hooks and
+	* permissions features also write. Declared here so the write-order
+	* derivation sees this feature as one of that file's writers — it is not a
+	* settable path, since the servers themselves live in the MCP file.
+	*/
+	static getExtraSharedWritePaths({ global = false } = {}) {
+		return [copilotCliSettingsPaths({ global })];
+	}
+	/**
+	* Routes the canonical `disabled: true` to `disabledMcpServers`, the key
+	* Copilot CLI actually consults: an MCP file entry has no `disabled` field.
+	* rulesync owns the toggle for the servers it writes; names it does not
+	* manage keep their existing state. The file is not created or touched when
+	* there is nothing to disable and nothing to retract, nor when the existing
+	* `disabledMcpServers` is not a string array (left as is, with a warning).
+	*/
+	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
+		const servers = rulesyncMcp.forTarget({
+			toolTarget: "copilotcli",
+			global
+		}).getMcpServers();
+		const managedNames = managedServerNames(servers);
+		const disabledNames = managedNames.filter((name) => servers[name]?.disabled === true);
+		const settings = await readCopilotCliSettings({
+			outputRoot,
+			global
+		});
+		if (settings.document === null) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: ${formatError(settings.error)}`);
+			return [];
+		}
+		const existing = settings.document.disabledMcpServers;
+		if (existing !== void 0 && !isStringArray$1(existing)) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: the existing value is not an array of server names. Fix it in ${(0, node_path.join)(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} so rulesync can manage the toggle.`);
+			return [];
+		}
+		const existingDisabled = existing ?? [];
+		const managedNameSet = new Set(managedNames);
+		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
+		if (reEnabled.length > 0) logger?.warn(`Copilot CLI MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
+		const mergedDisabled = [...existingDisabled.filter((name) => !managedNameSet.has(name)), ...disabledNames].toSorted();
+		if (mergedDisabled.length === 0 && existing === void 0) return [];
+		if (isStringArray$1(existing) && existing.length === mergedDisabled.length && existing.toSorted().every((name, index) => name === mergedDisabled[index])) return [];
+		const { paths } = settings;
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		return [new CopilotcliMcpSettings({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent: settings.existingContent,
+				patch: { disabledMcpServers: mergedDisabled.length > 0 ? mergedDisabled : void 0 },
+				filePath
+			}),
+			global
+		})];
+	}
 	toRulesyncMcp() {
 		const mcpServers = removeTypeField(this.json);
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
@@ -42999,10 +43390,10 @@ function convertFromCrushFormat(crushServers) {
 					if (value === "http" || value === "sse") converted.type = value;
 					break;
 				case "disabled_tools":
-					if (isStringArray$2(value)) converted.disabledTools = value;
+					if (isStringArray$1(value)) converted.disabledTools = value;
 					break;
 				case "enabled_tools":
-					if (isStringArray$2(value)) converted.enabledTools = value;
+					if (isStringArray$1(value)) converted.enabledTools = value;
 					break;
 				case "oauth_token": break;
 				default: {
@@ -43989,7 +44380,7 @@ function convertRowsFromDsh(rows, logger) {
 		} else {
 			server.type = "stdio";
 			if (typeof config.command === "string") server.command = config.command;
-			if (isStringArray$2(config.args)) server.args = config.args;
+			if (isStringArray$1(config.args)) server.args = config.args;
 			const env = copyStringRecord(config.env);
 			if (env !== void 0) server.env = env;
 			if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -44420,11 +44811,11 @@ function applyGooseStdioFields(ext, config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") ext.cmd = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$2(config.args) ? config.args : [];
+		const args = isStringArray$1(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) ext.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		ext.cmd = command;
-		if (isStringArray$2(config.args)) ext.args = config.args;
+		if (isStringArray$1(config.args)) ext.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) ext.envs = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") ext.cwd = config.cwd;
@@ -44527,7 +44918,7 @@ function convertFromGooseFormat(extensions) {
 		else if (type === "streamable_http") server.type = "http";
 		else server.type = "stdio";
 		if (typeof ext.cmd === "string") server.command = ext.cmd;
-		if (isStringArray$2(ext.args)) server.args = ext.args;
+		if (isStringArray$1(ext.args)) server.args = ext.args;
 		if (isPlainObject$1(ext.envs)) server.env = omitPrototypePollutionKeys(ext.envs);
 		if (typeof ext.cwd === "string") server.cwd = ext.cwd;
 		if (typeof ext.uri === "string") server.url = ext.uri;
@@ -44549,11 +44940,11 @@ function buildGoosePluginStdioServer(config) {
 	if (Array.isArray(command)) {
 		if (typeof command[0] === "string") server.command = command[0];
 		const rest = command.slice(1).filter((c) => typeof c === "string");
-		const args = isStringArray$2(config.args) ? config.args : [];
+		const args = isStringArray$1(config.args) ? config.args : [];
 		if (rest.length > 0 || args.length > 0) server.args = [...rest, ...args];
 	} else if (typeof command === "string") {
 		server.command = command;
-		if (isStringArray$2(config.args)) server.args = config.args;
+		if (isStringArray$1(config.args)) server.args = config.args;
 	}
 	if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 	if (typeof config.cwd === "string") server.cwd = config.cwd;
@@ -44961,7 +45352,7 @@ function copyHermesOauth(source) {
 	if (!isRecord$1(source)) return;
 	const oauth = {};
 	for (const key of HERMES_OAUTH_STRING_KEYS) if (typeof source[key] === "string") oauth[key] = source[key];
-	if (typeof oauth.scope !== "string" && isStringArray$2(source.scopes)) oauth.scope = source.scopes.join(" ");
+	if (typeof oauth.scope !== "string" && isStringArray$1(source.scopes)) oauth.scope = source.scopes.join(" ");
 	for (const key of ["redirect_port", "timeout"]) if (typeof source[key] === "number") oauth[key] = source[key];
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
@@ -44988,7 +45379,7 @@ function copyHermesAdvancedFields(source, target) {
 		target.auth = source.auth;
 		copied = true;
 	}
-	if (typeof source.client_cert === "string" || isStringArray$2(source.client_cert)) {
+	if (typeof source.client_cert === "string" || isStringArray$1(source.client_cert)) {
 		target.client_cert = source.client_cert;
 		copied = true;
 	}
@@ -45060,8 +45451,8 @@ function copyHermesAdvancedFields(source, target) {
 */
 function buildHermesToolsBlock(config) {
 	const tools = {};
-	if (isStringArray$2(config.enabledTools)) tools.include = config.enabledTools;
-	if (isStringArray$2(config.disabledTools)) tools.exclude = config.disabledTools;
+	if (isStringArray$1(config.enabledTools)) tools.include = config.enabledTools;
+	if (isStringArray$1(config.disabledTools)) tools.exclude = config.disabledTools;
 	if (typeof config.promptsEnabled === "boolean") tools.prompts = config.promptsEnabled;
 	if (typeof config.resourcesEnabled === "boolean") tools.resources = config.resourcesEnabled;
 	return tools;
@@ -45073,8 +45464,8 @@ function buildHermesToolsBlock(config) {
 * `promptsEnabled`/`resourcesEnabled` top-level toggles.
 */
 function applyHermesToolsBlock(hermesTools, server) {
-	if (isStringArray$2(hermesTools.include)) server.enabledTools = hermesTools.include;
-	if (isStringArray$2(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
+	if (isStringArray$1(hermesTools.include)) server.enabledTools = hermesTools.include;
+	if (isStringArray$1(hermesTools.exclude)) server.disabledTools = hermesTools.exclude;
 	if (typeof hermesTools.prompts === "boolean") server.promptsEnabled = hermesTools.prompts;
 	if (typeof hermesTools.resources === "boolean") server.resourcesEnabled = hermesTools.resources;
 }
@@ -45100,11 +45491,11 @@ function convertServerToHermes(config) {
 		if (Array.isArray(command)) {
 			if (typeof command[0] === "string") out.command = command[0];
 			const rest = command.slice(1).filter((c) => typeof c === "string");
-			const args = isStringArray$2(config.args) ? config.args : [];
+			const args = isStringArray$1(config.args) ? config.args : [];
 			if (rest.length > 0 || args.length > 0) out.args = [...rest, ...args];
 		} else if (typeof command === "string") {
 			out.command = command;
-			if (isStringArray$2(config.args)) out.args = config.args;
+			if (isStringArray$1(config.args)) out.args = config.args;
 		}
 		if (isPlainObject$1(config.env)) out.env = omitPrototypePollutionKeys(config.env);
 	} else if (url !== void 0) {
@@ -45154,7 +45545,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const server = {};
 		if (typeof config.command === "string") server.command = config.command;
-		if (isStringArray$2(config.args)) server.args = config.args;
+		if (isStringArray$1(config.args)) server.args = config.args;
 		if (isPlainObject$1(config.env)) server.env = omitPrototypePollutionKeys(config.env);
 		if (typeof config.url === "string") server.url = config.url;
 		if (isPlainObject$1(config.headers)) server.headers = omitPrototypePollutionKeys(config.headers);
@@ -46346,7 +46737,7 @@ function mergeToolLists(...lists) {
 function toKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		const { kiroAutoApprove, kiroAutoBlock, disabledTools, ...rest } = server;
-		const autoApprove = mergeToolLists(isStringArray$2(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
+		const autoApprove = mergeToolLists(isStringArray$1(rest.autoApprove) ? rest.autoApprove : void 0, kiroAutoApprove);
 		const disabled = mergeToolLists(disabledTools, kiroAutoBlock);
 		return [name, {
 			...rest,
@@ -46370,7 +46761,7 @@ function fromKiroMcpServers(servers) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		if (server === null || typeof server !== "object" || Array.isArray(server)) return [name, server];
 		const { autoApprove, ...rest } = server;
-		if (!isStringArray$2(autoApprove)) return [name, server];
+		if (!isStringArray$1(autoApprove)) return [name, server];
 		return [name, {
 			...rest,
 			kiroAutoApprove: autoApprove
@@ -47799,7 +48190,7 @@ function headersRecordToPoolList(headers) {
 	return Object.entries(headers).map(([name, value]) => `${name}: ${value}`);
 }
 function poolHeadersListToRecord(serverName, headers) {
-	if (!isStringArray$2(headers)) return void 0;
+	if (!isStringArray$1(headers)) return void 0;
 	const result = {};
 	for (const entry of headers) {
 		const separator = entry.indexOf(":");
@@ -47825,7 +48216,7 @@ const GLOB_METACHARACTERS = /[*?[]/;
 /** Patterns named in the glob warning before the rest collapse to `(+N more)`. */
 const MAX_LISTED_GLOB_PATTERNS = 10;
 function importPoolToolList({ serverName, poolKey, value, warnOnGlobs }) {
-	if (!isStringArray$2(value)) {
+	if (!isStringArray$1(value)) {
 		warnWithFallback(void 0, `Ignored malformed value for ${poolKey} in Pool MCP server ${quoteValueForWarning(serverName)}: expected a list of strings`);
 		return;
 	}
@@ -48035,7 +48426,7 @@ var PoolMcp = class PoolMcp extends ToolMcp {
 			const poolAllow = isRecord$1(rawServer) ? rawServer.poolAllow : void 0;
 			return [serverName, {
 				...serverConfig,
-				...isStringArray$2(poolAllow) && { poolAllow }
+				...isStringArray$1(poolAllow) && { poolAllow }
 			}];
 		})), logger);
 		return new PoolMcp({
@@ -48266,7 +48657,7 @@ function pickServerLists(source) {
 	if (!isPlainObject$1(source)) return {};
 	return Object.fromEntries(QWENCODE_MCP_SERVER_LIST_KEYS.flatMap((key) => {
 		const value = source[key];
-		return isStringArray$2(value) ? [[key, value]] : [];
+		return isStringArray$1(value) ? [[key, value]] : [];
 	}));
 }
 /**
@@ -48959,7 +49350,7 @@ async function resolveRovodevMcpImportPath({ outputRoot, global, config, logger
 }
 function disabledNamesOf(config) {
 	const mcpBlock = config && isRecord$1(config.mcp) ? config.mcp : {};
-	return isStringArray$2(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
+	return isStringArray$1(mcpBlock.disabledMcpServers) ? mcpBlock.disabledMcpServers : [];
 }
 /**
 * The value `mcp.mcpConfigPath` needs so Rovo Dev reads the `mcp.json` rulesync
@@ -49375,7 +49766,7 @@ var RovodevMcp = class RovodevMcp extends ToolMcp {
 			return [];
 		}
 		const existingMcp = isRecord$1(existingParsed.mcp) ? { ...existingParsed.mcp } : {};
-		const existingDisabled = isStringArray$2(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
+		const existingDisabled = isStringArray$1(existingMcp.disabledMcpServers) ? existingMcp.disabledMcpServers : [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
 		if (reEnabled.length > 0) logger?.warn(`Rovo Dev MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
@@ -56534,8 +56925,9 @@ function convertClaudeToRulesyncPermissions(params) {
 //#endregion
 //#region src/features/permissions/cline-permissions.ts
 /**
-* Cline CLI loads command permissions from the `CLINE_COMMAND_PERMISSIONS` environment variable.
-* Cline supports only `allow` and `deny` (no `ask`), and only for shell commands.
+* The legacy Cline CLI loaded command permissions from the `CLINE_COMMAND_PERMISSIONS`
+* environment variable. It supported only `allow` and `deny` (no `ask`), and only for
+* shell commands.
 * Schema:
 * ```json
 * { "allow": ["pattern1", ...], "deny": ["pattern2", ...], "allowRedirects": false }
@@ -56543,7 +56935,14 @@ function convertClaudeToRulesyncPermissions(params) {
 *
 * Rulesync writes the JSON to `.cline/command-permissions.json` so users can do:
 * `export CLINE_COMMAND_PERMISSIONS=$(cat .cline/command-permissions.json)`
+*
+* Deprecated: no Cline CLI 3 release reads `CLINE_COMMAND_PERMISSIONS`. Upstream removed
+* it from the docs in cline/cline@6354d209, and the CLI reference now says the CLI has no
+* allow or deny list for shell commands and recommends a `PreToolUse` hook instead
+* (https://docs.cline.bot/cli/cli-reference). The output is still generated for
+* compatibility, with a deprecation warning on every generation.
 */
+const CLINE_PERMISSIONS_DEPRECATION_WARNING = "The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. Note that a hook returning `cancel: true` stops the whole Cline task, not just that one tool call (https://github.com/cline/cline/issues/14697). See https://docs.cline.bot/cli/cli-reference.";
 const ClineCommandPermissionsSchema = zod_mini.z.looseObject({
 	allow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
@@ -56661,6 +57060,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = false, logger }) {
+		logger?.warn(CLINE_PERMISSIONS_DEPRECATION_WARNING);
 		const paths = ClinePermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
@@ -56690,7 +57090,7 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 		const mergedDeny = (0, es_toolkit.uniq)([...existing.deny ?? [], ...dedupedDeny]).toSorted();
 		const denySet = new Set(mergedDeny);
 		const collisions = dedupedAllow.filter((p) => denySet.has(p));
-		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. Cline documents that deny rules always take precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
+		if (collisions.length > 0) logger?.warn(`Cline command permissions: pattern(s) ${collisions.map((p) => `'${p}'`).join(", ")} appear in both 'allow' and 'deny'. The legacy Cline CLI gave deny rules precedence, so the 'allow' entry has no effect. Consider removing the duplicate rule.`);
 		const next = {
 			...existing,
 			allow: dedupedAllow,
@@ -59973,9 +60373,9 @@ function managedContinueToolNames(config) {
 */
 function parseContinuePermissionLists(parsed) {
 	return {
-		exclude: isStringArray$2(parsed.exclude) ? parsed.exclude : [],
-		ask: isStringArray$2(parsed.ask) ? parsed.ask : [],
-		allow: isStringArray$2(parsed.allow) ? parsed.allow : []
+		exclude: isStringArray$1(parsed.exclude) ? parsed.exclude : [],
+		ask: isStringArray$1(parsed.ask) ? parsed.ask : [],
+		allow: isStringArray$1(parsed.allow) ? parsed.allow : []
 	};
 }
 /**
@@ -60058,6 +60458,193 @@ const AUTO_APPROVE_KEYS = {
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
 const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+/**
+* The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
+* at path `a.b` is written to `chat.agent.sandbox.a.b`.
+*/
+const SANDBOX_KEY_PREFIX = "chat.agent.sandbox.";
+/**
+* The `copilot.sandbox` leaves rulesync manages, each a flat VS Code setting
+* (`SANDBOX_KEY_PREFIX` + the dotted path) with the value shape VS Code
+* registers for it. The shape is re-checked on import, so a hand-written value
+* VS Code would not accept is skipped instead of failing the whole import.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const SANDBOX_LEAVES = [
+	{
+		path: ["enabled"],
+		schema: CopilotSandboxEnabledSchema,
+		normalize: (value) => value === true ? "on" : value === false ? "off" : value
+	},
+	{
+		path: ["network", "allowNetwork"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["mcpServers"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["lspServers"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["fileSystem", "userConfiguredPaths"],
+		schema: CopilotSandboxUserConfiguredPathsSchema
+	}
+];
+const USER_CONFIGURED_PATHS_KEY = `${SANDBOX_KEY_PREFIX}fileSystem.userConfiguredPaths`;
+/**
+* `copilot.sandbox` values that loosen the Agent Host sandbox. They are still
+* written — a sandbox policy is the user's call — but never silently. Each
+* `widens` names the value that does *not* loosen anything and reports the
+* rest, so an unexpected value is reported rather than ignored.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+*/
+const COPILOT_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox off, so agent terminal commands run unconfined",
+		widens: (value) => value !== "on"
+	},
+	{
+		path: ["network", "allowNetwork"],
+		reason: "lets sandboxed commands reach the external network",
+		widens: isNotFalse
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		reason: "lets sandboxed commands reach local network resources",
+		widens: isNotFalse
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "lets the agent ask to run a blocked command outside the sandbox",
+		widens: isNotFalse
+	},
+	{
+		path: ["mcpServers"],
+		reason: "runs locally launched MCP servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["lspServers"],
+		reason: "runs language servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		reason: "hands your Git credentials to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		reason: "hands your GitHub CLI authentication to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		reason: "grants sandboxed commands developer-tool directories, which can hold credentials such as registry tokens",
+		widens: isNotFalse
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readwritePaths"
+		],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: isNonEmptyList
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readonlyPaths"
+		],
+		reason: "adds paths sandboxed commands may read, outside the working directory",
+		widens: isNonEmptyList
+	}
+];
+const COPILOT_TOOL_LABEL = "GitHub Copilot";
+function sandboxKey(path) {
+	return `${SANDBOX_KEY_PREFIX}${path.join(".")}`;
+}
+/**
+* Patch entries for every `copilot.sandbox` leaf the canonical config states.
+* Leaves it does not state are left as the file has them, so authoring only
+* `network.allowNetwork` never disturbs a hand-written `enabled`. The
+* `userConfiguredPaths` object merges per list for the same reason: authoring
+* `readwritePaths` keeps a hand-written `deniedPaths`, which would otherwise be
+* a restriction lost without a word.
+*/
+function buildSandboxPatch({ sandbox, existingSettings }) {
+	const patch = {};
+	for (const { path } of SANDBOX_LEAVES) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0 || value === UNREADABLE_SANDBOX_PATH) continue;
+		const key = sandboxKey(path);
+		if (key === USER_CONFIGURED_PATHS_KEY && isPlainObject$1(value)) {
+			const existing = existingSettings[key];
+			patch[key] = {
+				...isPlainObject$1(existing) ? existing : {},
+				...value
+			};
+			continue;
+		}
+		patch[key] = value;
+	}
+	return patch;
+}
+/**
+* Lift every managed `chat.agent.sandbox.*` key the file holds back into a
+* nested `copilot.sandbox` object. A value whose shape VS Code would reject is
+* skipped; the write path leaves it in place.
+*/
+function readSandboxFromSettings(settings) {
+	const sandbox = {};
+	for (const { path, schema, normalize } of SANDBOX_LEAVES) {
+		const value = settings[sandboxKey(path)];
+		const parsed = schema.safeParse(normalize === void 0 ? value : normalize(value));
+		if (!parsed.success) continue;
+		let cursor = sandbox;
+		for (const segment of path.slice(0, -1)) {
+			const next = cursor[segment];
+			const child = isPlainObject$1(next) ? next : {};
+			cursor[segment] = child;
+			cursor = child;
+		}
+		const leaf = path[path.length - 1];
+		if (leaf !== void 0) cursor[leaf] = parsed.data;
+	}
+	return Object.keys(sandbox).length > 0 ? sandbox : void 0;
+}
 function isCopilotDefaultPermissionMode(value) {
 	return COPILOT_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
 }
@@ -60102,7 +60689,9 @@ function buildAutoApproveValue(rules) {
 * hand-written edits or urls map.
 * The `copilot.defaultPermissionMode` override writes `chat.permissions.default`
 * (the starting permission level of new chat sessions); without it the key is
-* left untouched.
+* left untouched. The `copilot.sandbox` override writes the Agent Host sandbox
+* settings (`chat.agent.sandbox.*`, see {@link SANDBOX_LEAVES}) per key, and
+* warns about every value it writes that loosens the sandbox.
 * Only project scope is modeled: VS Code's user-scope settings.json lives at a
 * platform-dependent path outside rulesync's home-relative global model.
 */
@@ -60150,6 +60739,26 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
 		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		const sandbox = config.copilot?.sandbox;
+		if (sandbox !== void 0) {
+			Object.assign(patch, buildSandboxPatch({
+				sandbox,
+				existingSettings: parseSharedConfig({
+					format: "jsonc",
+					fileContent: existingContent,
+					filePath
+				})
+			}));
+			warnOnTrustAffectingEntries({
+				toolLabel: COPILOT_TOOL_LABEL,
+				entries: collectTrustAffectingSandboxPaths({
+					sandbox,
+					paths: COPILOT_TRUST_AFFECTING_SANDBOX_PATHS
+				}),
+				relativeFilePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath),
+				logger
+			});
+		}
 		return new CopilotPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -60186,9 +60795,14 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const sandbox = readSandboxFromSettings(settings);
+		const copilot = {
+			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
+			...sandbox !== void 0 && { sandbox }
+		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
 			permission,
-			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { copilot: { defaultPermissionMode } }
+			...Object.keys(copilot).length > 0 && { copilot }
 		}, null, 2) });
 	}
 	validate() {
@@ -60502,8 +61116,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 			logger
 		});
 		const managedToolNames = managedCrushToolNames(config);
-		const preservedAllowed = (isStringArray$2(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
-		const preservedDisabled = (isStringArray$2(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
+		const preservedAllowed = (isStringArray$1(existingPermissions?.["allowed_tools"]) ? existingPermissions[CRUSH_ALLOWED_TOOLS_KEY] : []).filter((entry) => entry.includes(":") || !managedToolNames.has(entry));
+		const preservedDisabled = (isStringArray$1(existingOptions?.["disabled_tools"]) ? existingOptions[CRUSH_DISABLED_TOOLS_KEY] : []).filter((entry) => !managedToolNames.has(entry));
 		const allowedList = uniq$11([...preservedAllowed, ...generated.allowed]);
 		const disabledList = uniq$11([...preservedDisabled, ...generated.disabled]);
 		const patch = {};
@@ -60529,8 +61143,8 @@ var CrushPermissions = class CrushPermissions extends ToolPermissions {
 		const permissions = isRecord$1(this.json["permissions"]) ? this.json[CRUSH_PERMISSIONS_KEY] : {};
 		const options = isRecord$1(this.json["options"]) ? this.json[CRUSH_OPTIONS_KEY] : {};
 		const rulesyncConfig = convertCrushListsToRulesync({
-			allowed: isStringArray$2(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
-			disabled: isStringArray$2(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
+			allowed: isStringArray$1(permissions["allowed_tools"]) ? permissions[CRUSH_ALLOWED_TOOLS_KEY] : [],
+			disabled: isStringArray$1(options["disabled_tools"]) ? options[CRUSH_DISABLED_TOOLS_KEY] : []
 		});
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
@@ -62705,7 +63319,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 function convertGoosePermissionConfigToRulesync(userPermission) {
 	const permission = {};
 	for (const key of GOOSE_PERMISSION_LIST_KEYS) {
-		const toolNames = isStringArray$2(userPermission[key]) ? userPermission[key] : [];
+		const toolNames = isStringArray$1(userPermission[key]) ? userPermission[key] : [];
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
@@ -63053,7 +63667,7 @@ const ACTION_RANK$3 = {
 * (mirrors the Cursor adapter's preservation of unmanaged types).
 */
 function unmanagedEntries(existingPermission, key) {
-	return (isStringArray$2(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
+	return (isStringArray$1(existingPermission[key]) ? existingPermission[key] : []).filter((entry) => parseGrokEntry(entry) === null);
 }
 /**
 * Bucket canonical rules into Grok's `[permission]` allow/deny/ask arrays of
@@ -63110,7 +63724,7 @@ function warnRemovedAllToolsRestrictions({ existingPermission, ranked, logger })
 	const generated = ranked.get(GROK_ALL_TOOLS_ENTRY);
 	for (const action of ["deny", "ask"]) {
 		const entries = existingPermission[action];
-		if (!isStringArray$2(entries)) continue;
+		if (!isStringArray$1(entries)) continue;
 		if (!entries.some((entry) => parseGrokEntry(entry)?.category === "*")) continue;
 		if (generated !== void 0 && ACTION_RANK$3[generated] >= ACTION_RANK$3[action]) continue;
 		logger.warn(`Grok CLI permissions: removing the existing bare '*' entry from the '${action}' array — Rulesync now manages it through the all-tools '*' category, and the canonical config has no '*' '${action}' rule. Add "*": { "*": "${action}" } to keep restricting every tool.`);
@@ -63141,9 +63755,9 @@ function warnEntriesShadowedByAllTools({ ranked, logger }) {
 * described more than once resolves to the strictest action.
 */
 function parseGrokPermissionArrays(permission) {
-	const allow = isStringArray$2(permission.allow) ? permission.allow : void 0;
-	const deny = isStringArray$2(permission.deny) ? permission.deny : void 0;
-	const ask = isStringArray$2(permission.ask) ? permission.ask : void 0;
+	const allow = isStringArray$1(permission.allow) ? permission.allow : void 0;
+	const deny = isStringArray$1(permission.deny) ? permission.deny : void 0;
+	const ask = isStringArray$1(permission.ask) ? permission.ask : void 0;
 	const rules = Array.isArray(permission[GROKCLI_PERMISSION_RULES_KEY]) ? permission[GROKCLI_PERMISSION_RULES_KEY] : void 0;
 	if ((allow?.length ?? 0) + (deny?.length ?? 0) + (ask?.length ?? 0) + (rules?.length ?? 0) === 0) return null;
 	const result = {};
@@ -63351,20 +63965,20 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		const permission = clonePermissionBlock(provenance.permission);
 		reconcileCommandAllowlist({
 			permission,
-			commandAllowlist: isStringArray$2(config.command_allowlist) ? config.command_allowlist : []
+			commandAllowlist: isStringArray$1(config.command_allowlist) ? config.command_allowlist : []
 		});
 		const approvals = isRecord$1(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
 			permission,
 			category: SHELL_PERMISSION_CATEGORY,
-			patterns: isStringArray$2(approvals.deny) ? approvals.deny : []
+			patterns: isStringArray$1(approvals.deny) ? approvals.deny : []
 		});
 		const security = isRecord$1(config.security) ? config.security : {};
 		const websiteBlocklist = isRecord$1(security.website_blocklist) ? security.website_blocklist : {};
 		reconcileNativeDenies({
 			permission,
 			category: WEBFETCH_PERMISSION_CATEGORY,
-			patterns: websiteBlocklist.enabled === true && isStringArray$2(websiteBlocklist.domains) ? websiteBlocklist.domains : []
+			patterns: websiteBlocklist.enabled === true && isStringArray$1(websiteBlocklist.domains) ? websiteBlocklist.domains : []
 		});
 		removeEmptyCategories(permission);
 		const { permission: _permission, hermes: _hermes, ...otherProvenance } = provenance;
@@ -64758,13 +65372,13 @@ function classifyExistingEntry({ emitted, capability, pattern, effect }) {
 * how many entries rulesync does not generate.
 */
 function mergeExistingRule({ rule, emitted, logger }) {
-	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$2(rule.match)) return {
+	if (!isRecord$1(rule) || typeof rule.capability !== "string" || rule.exclude !== void 0 || !MANAGED_CAPABILITIES.has(rule.capability) || rule.match !== void 0 && !isStringArray$1(rule.match)) return {
 		rule,
 		unrelatedEntries: 0
 	};
 	const capability = rule.capability;
 	const isCatchAll = rule.match === void 0;
-	const patterns = isStringArray$2(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
+	const patterns = isStringArray$1(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
 	if (patterns.length === 0) return {
 		rule,
 		unrelatedEntries: 0
@@ -64948,7 +65562,7 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 		for (const rule of rules) {
 			if (!isImportableRule(rule) || !isRecord$1(rule) || !isPermissionAction$1(rule.effect)) continue;
 			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
-			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$2(rule.match) ? rule.match : [];
+			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$1(rule.match) ? rule.match : [];
 			const categoryRules = permission[category] ??= {};
 			for (const pattern of patterns) {
 				const previous = categoryRules[pattern];
@@ -66666,8 +67280,8 @@ function importPoolTool({ toolConfig, bucket }) {
 		bucket[CATCH_ALL_PATTERN$3] = "deny";
 		return;
 	}
-	const denied = isStringArray$2(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
-	const allowed = isStringArray$2(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
+	const denied = isStringArray$1(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
+	const allowed = isStringArray$1(toolConfig[POOL_ALLOW_KEY]) ? toolConfig[POOL_ALLOW_KEY] : [];
 	for (const pattern of denied.filter(isUsablePattern)) bucket[pattern] = "deny";
 	for (const pattern of allowed.filter(isUsablePattern)) bucket[pattern] ??= "allow";
 }
@@ -68872,7 +69486,7 @@ function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 		permission[category] ??= {};
 		permission[category][CATCH_ALL_PATTERN$1] = levels.reduce((strictest, level) => strictestAction(strictest, level ?? implicitLevel), permission[category][CATCH_ALL_PATTERN$1]);
 	}
-	if (isStringArray$2(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
+	if (isStringArray$1(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
 		permission.read[path] ??= "allow";
 	}
@@ -69128,7 +69742,7 @@ function stripRefusedOverridePaths(override) {
 */
 function collectTrustAffectingOverrideEntries({ tools, general }) {
 	const entries = [];
-	const allowed = isStringArray$2(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
+	const allowed = isStringArray$1(tools[ALLOWED_KEY]) ? tools[ALLOWED_KEY] : [];
 	if (allowed.length > 0) entries.push({
 		label: `tools.allowed (${allowed.map(quoteValueForWarning).join(", ")})`,
 		reason: "auto-approves what it names as the override spells it; a non-shell entry is only checked against a whole-tool deny of its tool"
@@ -69279,7 +69893,7 @@ function withholdDeniedOverrideAllowed({ overrideVerbatimAllowed, exclude, logge
 * hand-written entry went.
 */
 function reportDroppedManagedEntries({ existingTools, allowedList, excludeList, logger }) {
-	const dropped = (key, list) => (0, es_toolkit.uniq)(isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+	const dropped = (key, list) => (0, es_toolkit.uniq)(isStringArray$1(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
 		if (list.includes(entry)) return false;
 		const toolName = parseTabnineEntry(entry)?.toolName;
 		return toolName === void 0 || !list.includes(toolName);
@@ -69361,7 +69975,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		}
 		const overrideList = (key) => {
 			const value = overrideTools[key];
-			if (value === void 0 || isStringArray$2(value)) return value ?? [];
+			if (value === void 0 || isStringArray$1(value)) return value ?? [];
 			warnWithFallback(logger, `Tabnine CLI permissions: ignored tools.${key} of the tabnine override (${quoteValueForWarning(value)}); it must be a list of tool names.`);
 			return [];
 		};
@@ -69399,7 +70013,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 		if (ignoredOverrideKeys.length > 0) warnWithFallback(logger, `Tabnine CLI permissions: ignored ${ignoredOverrideKeys.length} key(s) of the tabnine override (${ignoredOverrideKeys.map(quoteValueForWarning).join(", ")}); only 'tools' and 'general' are written through the permissions feature.`);
 		const existingTools = this.existingToolsGroup(existingContent);
 		const managedToolNames = new Set(Object.keys(config.permission).map((category) => category === "bash" || category === "*" ? SHELL_TOOL_NAME : toTabnineToolName(category)));
-		const preservedEntries = (key) => (isStringArray$2(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
+		const preservedEntries = (key) => (isStringArray$1(existingTools?.[key]) ? existingTools[key] : []).filter((entry) => {
 			const toolName = parseTabnineEntry(entry)?.toolName;
 			return toolName === void 0 || !managedToolNames.has(toolName);
 		});
@@ -69477,7 +70091,7 @@ var TabninePermissions = class TabninePermissions extends ToolPermissions {
 			if (rules !== void 0 && !Object.hasOwn(rules, pattern)) rules[pattern] = action;
 		};
 		for (const [key, action] of [[EXCLUDE_KEY, "deny"], [ALLOWED_KEY, "allow"]]) {
-			const entries = isStringArray$2(tools[key]) ? tools[key] : [];
+			const entries = isStringArray$1(tools[key]) ? tools[key] : [];
 			for (const entry of entries) {
 				const parsed = parseTabnineEntry(entry);
 				if (parsed === void 0) {
@@ -70345,12 +70959,12 @@ const WIDE_CHARACTERS_PATTERN = /\p{Emoji_Presentation}|\p{Emoji_Modifier_Base}|
 * The ranges are the `East_Asian_Width=A` property of Unicode 17.0, taken from
 * the table `get-east-asian-width` 1.6.0 carries and merged where two are
 * adjacent. The table is written out here rather than read from the package so
-* that the one lookup adds no dependency of its own, and the drift test in
-* `display-width.test.ts` is what keeps it honest: it loads the package through
-* the prompt renderer that already depends on it, walks every code point, and
-* fails when this table and the property disagree in either direction. When
-* the renderer's copy moves to a newer Unicode, that test is what fails, and
-* the table is regenerated from the new property — its ranges, marks aside,
+* that the one lookup adds no runtime dependency of its own, and the drift test
+* in `display-width.test.ts` is what keeps it honest: it loads the package,
+* pinned as a dev dependency, walks every code point, and fails when this
+* table and the property disagree in either direction. When that pin moves to
+* a newer Unicode, that test is what fails, and the table is regenerated from
+* the new property — its ranges, marks aside,
 * merged where adjacent and written as escapes — with the version named here.
 *
 * Three stretches of the property are left out because they never reach this
@@ -72099,8 +72713,8 @@ var WarpPermissions = class WarpPermissions extends ToolPermissions {
 		const executionProfiles = isRecord$1(agents["execution_profiles"]) ? agents[EXECUTION_PROFILES_KEY] : void 0;
 		const defaultProfile = executionProfiles && isRecord$1(executionProfiles["default"]) ? executionProfiles[DEFAULT_PROFILE_KEY] : void 0;
 		const config = convertWarpToRulesyncPermissions({
-			allow: defaultProfile ? isStringArray$2(defaultProfile["command_allowlist"]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$2(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
-			deny: defaultProfile ? isStringArray$2(defaultProfile["command_denylist"]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$2(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
+			allow: defaultProfile ? isStringArray$1(defaultProfile["command_allowlist"]) ? defaultProfile[PROFILE_ALLOWLIST_KEY] : [] : isStringArray$1(profiles[ALLOWLIST_KEY]) ? profiles[ALLOWLIST_KEY] : [],
+			deny: defaultProfile ? isStringArray$1(defaultProfile["command_denylist"]) ? defaultProfile[PROFILE_DENYLIST_KEY] : [] : isStringArray$1(profiles[DENYLIST_KEY]) ? profiles[DENYLIST_KEY] : []
 		});
 		const warpOverride = {};
 		for (const key of WARP_OVERRIDE_KEYS) if (profiles[key] !== void 0) warpOverride[key] = profiles[key];
@@ -72630,8 +73244,8 @@ var WarpcliPermissions = class WarpcliPermissions extends ToolPermissions {
 		const allowlist = defaultProfile[PROFILE_ALLOWLIST_KEY];
 		const denylist = defaultProfile[PROFILE_DENYLIST_KEY];
 		const config = convertWarpToRulesyncPermissions({
-			allow: isStringArray$2(allowlist) ? allowlist : [],
-			deny: isStringArray$2(denylist) ? denylist : []
+			allow: isStringArray$1(allowlist) ? allowlist : [],
+			deny: isStringArray$1(denylist) ? denylist : []
 		});
 		const executionProfileOverride = liftExecutionProfileOverride(defaultProfile);
 		const warpcliOverride = {};
@@ -84646,7 +85260,7 @@ var BobSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const bobSection = isRecord$1(frontmatter.bob) ? frontmatter.bob : {};
-		if (isStringArray$2(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
+		if (isStringArray$1(bobSection.allowedSubagents)) mode.allowedSubagents = bobSection.allowedSubagents;
 		return mode;
 	}
 };
@@ -90101,7 +90715,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 		const mode = super.toRooMode(rulesyncSubagent);
 		const frontmatter = rulesyncSubagent.getFrontmatter();
 		const zoocodeSection = isRecord$1(frontmatter.zoocode) ? frontmatter.zoocode : {};
-		if (isStringArray$2(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
+		if (isStringArray$1(zoocodeSection.allowedMcpServers)) mode.allowedMcpServers = zoocodeSection.allowedMcpServers;
 		return mode;
 	}
 	toRulesyncSubagents() {
@@ -90113,7 +90727,7 @@ var ZoocodeSubagent = class extends RooSubagent {
 				targets: ["zoocode"],
 				roo: restRooSection
 			};
-			if (isStringArray$2(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
+			if (isStringArray$1(allowedMcpServers)) rebuilt.zoocode = { allowedMcpServers };
 			return new RulesyncSubagent({
 				outputRoot: ".",
 				frontmatter: rebuilt,
@@ -94054,7 +94668,8 @@ var NestedAgentsmdRule = class extends ToolRule {
 * `<subprojectPath>/AGENTS.md` (project scope only); every other non-root rule
 * folds into the root `AGENTS.md`, since Codex has no modular rules directory.
 * The project files on the root-to-cwd chain share one `project_doc_max_bytes`
-* budget (32 KiB by default), which the RulesProcessor warns about.
+* budget (32 KiB by default, or the value set in the project's
+* `.codex/config.toml`), which the RulesProcessor warns about.
 *
 * @see https://learn.chatgpt.com/docs/agent-configuration/agents-md
 */
@@ -94066,6 +94681,29 @@ var CodexcliRule = class extends NestedAgentsmdRule {
 		};
 	}
 };
+/**
+* Read the `project_doc_max_bytes` value set in the project's
+* `.codex/config.toml`, which Codex loads for trusted projects and which
+* overrides the 32 KiB default budget for project `AGENTS.md` files.
+*
+* Answers `undefined` when the file is missing, is not valid TOML, or does not
+* set the key to a positive integer, so the caller falls back to the default.
+*
+* @see https://learn.chatgpt.com/docs/config-file/config-reference
+*/
+async function readCodexcliProjectDocMaxBytes(outputRoot) {
+	const content = await readFileContentOrNull((0, node_path.join)(outputRoot, CODEXCLI_DIR, CODEXCLI_MCP_FILE_NAME));
+	if (content === null) return;
+	let parsed;
+	try {
+		parsed = smol_toml.parse(content);
+	} catch {
+		return;
+	}
+	if (!isPlainObject$1(parsed)) return;
+	const value = parsed.project_doc_max_bytes;
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
 //#endregion
 //#region src/features/rules/commandcode-rule.ts
 var CommandcodeRule = class CommandcodeRule extends ToolRule {
@@ -99440,7 +100078,10 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold",
 			projectInstructionBudget: {
 				bytes: CODEXCLI_PROJECT_DOC_MAX_BYTES,
-				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (ignore this warning if you already have)."
+				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (Codex reads that file only if the project is trusted).",
+				readConfiguredBytes: readCodexcliProjectDocMaxBytes,
+				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml` (honored only if the project is trusted)",
+				defaultLimitHint: "Rulesync does not read `~/.codex/config.toml`; ignore this warning if you already raised `project_doc_max_bytes` there."
 			}
 		}
 	}],
@@ -99985,7 +100626,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			factory
 		});
 		await this.warnForWarpLegacyRootFile(toolRules);
-		this.warnForInstructionBudget({
+		await this.warnForInstructionBudget({
 			toolRules,
 			meta
 		});
@@ -100006,14 +100647,20 @@ var RulesProcessor = class extends FeatureProcessor {
 	* once, at its shallowest directory. With several output roots the warning
 	* names the root it refers to. An output root below the git root is measured
 	* without the parent directories' files Codex would also load, so the
-	* estimate can come out low there. The budget checked is the tool's default: a value
-	* raised by hand in the tool's own config is not read. Global scope is not
+	* estimate can come out low there. The budget checked is the value set in the
+	* output root's tool config when the tool supports one (Codex's
+	* `project_doc_max_bytes` in `.codex/config.toml`), else the tool's default;
+	* the warning names which one it used. Global scope is not
 	* checked because Codex loads the personal `~/.codex/AGENTS.md` outside the
 	* project budget.
 	*/
-	warnForInstructionBudget({ toolRules, meta }) {
+	async warnForInstructionBudget({ toolRules, meta }) {
 		const budget = meta.projectInstructionBudget;
 		if (budget === void 0 || this.global) return;
+		const configuredBytes = await budget.readConfiguredBytes?.(this.outputRoot);
+		const limitBytes = configuredBytes ?? budget.bytes;
+		const limitLabel = budget.readConfiguredBytes === void 0 ? `${limitBytes}-byte limit` : configuredBytes === void 0 ? `${limitBytes}-byte default limit` : `${limitBytes}-byte limit set by ${budget.configuredSource ?? "the tool config"}`;
+		const remedy = configuredBytes === void 0 && budget.defaultLimitHint !== void 0 ? `${budget.remedy} ${budget.defaultLimitHint}` : budget.remedy;
 		const files = toolRules.map((rule) => ({
 			dir: normalizeRelativeDir(rule.getRelativeDirPath()),
 			path: toPosixPath((0, node_path.join)(rule.getRelativeDirPath(), rule.getRelativeFilePath())),
@@ -100023,8 +100670,8 @@ var RulesProcessor = class extends FeatureProcessor {
 		const location = this.outputRoot === process.cwd() ? "" : ` under '${this.outputRoot}'`;
 		const rootFiles = files.filter(({ dir }) => dir === ".");
 		const rootBytes = rootFiles.reduce((sum, { bytes }) => sum + bytes, 0);
-		if (rootBytes > budget.bytes) {
-			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${budget.bytes}-byte limit. ${budget.remedy}`);
+		if (rootBytes > limitBytes) {
+			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${remedy}`);
 			return;
 		}
 		const reportedDirs = [];
@@ -100033,9 +100680,9 @@ var RulesProcessor = class extends FeatureProcessor {
 			if (reportedDirs.some((dir) => isAncestorOrSelf(dir, file.dir))) continue;
 			const chain = files.filter(({ dir }) => isAncestorOrSelf(dir, file.dir));
 			const chainBytes = chain.reduce((sum, { bytes }) => sum + bytes, 0);
-			if (chainBytes > budget.bytes) {
+			if (chainBytes > limitBytes) {
 				reportedDirs.push(file.dir);
-				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${budget.bytes}-byte limit (as is every directory below it). ${budget.remedy}`);
+				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${remedy}`);
 			}
 		}
 	}