rulesync 37.0.0 → 37.1.0

package/dist/{import-S70XttcD.cjs → import-DYYG88Rs.cjs}

@@ -7917,14 +7917,53 @@ const COPILOT_DEFAULT_PERMISSION_MODES = [
 	"autoApprove",
 	"autopilot"
 ];
+/** `chat.agent.sandbox.enabled`: `"off"` or `"on"`. */
+const CopilotSandboxEnabledSchema = zod_mini.z.enum(["off", "on"]);
+/** `chat.agent.sandbox.fileSystem.userConfiguredPaths`. */
+const CopilotSandboxUserConfiguredPathsSchema = zod_mini.z.strictObject({
+	readwritePaths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	readonlyPaths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+	deniedPaths: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+});
+/**
+* The Agent Host sandbox settings VS Code 1.141 settled on, as a nested object
+* whose path mirrors the dotted setting key under `chat.agent.sandbox.` — e.g.
+* `network.allowNetwork` writes `chat.agent.sandbox.network.allowNetwork`.
+* Only the documented, registered keys are accepted; the deprecated 1.138
+* shapes (`chat.agent.sandbox.allowNetwork`, `.fileSystem.linux|mac|windows`)
+* are not modeled, since the Agent Host ignores them.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const CopilotSandboxSchema = zod_mini.z.strictObject({
+	enabled: zod_mini.z.optional(CopilotSandboxEnabledSchema),
+	network: zod_mini.z.optional(zod_mini.z.strictObject({
+		allowNetwork: zod_mini.z.optional(zod_mini.z.boolean()),
+		allowLocalNetwork: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
+	allowUnsandboxedCommands: zod_mini.z.optional(zod_mini.z.boolean()),
+	mcpServers: zod_mini.z.optional(zod_mini.z.boolean()),
+	lspServers: zod_mini.z.optional(zod_mini.z.boolean()),
+	credentials: zod_mini.z.optional(zod_mini.z.strictObject({
+		authenticategit: zod_mini.z.optional(zod_mini.z.boolean()),
+		authenticategh: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
+	fileSystem: zod_mini.z.optional(zod_mini.z.strictObject({
+		allowDevToolAccess: zod_mini.z.optional(zod_mini.z.boolean()),
+		userConfiguredPaths: zod_mini.z.optional(CopilotSandboxUserConfiguredPathsSchema)
+	}))
+});
 /**
 * Tool-scoped override block for GitHub Copilot in VS Code.
 * `defaultPermissionMode` writes the workspace `chat.permissions.default`
-* setting, which has no canonical category.
+* setting, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
+* has a canonical category.
 */
 const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum(COPILOT_DEFAULT_PERMISSION_MODES))
+	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum(COPILOT_DEFAULT_PERMISSION_MODES)),
+	sandbox: zod_mini.z.optional(CopilotSandboxSchema)
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
@@ -12896,6 +12935,16 @@ const SHARED_CONFIG_OWNERSHIP = {
 				"chat.tools.edits.autoApprove",
 				"chat.tools.urls.autoApprove",
 				"chat.permissions.default",
+				"chat.agent.sandbox.enabled",
+				"chat.agent.sandbox.network.allowNetwork",
+				"chat.agent.sandbox.network.allowLocalNetwork",
+				"chat.agent.sandbox.allowUnsandboxedCommands",
+				"chat.agent.sandbox.mcpServers",
+				"chat.agent.sandbox.lspServers",
+				"chat.agent.sandbox.credentials.authenticategit",
+				"chat.agent.sandbox.credentials.authenticategh",
+				"chat.agent.sandbox.fileSystem.allowDevToolAccess",
+				"chat.agent.sandbox.fileSystem.userConfiguredPaths",
 				"zoo-code.allowedCommands",
 				"zoo-code.deniedCommands",
 				"roo-cline.allowedCommands",
@@ -28058,8 +28107,34 @@ function collectOwnedRefs({ generatedHooks, shape }) {
 	}
 	return owned;
 }
+/**
+* The merge keeps every unowned existing handler where it is. Some tools key
+* state by position — Codex CLI persists a hook's trust review under its event,
+* matcher group index and handler index — so moving a handler the user already
+* reviewed would silently change which hook that review belongs to. Hence:
+* - an unowned existing handler stays at its index;
+* - a newly generated handler is appended to the first existing group with its
+*   matcher and group-level keys, or in a new group after the existing ones;
+* - within a group, the slots rulesync's own handlers occupy (including the
+*   appended ones) are filled in generated order, so reordering the sources
+*   still reorders the generated handlers, which matters wherever handlers
+*   run in order (a Qwen Code `sequential` group, a Cursor list).
+*
+* A retracted handler, or a group left empty by retractions, is still removed,
+* which shifts whatever follows it in the same list; that is unavoidable
+* without leaving a placeholder behind.
+*/
 function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const merged = [...generated];
+	const pending = createPendingGenerated();
+	for (const group of generated) if (isMatcherGroup(group)) addPending({
+		pending,
+		handlers: group.hooks,
+		event,
+		matcher: matcherKey(group.matcher),
+		attributes: groupAttributesKey(group)
+	});
+	const merged = [];
+	const homes = /* @__PURE__ */ new Map();
 	for (const group of existing) {
 		if (!isMatcherGroup(group)) {
 			warnSkip({
@@ -28070,27 +28145,57 @@ function mergeMatcherGroups({ existing, generated, event, seen, previouslyOwned,
 			continue;
 		}
 		const matcher = matcherKey(group.matcher);
-		const preserved = group.hooks.filter((handler) => shouldPreserve({
-			handler,
+		const hooks = keepExistingHandlers({
+			handlers: group.hooks,
 			event,
 			matcher,
+			attributes: groupAttributesKey(group),
+			pending,
 			seen,
 			previouslyOwned,
 			logger
-		})).map((handler) => cloneHandler(handler));
-		if (preserved.length === 0) continue;
-		const attributes = groupAttributesKey(group);
-		const target = merged.find((candidate) => isMatcherGroup(candidate) && matcherKey(candidate.matcher) === matcher && groupAttributesKey(candidate) === attributes);
-		if (target !== void 0 && isMatcherGroup(target)) target.hooks.push(...preserved);
-		else merged.push({
+		});
+		if (hooks.length === 0) continue;
+		const kept = {
 			...omitPrototypePollutionKeys(group),
-			hooks: preserved
+			hooks
+		};
+		merged.push(kept);
+		const home = groupSlotKey(group);
+		if (!homes.has(home)) homes.set(home, kept);
+	}
+	for (const group of generated) {
+		if (!isMatcherGroup(group)) {
+			merged.push(group);
+			continue;
+		}
+		const remaining = group.hooks.filter((handler) => !pending.placed.has(handler));
+		if (remaining.length === 0) continue;
+		const home = homes.get(groupSlotKey(group));
+		if (home === void 0) merged.push({
+			...group,
+			hooks: remaining
 		});
+		else home.hooks.push(...remaining);
 	}
+	const order = generatedOrder(generated.flatMap((group) => isMatcherGroup(group) ? group.hooks : []));
+	for (const group of merged) if (isMatcherGroup(group)) orderGeneratedSlots({
+		handlers: group.hooks,
+		order
+	});
 	return merged;
 }
+/** The flat-list counterpart of {@link mergeMatcherGroups}, with the same positional rules. */
 function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned, logger }) {
-	const preserved = [];
+	const pending = createPendingGenerated();
+	addPending({
+		pending,
+		handlers: generated,
+		event,
+		matcher: void 0,
+		attributes: ""
+	});
+	const flat = [];
 	for (const handler of existing) {
 		if (isMatcherGroup(handler)) {
 			warnSkip({
@@ -28100,17 +28205,93 @@ function mergeFlatHandlers({ existing, generated, event, seen, previouslyOwned,
 			});
 			continue;
 		}
-		if (!shouldPreserve({
+		flat.push(handler);
+	}
+	const merged = keepExistingHandlers({
+		handlers: flat,
+		event,
+		matcher: void 0,
+		attributes: "",
+		pending,
+		seen,
+		previouslyOwned,
+		logger
+	});
+	merged.push(...generated.filter((handler) => !pending.placed.has(handler)));
+	orderGeneratedSlots({
+		handlers: merged,
+		order: generatedOrder(generated)
+	});
+	return merged;
+}
+/** Each generated handler's position in the generated list, by object identity. */
+function generatedOrder(handlers) {
+	const order = /* @__PURE__ */ new Map();
+	for (const [index, handler] of handlers.entries()) if (isPlainObject$1(handler)) order.set(handler, index);
+	return order;
+}
+/**
+* Rewrite, in place, the slots of `handlers` that hold generated handlers so
+* they follow the generated order. Every other slot — an unowned handler — is
+* left at its index.
+*/
+function orderGeneratedSlots({ handlers, order }) {
+	const slots = [];
+	for (const [index, handler] of handlers.entries()) if (order.has(handler)) slots.push(index);
+	const sorted = slots.map((index) => handlers[index]).toSorted((left, right) => (order.get(left) ?? 0) - (order.get(right) ?? 0));
+	for (const [position, index] of slots.entries()) handlers[index] = sorted[position];
+}
+function createPendingGenerated() {
+	return {
+		byKey: /* @__PURE__ */ new Map(),
+		placed: /* @__PURE__ */ new Set()
+	};
+}
+function addPending({ pending, handlers, event, matcher, attributes }) {
+	for (const handler of handlers) {
+		if (!isPlainObject$1(handler)) continue;
+		const key = pendingKey({
+			event,
+			matcher,
+			attributes,
+			handler
+		});
+		const queue = pending.byKey.get(key);
+		if (queue === void 0) pending.byKey.set(key, [handler]);
+		else queue.push(handler);
+	}
+}
+/**
+* Walk one existing list in order and decide each handler: replaced in place
+* by its generated copy, kept as unowned, or dropped (retracted or duplicate).
+*/
+function keepExistingHandlers({ handlers, event, matcher, attributes, pending, seen, previouslyOwned, logger }) {
+	const kept = [];
+	for (const handler of handlers) {
+		if (isPlainObject$1(handler)) {
+			const key = pendingKey({
+				event,
+				matcher,
+				attributes,
+				handler
+			});
+			const generated = pending.byKey.get(key)?.shift();
+			if (generated !== void 0) {
+				pending.placed.add(generated);
+				kept.push(generated);
+				continue;
+			}
+		}
+		if (shouldPreserve({
 			handler,
 			event,
-			matcher: void 0,
+			matcher,
 			seen,
 			previouslyOwned,
 			logger
-		})) continue;
-		preserved.push(cloneHandler(handler));
+		})) kept.push(cloneHandler(handler));
 	}
-	return [...generated, ...preserved];
+	return kept;
 }
 function isMatcherGroup(value) {
 	return isPlainObject$1(value) && Array.isArray(value.hooks);
@@ -28201,10 +28382,35 @@ function stableStringify$1(value) {
 function matcherKey(matcher) {
 	return matcher === void 0 ? "" : stableStringify$1(matcher);
 }
-/** The stable form of a matcher group's keys other than `matcher` and `hooks`. */
+function pendingKey({ event, matcher, attributes, handler }) {
+	const key = ownedHookKey({
+		event,
+		matcher,
+		identity: handlerIdentity(handler)
+	});
+	return JSON.stringify([key, attributes]);
+}
+/** Groups that share a matcher and attributes are interchangeable homes for a handler. */
+function groupSlotKey(group) {
+	return JSON.stringify([matcherKey(group.matcher), groupAttributesKey(group)]);
+}
+/** Group-level keys whose default value is known, so an explicit default can be ignored. */
+const GROUP_ATTRIBUTE_DEFAULTS = Object.freeze({
+	__proto__: null,
+	sequential: false
+});
+/**
+* The stable form of a matcher group's keys other than `matcher` and `hooks`.
+*
+* A key set to its known default is the same group as one that omits it:
+* Qwen Code's `sequential` defaults to `false` and rulesync emits it only when
+* `true`, so an explicit `sequential: false` (or any `undefined` key) is
+* dropped before comparing. Other `false` values are kept, since their default
+* is not known here.
+*/
 function groupAttributesKey(group) {
 	const { matcher: _matcher, hooks: _hooks, ...attributes } = group;
-	return stableStringify$1(attributes);
+	return stableStringify$1(Object.fromEntries(Object.entries(attributes).filter(([key, value]) => value !== void 0 && GROUP_ATTRIBUTE_DEFAULTS[key] !== value)));
 }
 function warnSkip({ logger, event, expected }) {
 	logger?.warn(`Skipping existing hook entry on ${event}: expected ${expected}`);
@@ -42673,9 +42879,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			outputRoot,
 			global
 		});
+		const existingDisabled = settings.document?.disabledMcpServers;
+		const offSwitchBlocker = settings.document === null ? "cannot be parsed" : existingDisabled !== void 0 && !isStringArray$1(existingDisabled) ? "has a disabledMcpServers value that is not an array of server names" : void 0;
 		const copilotCliMcpServers = addTypeField(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).filter(([name, server]) => {
-			if (server.disabled !== true || settings.document !== null) return true;
-			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${(0, node_path.join)(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} cannot be parsed, so disabledMcpServers cannot be written to switch it off.`);
+			if (server.disabled !== true || offSwitchBlocker === void 0) return true;
+			logger?.warn(`[CopilotcliMcp] Skipping disabled MCP server "${name}": ${(0, node_path.join)(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} ${offSwitchBlocker}, so disabledMcpServers cannot be written to switch it off.`);
 			return false;
 		})), logger);
 		const mcpJson = {
@@ -42705,7 +42913,8 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 	* Copilot CLI actually consults: an MCP file entry has no `disabled` field.
 	* rulesync owns the toggle for the servers it writes; names it does not
 	* manage keep their existing state. The file is not created or touched when
-	* there is nothing to disable and nothing to retract.
+	* there is nothing to disable and nothing to retract, nor when the existing
+	* `disabledMcpServers` is not a string array (left as is, with a warning).
 	*/
 	static async getAuxiliaryFiles({ outputRoot = process.cwd(), global = false, rulesyncMcp, logger }) {
 		const servers = rulesyncMcp.forTarget({
@@ -42723,7 +42932,11 @@ var CopilotcliMcp = class CopilotcliMcp extends ToolMcp {
 			return [];
 		}
 		const existing = settings.document.disabledMcpServers;
-		const existingDisabled = isStringArray$1(existing) ? existing : [];
+		if (existing !== void 0 && !isStringArray$1(existing)) {
+			logger?.warn(`Skipping the Copilot CLI disabledMcpServers update: the existing value is not an array of server names. Fix it in ${(0, node_path.join)(settings.paths.relativeDirPath, settings.paths.relativeFilePath)} so rulesync can manage the toggle.`);
+			return [];
+		}
+		const existingDisabled = existing ?? [];
 		const managedNameSet = new Set(managedNames);
 		const reEnabled = existingDisabled.filter((name) => managedNameSet.has(name) && !disabledNames.includes(name));
 		if (reEnabled.length > 0) logger?.warn(`Copilot CLI MCP: re-enabling ${reEnabled.join(", ")} — the canonical config does not mark ${reEnabled.length === 1 ? "it" : "them"} disabled. Set "disabled": true in .rulesync/mcp.jsonc to keep a managed server off.`);
@@ -56729,7 +56942,7 @@ function convertClaudeToRulesyncPermissions(params) {
 * (https://docs.cline.bot/cli/cli-reference). The output is still generated for
 * compatibility, with a deprecation warning on every generation.
 */
-const CLINE_PERMISSIONS_DEPRECATION_WARNING = "WARNING: The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. See https://docs.cline.bot/cli/cli-reference.";
+const CLINE_PERMISSIONS_DEPRECATION_WARNING = "The Cline permissions output (.cline/command-permissions.json) is deprecated. No Cline CLI 3 release reads CLINE_COMMAND_PERMISSIONS, so the generated allow/deny lists are not enforced by current Cline releases. To block shell commands in Cline, use a preToolUse hook (rulesync hooks feature, cline target) that cancels the run_commands calls you do not allow. Note that a hook returning `cancel: true` stops the whole Cline task, not just that one tool call (https://github.com/cline/cline/issues/14697). See https://docs.cline.bot/cli/cli-reference.";
 const ClineCommandPermissionsSchema = zod_mini.z.looseObject({
 	allow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
@@ -60245,6 +60458,193 @@ const AUTO_APPROVE_KEYS = {
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
 const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+/**
+* The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
+* at path `a.b` is written to `chat.agent.sandbox.a.b`.
+*/
+const SANDBOX_KEY_PREFIX = "chat.agent.sandbox.";
+/**
+* The `copilot.sandbox` leaves rulesync manages, each a flat VS Code setting
+* (`SANDBOX_KEY_PREFIX` + the dotted path) with the value shape VS Code
+* registers for it. The shape is re-checked on import, so a hand-written value
+* VS Code would not accept is skipped instead of failing the whole import.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+* @see https://code.visualstudio.com/docs/agents/reference/ai-settings
+*/
+const SANDBOX_LEAVES = [
+	{
+		path: ["enabled"],
+		schema: CopilotSandboxEnabledSchema,
+		normalize: (value) => value === true ? "on" : value === false ? "off" : value
+	},
+	{
+		path: ["network", "allowNetwork"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["mcpServers"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["lspServers"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		schema: zod_mini.z.boolean()
+	},
+	{
+		path: ["fileSystem", "userConfiguredPaths"],
+		schema: CopilotSandboxUserConfiguredPathsSchema
+	}
+];
+const USER_CONFIGURED_PATHS_KEY = `${SANDBOX_KEY_PREFIX}fileSystem.userConfiguredPaths`;
+/**
+* `copilot.sandbox` values that loosen the Agent Host sandbox. They are still
+* written — a sandbox policy is the user's call — but never silently. Each
+* `widens` names the value that does *not* loosen anything and reports the
+* rest, so an unexpected value is reported rather than ignored.
+*
+* @see https://code.visualstudio.com/docs/agents/run/agent-sandboxing
+*/
+const COPILOT_TRUST_AFFECTING_SANDBOX_PATHS = [
+	{
+		path: ["enabled"],
+		reason: "turns the sandbox off, so agent terminal commands run unconfined",
+		widens: (value) => value !== "on"
+	},
+	{
+		path: ["network", "allowNetwork"],
+		reason: "lets sandboxed commands reach the external network",
+		widens: isNotFalse
+	},
+	{
+		path: ["network", "allowLocalNetwork"],
+		reason: "lets sandboxed commands reach local network resources",
+		widens: isNotFalse
+	},
+	{
+		path: ["allowUnsandboxedCommands"],
+		reason: "lets the agent ask to run a blocked command outside the sandbox",
+		widens: isNotFalse
+	},
+	{
+		path: ["mcpServers"],
+		reason: "runs locally launched MCP servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["lspServers"],
+		reason: "runs language servers outside the sandbox",
+		widens: isNotTrue
+	},
+	{
+		path: ["credentials", "authenticategit"],
+		reason: "hands your Git credentials to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["credentials", "authenticategh"],
+		reason: "hands your GitHub CLI authentication to sandboxed commands",
+		widens: isNotFalse
+	},
+	{
+		path: ["fileSystem", "allowDevToolAccess"],
+		reason: "grants sandboxed commands developer-tool directories, which can hold credentials such as registry tokens",
+		widens: isNotFalse
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readwritePaths"
+		],
+		reason: "adds paths sandboxed commands may write to, outside the working directory",
+		widens: isNonEmptyList
+	},
+	{
+		path: [
+			"fileSystem",
+			"userConfiguredPaths",
+			"readonlyPaths"
+		],
+		reason: "adds paths sandboxed commands may read, outside the working directory",
+		widens: isNonEmptyList
+	}
+];
+const COPILOT_TOOL_LABEL = "GitHub Copilot";
+function sandboxKey(path) {
+	return `${SANDBOX_KEY_PREFIX}${path.join(".")}`;
+}
+/**
+* Patch entries for every `copilot.sandbox` leaf the canonical config states.
+* Leaves it does not state are left as the file has them, so authoring only
+* `network.allowNetwork` never disturbs a hand-written `enabled`. The
+* `userConfiguredPaths` object merges per list for the same reason: authoring
+* `readwritePaths` keeps a hand-written `deniedPaths`, which would otherwise be
+* a restriction lost without a word.
+*/
+function buildSandboxPatch({ sandbox, existingSettings }) {
+	const patch = {};
+	for (const { path } of SANDBOX_LEAVES) {
+		const value = readSandboxPath({
+			sandbox,
+			path
+		});
+		if (value === void 0 || value === UNREADABLE_SANDBOX_PATH) continue;
+		const key = sandboxKey(path);
+		if (key === USER_CONFIGURED_PATHS_KEY && isPlainObject$1(value)) {
+			const existing = existingSettings[key];
+			patch[key] = {
+				...isPlainObject$1(existing) ? existing : {},
+				...value
+			};
+			continue;
+		}
+		patch[key] = value;
+	}
+	return patch;
+}
+/**
+* Lift every managed `chat.agent.sandbox.*` key the file holds back into a
+* nested `copilot.sandbox` object. A value whose shape VS Code would reject is
+* skipped; the write path leaves it in place.
+*/
+function readSandboxFromSettings(settings) {
+	const sandbox = {};
+	for (const { path, schema, normalize } of SANDBOX_LEAVES) {
+		const value = settings[sandboxKey(path)];
+		const parsed = schema.safeParse(normalize === void 0 ? value : normalize(value));
+		if (!parsed.success) continue;
+		let cursor = sandbox;
+		for (const segment of path.slice(0, -1)) {
+			const next = cursor[segment];
+			const child = isPlainObject$1(next) ? next : {};
+			cursor[segment] = child;
+			cursor = child;
+		}
+		const leaf = path[path.length - 1];
+		if (leaf !== void 0) cursor[leaf] = parsed.data;
+	}
+	return Object.keys(sandbox).length > 0 ? sandbox : void 0;
+}
 function isCopilotDefaultPermissionMode(value) {
 	return COPILOT_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
 }
@@ -60289,7 +60689,9 @@ function buildAutoApproveValue(rules) {
 * hand-written edits or urls map.
 * The `copilot.defaultPermissionMode` override writes `chat.permissions.default`
 * (the starting permission level of new chat sessions); without it the key is
-* left untouched.
+* left untouched. The `copilot.sandbox` override writes the Agent Host sandbox
+* settings (`chat.agent.sandbox.*`, see {@link SANDBOX_LEAVES}) per key, and
+* warns about every value it writes that loosens the sandbox.
 * Only project scope is modeled: VS Code's user-scope settings.json lives at a
 * platform-dependent path outside rulesync's home-relative global model.
 */
@@ -60337,6 +60739,26 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
 		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		const sandbox = config.copilot?.sandbox;
+		if (sandbox !== void 0) {
+			Object.assign(patch, buildSandboxPatch({
+				sandbox,
+				existingSettings: parseSharedConfig({
+					format: "jsonc",
+					fileContent: existingContent,
+					filePath
+				})
+			}));
+			warnOnTrustAffectingEntries({
+				toolLabel: COPILOT_TOOL_LABEL,
+				entries: collectTrustAffectingSandboxPaths({
+					sandbox,
+					paths: COPILOT_TRUST_AFFECTING_SANDBOX_PATHS
+				}),
+				relativeFilePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath),
+				logger
+			});
+		}
 		return new CopilotPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -60373,9 +60795,14 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
 		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const sandbox = readSandboxFromSettings(settings);
+		const copilot = {
+			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
+			...sandbox !== void 0 && { sandbox }
+		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
 			permission,
-			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { copilot: { defaultPermissionMode } }
+			...Object.keys(copilot).length > 0 && { copilot }
 		}, null, 2) });
 	}
 	validate() {
@@ -99651,9 +100078,10 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold",
 			projectInstructionBudget: {
 				bytes: CODEXCLI_PROJECT_DOC_MAX_BYTES,
-				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml`.",
+				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (Codex reads that file only if the project is trusted).",
 				readConfiguredBytes: readCodexcliProjectDocMaxBytes,
-				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml`"
+				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml` (honored only if the project is trusted)",
+				defaultLimitHint: "Rulesync does not read `~/.codex/config.toml`; ignore this warning if you already raised `project_doc_max_bytes` there."
 			}
 		}
 	}],
@@ -100232,6 +100660,7 @@ var RulesProcessor = class extends FeatureProcessor {
 		const configuredBytes = await budget.readConfiguredBytes?.(this.outputRoot);
 		const limitBytes = configuredBytes ?? budget.bytes;
 		const limitLabel = budget.readConfiguredBytes === void 0 ? `${limitBytes}-byte limit` : configuredBytes === void 0 ? `${limitBytes}-byte default limit` : `${limitBytes}-byte limit set by ${budget.configuredSource ?? "the tool config"}`;
+		const remedy = configuredBytes === void 0 && budget.defaultLimitHint !== void 0 ? `${budget.remedy} ${budget.defaultLimitHint}` : budget.remedy;
 		const files = toolRules.map((rule) => ({
 			dir: normalizeRelativeDir(rule.getRelativeDirPath()),
 			path: toPosixPath((0, node_path.join)(rule.getRelativeDirPath(), rule.getRelativeFilePath())),
@@ -100242,7 +100671,7 @@ var RulesProcessor = class extends FeatureProcessor {
 		const rootFiles = files.filter(({ dir }) => dir === ".");
 		const rootBytes = rootFiles.reduce((sum, { bytes }) => sum + bytes, 0);
 		if (rootBytes > limitBytes) {
-			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${budget.remedy}`);
+			this.logger.warn(`The generated ${this.toolTarget} root instruction file${location} (${rootFiles.map(({ path }) => path).join(", ")}) is ${rootBytes} bytes, over the ${limitLabel}. ${remedy}`);
 			return;
 		}
 		const reportedDirs = [];
@@ -100253,7 +100682,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			const chainBytes = chain.reduce((sum, { bytes }) => sum + bytes, 0);
 			if (chainBytes > limitBytes) {
 				reportedDirs.push(file.dir);
-				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${budget.remedy}`);
+				this.logger.warn(`The generated ${this.toolTarget} instruction files${location} loaded while working in '${file.dir}' (${chain.map(({ path }) => path).join(", ")}) total ${chainBytes} bytes, over the ${limitLabel} (as is every directory below it). ${remedy}`);
 			}
 		}
 	}

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_import = require("./import-S70XttcD.cjs");
+const require_import = require("./import-DYYG88Rs.cjs");
 //#region src/index.ts
 async function generate(options = {}) {
 	const { silent = true, verbose = false, ...rest } = options;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Vn as ALL_FEATURES, bt as ConsoleLogger, dn as ALL_TOOL_TARGETS, dt as ConfigResolver, i as inspectInputRoots, o as convertFromTool$1, r as generate$1, t as importFromTool$1 } from "./import-BPSwSahy.js";
+import { Vn as ALL_FEATURES, bt as ConsoleLogger, dn as ALL_TOOL_TARGETS, dt as ConfigResolver, i as inspectInputRoots, o as convertFromTool$1, r as generate$1, t as importFromTool$1 } from "./import-BsEFYJsg.js";
 //#region src/index.ts
 async function generate(options = {}) {
 	const { silent = true, verbose = false, ...rest } = options;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulesync",
-  "version": "37.0.0",
+  "version": "37.1.0",
   "description": "Unified AI rules management CLI tool that generates configuration files for various AI development tools",
   "keywords": [
     "ai",