rulesync 37.0.0 → 37.1.0

package/dist/{import-BPSwSahy.js → import-BsEFYJsg.js}

@@ -7895,14 +7895,53 @@ const COPILOT_DEFAULT_PERMISSION_MODES = [
 	"autoApprove",
 	"autopilot"
 ];
+/** `chat.agent.sandbox.enabled`: `"off"` or `"on"`. */
+const CopilotSandboxEnabledSchema = z.enum(["off", "on"]);
+/** `chat.agent.sandbox.fileSystem.userConfiguredPaths`. */
+const CopilotSandboxUserConfiguredPathsSchema = z.strictObject({
+	readwritePaths: z.optional(z.array(z.string())),
+	readonlyPaths: z.optional(z.array(z.string())),
+	deniedPaths: z.optional(z.array(z.string()))
+});
+/**
+* The Agent Host sandbox settings VS Code 1.141 settled on, as a nested object
+* whose path mirrors the dotted setting key under `chat.agent.sandbox.` — e.g.
+* `network.allowNetwork` writes `chat.agent.sandbox.network.allowNetwork`.
+* Only the documented, registered keys are accepted; the deprecated 1.138
+* shapes (`chat.agent.sandbox.allowNetwork`, `.fileSystem.linux|mac|windows`)
+* are not modeled, since the Agent Host ignores them.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const CopilotSandboxSchema = z.strictObject({
+	enabled: z.optional(CopilotSandboxEnabledSchema),
+	network: z.optional(z.strictObject({
+		allowNetwork: z.optional(z.boolean()),
+		allowLocalNetwork: z.optional(z.boolean())
+	})),
+	allowUnsandboxedCommands: z.optional(z.boolean()),
+	mcpServers: z.optional(z.boolean()),
+	lspServers: z.optional(z.boolean()),
+	credentials: z.optional(z.strictObject({
+		authenticategit: z.optional(z.boolean()),
+		authenticategh: z.optional(z.boolean())
+	})),
+	fileSystem: z.optional(z.strictObject({
+		allowDevToolAccess: z.optional(z.boolean()),
+		userConfiguredPaths: z.optional(CopilotSandboxUserConfiguredPathsSchema)
+	}))
+});
 /**
 * Tool-scoped override block for GitHub Copilot in VS Code.
 * `defaultPermissionMode` writes the workspace `chat.permissions.default`
-* setting, which has no canonical category.
+* setting, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
+* has a canonical category.
 */
 const CopilotPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
-	defaultPermissionMode: z.optional(z.enum(COPILOT_DEFAULT_PERMISSION_MODES))
+	defaultPermissionMode: z.optional(z.enum(COPILOT_DEFAULT_PERMISSION_MODES)),
+	sandbox: z.optional(CopilotSandboxSchema)
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
@@ -12874,6 +12913,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 				"chat.tools.edits.autoApprove",
 				"chat.tools.urls.autoApprove",
 				"chat.permissions.default",
+				"chat.agent.sandbox.enabled",
+				"chat.agent.sandbox.network.allowNetwork",
+				"chat.agent.sandbox.network.allowLocalNetwork",
+				"chat.agent.sandbox.allowUnsandboxedCommands",
+				"chat.agent.sandbox.mcpServers",
+				"chat.agent.sandbox.lspServers",
+				"chat.agent.sandbox.credentials.authenticategit",
+				"chat.agent.sandbox.credentials.authenticategh",
+				"chat.agent.sandbox.fileSystem.allowDevToolAccess",
+				"chat.agent.sandbox.fileSystem.userConfiguredPaths",
 				"zoo-code.allowedCommands",
 				"zoo-code.deniedCommands",
 				"roo-cline.allowedCommands",
@@ -28036,8 +28085,34 @@ function collectOwnedRefs({ generatedHooks, shape }) {
 	}
 	return owned;
 }
+/**
+* The merge keeps every unowned existing handler where it is. Some tools key
+* state by position — Codex CLI persists a hook's trust review under its event,
+* matcher group index and handler index — so moving a handler the user already
+* reviewed would silently change which hook that review belongs to. Hence:
+* - an unowned existing handler stays at its index;
+* - a newly generated handler is appended to the first existing group with its
+*   matcher and group-level keys, or in a new group after the existing ones;
+* - within a group, the slots rulesync's own handlers occupy (including the
+*   appended ones) are filled in generated order, so reordering the sources
+*   still reorders the generated handlers, which matters wherever handlers
+*   run in order (a Qwen Code `sequential` group, a Cursor list).
+*
+* A retracted handler, or a group left empty by retractions, is still removed,
+* which shifts whatever follows it in the same list; that is unavoidable
+* without leaving a placeholder behind.
+*/
 function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const merged = [...generated];
+	const pending = createPendingGenerated();
+	for (const group of generated) if (isMatcherGroup(group)) addPending({
+		pending,
+		handlers: group.hooks,
+		event,
+		matcher: matcherKey(group.matcher),
+		attributes: groupAttributesKey(group)
+	});
+	const merged = [];
+	const homes = /* @__PURE__ */ new Map();
 	for (const group of existing) {
 		if (!isMatcherGroup(group)) {
 			warnSkip({
@@ -28048,27 +28123,57 @@ function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned,
 			continue;
 		}
 		const matcher = matcherKey(group.matcher);
-		const preserved = group.hooks.filter((handler) => shouldPreserve({
-			handler,
+		const hooks = keepExistingHandlers({
+			handlers: group.hooks,
 			event,
 			matcher,
+			attributes: groupAttributesKey(group),
+			pending,
 			seen,
 			previouslyOwned,
 			logger
-		})).map((handler) => cloneHandler(handler));
-		if (preserved.length === 0) continue;
-		const attributes = groupAttributesKey(group);
-		const target = merged.find((candidate) => isMatcherGroup(candidate) && matcherKey(candidate.matcher) === matcher && groupAttributesKey(candidate) === attributes);
-		if (target !== void 0 && isMatcherGroup(target)) target.hooks.push(...preserved);
-		else merged.push({
+		});
+		if (hooks.length === 0) continue;
+		const kept = {
 			...omitPrototypePollutionKeys(group),
-			hooks: preserved
+			hooks
+		};
+		merged.push(kept);
+		const home = groupSlotKey(group);
+		if (!homes.has(home)) homes.set(home, kept);
+	}
+	for (const group of generated) {
+		if (!isMatcherGroup(group)) {
+			merged.push(group);
+			continue;
+		}
+		const remaining = group.hooks.filter((handler) => !pending.placed.has(handler));
+		if (remaining.length === 0) continue;
+		const home = homes.get(groupSlotKey(group));
+		if (home === void 0) merged.push({
+			...group,
+			hooks: remaining
 		});
+		else home.hooks.push(...remaining);
 	}
+	const order = generatedOrder(generated.flatMap((group) => isMatcherGroup(group) ? group.hooks : []));
+	for (const group of merged) if (isMatcherGroup(group)) orderGeneratedSlots({
+		handlers: group.hooks,
+		order
+	});
 	return merged;
 }
+/** The flat-list counterpart of {@link mergeMatcherGroups}, with the same positional rules. */
 function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const preserved = [];
+	const pending = createPendingGenerated();
+	addPending({
+		pending,
+		handlers: generated,
+		event,
+		matcher: void 0,
+		attributes: ""
+	});
+	const flat = [];
 	for (const handler of existing) {
 		if (isMatcherGroup(handler)) {
 			warnSkip({
@@ -28078,17 +28183,93 @@ function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned,
 			});
 			continue;
 		}
-		if (!shouldPreserve({
+		flat.push(handler);
+	}
+	const merged = keepExistingHandlers({
+		handlers: flat,
+		event,
+		matcher: void 0,
+		attributes: "",
+		pending,
+		seen,
+		previouslyOwned,
+		logger
+	});
+	merged.push(...generated.filter((handler) => !pending.placed.has(handler)));
+	orderGeneratedSlots({
+		handlers: merged,
+		order: generatedOrder(generated)
+	});
+	return merged;
+}
+/** Each generated handler's position in the generated list, by object identity. */
+function generatedOrder(handlers) {
+	const order = /* @__PURE__ */ new Map();
+	for (const [index, handler] of handlers.entries()) if (isPlainObject$1(handler)) order.set(handler, index);
+	return order;
+}
+/**
+* Rewrite, in place, the slots of `handlers` that hold generated handlers so
+* they follow the generated order. Every other slot — an unowned handler — is
+* left at its index.
+*/
+function orderGeneratedSlots({ handlers, order }) {
+	const slots = [];
+	for (const [index, handler] of handlers.entries()) if (order.has(handler)) slots.push(index);
+	const sorted = slots.map((index) => handlers[index]).toSorted((left, right) => (order.get(left) ?? 0) - (order.get(right) ?? 0));
+	for (const [position, index] of slots.entries()) handlers[index] = sorted[position];
+}
+function createPendingGenerated() {
+	return {
+		byKey: /* @__PURE__ */ new Map(),
+		placed: /* @__PURE__ */ new Set()
+	};
+}
+function addPending({ pending, handlers, event, matcher, attributes }) {
+	for (const handler of handlers) {
+		if (!isPlainObject$1(handler)) continue;
+		const key = pendingKey({
+			event,
+			matcher,
+			attributes,
+			handler
+		});
+		const queue = pending.byKey.get(key);
+		if (queue === void 0) pending.byKey.set(key, [handler]);
+		else queue.push(handler);
+	}
+}
+/**
+* Walk one existing list in order and decide each handler: replaced in place
+* by its generated copy, kept as unowned, or dropped (retracted or duplicate).
+*/
+function keepExistingHandlers({ handlers, event, matcher, attributes, pending, seen, previouslyOwned, logger }) {
+	const kept = [];
+	for (const handler of handlers) {
+		if (isPlainObject$1(handler)) {
+			const key = pendingKey({
+				event,
+				matcher,
+				attributes,
+				handler
+			});
+			const generated = pending.byKey.get(key)?.shift();
+			if (generated !== void 0) {
+				pending.placed.add(generated);
+				kept.push(generated);
+				continue;
+			}
+		}
+		if (shouldPreserve({
 			handler,
 			event,
-			matcher: void 0,
+			matcher,
 			seen,
 			previouslyOwned,
 			logger
-		})) continue;
-		preserved.push(cloneHandler(handler));
+		})) kept.push(cloneHandler(handler));
 	}
-	return [...generated, ...preserved];
+	return kept;
 }
 function isMatcherGroup(value) {
 	return isPlainObject$1(value) && Array.isArray(value.hooks);
@@ -28179,10 +28360,35 @@ function stableStringify$1(value) {
 function matcherKey(matcher) {
 	return matcher === void 0 ? "" : stableStringify$1(matcher);
 }
-/** The stable form of a matcher group's keys other than `matcher` and `hooks`. */
+function pendingKey({ event, matcher, attributes, handler }) {
+	const key = ownedHookKey({
+		event,
+		matcher,
+		identity: handlerIdentity(handler)
+	});
+	return JSON.stringify([key, attributes]);
+}
+/** Groups that share a matcher and attributes are interchangeable homes for a handler. */
+function groupSlotKey(group) {
+	return JSON.stringify([matcherKey(group.matcher), groupAttributesKey(group)]);
+}
+/** Group-level keys whose default value is known, so an explicit default can be ignored. */
+const GROUP_ATTRIBUTE_DEFAULTS = Object.freeze({
+	__proto__: null,
+	sequential: false
+});
+/**
+* The stable form of a matcher group's keys other than `matcher` and `hooks`.
+*
+* A key set to its known default is the same group as one that omits it:
+* Qwen Code's `sequential` defaults to `false` and rulesync emits it only when
+* `true`, so an explicit `sequential: false` (or any `undefined` key) is
+* dropped before comparing. Other `false` values are kept, since their default
+* is not known here.
+*/
 function groupAttributesKey(group) {
 	const { matcher: _matcher, hooks: _hooks, ...attributes } = group;
-	return stableStringify$1(attributes);
+	return stableStringify$1(Object.fromEntries(Object.entries(attributes).filter(([key, value]) => value !== void 0 && GROUP_ATTRIBUTE_DEFAULTS[key] !== value)));
 }
 function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
@@ -42651,9 +42857,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			outputRoot,
 			global
 		});
+		const existingDisabled = settings.document?.disabledMcpServers;
+		const offSwitchBlocker = settings.document === null ? "cannot be parsed" : existingDisabled !== void 0 && !isStringArray$1(existingDisabled) ? "has a disabledMcpServers value that is not an array of server names" : void 0;
 		const copilotCliMcpServers = addTypeField(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).filter(([name, server]) => {
-			if (server.disabled !== true || settings.document !== null) return true;
-			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${join(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} cannot be parsed, so disabledMcpServers cannot be written to switch it off.`);
+			if (server.disabled !== true || offSwitchBlocker === void 0) return true;
+			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${join(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} ${offSwitchBlocker}, so disabledMcpServers cannot be written to switch it off.`);
 			return false;
 		})), logger);
 		const mcpJson = {
@@ -42683,7 +42891,8 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 	* Copilot CLI actually consults: an MCP file entry has no `disabled` field.
 	* rulesync owns the toggle for the servers it writes; names it does not
 	* manage keep their existing state. The file is not created or touched when
-	* there is nothing to disable and nothing to retract.
+	* there is nothing to disable and nothing to retract, nor when the existing
+	* `disabledMcpServers` is not a string array (left as is, with a warning).
 	*/
 	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
 		const servers = rulesyncMcp.forTarget({
@@ -42701,7 +42910,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			return [];
 		}
 		const existing = settings.document.disabledMcpServers;
-		const existingDisabled = isStringArray$1(existing) ? existing : [];
+		if (existing !== void 0 && !isStringArray$1(existing)) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: the existing value is not an array of server names. Fix it in ${join(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} so rulesync can manage the toggle.`);
+			return [];
+		}
+		const existingDisabled = existing ?? [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
 		if (reEnabled.length > 0) logger?.warn(`Copilot CLI MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
@@ -56707,7 +56920,7 @@ function convertClaudeToRulesyncPermissions(params) {
 * (https://docs.cline.bot/cli/cli-reference). The output is still generated for
 * compatibility, with a deprecation warning on every generation.
 */
-const CLINE_PERMISSIONS_DEPRECATION_WARNING = "WARNING: The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. See https://docs.cline.bot/cli/cli-reference.";
+const CLINE_PERMISSIONS_DEPRECATION_WARNING = "The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. Note that a hook returning `cancel: true` stops the whole Cline task, not just that one tool call (https://github.com/cline/cline/issues/14697). See https://docs.cline.bot/cli/cli-reference.";
 const ClineCommandPermissionsSchema = z.looseObject({
 	allow: z.optional(z.array(z.string())),
 	deny: z.optional(z.array(z.string())),
@@ -60223,6 +60436,193 @@ const AUTO_APPROVE_KEYS = {
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
 const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+/**
+* The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
+* at path `a.b` is written to `chat.agent.sandbox.a.b`.
+*/
+const SANDBOX_KEY_PREFIX = "chat.agent.sandbox.";
+/**
+* The `copilot.sandbox` leaves rulesync manages, each a flat VS Code setting
+* (`SANDBOX_KEY_PREFIX` + the dotted path) with the value shape VS Code
+* registers for it. The shape is re-checked on import, so a hand-written value
+* VS Code would not accept is skipped instead of failing the whole import.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const SANDBOX_LEAVES = [
+	{
+		path: ["enabled"],
+		schema: CopilotSandboxEnabledSchema,
+		normalize: (value) => value === true ? "on" : value === false ? "off" : value
+	},
+	{
+		path: ["network", "allowNetwork"],
+		schema: z.boolean()
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		schema: z.boolean()
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		schema: z.boolean()
+	},
+	{
+		path: ["mcpServers"],
+		schema: z.boolean()
+	},
+	{
+		path: ["lspServers"],
+		schema: z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		schema: z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		schema: z.boolean()
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		schema: z.boolean()
+	},
+	{
+		path: ["fileSystem", "userConfiguredPaths"],
+		schema: CopilotSandboxUserConfiguredPathsSchema
+	}
+];
+const USER_CONFIGURED_PATHS_KEY = `${SANDBOX_KEY_PREFIX}fileSystem.userConfiguredPaths`;
+/**
+* `copilot.sandbox` values that loosen the Agent Host sandbox. They are still
+* written — a sandbox policy is the user's call — but never silently. Each
+* `widens` names the value that does *not* loosen anything and reports the
+* rest, so an unexpected value is reported rather than ignored.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+*/
+const COPILOT_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox off, so agent terminal commands run unconfined",
+		widens: (value) => value !== "on"
+	},
+	{
+		path: ["network", "allowNetwork"],
+		reason: "lets sandboxed commands reach the external network",
+		widens: isNotFalse
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		reason: "lets sandboxed commands reach local network resources",
+		widens: isNotFalse
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "lets the agent ask to run a blocked command outside the sandbox",
+		widens: isNotFalse
+	},
+	{
+		path: ["mcpServers"],
+		reason: "runs locally launched MCP servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["lspServers"],
+		reason: "runs language servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		reason: "hands your Git credentials to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		reason: "hands your GitHub CLI authentication to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		reason: "grants sandboxed commands developer-tool directories, which can hold credentials such as registry tokens",
+		widens: isNotFalse
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readwritePaths"
+		],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: isNonEmptyList
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readonlyPaths"
+		],
+		reason: "adds paths sandboxed commands may read, outside the working directory",
+		widens: isNonEmptyList
+	}
+];
+const COPILOT_TOOL_LABEL = "GitHub Copilot";
+function sandboxKey(path) {
+	return `${SANDBOX_KEY_PREFIX}${path.join(".")}`;
+}
+/**
+* Patch entries for every `copilot.sandbox` leaf the canonical config states.
+* Leaves it does not state are left as the file has them, so authoring only
+* `network.allowNetwork` never disturbs a hand-written `enabled`. The
+* `userConfiguredPaths` object merges per list for the same reason: authoring
+* `readwritePaths` keeps a hand-written `deniedPaths`, which would otherwise be
+* a restriction lost without a word.
+*/
+function buildSandboxPatch({ sandbox, existingSettings }) {
+	const patch = {};
+	for (const { path } of SANDBOX_LEAVES) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0 || value === UNREADABLE_SANDBOX_PATH) continue;
+		const key = sandboxKey(path);
+		if (key === USER_CONFIGURED_PATHS_KEY && isPlainObject$1(value)) {
+			const existing = existingSettings[key];
+			patch[key] = {
+				...isPlainObject$1(existing) ? existing : {},
+				...value
+			};
+			continue;
+		}
+		patch[key] = value;
+	}
+	return patch;
+}
+/**
+* Lift every managed `chat.agent.sandbox.*` key the file holds back into a
+* nested `copilot.sandbox` object. A value whose shape VS Code would reject is
+* skipped; the write path leaves it in place.
+*/
+function readSandboxFromSettings(settings) {
+	const sandbox = {};
+	for (const { path, schema, normalize } of SANDBOX_LEAVES) {
+		const value = settings[sandboxKey(path)];
+		const parsed = schema.safeParse(normalize === void 0 ? value : normalize(value));
+		if (!parsed.success) continue;
+		let cursor = sandbox;
+		for (const segment of path.slice(0, -1)) {
+			const next = cursor[segment];
+			const child = isPlainObject$1(next) ? next : {};
+			cursor[segment] = child;
+			cursor = child;
+		}
+		const leaf = path[path.length - 1];
+		if (leaf !== void 0) cursor[leaf] = parsed.data;
+	}
+	return Object.keys(sandbox).length > 0 ? sandbox : void 0;
+}
 function isCopilotDefaultPermissionMode(value) {
 	return COPILOT_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
 }
@@ -60267,7 +60667,9 @@ function buildAutoApproveValue(rules) {
 * hand-written edits or urls map.
 * The `copilot.defaultPermissionMode` override writes `chat.permissions.default`
 * (the starting permission level of new chat sessions); without it the key is
-* left untouched.
+* left untouched. The `copilot.sandbox` override writes the Agent Host sandbox
+* settings (`chat.agent.sandbox.*`, see {@link SANDBOX_LEAVES}) per key, and
+* warns about every value it writes that loosens the sandbox.
 * Only project scope is modeled: VS Code's user-scope settings.json lives at a
 * platform-dependent path outside rulesync's home-relative global model.
 */
@@ -60315,6 +60717,26 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
 		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		const sandbox = config.copilot?.sandbox;
+		if (sandbox !== void 0) {
+			Object.assign(patch, buildSandboxPatch({
+				sandbox,
+				existingSettings: parseSharedConfig({
+					format: "jsonc",
+					fileContent: existingContent,
+					filePath
+				})
+			}));
+			warnOnTrustAffectingEntries({
+				toolLabel: COPILOT_TOOL_LABEL,
+				entries: collectTrustAffectingSandboxPaths({
+					sandbox,
+					paths: COPILOT_TRUST_AFFECTING_SANDBOX_PATHS
+				}),
+				relativeFilePath: join(paths.relativeDirPath, paths.relativeFilePath),
+				logger
+			});
+		}
 		return new CopilotPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -60351,9 +60773,14 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const sandbox = readSandboxFromSettings(settings);
+		const copilot = {
+			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
+			...sandbox !== void 0 && { sandbox }
+		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
 			permission,
-			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { copilot: { defaultPermissionMode } }
+			...Object.keys(copilot).length > 0 && { copilot }
 		}, null, 2) });
 	}
 	validate() {
@@ -99629,9 +100056,10 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold",
 			projectInstructionBudget: {
 				bytes: CODEXCLI_PROJECT_DOC_MAX_BYTES,
-				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml`.",
+				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (Codex reads that file only if the project is trusted).",
 				readConfiguredBytes: readCodexcliProjectDocMaxBytes,
-				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml`"
+				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml` (honored only if the project is trusted)",
+				defaultLimitHint: "Rulesync does not read `~/.codex/config.toml`; ignore this warning if you already raised `project_doc_max_bytes` there."
 			}
 		}
 	}],
@@ -100210,6 +100638,7 @@ var RulesProcessor = class extends FeatureProcessor {
 		const configuredBytes = await budget.readConfiguredBytes?.(this.outputRoot);
 		const limitBytes = configuredBytes ?? budget.bytes;
 		const limitLabel = budget.readConfiguredBytes === void 0 ? `${limitBytes}-byte limit` : configuredBytes === void 0 ? `${limitBytes}-byte default limit` : `${limitBytes}-byte limit set by ${budget.configuredSource ?? "the tool config"}`;
+		const remedy = configuredBytes === void 0 && budget.defaultLimitHint !== void 0 ? `${budget.remedy} ${budget.defaultLimitHint}` : budget.remedy;
 		const files = toolRules.map((rule) => ({
 			dir: normalizeRelativeDir(rule.getRelativeDirPath()),
 			path: toPosixPath(join(rule.getRelativeDirPath(), rule.getRelativeFilePath())),
@@ -100220,7 +100649,7 @@ var RulesProcessor = class extends FeatureProcessor {
 		const rootFiles = files.filter(({ dir }) => dir === ".");
 		const rootBytes = rootFiles.reduce((sum, { bytes }) => sum + bytes, 0);
 		if (rootBytes > limitBytes) {
-			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${budget.remedy}`);
+			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${remedy}`);
 			return;
 		}
 		const reportedDirs = [];
@@ -100231,7 +100660,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			const chainBytes = chain.reduce((sum, { bytes }) => sum + bytes, 0);
 			if (chainBytes > limitBytes) {
 				reportedDirs.push(file.dir);
-				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${budget.remedy}`);
+				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${remedy}`);
 			}
 		}
 	}
@@ -104136,4 +104565,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncHooks as $, removeDirectoryStrict as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, parseCommaSeparatedList as Bn, getFileSizeAndExecutableBit as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_IGNORE_RELATIVE_FILE_PATH as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, truncateText as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, ALL_FEATURES_WITH_WILDCARD as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as In, directoryExists as It, RulesyncRule as J, quoteForLog as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, hasDeceptiveHiddenCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_PERMISSIONS_SCHEMA_URL as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_RELATIVE_DIR_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_MCP_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_RULES_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectory as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, RULESYNC_USER_CONFIG_DIR_NAME as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_CONFIG_SCHEMA_URL as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, DEPRECATED_FEATURE_REPLACEMENTS as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, ALL_FEATURES as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, formatError as Wn, isSymlink as Wt, RulesyncPermissions as X, stripControlCharactersKeepingLineFeeds as Xn, readFileContent as Xt, RulesyncRuleFrontmatterSchema as Y, stripControlCharacters as Yn, posixRelativePathEscapesRoot as Yt, RulesyncMcp as Z, stripHiddenCharacters as Zn, readFileContentOrNull as Zt, LETTACODE_DIR as _, MAX_FILE_SIZE as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, runWithDirectoryRollback as an, RulesyncCheck as at, CommandsProcessor as b, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, writeFileBuffer as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ALL_TOOL_TARGETS as dn, ConfigResolver as dt, removeFile as en, getRulesyncSourceCandidates as et, displayWidthOf as f, ALL_TOOL_TARGETS_WITH_WILDCARD as fn, mergeInputRootConfigs as ft, HooksProcessor as g, FEATURE_SOURCE_TREE_ENTRIES as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, CURATED_RULES_FEATURE_SUBDIR as hn, ConfigFileSchema as ht, inspectInputRoots as i, resolvedRelativePath as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_MCP_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, writeFileContent as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, ToolTargetSchema as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, removeTempDirectory as nn, parseJsonc as nt, convertFromTool as o, splitPathSegments as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, PACKAGING_TOOL_TARGETS as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, hasEnclosingMarkOutsideKeycap as qn, listSubdirectoryNames as qt, generate as r, resolvePath as rn, RulesyncCommand as rt, isPackagingToolTarget as s, toPosixPath as sn, stringifyFrontmatter as st, importFromTool as t, removeFileStrict as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, mapWithConcurrency as un, SKILL_FILE_NAME as ut, LETTACODE_SETTINGS_LOCAL_FILE_NAME as v, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as wn, warnOnConflictingFlags as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, RULESYNC_CONFIG_RELATIVE_FILE_PATH as xn, JsonLogger as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, RULESYNC_CHECKS_RELATIVE_DIR_PATH as yn, findControlCharacter as yt, QWENCODE_DIR as z, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as zn, findFilesByGlobs as zt };
 
-//# sourceMappingURL=import-BPSwSahy.js.map
+//# sourceMappingURL=import-BsEFYJsg.js.map