rulesync 37.1.0 → 38.0.0

package/dist/{import-DYYG88Rs.cjs → import-B9NOtObR.cjs}

@@ -457,36 +457,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$423 } = node_path.posix;
+const { join: join$426 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$423(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$426(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$423(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$423(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$426(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$426(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$423(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -652,6 +652,7 @@ const mcpProcessorToolTargetTuple = [
 	"musecode",
 	"mimocode",
 	"omp",
+	"openclaw",
 	"opencode",
 	"pi",
 	"pool",
@@ -704,6 +705,7 @@ const commandsProcessorToolTargetTuple = [
 	"kiro",
 	"kiro-cli",
 	"kiro-ide",
+	"lettacode",
 	"mimocode",
 	"omp",
 	"opencode",
@@ -931,6 +933,7 @@ const permissionsProcessorToolTargetTuple = [
 	"rovodev",
 	"tabnine",
 	"takt",
+	"trae",
 	"vibe",
 	"warp",
 	"warpcli",
@@ -4764,10 +4767,13 @@ const CLAUDE_HOOK_EVENTS = [
 * eight events: `PreToolUse`, `PostToolUse`, `PermissionRequest`,
 * `UserPromptSubmit`, `Stop`, `SessionStart`, `SessionEnd`, and
 * `PostCompaction` (fires after context compaction; added in the Devin CLI
-* stable changelog — https://docs.devin.ai/cli/changelog/stable). The
-* tool/permission events (`PreToolUse`/`PostToolUse`/`PermissionRequest`) carry
-* a `matcher` (regex against `tool_name`); the session/turn/compaction events
-* do not.
+* stable changelog — https://docs.devin.ai/cli/changelog/stable). CLI
+* v3000.11.92 added `PreCompact` and `PostCompact`, which run before and after
+* compaction with `manual` / `auto` trigger matchers; `PostCompaction` stays
+* supported. The tool/permission events (`PreToolUse`/`PostToolUse`/
+* `PermissionRequest`) carry a `matcher` (regex against `tool_name`) and
+* `PreCompact` a trigger matcher; the other session/turn/compaction events do
+* not.
 *
 * Hooks live in `.devin/hooks.v1.json` (project, standalone — the hooks object
 * is the entire file) or under the `"hooks"` key of `.devin/config.json` /
@@ -4783,6 +4789,7 @@ const DEVIN_HOOK_EVENTS = [
 	"beforeSubmitPrompt",
 	"stop",
 	"permissionRequest",
+	"preCompact",
 	"postCompact"
 ];
 /**
@@ -6166,12 +6173,17 @@ const CANONICAL_TO_DEVIN_EVENT_NAMES = {
 	beforeSubmitPrompt: "UserPromptSubmit",
 	stop: "Stop",
 	permissionRequest: "PermissionRequest",
+	preCompact: "PreCompact",
 	postCompact: "PostCompaction"
 };
 /**
-* Map Devin Local PascalCase event names to canonical camelCase.
+* Map Devin Local PascalCase event names to canonical camelCase. `PostCompact`
+* (CLI v3000.11.92) is accepted on import as an alias of `PostCompaction`.
 */
-const DEVIN_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_DEVIN_EVENT_NAMES).map(([k, v]) => [v, k]));
+const DEVIN_TO_CANONICAL_EVENT_NAMES = {
+	...Object.fromEntries(Object.entries(CANONICAL_TO_DEVIN_EVENT_NAMES).map(([k, v]) => [v, k])),
+	PostCompact: "postCompact"
+};
 /**
 * Map canonical camelCase event names to AugmentCode PascalCase.
 * Auggie reuses the same PascalCase names as Claude for the events it supports.
@@ -7104,6 +7116,17 @@ const CodexcliMcpToolConfigSchema = zod_mini.z.looseObject({
 function isCodexcliToolConfig(value) {
 	return CodexcliMcpToolConfigSchema.safeParse(value).success;
 }
+const CrushChannelReplyRouteSchema = zod_mini.z.looseObject({
+	tool: zod_mini.z.string(),
+	target_param: zod_mini.z.optional(zod_mini.z.string()),
+	target_meta: zod_mini.z.optional(zod_mini.z.string())
+});
+const CrushChannelReplySchema = zod_mini.z.looseObject({
+	user: zod_mini.z.optional(CrushChannelReplyRouteSchema),
+	group: zod_mini.z.optional(CrushChannelReplyRouteSchema),
+	message_param: zod_mini.z.optional(zod_mini.z.string()),
+	suppress_tools: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+});
 const McpServerSchema = zod_mini.z.looseObject({
 	type: zod_mini.z.optional(zod_mini.z.enum([
 		"local",
@@ -7145,6 +7168,9 @@ const McpServerSchema = zod_mini.z.looseObject({
 	crushOauthClientSecret: zod_mini.z.optional(zod_mini.z.string()),
 	crushOauthCallbackPort: zod_mini.z.optional(zod_mini.z.int()),
 	crushSessionless: zod_mini.z.optional(zod_mini.z.boolean()),
+	crushChannelEnabled: zod_mini.z.optional(zod_mini.z.boolean()),
+	crushChannelReply: zod_mini.z.optional(CrushChannelReplySchema),
+	zcodeOauth: zod_mini.z.optional(zod_mini.z.looseObject({ type: zod_mini.z.string() })),
 	poolAllow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	/**
@@ -7256,6 +7282,7 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	kiro: zod_mini.z.optional(toolScopedMcpSchema),
 	mimocode: zod_mini.z.optional(toolScopedMcpSchema),
 	omp: zod_mini.z.optional(toolScopedMcpSchema),
+	openclaw: zod_mini.z.optional(toolScopedMcpSchema),
 	opencode: zod_mini.z.optional(toolScopedMcpSchema),
 	pi: zod_mini.z.optional(toolScopedMcpSchema),
 	qoder: zod_mini.z.optional(toolScopedMcpSchema),
@@ -7603,11 +7630,16 @@ var RulesyncMcp = class RulesyncMcp extends RulesyncFile {
 				"crushOauthClientSecret",
 				"crushOauthCallbackPort",
 				"crushSessionless",
+				"crushChannelEnabled",
+				"crushChannelReply",
 				"poolAllow",
+				"zcodeOauth",
 				"oauth_client_id",
 				"oauth_client_secret",
 				"oauth_callback_port",
 				"sessionless",
+				"channel_enabled",
+				"channel_reply",
 				"enabled"
 			])];
 		}));
@@ -8343,8 +8375,12 @@ const TabninePermissionsOverrideSchema = zod_mini.z.looseObject({
 * are merged into the matching `reasonix.toml` table and emitted only for
 * Reasonix, while the shared `permission` block continues to drive
 * `[permissions].allow`/`ask`/`deny`. Kept `looseObject` (verbatim passthrough).
-* Note: the whole `[sandbox]` table round-trips, but only the plan-mode keys are
-* re-extracted from `[agent]` on import — other `agent` keys authored here reach
+* The user-only `[sandbox]` keys (`allow_devices`, `egress_unlisted`,
+* `host_authorities`) are written only by `--global` generate: Reasonix replaces
+* a project value with the user's (`narrowSandbox` in `project_scope.go`).
+* Note: the whole `[sandbox]` table round-trips (minus the user-only keys of a
+* project file), but only the plan-mode keys are re-extracted from `[agent]` on
+* import — other `agent` keys authored here reach
 * `reasonix.toml` on generate but are not re-extracted back into the override.
 *
 * @example
@@ -8376,14 +8412,52 @@ const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 * output-style` rule option) or a `plugin-name:style-name` reference. The
 * shared `permission` block continues to drive `permissions.allow`/`ask`/`deny`.
 *
+* The other documented settings with no canonical category are authored here
+* too and merged into the same file, key by key, over what the file already
+* holds: `general.defaultPermissionMode`, `tools.core` / `tools.exclude`, the
+* MCP approval and loading keys under `mcp` (`allowed`, `excluded`,
+* `enableAllProjectMcpServers`, `enabledProjectMcpServers`, `lazyLoad`),
+* `agents.overrides`, the top-level `agentsMdExcludes` and the top-level
+* `autoMode` classifier guidance (`allow` / `soft_deny` / `environment`).
+* Qoder reads `autoMode` from the user settings only, so it is written by
+* `--global` generate alone. Only the keys listed here are written; any other
+* key of these groups or of `autoMode` (`tools.shell.pager`,
+* `general.preferredEditor`, ...) is skipped with a warning. Each authored key
+* is laid over what the file holds; removing it from the override leaves the
+* previously written value in place.
+*
 * @see https://docs.qoder.com/cli/output-styles
 * @see https://docs.qoder.com/cli/settings-reference
+* @see https://docs.qoder.com/en/cli/permissions
 * @example
 * { "outputStyle": "concise-review" }
+* @example
+* { "mcp": { "enabledProjectMcpServers": ["playwright"], "lazyLoad": true },
+*   "tools": { "exclude": ["WebSearch"] },
+*   "autoMode": { "environment": ["This is a pnpm monorepo"] } }
 */
 const QoderPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	outputStyle: zod_mini.z.optional(zod_mini.z.string().check(zod_mini.z.trim(), zod_mini.z.minLength(1)))
+	outputStyle: zod_mini.z.optional(zod_mini.z.string().check(zod_mini.z.trim(), zod_mini.z.minLength(1))),
+	general: zod_mini.z.optional(zod_mini.z.looseObject({ defaultPermissionMode: zod_mini.z.optional(zod_mini.z.string().check(zod_mini.z.trim(), zod_mini.z.minLength(1))) })),
+	tools: zod_mini.z.optional(zod_mini.z.looseObject({
+		core: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		exclude: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	})),
+	mcp: zod_mini.z.optional(zod_mini.z.looseObject({
+		allowed: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		excluded: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		enableAllProjectMcpServers: zod_mini.z.optional(zod_mini.z.boolean()),
+		enabledProjectMcpServers: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		lazyLoad: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
+	agents: zod_mini.z.optional(zod_mini.z.looseObject({ overrides: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.looseObject({}))) })),
+	autoMode: zod_mini.z.optional(zod_mini.z.looseObject({
+		allow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		soft_deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		environment: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	})),
+	agentsMdExcludes: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 /**
 * One native Factory Droid permission rule. `match.prefix` positions are either
@@ -9171,14 +9245,40 @@ const ZedPermissionsOverrideSchema = zod_mini.z.looseObject({
 *
 * @example
 * { "sandbox": { "allowed_domains": ["github.com"], "network_mode": "limited" } }
+* The same override carries the repo-level plugin governance lists Devin reads
+* from a checkout's `.devin/config.json`: `requiredPlugins` (plugin sources
+* installed automatically), `optionalPlugins` (endorsed sources that carve an
+* exception out of a forbidden entry; never installed) and `forbiddenPlugins`
+* (plugin identities or `*` globs that may not load). A source is a string
+* (`"owner/repo"` or a git URL) or an object such as
+* `{ "source": "github", "repo": "owner/repo" }`. They are a repo governance
+* level, so they are emitted at project scope only.
+*
 * @example
 * { "sandbox": { "excluded": { "allow": ["Exec(git status *)"], "deny": ["Exec(git tag *)"] } } }
+* @example
+* { "forbiddenPlugins": ["*"], "optionalPlugins": ["acme/approved"] }
 * @see https://docs.devin.ai/cli/sandbox
 * @see https://docs.devin.ai/cli/reference/configuration/config-file
+* @see https://docs.devin.ai/cli/extensibility/plugins/overview
+*/
+const DevinPluginSourceListSchema = zod_mini.z.array(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})]));
+/**
+* Shapes of the Devin repo-level plugin governance lists, keyed by their
+* `.devin/config.json` name. Shared by the override schema and the import,
+* which drops a list that would not pass it.
 */
+const DEVIN_PLUGIN_GOVERNANCE_SCHEMAS = {
+	requiredPlugins: DevinPluginSourceListSchema,
+	optionalPlugins: DevinPluginSourceListSchema,
+	forbiddenPlugins: zod_mini.z.array(zod_mini.z.string())
+};
 const DevinPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({}))
+	sandbox: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	requiredPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.requiredPlugins),
+	optionalPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.optionalPlugins),
+	forbiddenPlugins: zod_mini.z.optional(DEVIN_PLUGIN_GOVERNANCE_SCHEMAS.forbiddenPlugins)
 });
 /**
 * Permissions configuration.
@@ -9252,6 +9352,7 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	"kimi-code": zod_mini.z.optional(KimiCodePermissionsOverrideSchema),
 	roo: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	rovodev: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	trae: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	zoocode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema)
 });
 /**
@@ -11110,6 +11211,11 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	})),
+	musecode: zod_mini.z.optional(zod_mini.z.looseObject({
+		license: zod_mini.z.optional(zod_mini.z.string()),
+		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
+	})),
 	zcode: zod_mini.z.optional(zod_mini.z.looseObject({
 		when_to_use: zod_mini.z.optional(zod_mini.z.string()),
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -11540,8 +11646,20 @@ const GITLABDUO_MR_REVIEW_INSTRUCTIONS_FILE_NAME = "mr-review-instructions.yaml"
 const GITLABDUO_COMMANDS_DIR = (0, node_path.join)(".agents", "commands");
 /** User custom slash commands. */
 const GITLABDUO_GLOBAL_COMMANDS_DIR = (0, node_path.join)(GITLABDUO_DIR, "commands");
-/** Project skills live in a non-hidden `skills/` directory at the project root. */
-const GITLABDUO_SKILLS_DIR = "skills";
+/**
+* Project skills live in the cross-tool `.agents/skills/` directory, which
+* GitLab Duo reads alongside a non-hidden `skills/` directory at the project
+* root; when both hold a skill of the same name, `.agents/skills/` wins.
+*
+* @see https://docs.gitlab.com/user/duo_agent_platform/customize/agent_skills/
+*/
+const GITLABDUO_SKILLS_DIR = (0, node_path.join)(".agents", "skills");
+/**
+* The project-root `skills/` directory GitLab Duo also reads. Earlier rulesync
+* versions wrote project skills there; it is now an import-only root, since it
+* routinely holds hand-authored skills rulesync must not manage.
+*/
+const GITLABDUO_LEGACY_SKILLS_DIR = "skills";
 /** User skills (requires `--enable-global-skills` / `GITLAB_ENABLE_GLOBAL_SKILLS`). */
 const GITLABDUO_GLOBAL_SKILLS_DIR = (0, node_path.join)(GITLABDUO_DIR, "skills");
 //#endregion
@@ -11703,6 +11821,239 @@ const CODEXCLI_OVERRIDE_KEYS = [
 	"approvals_reviewer",
 	"tui"
 ];
+const SINGLE_CHAR_ESCAPES = {
+	"'": "'",
+	"\"": "\"",
+	"\\": "\\",
+	b: "\b",
+	f: "\f",
+	n: "\n",
+	r: "\r",
+	t: "	",
+	v: "\v"
+};
+const LINE_TERMINATORS = /* @__PURE__ */ new Set([
+	"\n",
+	"\r",
+	"\u2028",
+	"\u2029"
+]);
+const ID_START = /[\p{L}\p{Nl}$_]/u;
+const ID_CONTINUE = /[\p{L}\p{Nl}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$_\u200C\u200D]/u;
+const WHITESPACE$1 = /[\t\n\v\f\r \u00A0\u2028\u2029\uFEFF\p{Zs}]/u;
+var Json5Reader = class {
+	text;
+	pos = 0;
+	constructor(text) {
+		this.text = text;
+	}
+	parse() {
+		this.skipTrivia();
+		const value = this.readValue(0);
+		this.skipTrivia();
+		if (this.pos < this.text.length) this.fail(`unexpected ${this.describe()} after the end of the document`);
+		return value;
+	}
+	fail(message) {
+		let line = 1;
+		let column = 1;
+		for (let i = 0; i < this.pos && i < this.text.length; i++) if (this.text[i] === "\n") {
+			line++;
+			column = 1;
+		} else column++;
+		throw new SyntaxError(`JSON5: ${message} at line ${line}, column ${column}`);
+	}
+	describe() {
+		const char = this.text[this.pos];
+		return char === void 0 ? "end of input" : `character ${JSON.stringify(char)}`;
+	}
+	peek(offset = 0) {
+		return this.text[this.pos + offset];
+	}
+	skipTrivia() {
+		while (this.pos < this.text.length) {
+			const char = this.text[this.pos];
+			if (WHITESPACE$1.test(char)) this.pos++;
+			else if (char === "/" && this.peek(1) === "/") {
+				this.pos += 2;
+				while (this.pos < this.text.length && !LINE_TERMINATORS.has(this.text[this.pos])) this.pos++;
+			} else if (char === "/" && this.peek(1) === "*") {
+				const end = this.text.indexOf("*/", this.pos + 2);
+				if (end === -1) this.fail("unterminated block comment");
+				this.pos = end + 2;
+			} else return;
+		}
+	}
+	readValue(depth) {
+		const char = this.peek();
+		if (char === "{" || char === "[") {
+			if (depth >= 256) this.fail(`document nests deeper than 256 levels`);
+			return char === "{" ? this.readObject(depth + 1) : this.readArray(depth + 1);
+		}
+		if (char === "\"" || char === "'") return this.readString();
+		if (char !== void 0 && /[0-9+\-.IN]/.test(char)) return this.readNumber();
+		for (const [literal, value] of [
+			["true", true],
+			["false", false],
+			["null", null]
+		]) if (this.text.startsWith(literal, this.pos) && !this.isIdContinueAt(literal.length)) {
+			this.pos += literal.length;
+			return value;
+		}
+		return this.fail(`unexpected ${this.describe()}`);
+	}
+	isIdContinueAt(offset) {
+		const char = this.peek(offset);
+		return char !== void 0 && (ID_CONTINUE.test(char) || char === "\\");
+	}
+	readObject(depth) {
+		const result = {};
+		this.pos++;
+		this.skipTrivia();
+		while (this.peek() !== "}") {
+			const key = this.readKey();
+			this.skipTrivia();
+			if (this.peek() !== ":") this.fail(`expected ':' after the key ${JSON.stringify(key)}`);
+			this.pos++;
+			this.skipTrivia();
+			const value = this.readValue(depth);
+			Object.defineProperty(result, key, {
+				value,
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+			this.skipTrivia();
+			if (this.peek() === ",") {
+				this.pos++;
+				this.skipTrivia();
+				continue;
+			}
+			if (this.peek() !== "}") this.fail(`expected ',' or '}' but found ${this.describe()}`);
+		}
+		this.pos++;
+		return result;
+	}
+	readArray(depth) {
+		const result = [];
+		this.pos++;
+		this.skipTrivia();
+		while (this.peek() !== "]") {
+			result.push(this.readValue(depth));
+			this.skipTrivia();
+			if (this.peek() === ",") {
+				this.pos++;
+				this.skipTrivia();
+				continue;
+			}
+			if (this.peek() !== "]") this.fail(`expected ',' or ']' but found ${this.describe()}`);
+		}
+		this.pos++;
+		return result;
+	}
+	readKey() {
+		const char = this.peek();
+		if (char === "\"" || char === "'") return this.readString();
+		let key = "";
+		while (this.pos < this.text.length) {
+			const start = this.pos;
+			let next = this.peek();
+			if (next === "\\") {
+				if (this.peek(1) !== "u") this.fail("expected a \\u escape in an identifier key");
+				this.pos += 2;
+				next = this.readHex(4);
+			} else this.pos++;
+			if (!(key === "" ? ID_START.test(next) : ID_CONTINUE.test(next))) {
+				this.pos = start;
+				break;
+			}
+			key += next;
+		}
+		if (key === "") this.fail(`expected a key but found ${this.describe()}`);
+		return key;
+	}
+	/** Reads `length` hex digits at the cursor and returns the character they encode. */
+	readHex(length) {
+		const digits = this.text.slice(this.pos, this.pos + length);
+		if (digits.length !== length || !/^[0-9a-fA-F]+$/.test(digits)) this.fail(`expected ${length} hexadecimal digits`);
+		this.pos += length;
+		return String.fromCharCode(Number.parseInt(digits, 16));
+	}
+	readString() {
+		const quote = this.peek();
+		this.pos++;
+		let result = "";
+		while (true) {
+			const char = this.peek();
+			if (char === void 0) this.fail("unterminated string");
+			if (char === quote) {
+				this.pos++;
+				return result;
+			}
+			if (char === "\n" || char === "\r") this.fail("unescaped line break in a string");
+			if (char !== "\\") {
+				result += char;
+				this.pos++;
+				continue;
+			}
+			this.pos++;
+			const escape = this.peek();
+			if (escape === void 0) this.fail("unterminated string");
+			if (escape === "\r") this.pos += this.peek(1) === "\n" ? 2 : 1;
+			else if (LINE_TERMINATORS.has(escape)) this.pos++;
+			else if (escape === "x") {
+				this.pos++;
+				result += this.readHex(2);
+			} else if (escape === "u") {
+				this.pos++;
+				result += this.readHex(4);
+			} else if (escape === "0") {
+				if (/[0-9]/.test(this.peek(1) ?? "")) this.fail("octal escapes are not allowed");
+				result += "\0";
+				this.pos++;
+			} else if (/[1-9]/.test(escape)) this.fail("octal escapes are not allowed");
+			else {
+				result += SINGLE_CHAR_ESCAPES[escape] ?? escape;
+				this.pos++;
+			}
+		}
+	}
+	readNumber() {
+		const start = this.pos;
+		let sign = 1;
+		if (this.peek() === "+" || this.peek() === "-") {
+			sign = this.peek() === "-" ? -1 : 1;
+			this.pos++;
+		}
+		for (const [literal, value] of [["Infinity", Infinity], ["NaN", NaN]]) if (this.text.startsWith(literal, this.pos)) {
+			if (this.isIdContinueAt(literal.length)) break;
+			this.pos += literal.length;
+			return sign * value;
+		}
+		if (this.peek() === "0" && (this.peek(1) === "x" || this.peek(1) === "X")) {
+			this.pos += 2;
+			const digits = /^[0-9a-fA-F]+/.exec(this.text.slice(this.pos))?.[0];
+			if (digits === void 0) this.fail("expected hexadecimal digits");
+			this.pos += digits.length;
+			return sign * Number.parseInt(digits, 16);
+		}
+		const match = /^(?:(?:0|[1-9][0-9]*)(?:\.[0-9]*)?|\.[0-9]+)(?:[eE][+-]?[0-9]+)?/.exec(this.text.slice(this.pos));
+		if (match === null) {
+			this.pos = start;
+			this.fail(`invalid number`);
+		}
+		this.pos += match[0].length;
+		if (this.isIdContinueAt(0)) this.fail(`invalid number`);
+		return sign * Number(match[0]);
+	}
+};
+/**
+* Parse a JSON5 document. Throws a `SyntaxError` naming the line and column of
+* the first problem.
+*/
+function parseJson5(text) {
+	return new Json5Reader(text).parse();
+}
 //#endregion
 //#region src/utils/quote-value.ts
 /**
@@ -11852,6 +12203,7 @@ function parseSharedConfig({ format, fileContent, filePath, invalidRootPolicy =
 		if (format === "yaml") parsed = loadYaml(fileContent);
 		else if (format === "toml") parsed = (0, smol_toml.parse)(fileContent);
 		else if (format === "json") parsed = JSON.parse(fileContent);
+		else if (format === "json5") parsed = parseJson5(fileContent);
 		else if (jsoncParseErrors === "error") {
 			const errors = [];
 			parsed = (0, jsonc_parser.parse)(fileContent, errors, { allowTrailingComma: true });
@@ -12449,8 +12801,12 @@ function serializeSharedConfig({ format, document, existingContent, leadingKeys
 		format,
 		document
 	});
-	if (format !== "jsonc" || existingContent.trim() === "") return whole;
+	if (format !== "jsonc" && format !== "json5" || existingContent.trim() === "") return whole;
 	const wholeBecause = (reason) => {
+		if (format === "json5") throw new Json5EditRefusedError({
+			filePath,
+			reason
+		});
 		warnAboutWholeJsoncRewrite({
 			filePath,
 			reason,
@@ -12461,7 +12817,7 @@ function serializeSharedConfig({ format, document, existingContent, leadingKeys
 	try {
 		const errors = [];
 		const root = (0, jsonc_parser.parseTree)(existingContent, errors, { allowTrailingComma: true });
-		if (root === void 0 || errors.length > 0) return wholeBecause("it could not be parsed");
+		if (root === void 0 || errors.length > 0) return wholeBecause(format === "json5" ? "it uses JSON5-only syntax (such as unquoted keys, single quotes, hex numbers, Infinity or NaN)" : "it could not be parsed");
 		if (root.type !== "object") return wholeBecause("its root is not an object");
 		const uneditable = uneditableKeyOf(root);
 		if (uneditable !== void 0) {
@@ -12490,10 +12846,22 @@ function serializeSharedConfig({ format, document, existingContent, leadingKeys
 			leadingKeys
 		});
 	} catch (error) {
+		if (error instanceof Json5EditRefusedError) throw error;
 		return wholeBecause(`the editor refused it (${stripControlCharacters(formatError(error))})`);
 	}
 }
 /**
+* Thrown instead of rewriting a `json5` file whole (see
+* {@link serializeSharedConfig}); nothing is written.
+*/
+var Json5EditRefusedError = class extends Error {
+	constructor({ filePath, reason }) {
+		const subject = filePath === void 0 ? "a shared JSON5 config file" : quoteForLog(filePath);
+		super(`Refusing to update ${subject}: rulesync cannot edit it in place because ${reason}, and rewriting it whole would drop its comments and could change its values. Convert it to JSONC-compatible syntax (double-quoted keys and strings, decimal numbers; comments and trailing commas are fine), or add the entries by hand.`);
+		this.name = "Json5EditRefusedError";
+	}
+};
+/**
 * Report, once per run and file, that a JSONC file is being written whole
 * instead of edited in place. Named by `filePath` when the caller knows it;
 * a caller serializing text it never read from disk has no name to give.
@@ -12556,6 +12924,7 @@ const KIMI_CODE_HOME_CONFIG_SHARED_FILE_KEY = "config.toml";
 const REASONIX_PROJECT_CONFIG_SHARED_FILE_KEY = "reasonix.toml";
 const REASONIX_GLOBAL_CONFIG_SHARED_FILE_KEY = ".reasonix/config.toml";
 const ROVODEV_CONFIG_SHARED_FILE_KEY = ".rovodev/config.yml";
+const OPENCLAW_CONFIG_SHARED_FILE_KEY = ".openclaw/openclaw.json";
 const POOL_PROJECT_SETTINGS_SHARED_FILE_KEY = ".poolside/settings.yaml";
 const POOL_GLOBAL_SETTINGS_SHARED_FILE_KEY = ".config/poolside/settings.yaml";
 /**
@@ -13011,7 +13380,12 @@ const SHARED_CONFIG_OWNERSHIP = {
 		format: "json",
 		features: { permissions: {
 			kind: "replace-owned-keys",
-			ownedKeys: ["permissions"]
+			ownedKeys: [
+				"permissions",
+				"requiredPlugins",
+				"optionalPlugins",
+				"forbiddenPlugins"
+			]
 		} }
 	},
 	".config/devin/config.json": {
@@ -13159,10 +13533,27 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions", "outputStyle"]
+				ownedKeys: [
+					"permissions",
+					"outputStyle",
+					"general",
+					"tools",
+					"mcp",
+					"agents",
+					"autoMode",
+					"agentsMdExcludes"
+				]
 			}
 		}
 	},
+	".trae/permission/global.json": {
+		format: "json",
+		invalidRootPolicy: "error",
+		features: { permissions: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["customProfiles", "resourceAuthorization"]
+		} }
+	},
 	".tabnine/agent/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -13436,6 +13827,14 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: ["toolPermissions"]
 			}
 		}
+	},
+	[OPENCLAW_CONFIG_SHARED_FILE_KEY]: {
+		format: "json5",
+		invalidRootPolicy: "error",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcp"]
+		} }
 	}
 };
 /**
@@ -21978,6 +22377,190 @@ var KiroIdeCommand = class extends KiroCommand {
 	}
 };
 //#endregion
+//#region src/constants/lettacode-paths.ts
+const LETTACODE_DIR = ".letta";
+const LETTACODE_SETTINGS_FILE_NAME = "settings.json";
+const LETTACODE_SETTINGS_LOCAL_FILE_NAME = "settings.local.json";
+const LETTACODE_IGNORE_FILE_NAME = ".lettaignore";
+const LETTACODE_AGENTS_DIR_PATH = (0, node_path.join)(LETTACODE_DIR, "agents");
+const LETTACODE_PROJECT_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
+const LETTACODE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(LETTACODE_DIR, "skills");
+const LETTACODE_PROJECT_COMMANDS_DIR_PATH = ".commands";
+const LETTACODE_GLOBAL_COMMANDS_DIR_PATH = (0, node_path.join)(LETTACODE_DIR, "commands");
+//#endregion
+//#region src/features/commands/lettacode-command.ts
+/**
+* The only frontmatter keys Letta Code reads from a custom command
+* (`parseCommandFile` in `src/cli/commands/custom.ts`). Anything else — e.g.
+* `allowed-tools`, `model` or `disable-model-invocation` copied over from a
+* Claude Code command — is parsed and ignored upstream.
+*/
+const LETTACODE_COMMAND_FRONTMATTER_KEYS = ["description", "argument-hint"];
+const LettacodeCommandFrontmatterSchema = zod_mini.z.looseObject({
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	"argument-hint": zod_mini.z.optional(zod_mini.z.string())
+});
+function pickLettacodeFrontmatter({ section, relativeFilePath, logger }) {
+	if (!isRecord$1(section)) return {};
+	const picked = {};
+	for (const [key, value] of Object.entries(section)) {
+		if (LETTACODE_COMMAND_FRONTMATTER_KEYS.includes(key)) {
+			picked[key] = value;
+			continue;
+		}
+		warnWithFallback(logger, `Letta Code commands: dropping lettacode.${stripControlCharacters(key)} from ${quoteForLog(relativeFilePath)}: Letta Code only reads ${LETTACODE_COMMAND_FRONTMATTER_KEYS.join(" and ")}.`);
+	}
+	return picked;
+}
+/**
+* Letta Code custom slash commands: Markdown prompt files under `.commands/`
+* (project, at the working-directory root) and `~/.letta/commands/` (global),
+* discovered recursively. The file basename is the command id
+* (`git/commit.md` is invoked as `/commit`; `findCustomCommand` matches the
+* id only), so two files with the same basename collide and the first one
+* found wins; a project command wins over a global one with the same id. Frontmatter supports `description` (defaulting to the first body
+* line) and `argument-hint`; the body supports `$ARGUMENTS`, `$1`..`$9`,
+* `` !`command` `` and `@file`.
+*
+* `description` comes from the rulesync frontmatter; a `lettacode:` section
+* may set `argument-hint` (and override `description`). Other keys in that
+* section are dropped with a warning because Letta Code never reads them.
+*
+* @see https://docs.letta.com/platform/cli/slash-commands
+* @see https://github.com/letta-ai/letta-code/blob/main/src/cli/commands/custom.ts
+*/
+var LettacodeCommand = class LettacodeCommand extends ToolCommand {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate) {
+			const result = LettacodeCommandFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: stringifyFrontmatter(body, frontmatter)
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return { relativeDirPath: global ? LETTACODE_GLOBAL_COMMANDS_DIR_PATH : LETTACODE_PROJECT_COMMANDS_DIR_PATH };
+	}
+	getBody() {
+		return this.body;
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	toRulesyncCommand() {
+		const { description, ...restFields } = this.frontmatter;
+		const rulesyncFrontmatter = {
+			targets: ["*"],
+			description,
+			...Object.keys(restFields).length > 0 && { lettacode: restFields }
+		};
+		return new RulesyncCommand({
+			outputRoot: ".",
+			frontmatter: rulesyncFrontmatter,
+			body: this.body,
+			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.relativeFilePath,
+			fileContent: stringifyFrontmatter(this.body, rulesyncFrontmatter),
+			validate: true
+		});
+	}
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false, logger }) {
+		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
+		const lettacodeFields = pickLettacodeFrontmatter({
+			section: rulesyncFrontmatter.lettacode,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
+			logger
+		});
+		const frontmatter = {
+			...rulesyncFrontmatter.description !== void 0 && { description: rulesyncFrontmatter.description },
+			...lettacodeFields
+		};
+		const paths = this.getSettablePaths({ global });
+		return new LettacodeCommand({
+			outputRoot,
+			frontmatter,
+			body: rulesyncCommand.getBody(),
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath(),
+			validate,
+			global
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = LettacodeCommandFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	/**
+	* Warn when two targeted commands share a basename. Letta Code invokes a
+	* command by its basename only, so `git/commit.md` and `release/commit.md`
+	* are both `/commit` and only the first one Letta Code finds is reachable.
+	* Both files are still written, so this warns instead of failing the run.
+	*/
+	static validateRulesyncCommands({ rulesyncCommands, logger }) {
+		const pathsById = /* @__PURE__ */ new Map();
+		for (const command of rulesyncCommands) {
+			if (!this.isTargetedByRulesyncCommand(command)) continue;
+			const relativeFilePath = command.getRelativeFilePath();
+			const id = (0, node_path.basename)(relativeFilePath, ".md");
+			pathsById.set(id, [...pathsById.get(id) ?? [], relativeFilePath]);
+		}
+		for (const [id, paths] of pathsById) {
+			if (paths.length < 2) continue;
+			logger.warn(`Letta Code invokes commands by file basename, so ${paths.map((path) => quoteForLog(path)).join(", ")} are all /${stripControlCharacters(id)} and only one of them is reachable. Rename them to make each invocable.`);
+		}
+	}
+	static isTargetedByRulesyncCommand(rulesyncCommand) {
+		return this.isTargetedByRulesyncCommandDefault({
+			rulesyncCommand,
+			toolTarget: "lettacode"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const result = LettacodeCommandFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new LettacodeCommand({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new LettacodeCommand({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/constants/mimocode-paths.ts
 /**
 * MiMo Code (Xiaomi's OpenCode fork) reads `.mimocode/` in the project and
@@ -21995,7 +22578,8 @@ const MIMOCODE_LAYOUT = {
 	configDir: MIMOCODE_DIR,
 	jsonFileName: "mimocode.json",
 	jsoncFileName: "mimocode.jsonc",
-	readsV2ConfigSpellings: false
+	readsV2ConfigSpellings: false,
+	readsDotDirConfig: false
 };
 //#endregion
 //#region src/constants/opencode-paths.ts
@@ -22022,7 +22606,8 @@ const OPENCODE_LAYOUT = {
 	configDir: ".",
 	jsonFileName: OPENCODE_JSON_FILE_NAME,
 	jsoncFileName: OPENCODE_JSONC_FILE_NAME,
-	readsV2ConfigSpellings: true
+	readsV2ConfigSpellings: true,
+	readsDotDirConfig: true
 };
 //#endregion
 //#region src/features/opencode-config.ts
@@ -22056,6 +22641,107 @@ async function readOpencodeConfig({ outputRoot, global = false, layout = OPENCOD
 	});
 }
 /**
+* Reads the project-scope config files OpenCode merges over the root
+* `opencode.json(c)`: `.opencode/opencode.json`, then `.opencode/opencode.jsonc`,
+* in the order OpenCode loads them (a later file wins). Returns an empty list
+* in global mode and for layouts without this location (MiMo Code).
+*
+* @see https://opencode.ai/docs/config/#precedence-order
+* @see https://github.com/anomalyco/opencode/blob/v1.19.3/packages/opencode/src/config/config.ts
+*/
+async function readOpencodeDotDirConfigLayers({ outputRoot, global = false, layout = OPENCODE_LAYOUT }) {
+	if (global || !layout.readsDotDirConfig) return [];
+	const configDir = (0, node_path.join)(outputRoot, layout.dir);
+	const layers = [];
+	for (const fileName of [layout.jsonFileName, layout.jsoncFileName]) {
+		const fileContent = await readFileContentOrNull((0, node_path.join)(configDir, fileName));
+		if (fileContent === null) continue;
+		layers.push({
+			relativeFilePath: (0, node_path.join)(layout.dir, fileName),
+			configDir,
+			config: parseSharedConfig({
+				format: "jsonc",
+				fileContent
+			})
+		});
+	}
+	return layers;
+}
+/**
+* Reads every OpenCode config file that applies at this scope, lowest
+* precedence first: the root config (see {@link readOpencodeConfig}), then the
+* `.opencode/` files (see {@link readOpencodeDotDirConfigLayers}).
+*/
+async function readOpencodeConfigLayers({ outputRoot, global = false, layout = OPENCODE_LAYOUT }) {
+	return [{
+		configDir: getOpencodeConfigDir({
+			outputRoot,
+			global,
+			layout
+		}),
+		config: await readOpencodeConfig({
+			outputRoot,
+			global,
+			layout
+		})
+	}, ...await readOpencodeDotDirConfigLayers({
+		outputRoot,
+		global,
+		layout
+	})];
+}
+/**
+* Deep-merges `source` over `target` the way OpenCode merges its config files
+* (remeda's `mergeDeep`): plain objects merge key by key, and any other value —
+* arrays included — replaces the target's.
+*/
+function mergeOpencodeConfigValues(target, source) {
+	if (!isRecord$1(target) || !isRecord$1(source)) return source;
+	const merged = {};
+	for (const [key, value] of Object.entries(target)) setOwnEntry(merged, key, value);
+	for (const [key, value] of Object.entries(source)) setOwnEntry(merged, key, Object.hasOwn(target, key) ? mergeOpencodeConfigValues(target[key], value) : value);
+	return merged;
+}
+/**
+* Merges per-file entry maps (the `command` or `agent` entries of each config
+* layer, lowest precedence first) into one, as OpenCode does. Returns `null`
+* when no layer has entries.
+*/
+function mergeOpencodeEntryLayers(layers) {
+	let merged = null;
+	for (const entries of layers) {
+		if (entries === null) continue;
+		const next = mergeOpencodeConfigValues(merged ?? {}, entries);
+		merged = isRecord$1(next) ? next : merged;
+	}
+	return merged;
+}
+/**
+* Warns when a `.opencode/opencode.json(c)` file sets entries that the
+* generated root config also sets. OpenCode merges those files over the root
+* config, so their entries win and the generated ones never take effect.
+*
+* `generated` maps each top-level key rulesync writes (`mcp`, `permission`) to
+* its generated value. `overlays` are the `.opencode/` layers, already lowered
+* by the caller where needed.
+*/
+function warnOpencodeDotDirOverrides({ generated, overlays, rootFileName, logger }) {
+	if (!logger) return;
+	for (const overlay of overlays) {
+		const overridden = [];
+		for (const [key, value] of Object.entries(generated)) {
+			if (value === void 0 || !Object.hasOwn(overlay.config, key)) continue;
+			const overlayValue = overlay.config[key];
+			if (!isRecord$1(value) || !isRecord$1(overlayValue)) {
+				overridden.push(`"${key}"`);
+				continue;
+			}
+			for (const name of Object.keys(value)) if (Object.hasOwn(overlayValue, name)) overridden.push(`"${key}" > ${quoteValueForWarning(name)}`);
+		}
+		if (overridden.length > 0) logger.warn(`OpenCode merges "${toPosixPath(overlay.relativeFilePath)}" over the generated "${rootFileName}", so its values for these generated entries take precedence: ${overridden.join(", ")}.`);
+	}
+}
+/**
 * Narrows an unknown value to a plain record of entries keyed by name, as used
 * for OpenCode's `command` / `agent` config sections. Returns `null` when the
 * value is not a usable object.
@@ -22498,8 +23184,9 @@ var OpenCodeCommand = class extends ToolCommand {
 		});
 	}
 	/**
-	* Imports commands defined inline in `opencode.json` / `opencode.jsonc` under
-	* the top-level `command` key — or its V2 spelling `commands`, see
+	* Imports commands defined inline in `opencode.json` / `opencode.jsonc` (and,
+	* at project scope, `.opencode/opencode.json(c)`, which OpenCode merges over
+	* them) under the top-level `command` key — or its V2 spelling `commands`, see
 	* `getOpencodeCommandEntries` — (in addition to the Markdown files under
 	* `.opencode/commands/`). Each entry's `template` becomes the command body,
 	* while `description` / `agent` / `model` / `variant` / `subtask` map to the
@@ -22512,14 +23199,14 @@ var OpenCodeCommand = class extends ToolCommand {
 	* @see https://opencode.ai/docs/commands/#json
 	*/
 	static async loadAdditionalImportFiles({ outputRoot = process.cwd(), global = false } = {}) {
-		const commandEntries = getOpencodeCommandEntries({
-			config: await readOpencodeConfig({
-				outputRoot,
-				global,
-				layout: this.layout
-			}),
+		const commandEntries = mergeOpencodeEntryLayers((await readOpencodeConfigLayers({
+			outputRoot,
+			global,
 			layout: this.layout
-		});
+		})).map(({ config }) => getOpencodeCommandEntries({
+			config,
+			layout: this.layout
+		})));
 		if (!commandEntries) return [];
 		const paths = this.getSettablePaths({ global });
 		const commands = [];
@@ -23905,6 +24592,7 @@ var TaktCommand = class TaktCommand extends ToolCommand {
 * @see https://docs.trae.ai/ide/add-mcp-servers?_lang=en
 * @see https://docs.trae.ai/ide/slash-commands?_lang=en
 * @see https://docs.trae.ai/ide/ignore-files?_lang=en
+* @see https://docs.trae.ai/ide/permission-and-approval?_lang=en
 */
 const TRAE_DIR = ".trae";
 /** Project MCP servers (`mcpServers` object), project scope only. */
@@ -23918,6 +24606,13 @@ const TRAE_SKILLS_DIR_PATH = (0, node_path.join)(TRAE_DIR, "skills");
 const TRAE_COMMANDS_DIR_PATH = (0, node_path.join)(TRAE_DIR, "commands");
 /** Indexing ignore list (gitignore syntax), `.trae/.ignore`, project scope only. */
 const TRAE_IGNORE_FILE_NAME = ".ignore";
+/**
+* Global permission policy: `~/.trae/permission/global.json`, user scope only. It
+* also holds the custom permission mode (`customProfiles`), so it is edited in
+* place rather than owned outright.
+*/
+const TRAE_PERMISSION_DIR_PATH = (0, node_path.join)(TRAE_DIR, "permission");
+const TRAE_PERMISSION_FILE_NAME = "global.json";
 //#endregion
 //#region src/features/commands/trae-command.ts
 const TraeCommandFrontmatterSchema = zod_mini.z.looseObject({
@@ -24683,6 +25378,17 @@ const toolCommandFactories = /* @__PURE__ */ new Map([
 			supportsSubdirectory: false
 		}
 	}],
+	["lettacode", {
+		class: LettacodeCommand,
+		meta: {
+			extension: "md",
+			supportsProject: true,
+			supportsGlobal: true,
+			isSimulated: false,
+			supportsSubdirectory: true,
+			committedOutput: true
+		}
+	}],
 	["mimocode", {
 		class: MimocodeCommand,
 		meta: {
@@ -24992,12 +25698,25 @@ var CommandsProcessor = class extends FeatureProcessor {
 		return rulesyncCommands;
 	}
 	/**
+	* Whether {@link loadToolFiles} must not scan the tool's output tree at all.
+	* `skipToolFileScan` targets never scan it; a `committedOutput` target is not
+	* swept at project scope, because nothing on disk tells a hand-written
+	* command in such a committed root apart from one rulesync generated.
+	*/
+	skipsToolFileScan({ factory, forDeletion }) {
+		if (factory.meta.skipToolFileScan) return true;
+		return forDeletion && factory.meta.committedOutput === true && !this.global;
+	}
+	/**
 	* Implementation of abstract method from FeatureProcessor
 	* Load tool-specific command configurations and parse them into ToolCommand instances
 	*/
 	async loadToolFiles({ forDeletion = false } = {}) {
 		const factory = this.getFactory(this.toolTarget);
-		if (factory.meta.skipToolFileScan) return [];
+		if (this.skipsToolFileScan({
+			factory,
+			forDeletion
+		})) return [];
 		const paths = factory.class.getSettablePaths({ global: this.global });
 		const outputRootFull = (0, node_path.join)(this.outputRoot, paths.relativeDirPath);
 		const commandFilePaths = await findFilesByGlobs(factory.meta.supportsSubdirectory ? `**/*.${factory.meta.extension}` : `*.${factory.meta.extension}`, {
@@ -26714,13 +27433,48 @@ function emitAllPassthroughFields({ def, hookType, eventName, converterConfig, w
 		})
 	};
 }
+/**
+* Why a definition must not be emitted for this tool, or `undefined` when it
+* can be: it carries a restricting field the tool refuses to honour (see
+* `skippedWhenFields`).
+*/
+function describeExportSkipReason({ def, hookType, eventName, converterConfig }) {
+	const field = converterConfig.skippedWhenFields?.find((name) => isNonEmptyString(def[name]));
+	if (field === void 0) return;
+	return `Skipping a "${eventName}" ${hookType} hook (${quoteValueForWarning(def.command ?? def.url)}): this tool does not support its "${field}" condition (${quoteValueForWarning(def[field])}), and without it the hook would run on every call its matcher selects.`;
+}
+/**
+* Whether a definition can be emitted for this tool: its hook type is one the
+* tool supports, and it carries no restricting field the tool refuses to
+* honour (warned about here).
+*/
+function isEmittableDefinition({ def, hookType, eventName, converterConfig, warn }) {
+	if (!isSupportedHookType({
+		type: hookType,
+		converterConfig
+	})) return false;
+	const skipReason = describeExportSkipReason({
+		def,
+		hookType,
+		eventName,
+		converterConfig
+	});
+	if (skipReason !== void 0) {
+		warn?.(skipReason);
+		return false;
+	}
+	return true;
+}
 function buildToolHooks({ defs, eventName, converterConfig, warn }) {
 	const hooks = [];
 	for (const def of defs) {
 		const hookType = def.type ?? "command";
-		if (!isSupportedHookType({
-			type: hookType,
-			converterConfig
+		if (!isEmittableDefinition({
+			def,
+			hookType,
+			eventName,
+			converterConfig,
+			warn
 		})) continue;
 		const command = applyCommandPrefix({
 			def,
@@ -27292,7 +28046,10 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 				warn
 			}));
 		}
-		if (defs.length > 0) canonical[eventName] = defs;
+		if (defs.length > 0) {
+			const existing = Object.hasOwn(canonical, eventName) ? canonical[eventName] : void 0;
+			canonical[eventName] = existing ? [...existing, ...defs] : defs;
+		}
 	}
 	return canonical;
 }
@@ -32002,6 +32759,16 @@ const GROKCLI_CONVERTER_CONFIG = {
 		tool: "env",
 		commandOnly: true
 	}],
+	arrayPassthroughFields: [{
+		canonical: "args",
+		tool: "args",
+		commandOnly: true
+	}],
+	skippedWhenFields: ["if"],
+	stringPassthroughFields: [{
+		canonical: "if",
+		tool: "if"
+	}],
 	noMatcherEvents: /* @__PURE__ */ new Set(["stop", "beforeSubmitPrompt"])
 };
 /**
@@ -33498,15 +34265,6 @@ var KiroHooks = class KiroHooks extends ToolHooks {
 	}
 };
 //#endregion
-//#region src/constants/lettacode-paths.ts
-const LETTACODE_DIR = ".letta";
-const LETTACODE_SETTINGS_FILE_NAME = "settings.json";
-const LETTACODE_SETTINGS_LOCAL_FILE_NAME = "settings.local.json";
-const LETTACODE_IGNORE_FILE_NAME = ".lettaignore";
-const LETTACODE_AGENTS_DIR_PATH = (0, node_path.join)(LETTACODE_DIR, "agents");
-const LETTACODE_PROJECT_SKILLS_DIR_PATH = (0, node_path.join)(".agents", "skills");
-const LETTACODE_GLOBAL_SKILLS_DIR_PATH = (0, node_path.join)(LETTACODE_DIR, "skills");
-//#endregion
 //#region src/features/hooks/lettacode-hooks.ts
 const LETTACODE_CONVERTER_CONFIG = {
 	supportedEvents: LETTACODE_HOOK_EVENTS,
@@ -43195,8 +43953,10 @@ var CortexcodeMcp = class CortexcodeMcp extends ToolMcp {
 /**
 * Crush-only MCP fields with no canonical counterpart, authored under a
 * `crush`-prefixed key in `.rulesync/mcp.jsonc` and written under Crush's own
-* name: `oauth*` drive Crush's OAuth 2.1 flow for HTTP servers and
-* `sessionless` marks a server that issues no `Mcp-Session-Id`.
+* name: `oauth*` drive Crush's OAuth 2.1 flow for HTTP servers,
+* `sessionless` marks a server that issues no `Mcp-Session-Id`; and
+* `channel_enabled` / `channel_reply` (v0.97.0) turn a server that implements
+* Claude Channels into a channel and route replies back through its tools.
 * `RulesyncMcp.getMcpServers()` strips both spellings so the client secret
 * never reaches another tool's config; `fromRulesyncMcp` re-merges them from
 * the raw source JSON, honouring the raw Crush spelling as a fallback for an
@@ -43235,6 +43995,18 @@ const CRUSH_ONLY_KEYS = [
 		crush: "sessionless",
 		accepts: (v) => typeof v === "boolean",
 		rawFallback: true
+	},
+	{
+		canonical: "crushChannelEnabled",
+		crush: "channel_enabled",
+		accepts: (v) => typeof v === "boolean",
+		rawFallback: true
+	},
+	{
+		canonical: "crushChannelReply",
+		crush: "channel_reply",
+		accepts: (v) => CrushChannelReplySchema.safeParse(v).success,
+		rawFallback: true
 	}
 ];
 /**
@@ -43242,12 +44014,16 @@ const CRUSH_ONLY_KEYS = [
 * canonical name, so `convertToCrushFormat` sees them after the shared map
 * stripped them.
 */
-function readCrushOnlyKeys(rawServer) {
+function readCrushOnlyKeys({ serverName, rawServer, logger }) {
 	const result = {};
 	if (!isRecord$1(rawServer)) return result;
 	for (const { canonical, crush, accepts, rawFallback } of CRUSH_ONLY_KEYS) {
 		const value = accepts(rawServer[canonical]) ? rawServer[canonical] : rawFallback && accepts(rawServer[crush]) ? rawServer[crush] : void 0;
 		if (value !== void 0) result[canonical] = value;
+		else if (canonical === "crushChannelReply") {
+			const rejected = [canonical, crush].find((key) => rawServer[key] !== void 0);
+			if (rejected !== void 0) logger?.warn(`Crush MCP server "${serverName}": ignoring "${rejected}" because it does not match Crush's channel_reply shape ({ user?, group?: { tool, target_param?, target_meta? }, message_param?, suppress_tools? }).`);
+		}
 	}
 	return result;
 }
@@ -43372,8 +44148,8 @@ function convertToCrushFormat(mcpServers, logger) {
 * servers. `stdio` is Crush's default `type`, so it is dropped (a canonical
 * server with a `command` is stdio already); `http` and `sse` are kept as the
 * canonical transport names; `disabled_tools`/`enabled_tools` become the
-* canonical `disabledTools`/`enabledTools`; the Crush-only OAuth and
-* `sessionless` fields are lifted into their `crush*` authoring keys (a value
+* canonical `disabledTools`/`enabledTools`; the Crush-only OAuth,
+* `sessionless` and channel fields are lifted into their `crush*` authoring keys (a value
 * of the wrong type is dropped, as Crush itself would refuse it), and any
 * other key is kept verbatim so an import preserves what a hand-authored
 * entry declared.
@@ -43464,7 +44240,11 @@ var CrushMcp = class CrushMcp extends ToolMcp {
 		});
 		const converted = convertToCrushFormat(Object.fromEntries(Object.entries(rulesyncMcp.getMcpServers()).map(([serverName, serverConfig]) => [serverName, {
 			...serverConfig,
-			...readCrushOnlyKeys(rulesyncMcp.getRawMcpServer(serverName))
+			...readCrushOnlyKeys({
+				serverName,
+				rawServer: rulesyncMcp.getRawMcpServer(serverName),
+				logger
+			})
 		}])), logger);
 		return new CrushMcp({
 			outputRoot,
@@ -44057,12 +44837,19 @@ var DevinPluginMcp = class DevinPluginMcp extends DevinMcp {
 * only the default location. Project-scoped assets live under a `.dsh/`
 * directory at the project root.
 *
-* Rules: `dsh-agent-instructions` loads the user-global `$DSH_HOME/AGENTS.md`
-* (root file only — the user-global file has no `.local.md` overlay), then the
-* project chain of `AGENTS.md` / `CLAUDE.md` files from the project root (the
-* nearest ancestor holding `.git`) down to the session cwd, broad to specific.
-* Rulesync emits `AGENTS.md` only; `CLAUDE.md` is the `claudecode` target's
-* file, and a `CLAUDE.md` duplicating its sibling `AGENTS.md` renders once.
+* Rules: `dsh-agent-instructions` loads the user-global chain —
+* `$DSH_HOME/AGENTS.md`, then `<agentsHome>/AGENTS.md` (`$DSH_AGENTS_HOME`,
+* default `~/.agents`, since dsh-v0.2.1-alpha.2) — then the project chain of
+* `AGENTS.md` / `CLAUDE.md` files plus their `AGENTS.local.md` /
+* `CLAUDE.local.md` overlays from the project root (the nearest ancestor
+* holding `.git`) down to the session cwd, broad to specific. Neither
+* user-global root has a `.local.md` overlay. The two user-global roots share
+* one dedupe group, so the shared-root file collapses behind the harness-home
+* file only when both match after trimming; otherwise both load. Rulesync
+* writes only `$DSH_HOME/AGENTS.md` globally (never the shared
+* `~/.agents/AGENTS.md`), and `AGENTS.md` / `AGENTS.local.md` in the project;
+* `CLAUDE.md` is the `claudecode` target's file, and a `CLAUDE.md` duplicating
+* its sibling `AGENTS.md` renders once.
 *
 * Skills: `dsh-skill-filesystem` scans `<projectRoot>/.dsh/skills` (rank 100),
 * `<projectRoot>/.agents/skills` (200), `<dshHome>/skills` (400) and
@@ -46406,6 +47193,20 @@ function normalizeKimiCodeTransport({ transport, hasCommand }) {
 	if (transport === "http" || transport === "streamable-http") return "http";
 	return hasCommand ? "stdio" : "http";
 }
+/**
+* The only `executor` value Kimi Code accepts on a stdio server. 2.2.0 removed
+* the never-implemented `kaos` option and narrowed the schema to
+* `z.enum(['local'])`, so any other value makes Kimi fail validation when it
+* loads `mcp.json`.
+* @see https://github.com/MoonshotAI/kimi-code/pull/4184
+*/
+const KIMI_CODE_MCP_EXECUTOR = "local";
+/** Remove, with a warning, an `executor` value Kimi Code would reject. Mutates `server`. */
+function dropUnsupportedKimiCodeExecutor({ name, server, logger }) {
+	if (server.executor === void 0 || server.executor === KIMI_CODE_MCP_EXECUTOR) return;
+	warnWithFallback(logger, `Kimi Code MCP: dropping executor ${JSON.stringify(server.executor)} from "${name}" because Kimi Code only accepts "${KIMI_CODE_MCP_EXECUTOR}".`);
+	delete server.executor;
+}
 function toKimiCodeServer({ name, server, logger }) {
 	const transport = server.transport ?? server.type;
 	if (transport === "ws") {
@@ -46444,6 +47245,11 @@ function toKimiCodeServer({ name, server, logger }) {
 		"enabledTools",
 		"disabledTools"
 	]) if (server[field] !== void 0) converted[field] = server[field];
+	dropUnsupportedKimiCodeExecutor({
+		name,
+		server: converted,
+		logger
+	});
 	if (server.disabled === true) converted.enabled = false;
 	return converted;
 }
@@ -46459,9 +47265,14 @@ function toKimiCodeServers({ servers, logger }) {
 	}
 	return result;
 }
-function fromKimiCodeServers(servers) {
+function fromKimiCodeServers({ servers, logger }) {
 	return Object.fromEntries(Object.entries(servers).map(([name, server]) => {
 		const { transport, enabled, ...rest } = server;
+		dropUnsupportedKimiCodeExecutor({
+			name,
+			server: rest,
+			logger
+		});
 		const type = transport === "stdio" || transport === "sse" || transport === "http" ? transport : void 0;
 		return [name, {
 			...rest,
@@ -46576,9 +47387,11 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 	* a different file that only the async `fromFile` can read.
 	*/
 	configDefaults;
-	constructor(params) {
+	logger;
+	constructor({ configDefaults, logger, ...params }) {
 		super(params);
-		this.configDefaults = params.configDefaults ?? {};
+		this.configDefaults = configDefaults ?? {};
+		this.logger = logger;
 		try {
 			this.json = this.fileContent ? JSON.parse(this.fileContent) : {};
 		} catch (error) {
@@ -46594,7 +47407,7 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 			relativeFilePath: KIMI_CODE_MCP_FILE_NAME
 		};
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{\"mcpServers\":{}}";
 		return new KimiCodeMcp({
@@ -46604,7 +47417,8 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 			fileContent,
 			validate,
 			global,
-			configDefaults: global ? await readKimiCodeMcpDefaults({ outputRoot }) : {}
+			configDefaults: global ? await readKimiCodeMcpDefaults({ outputRoot }) : {},
+			logger
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
@@ -46678,7 +47492,10 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 			relativeFilePath: RULESYNC_MCP_FILE_NAME,
 			fileContent: JSON.stringify({
 				...this.json,
-				mcpServers: fromKimiCodeServers(isMcpServers(this.json.mcpServers) ? this.json.mcpServers : {}),
+				mcpServers: fromKimiCodeServers({
+					servers: isMcpServers(this.json.mcpServers) ? this.json.mcpServers : {},
+					logger: this.logger
+				}),
 				...Object.keys(this.configDefaults).length > 0 && { "kimi-code": this.configDefaults }
 			}, null, 2)
 		});
@@ -47119,7 +47936,13 @@ var OpencodeMcp = class extends ToolMcp {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = this.layout.jsonFileName;
 		}
-		const json = (0, jsonc_parser.parse)(fileContent ?? "{\"mcp\":{}}");
+		const fileContentToUse = fileContent ?? "{\"mcp\":{}}";
+		const overlays = await readOpencodeDotDirConfigLayers({
+			outputRoot,
+			global,
+			layout: this.layout
+		});
+		const json = overlays.length === 0 ? (0, jsonc_parser.parse)(fileContentToUse) : [(0, jsonc_parser.parse)(fileContentToUse), ...overlays.map(({ config }) => config)].map((layer) => this.lowerConfig(layer, logger)).reduce(mergeOpencodeConfigValues);
 		const newJson = {
 			...json,
 			mcp: json.mcp ?? {}
@@ -47156,6 +47979,27 @@ var OpencodeMcp = class extends ToolMcp {
 			if (containers.length > 0) logger?.warn(`OpenCode MCP: the whole "mcp" key is rewritten in the flat V1 shape, so ${containers.map(quoteValueForWarning).join(" and ")} ${containers.length === 1 ? "is" : "are"} not kept.`);
 		}
 		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(transformedServers, (existingMcp.success ? existingMcp.data.mcp : void 0) ?? {}, logger);
+		const generatedMcp = undefinedWhenEmpty(convertedMcp);
+		const generatedTools = Object.keys(mcpTools).length > 0 ? mcpTools : void 0;
+		warnOpencodeDotDirOverrides({
+			generated: {
+				mcp: generatedMcp,
+				tools: generatedTools
+			},
+			overlays: (await readOpencodeDotDirConfigLayers({
+				outputRoot,
+				global,
+				layout: this.layout
+			})).map((overlay) => {
+				const lowered = this.lowerConfig(overlay.config);
+				return {
+					...overlay,
+					config: isRecord$1(lowered) ? lowered : {}
+				};
+			}),
+			rootFileName: relativeFilePath,
+			logger
+		});
 		return new this({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
@@ -47165,8 +48009,8 @@ var OpencodeMcp = class extends ToolMcp {
 				feature: "mcp",
 				existingContent: fileContent ?? "",
 				patch: {
-					mcp: undefinedWhenEmpty(convertedMcp),
-					tools: Object.keys(mcpTools).length > 0 ? mcpTools : void 0
+					mcp: generatedMcp,
+					tools: generatedTools
 				},
 				filePath: (0, node_path.join)(jsonDir, relativeFilePath),
 				logger
@@ -47812,6 +48656,358 @@ var OmpMcp = class OmpMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/constants/openclaw-paths.ts
+const OPENCLAW_WORKSPACE_DIR_PATH = (0, node_path.join)(".openclaw", "workspace");
+const OPENCLAW_RULE_FILE_NAME = "AGENTS.md";
+const OPENCLAW_CONFIG_DIR_PATH = ".openclaw";
+const OPENCLAW_CONFIG_FILE_NAME = "openclaw.json";
+const OPENCLAW_MCP_SERVERS_KEY = "servers";
+//#endregion
+//#region src/features/mcp/openclaw-mcp.ts
+const OPENCLAW_GLOBAL_ONLY_MESSAGE = "OpenClaw MCP is global-only; use --global to sync ~/.openclaw/openclaw.json";
+/**
+* Single spelling of the openclaw.json codec/policy, matching its
+* `SHARED_CONFIG_OWNERSHIP` declaration: the file is JSON5, and a file whose
+* root is not an object is refused rather than replaced, since it also holds
+* every other Gateway setting.
+*/
+function parseOpenclawConfig(fileContent, filePath) {
+	return parseSharedConfig({
+		format: "json5",
+		fileContent,
+		filePath,
+		invalidRootPolicy: "error"
+	});
+}
+const OPENCLAW_OAUTH_STRING_KEYS = [
+	"authProfileId",
+	"scope",
+	"redirectUrl",
+	"clientMetadataUrl"
+];
+const OPENCLAW_OAUTH_IDENTITIES = /* @__PURE__ */ new Set(["shared", "per-requester"]);
+/**
+* Copies the `oauth` keys OpenClaw accepts. A known key with a value its
+* schema rejects (an `identity` other than `shared` / `per-requester`, a blank
+* string) is dropped with a warning, since the Gateway would refuse to start
+* on it; keys OpenClaw does not know are left behind silently, as they belong
+* to other tools' `oauth` blocks.
+*/
+function copyOpenclawOauth({ source, serverName, logger }) {
+	const oauth = {};
+	const dropped = [];
+	if (source.identity !== void 0) {
+		if (typeof source.identity === "string" && OPENCLAW_OAUTH_IDENTITIES.has(source.identity)) oauth.identity = source.identity;
+		else dropped.push("identity");
+	}
+	for (const key of OPENCLAW_OAUTH_STRING_KEYS) {
+		const value = source[key];
+		if (value === void 0) continue;
+		if (typeof value === "string" && value.trim() !== "") oauth[key] = value;
+		else dropped.push(key);
+	}
+	if (dropped.length > 0 && serverName !== void 0) logger?.warn(`OpenClaw MCP: dropping invalid oauth ${dropped.map((key) => `"${key}"`).join(", ")} of ${quoteValueForWarning(serverName)}; OpenClaw's config validation would reject it.`);
+	return Object.keys(oauth).length > 0 ? oauth : void 0;
+}
+const OPENCLAW_CODEX_APPROVAL_MODES = /* @__PURE__ */ new Set([
+	"auto",
+	"prompt",
+	"approve"
+]);
+/**
+* Copies the OpenClaw-only per-server fields that have no canonical
+* counterpart — `auth`, `oauth`, the TLS controls, the timeouts in
+* milliseconds, `supportsParallelToolCalls` and the `codex` projection — from
+* `source` to `target`, in both directions. OpenClaw validates its config
+* strictly (`oauth`, `toolFilter` and `codex` are strict objects) and refuses
+* to start the Gateway on a value it rejects, so only the documented keys with
+* the documented value types are copied; a same-named key another tool reads
+* differently (Hermes' snake_case `oauth` keys, say) is left behind.
+*
+* @see https://github.com/openclaw/openclaw/blob/v2026.10.4/src/config/zod-schema.mcp-server.ts
+*/
+function copyOpenclawOnlyFields(source, target, { serverName, logger } = {}) {
+	let copied = false;
+	if (source.auth === "oauth") {
+		target.auth = "oauth";
+		copied = true;
+	}
+	if (isRecord$1(source.oauth)) {
+		const oauth = copyOpenclawOauth({
+			source: source.oauth,
+			serverName,
+			logger
+		});
+		if (oauth) {
+			target.oauth = oauth;
+			copied = true;
+		}
+	}
+	for (const key of ["clientCert", "clientKey"]) if (typeof source[key] === "string") {
+		target[key] = source[key];
+		copied = true;
+	}
+	for (const key of ["sslVerify", "supportsParallelToolCalls"]) if (typeof source[key] === "boolean") {
+		target[key] = source[key];
+		copied = true;
+	}
+	for (const key of ["requestTimeoutMs", "connectionTimeoutMs"]) {
+		const value = source[key];
+		if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+			target[key] = value;
+			copied = true;
+		}
+	}
+	if (isRecord$1(source.codex)) {
+		const codex = {};
+		if (isStringArray$1(source.codex.agents) && source.codex.agents.length > 0) codex.agents = [...source.codex.agents];
+		const mode = source.codex.defaultToolsApprovalMode;
+		if (typeof mode === "string" && OPENCLAW_CODEX_APPROVAL_MODES.has(mode)) codex.defaultToolsApprovalMode = mode;
+		if (Object.keys(codex).length > 0) {
+			target.codex = codex;
+			copied = true;
+		}
+	}
+	return copied;
+}
+/** A string map without pollution keys, or `undefined` when nothing is left. */
+function copyStringMap(value) {
+	if (!isPlainObject$1(value)) return void 0;
+	const result = {};
+	for (const [key, entry] of Object.entries(value)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (typeof entry === "string") result[key] = entry;
+		else if (typeof entry === "number" || typeof entry === "boolean") result[key] = String(entry);
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+/** A non-empty `toolFilter` list, trimmed of blank entries OpenClaw rejects. */
+function toolFilterList(value) {
+	if (!isStringArray$1(value)) return void 0;
+	const list = value.map((entry) => entry.trim()).filter((entry) => entry !== "");
+	return list.length > 0 ? list : void 0;
+}
+function convertServerToOpenclaw({ name, config, logger }) {
+	if (declaresNoTransport(config)) return warnAndSkipMcpServer({
+		toolName: "OpenClaw",
+		serverName: name,
+		reason: "no transport",
+		logger
+	});
+	const out = {};
+	if (isRemoteMcpServer(config)) {
+		const url = resolveRemoteMcpUrl(config);
+		if (!url) return warnAndSkipMcpServer({
+			toolName: "OpenClaw",
+			serverName: name,
+			reason: "a remote transport without a url",
+			logger
+		});
+		const stated = config.type ?? config.transport;
+		if (stated === "ws" || stated === void 0 && /^wss?:\/\//i.test(url)) return warnAndSkipMcpServer({
+			toolName: "OpenClaw",
+			serverName: name,
+			reason: "a WebSocket transport, which OpenClaw does not offer (only streamable-http and sse)",
+			logger
+		});
+		out.url = url;
+		out.transport = stated === "sse" ? "sse" : "streamable-http";
+		const headers = copyStringMap(config.headers);
+		if (headers) out.headers = headers;
+	} else {
+		const [command, ...args] = resolveLocalMcpCommand(config);
+		if (!command) return warnAndSkipMcpServer({
+			toolName: "OpenClaw",
+			serverName: name,
+			reason: "a stdio transport without a command",
+			logger
+		});
+		out.command = command;
+		if (args.length > 0) out.args = args;
+		const env = copyStringMap(config.env);
+		if (env) out.env = env;
+		if (typeof config.cwd === "string") out.cwd = config.cwd;
+	}
+	if (config.disabled === true) out.enabled = false;
+	const include = toolFilterList(config.enabledTools);
+	const exclude = toolFilterList(config.disabledTools);
+	if (include || exclude) out.toolFilter = {
+		...include && { include },
+		...exclude && { exclude }
+	};
+	copyOpenclawOnlyFields(config, out, {
+		serverName: name,
+		logger
+	});
+	return out;
+}
+/**
+* Converts canonical rulesync servers into OpenClaw `mcp.servers` entries.
+* Only keys OpenClaw accepts are written — never canonical-only ones such as
+* `type` or `disabled`, which its strict config validation would answer by
+* refusing to start the Gateway.
+*/
+function convertToOpenclawFormat({ mcpServers, logger }) {
+	const result = {};
+	for (const [name, config] of Object.entries(mcpServers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const converted = convertServerToOpenclaw({
+			name,
+			config,
+			logger
+		});
+		if (converted) result[name] = converted;
+	}
+	return result;
+}
+/**
+* Converts OpenClaw `mcp.servers` entries back into canonical rulesync
+* servers. OpenClaw-only fields go into the `openclaw.mcpServers` override
+* block (the whole server, since an override entry replaces the shared one for
+* that tool), so they survive an import/generate round trip without leaking
+* into every other tool's config.
+*/
+function convertFromOpenclawFormat(servers) {
+	const mcpServers = {};
+	const openclawOverrides = {};
+	for (const [name, config] of Object.entries(servers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
+		const server = {};
+		if (typeof config.command === "string") {
+			server.command = config.command;
+			if (isStringArray$1(config.args)) server.args = config.args;
+			const env = copyStringMap(config.env);
+			if (env) server.env = env;
+			if (typeof config.cwd === "string") server.cwd = config.cwd;
+		} else if (typeof config.url === "string") {
+			server.type = config.transport === "sse" ? "sse" : "http";
+			server.url = config.url;
+			const headers = copyStringMap(config.headers);
+			if (headers) server.headers = headers;
+		}
+		if (config.enabled === false) server.disabled = true;
+		if (isRecord$1(config.toolFilter)) {
+			const include = toolFilterList(config.toolFilter.include);
+			const exclude = toolFilterList(config.toolFilter.exclude);
+			if (include) server.enabledTools = include;
+			if (exclude) server.disabledTools = exclude;
+		}
+		mcpServers[name] = server;
+		const openclawServer = { ...server };
+		if (copyOpenclawOnlyFields(config, openclawServer)) openclawOverrides[name] = openclawServer;
+	}
+	return {
+		mcpServers,
+		openclawOverrides
+	};
+}
+/**
+* OpenClaw MCP servers.
+*
+* OpenClaw keeps its MCP registry under `mcp.servers` of the Gateway config
+* `~/.openclaw/openclaw.json` (JSON5; global only — there is no project-scoped
+* MCP location). That file also holds credentials and every other Gateway
+* setting, so generation merges rulesync's servers into `mcp.servers` by name,
+* keeps servers rulesync does not define and every other key, and never deletes
+* the file.
+*
+* @see https://docs.openclaw.ai/gateway/config-extensions
+* @see https://docs.openclaw.ai/tools/mcp
+*/
+var OpenclawMcp = class OpenclawMcp extends ToolMcp {
+	config;
+	constructor(params) {
+		super(params);
+		this.config = parseOpenclawConfig(this.fileContent ?? "", (0, node_path.join)(this.relativeDirPath, this.relativeFilePath));
+	}
+	getConfig() {
+		return this.config;
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: OPENCLAW_CONFIG_DIR_PATH,
+			relativeFilePath: OPENCLAW_CONFIG_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		if (!global) throw new Error(OPENCLAW_GLOBAL_ONLY_MESSAGE);
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
+		return new OpenclawMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		if (!global) throw new Error(OPENCLAW_GLOBAL_ONLY_MESSAGE);
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "";
+		const existing = parseOpenclawConfig(existingContent, filePath);
+		const existingMcp = isRecord$1(existing["mcp"]) ? existing["mcp"] : {};
+		const existingServers = isRecord$1(existingMcp["servers"]) ? existingMcp[OPENCLAW_MCP_SERVERS_KEY] : {};
+		const converted = convertToOpenclawFormat({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			logger
+		});
+		const servers = {
+			...existingServers,
+			...converted
+		};
+		const kept = Object.keys(existingServers).filter((name) => !PROTOTYPE_POLLUTION_KEYS.has(name) && !Object.hasOwn(converted, name));
+		if (kept.length > 0) logger?.warn(`OpenClaw MCP servers not defined in rulesync are kept in ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)}: ${kept.map((name) => quoteValueForWarning(name)).join(", ")}. Remove them with 'openclaw mcp unset <name>' if they are no longer wanted.`);
+		return new OpenclawMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { ["mcp"]: {
+					...existingMcp,
+					[OPENCLAW_MCP_SERVERS_KEY]: servers
+				} },
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const mcp = isRecord$1(this.config["mcp"]) ? this.config["mcp"] : {};
+		const { mcpServers, openclawOverrides } = convertFromOpenclawFormat(isRecord$1(mcp["servers"]) ? mcp[OPENCLAW_MCP_SERVERS_KEY] : {});
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({
+			mcpServers,
+			...Object.keys(openclawOverrides).length > 0 && { openclaw: { mcpServers: openclawOverrides } }
+		}, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new OpenclawMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/pi-mcp.ts
 /**
 * Canonical keys consumed by the conversion below (or with no Pi counterpart),
@@ -50866,6 +52062,128 @@ function asZcodeRemoteType(stated, url) {
 	if (stated === void 0) return /^wss?:\/\//i.test(url) ? void 0 : "http";
 }
 /**
+* The keys each OAuth flow of ZCode's per-server `oauth` union accepts on a
+* remote server, and which of them are required. Read off the 3.14.3/3.15.3
+* runtime config schema, since ZCode's MCP page only says to "enable OAuth for
+* the service in its configuration". Both variants are strict, so any other
+* key would make ZCode skip the server.
+*/
+const ZCODE_OAUTH_FLOWS = {
+	client_credentials: {
+		required: ["clientId", "clientSecret"],
+		optional: ["clientName", "scope"]
+	},
+	authorization_code: {
+		required: [],
+		optional: [
+			"clientId",
+			"clientSecret",
+			"clientName",
+			"redirectPath",
+			"scope"
+		]
+	}
+};
+/**
+* The `protocolVersion` values ZCode's server schema accepts (an enum on a
+* strict object, so any other value makes ZCode skip the server).
+*/
+const ZCODE_PROTOCOL_VERSIONS = /* @__PURE__ */ new Set([
+	"auto",
+	"legacy",
+	"2026-07-28"
+]);
+/**
+* The namespaced canonical key that carries ZCode's `oauth`. The canonical
+* `oauth` already holds Claude Code's `{ clientId }` object, and ZCode's shape
+* may carry a client secret, so it is kept apart (the `crushOauth*`
+* precedent) and stripped by `RulesyncMcp.getMcpServers()`.
+*/
+const ZCODE_OAUTH_CANONICAL_KEY = "zcodeOauth";
+/**
+* Whether an `oauth` value names one of ZCode's flows.
+*/
+function isZcodeOauth(value) {
+	return isRecord$1(value) && typeof value.type === "string" && value.type in ZCODE_OAUTH_FLOWS;
+}
+/**
+* Build ZCode's `oauth` from a `zcodeOauth` value: only the keys of the named
+* flow are kept, as strings. A value naming no ZCode flow, or missing a key
+* the flow requires, is dropped with a warning instead of making ZCode skip
+* the server.
+*/
+function toZcodeOauth({ serverName, value, logger }) {
+	if (value === void 0) return void 0;
+	if (!isZcodeOauth(value)) {
+		logger?.warn(`ZCode MCP server "${serverName}": dropping zcodeOauth, as its type must be "client_credentials" or "authorization_code".`);
+		return;
+	}
+	const type = String(value.type);
+	const flow = ZCODE_OAUTH_FLOWS[type];
+	if (!flow) return void 0;
+	const missing = flow.required.filter((key) => typeof value[key] !== "string");
+	if (missing.length > 0) {
+		logger?.warn(`ZCode MCP server "${serverName}": dropping zcodeOauth, as the ${type} flow requires ${missing.join(", ")}.`);
+		return;
+	}
+	const allowed = /* @__PURE__ */ new Set([...flow.required, ...flow.optional]);
+	const oauth = { type };
+	const ignored = [];
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "type" || PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		if (allowed.has(key) && typeof entry === "string") oauth[key] = entry;
+		else ignored.push(key);
+	}
+	if (ignored.length > 0) logger?.warn(`ZCode MCP server "${serverName}": ignoring zcodeOauth keys the ${type} flow does not accept: ${ignored.join(", ")}.`);
+	return oauth;
+}
+/**
+* The `zcodeOauth` a server was authored with. `getMcpServers()` strips it, so
+* the authored server (`rawServerOf`) is consulted first.
+*/
+function authoredZcodeOauth({ name, config, rawServerOf }) {
+	const raw = rawServerOf?.(name);
+	return isRecord$1(raw) ? raw[ZCODE_OAUTH_CANONICAL_KEY] : config[ZCODE_OAUTH_CANONICAL_KEY];
+}
+function isPositiveMs(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+/**
+* Resolve ZCode's per-server `timeoutMs` (a positive number of milliseconds):
+* a valid explicit `timeoutMs` wins, otherwise the canonical `timeout`
+* (milliseconds, the `gitlabduo-mcp.ts` precedent) is used. A value ZCode
+* would reject is dropped with a warning instead of making ZCode skip the
+* server.
+*/
+function resolveZcodeTimeoutMs({ serverName, config, logger }) {
+	const { timeoutMs, timeout } = config;
+	if (timeoutMs !== void 0) {
+		if (isPositiveMs(timeoutMs)) return timeoutMs;
+		logger?.warn(`ZCode MCP server "${serverName}": ignoring timeoutMs ${JSON.stringify(timeoutMs)}, as it must be a positive number of milliseconds.`);
+	}
+	if (timeout === void 0) return void 0;
+	if (isPositiveMs(timeout)) return timeout;
+	logger?.warn(`ZCode MCP server "${serverName}": dropping timeout ${JSON.stringify(timeout)}, as timeoutMs must be a positive number of milliseconds.`);
+}
+/**
+* The per-server keys ZCode reads on every transport: `timeoutMs`,
+* `protocolVersion` and the enable toggle (`enableKey`).
+*/
+function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
+	const common = {};
+	const timeoutMs = resolveZcodeTimeoutMs({
+		serverName,
+		config,
+		logger
+	});
+	if (timeoutMs !== void 0) common.timeoutMs = timeoutMs;
+	const { protocolVersion } = config;
+	if (ZCODE_PROTOCOL_VERSIONS.has(protocolVersion)) common.protocolVersion = protocolVersion;
+	else if (protocolVersion !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping protocolVersion ${JSON.stringify(protocolVersion)}, as ZCode accepts only ${[...ZCODE_PROTOCOL_VERSIONS].map((v) => JSON.stringify(v)).join(", ")}.`);
+	if (config.disabled === true) common[enableKey] = false;
+	return common;
+}
+/**
 * Convert canonical rulesync servers to ZCode's native `mcp.servers` shape:
 * stdio servers carry `command`/`args`/`env`, remote servers carry
 * `type` (`http` or `sse`), `url` and optional `headers`. A canonical
@@ -50873,9 +52191,18 @@ function asZcodeRemoteType(stated, url) {
 * plugin's `.mcp.json`, via `enableKey`), which it defaults to `true` when
 * absent.
 *
+* Every server also carries `timeoutMs` (from the canonical `timeout`, or an
+* explicit `timeoutMs`) and an allow-listed `protocolVersion`; stdio servers
+* carry `cwd`, and remote servers an `oauth` built from the namespaced
+* `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
+* is read from the authored server through `rawServerOf`. ZCode's docs do not
+* name these keys, so they follow the 3.14.3/3.15.3 runtime's per-server
+* schema, which is strict: an unknown key makes ZCode skip the server, which
+* is why the output stays a whitelist.
+*
 * @see https://zcode.z.ai/en/docs/mcp-services
 */
-function convertToZcodeFormat({ mcpServers, logger, enableKey = "enable" }) {
+function convertToZcodeFormat({ mcpServers, logger, enableKey = "enable", rawServerOf }) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
@@ -50915,6 +52242,16 @@ function convertToZcodeFormat({ mcpServers, logger, enableKey = "enable" }) {
 			converted.type = type;
 			converted.url = url;
 			if (config.headers && Object.keys(config.headers).length > 0) converted.headers = config.headers;
+			const oauth = toZcodeOauth({
+				serverName: name,
+				value: authoredZcodeOauth({
+					name,
+					config,
+					rawServerOf
+				}),
+				logger
+			});
+			if (oauth !== void 0) converted.oauth = oauth;
 		} else {
 			const [command, ...args] = resolveLocalMcpCommand(config);
 			if (!command) {
@@ -50929,35 +52266,62 @@ function convertToZcodeFormat({ mcpServers, logger, enableKey = "enable" }) {
 			converted.command = command;
 			converted.args = args;
 			if (config.env && Object.keys(config.env).length > 0) converted.env = config.env;
+			if (typeof config.cwd === "string" && config.cwd !== "") converted.cwd = config.cwd;
 		}
-		if (config.disabled === true) converted[enableKey] = false;
-		result[name] = converted;
+		result[name] = {
+			...converted,
+			...toZcodeCommonKeys({
+				serverName: name,
+				config,
+				enableKey,
+				logger
+			})
+		};
 	}
 	return result;
 }
 /**
+* ZCode's per-server enable toggle, in both spellings: the runtime normalizes
+* the legacy `enable` to `enabled`, and a plugin's `.mcp.json` uses `enabled`.
+*/
+const ZCODE_ENABLE_KEYS = /* @__PURE__ */ new Set(["enable", "enabled"]);
+/**
 * Convert ZCode's native `mcp.servers` shape back to canonical rulesync
-* servers: `enable: false` maps back to `disabled: true`, and unknown keys pass
-* through untouched so an import keeps whatever a hand-authored entry declared.
-* Generation back out is a whitelist, so only the keys `convertToZcodeFormat`
-* writes are re-emitted.
+* servers: `enable: false` / `enabled: false` map back to `disabled: true`,
+* and unknown keys pass through untouched so an import keeps whatever a
+* hand-authored entry declared. `timeoutMs` is lifted back into the canonical
+* `timeout` (milliseconds); when the server also states a `timeout`, ZCode
+* has already dropped that one, so `timeoutMs` replaces it. A ZCode-shaped
+* `oauth` is imported as the namespaced `zcodeOauth`, so its client secret is
+* never emitted to another tool. Generation back out is a whitelist, so only
+* the keys `convertToZcodeFormat` writes are re-emitted.
 *
 * An explicit `enable: true` is dropped rather than mapped to a canonical
 * `disabled: false`: absent already means enabled on both sides, so the flag
 * carries no information, and emitting it would push a redundant `disabled`
-* key into every other tool's generated config.
+* key into every other tool's generated config. (A canonical `enabled` is
+* rulesync's own generation filter, so it must never be passed through.)
 */
-function convertFromZcodeFormat({ zcodeServers, enableKey = "enable" }) {
+function convertFromZcodeFormat({ zcodeServers }) {
 	const result = {};
 	for (const [name, config] of Object.entries(zcodeServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
 		const converted = {};
 		for (const [key, value] of Object.entries(config)) {
 			if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
-			if (key === enableKey) {
+			if (ZCODE_ENABLE_KEYS.has(key)) {
 				if (value === false) converted.disabled = true;
 				continue;
 			}
+			if (key === "timeoutMs" && typeof value === "number") {
+				converted.timeout = value;
+				continue;
+			}
+			if (key === "timeout" && typeof config.timeoutMs === "number") continue;
+			if (key === "oauth" && isZcodeOauth(value)) {
+				converted[ZCODE_OAUTH_CANONICAL_KEY] = value;
+				continue;
+			}
 			converted[key] = value;
 		}
 		result[name] = converted;
@@ -51014,7 +52378,8 @@ var ZcodeMcp = class ZcodeMcp extends ToolMcp {
 		const existing = parseZcodeConfig(existingContent, filePath);
 		const converted = convertToZcodeFormat({
 			mcpServers: rulesyncMcp.getMcpServers(),
-			logger
+			logger,
+			rawServerOf: (name) => rulesyncMcp.getRawMcpServer(name)
 		});
 		const existingMcp = isRecord$1(existing["mcp"]) ? existing["mcp"] : {};
 		return new ZcodeMcp({
@@ -51118,7 +52483,8 @@ var ZcodePluginMcp = class ZcodePluginMcp extends ToolMcp {
 		const mcpServers = convertToZcodeFormat({
 			mcpServers: rulesyncMcp.getMcpServers(),
 			logger,
-			enableKey: ZCODE_PLUGIN_ENABLE_KEY
+			enableKey: ZCODE_PLUGIN_ENABLE_KEY,
+			rawServerOf: (name) => rulesyncMcp.getRawMcpServer(name)
 		});
 		return new ZcodePluginMcp({
 			outputRoot,
@@ -51129,10 +52495,7 @@ var ZcodePluginMcp = class ZcodePluginMcp extends ToolMcp {
 		});
 	}
 	toRulesyncMcp() {
-		const mcpServers = convertFromZcodeFormat({
-			zcodeServers: serversOf(this.json),
-			enableKey: ZCODE_PLUGIN_ENABLE_KEY
-		});
+		const mcpServers = convertFromZcodeFormat({ zcodeServers: serversOf(this.json) });
 		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
 	}
 	validate() {
@@ -51637,6 +53000,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: true
 		}
 	}],
+	["openclaw", {
+		class: OpenclawMcp,
+		meta: {
+			supportsProject: false,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: true
+		}
+	}],
 	["kimi-code", {
 		class: KimiCodeMcp,
 		meta: {
@@ -52790,7 +54162,7 @@ function parsedGlobsIntersect(left, right, budget) {
 *
 * @see https://antigravity.google/docs/permissions?tab=cli
 */
-const REGEX_PREFIX = "regex:";
+const REGEX_PREFIX$1 = "regex:";
 /**
 * The Antigravity actions whose target is a command: `command`, and
 * `unsandboxed`, which takes the same word-by-word prefix or `regex:` target.
@@ -53128,7 +54500,7 @@ function wordToRegexSource(word) {
 * pattern does.
 */
 function toAntigravityCommandTarget(pattern) {
-	if (pattern.startsWith(REGEX_PREFIX)) {
+	if (pattern.startsWith(REGEX_PREFIX$1)) {
 		const regexWords = splitWords(pattern.slice(6));
 		if (regexWords.length === 0) return { skipReason: "The regex is empty" };
 		const invalid = regexWords.find(isInvalidRegex);
@@ -53148,7 +54520,7 @@ function toAntigravityCommandTarget(pattern) {
 	const head = words.slice(0, -1);
 	if (head.length > 0 && isStarWord(words.at(-1) ?? []) && head.every(isLiteralWord)) return { target: head.map(wordToLiteral).join(" ") };
 	return {
-		target: `${REGEX_PREFIX}${words.map(wordToRegexSource).join(" ")}`,
+		target: `${REGEX_PREFIX$1}${words.map(wordToRegexSource).join(" ")}`,
 		note
 	};
 }
@@ -53160,7 +54532,7 @@ function toAntigravityCommandTarget(pattern) {
 * word with a brace may be part of `{a,b}` alternatives, so it ends the prefix.
 */
 function toAntigravityCommandLiteralPrefix(pattern) {
-	if (pattern.startsWith(REGEX_PREFIX)) return;
+	if (pattern.startsWith(REGEX_PREFIX$1)) return;
 	const words = splitIntoWords(parseGlobPattern(pattern).steps);
 	const prefix = [];
 	for (const word of words) {
@@ -53168,7 +54540,7 @@ function toAntigravityCommandLiteralPrefix(pattern) {
 		if (literal === void 0 || literal.includes("{") || literal.includes("}")) break;
 		prefix.push(literal);
 	}
-	if (prefix.length === 0 || prefix[0]?.startsWith(REGEX_PREFIX)) return;
+	if (prefix.length === 0 || prefix[0]?.startsWith(REGEX_PREFIX$1)) return;
 	return prefix.join(" ");
 }
 /**
@@ -53219,11 +54591,11 @@ function regexToGlob(source) {
 * `regex:` target is kept as is.
 */
 function fromAntigravityCommandTarget(target) {
-	if (target.startsWith(REGEX_PREFIX)) return regexToGlob(target.slice(6)) ?? target;
+	if (target.startsWith(REGEX_PREFIX$1)) return regexToGlob(target.slice(6)) ?? target;
 	if (target === "*") return target;
 	if (PLAIN_TARGET_GLOB_CHARACTERS.test(target)) {
 		const words = splitWords(target);
-		return `${REGEX_PREFIX}${words.map((word) => `^${[...word].map(escapeRegexCharacter).join("")}$`).join(" ")}`;
+		return `${REGEX_PREFIX$1}${words.map((word) => `^${[...word].map(escapeRegexCharacter).join("")}$`).join(" ")}`;
 	}
 	return `${target} *`;
 }
@@ -53243,7 +54615,7 @@ function fromAntigravityCommandTarget(target) {
 * @see https://antigravity.google/docs/permissions
 */
 function describeAntigravityCommandImportLoss(target) {
-	if (target.startsWith(REGEX_PREFIX) || target === "*") return;
+	if (target.startsWith(REGEX_PREFIX$1) || target === "*") return;
 	if (PLAIN_TARGET_GLOB_CHARACTERS.test(target)) return {
 		reason: "it holds characters that are special in a glob (`*`, `?`, `[`, `{` or `\\`), which Antigravity matches literally (likely output of an older rulesync), so it is imported as a literal-match regex that no other tool enforces",
 		denyConsequence: "This deny is NOT enforced by the other tools it is generated for."
@@ -55145,7 +56517,7 @@ function buildVscodeCommandLists({ rules, toolLabel, logger, prefixSemantics = "
 //#region src/features/permissions/bob-permissions.ts
 const TOOL_LABEL = "IBM Bob";
 /** The top-level settings key holding Bob's auto-approval configuration. */
-const APPROVAL_KEY = "approval";
+const APPROVAL_KEY$1 = "approval";
 /** The top-level settings key holding Bob's per-feature auto-approve toggles. */
 const AUTO_APPROVE_KEY = "autoApprove";
 /** The tool permission groups Bob documents for `approval.allowed_permissions`. */
@@ -55166,7 +56538,7 @@ const BOB_AUTO_APPROVE_KEYS = /* @__PURE__ */ new Set(["skills"]);
 const OUTSIDE_WORKSPACE_GROUP_ID = "read";
 /** The only executor tool Bob's `allowedExecutors` list documents. */
 const EXECUTE_COMMAND_TOOL_ID = "execute_command";
-const SURFACE_LABEL = `${APPROVAL_KEY}.allowedExecutors[${EXECUTE_COMMAND_TOOL_ID}].approvedCommands/deniedCommands`;
+const SURFACE_LABEL = `${APPROVAL_KEY$1}.allowedExecutors[${EXECUTE_COMMAND_TOOL_ID}].approvedCommands/deniedCommands`;
 function asStringArray$2(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => typeof entry === "string");
@@ -55258,7 +56630,7 @@ function warnAboutUndocumentedSettings({ override, logger }) {
 * fetched permissions file. Switches that are already on are not repeated.
 */
 function warnAboutNewAutoApprovals({ settings, override, filePath, logger }) {
-	const existingApproval = isPlainObject$1(settings[APPROVAL_KEY]) ? settings[APPROVAL_KEY] : {};
+	const existingApproval = isPlainObject$1(settings[APPROVAL_KEY$1]) ? settings[APPROVAL_KEY$1] : {};
 	const existingGroups = new Set(asStringArray$2(existingApproval.allowed_permissions));
 	const existingOutside = new Set((Array.isArray(existingApproval.permissionOptions) ? existingApproval.permissionOptions : []).filter(isPlainObject$1).filter((option) => option.enableOutsideWorkspace === true).map((option) => option.groupId));
 	const existingAutoApprove = isPlainObject$1(settings[AUTO_APPROVE_KEY]) ? settings[AUTO_APPROVE_KEY] : {};
@@ -55324,7 +56696,7 @@ function buildBobCommandLists({ permission, logger }) {
 */
 function readBobOverride(settings) {
 	const override = {};
-	const approval = settings[APPROVAL_KEY];
+	const approval = settings[APPROVAL_KEY$1];
 	if (isPlainObject$1(approval)) {
 		const overrideApproval = {};
 		const groups = approval.allowed_permissions;
@@ -55453,8 +56825,8 @@ var BobPermissions = class BobPermissions extends ToolPermissions {
 						deniedCommands: denied
 					};
 				}
-				patch[APPROVAL_KEY] = buildApproval({
-					existingApproval: settings[APPROVAL_KEY],
+				patch[APPROVAL_KEY$1] = buildApproval({
+					existingApproval: settings[APPROVAL_KEY$1],
 					overrideApproval,
 					commandLists
 				});
@@ -55483,7 +56855,7 @@ var BobPermissions = class BobPermissions extends ToolPermissions {
 			fileContent: this.getFileContent(),
 			filePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())
 		});
-		const approval = settings[APPROVAL_KEY];
+		const approval = settings[APPROVAL_KEY$1];
 		const entry = (isPlainObject$1(approval) && Array.isArray(approval.allowedExecutors) ? approval.allowedExecutors : []).find(isExecuteCommandEntry);
 		const rules = {};
 		for (const pattern of asStringArray$2(entry?.approvedCommands)) rules[pattern] = "allow";
@@ -57199,7 +58571,7 @@ const CODEBUDDY_RULE_LISTS = [
 	"ask",
 	"deny"
 ];
-const CATCH_ALL_PATTERN$12 = "*";
+const CATCH_ALL_PATTERN$13 = "*";
 const MCP_CATEGORY = "mcp";
 const MCP_RULE_PREFIX = "mcp__";
 const ALL_MCP_RULE = "mcp__*";
@@ -57226,7 +58598,7 @@ const CATEGORY_TO_CODEBUDDY_TOOL = {
 	skill: "Skill"
 };
 const CODEBUDDY_TOOL_TO_CATEGORY = Object.fromEntries(Object.entries(CATEGORY_TO_CODEBUDDY_TOOL).map(([category, tool]) => [tool, category]));
-function toStringList$2(value) {
+function toStringList$3(value) {
 	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
 /**
@@ -57272,7 +58644,7 @@ function categoryOfRule$2(rule) {
 *   and reach the `Bash` rules through `honorAllToolsOnBash`.
 */
 function buildCodebuddyRule({ category, pattern, action, logger }) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$12;
+	const catchAll = pattern === CATCH_ALL_PATTERN$13;
 	if (category === MCP_CATEGORY) {
 		if (catchAll && action === "allow") {
 			logger?.warn(`CodeBuddy permissions: skipping the 'mcp' allow rule '*' — CodeBuddy honors the all-MCP wildcard 'mcp__*' in deny and ask only. Allow servers by name instead (for example 'mcp__github').`);
@@ -57281,7 +58653,7 @@ function buildCodebuddyRule({ category, pattern, action, logger }) {
 		return catchAll ? ALL_MCP_RULE : `${MCP_RULE_PREFIX}${pattern}`;
 	}
 	if (category === "*") {
-		if (catchAll) return CATCH_ALL_PATTERN$12;
+		if (catchAll) return CATCH_ALL_PATTERN$13;
 		logger?.warn(`CodeBuddy permissions: skipping the all-tools '*' rule '${pattern}' — CodeBuddy's standalone '*' rule takes no specifier. Write it under the category it is meant for (for example 'bash' or 'read').`);
 		return null;
 	}
@@ -57299,7 +58671,7 @@ function parseCodebuddyRule(rule) {
 	const { specifier } = splitCodebuddyRule(rule);
 	if (specifier === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$12
+		pattern: CATCH_ALL_PATTERN$13
 	};
 	const trimmed = specifier.trim();
 	return trimmed === "" ? null : {
@@ -57340,7 +58712,7 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 		ask: [],
 		deny: []
 	};
-	for (const list of CODEBUDDY_RULE_LISTS) lists[list] = toStringList$2(existingPermissions[list]).filter((rule) => {
+	for (const list of CODEBUDDY_RULE_LISTS) lists[list] = toStringList$3(existingPermissions[list]).filter((rule) => {
 		const category = categoryOfRule$2(rule);
 		return category === void 0 || !managedCategories.has(category);
 	});
@@ -57431,7 +58803,7 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 		});
 		const permissions = isRecord$1(settings[CODEBUDDY_PERMISSIONS_KEY]) ? settings[CODEBUDDY_PERMISSIONS_KEY] : {};
 		const permission = {};
-		for (const action of CODEBUDDY_RULE_LISTS) for (const rule of toStringList$2(permissions[action])) {
+		for (const action of CODEBUDDY_RULE_LISTS) for (const rule of toStringList$3(permissions[action])) {
 			const parsed = parseCodebuddyRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) continue;
 			const rules = permission[parsed.category] ??= {};
@@ -59550,7 +60922,7 @@ function mapBashActionToDecision(action) {
 //#region src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$11 = "*";
+const CATCH_ALL_PATTERN$12 = "*";
 const MCP_CANONICAL_PREFIX$6 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
@@ -59575,14 +60947,14 @@ const COMMANDCODE_TOOL_TO_CATEGORY = {
 	web_fetch: "webfetch",
 	web_search: "websearch"
 };
-const ACTION_RANK$5 = {
+const ACTION_RANK$6 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
 /** Whether `action` outranks `existing` (deny > ask > allow). */
 function isStricterAction({ action, existing }) {
-	return existing === void 0 || ACTION_RANK$5[action] > ACTION_RANK$5[existing];
+	return existing === void 0 || ACTION_RANK$6[action] > ACTION_RANK$6[existing];
 }
 /**
 * Why a padded `Shell( * )` cannot stand in for the bare `Shell` in `allow`:
@@ -59605,10 +60977,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$11 || pattern === "";
+	const catchAll = pattern === CATCH_ALL_PATTERN$12 || pattern === "";
 	if (category.startsWith(MCP_CANONICAL_PREFIX$6)) return catchAll ? category : `${category}(${pattern})`;
 	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$6}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$11 : null;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$12 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -59644,7 +61016,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$11;
+	return inner === "" || inner === CATCH_ALL_PATTERN$12;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -59678,34 +61050,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$11,
+		pattern: CATCH_ALL_PATTERN$12,
 		notInAllow: true
 	};
 	if (tool.startsWith(MCP_CANONICAL_PREFIX$6)) {
-		if (server === CATCH_ALL_PATTERN$11) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$11)) return null;
+		if (server === CATCH_ALL_PATTERN$12) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$12)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$11 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$11,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$12 ? `${MCP_CANONICAL_PREFIX$6}${server}` : `${MCP_CANONICAL_PREFIX$6}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$12,
 			notInAllow: false
 		};
 	}
 	const category = `${MCP_CANONICAL_PREFIX$6}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$11);
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$12);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$11) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$11 && !server.includes(CATCH_ALL_PATTERN$11)) return {
+	if (remainder === CATCH_ALL_PATTERN$12) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$12 && !server.includes(CATCH_ALL_PATTERN$12)) return {
 		category: `${MCP_CANONICAL_PREFIX$6}${server}`,
-		pattern: CATCH_ALL_PATTERN$11,
+		pattern: CATCH_ALL_PATTERN$12,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$11,
+		pattern: CATCH_ALL_PATTERN$12,
 		notInAllow: false
 	} : null;
 }
@@ -59729,14 +61101,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$11,
+			pattern: CATCH_ALL_PATTERN$12,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$11,
+			pattern: CATCH_ALL_PATTERN$12,
 			notInAllow: true
 		} : {
 			category,
@@ -59746,7 +61118,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$11,
+		pattern: CATCH_ALL_PATTERN$12,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -59765,9 +61137,9 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$11) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$12) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$11,
+		pattern: CATCH_ALL_PATTERN$12,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
@@ -59837,7 +61209,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$11})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$12})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -59894,7 +61266,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$11);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$12);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -60165,7 +61537,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 //#endregion
 //#region src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$10 = "*";
+const CATCH_ALL_PATTERN$11 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -60173,7 +61545,7 @@ const CATCH_ALL_PATTERN$10 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$10 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$11 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -60210,7 +61582,7 @@ function toCanonicalToolName$6(continueName) {
 * `Tool(pattern)`.
 */
 function buildContinuePermissionEntry(toolName, pattern) {
-	return pattern === CATCH_ALL_PATTERN$10 ? toolName : `${toolName}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$11 ? toolName : `${toolName}(${pattern})`;
 }
 /**
 * Split a permissions.yaml entry into its tool name and argument pattern, or
@@ -60224,7 +61596,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$10 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$11 : pattern
 	};
 }
 /**
@@ -60398,7 +61770,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$10) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$11) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -60830,7 +62202,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 * arrays are accepted only in MDM/enterprise managed settings, and session
 * tool approvals are machine-written to `permissions-config.json`.
 */
-const WEBFETCH_CATEGORY = "webfetch";
+const WEBFETCH_CATEGORY$1 = "webfetch";
 /** `~/.copilot/settings.json` and `.github/copilot/settings.json` keys. */
 const ALLOWED_URLS_KEY = "allowedUrls";
 const DENIED_URLS_KEY = "deniedUrls";
@@ -60917,7 +62289,7 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const paths = CopilotcliPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const rules = rulesyncPermissions.getJson().permission[WEBFETCH_CATEGORY];
+		const rules = rulesyncPermissions.getJson().permission[WEBFETCH_CATEGORY$1];
 		const patch = {};
 		if (rules !== void 0) {
 			const { allowedUrls, deniedUrls } = splitUrlRules(rules);
@@ -60945,7 +62317,7 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const rules = {};
 		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
 		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
-		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY]: rules } : {};
+		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY$1]: rules } : {};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 	}
 	parseSettings() {
@@ -60980,14 +62352,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 };
 //#endregion
 //#region src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$9 = "*";
+const CATCH_ALL_PATTERN$10 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$9 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$10 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -61186,7 +62558,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$9) {
+		if (pattern === CATCH_ALL_PATTERN$10) {
 			catchAllAction = action;
 			continue;
 		}
@@ -61259,11 +62631,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$9] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$10] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$9] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$10] ??= "allow";
 	}
 	return { permission };
 }
@@ -62705,7 +64077,8 @@ const DEVIN_RESTRICTION_LOSING_SANDBOX_PATHS = [
 * (MCP moved to the dedicated mcp_config.json in v3000.3), so reads and writes
 * merge into the existing JSON and the file is never deleted; only the keys
 * this feature manages are rewritten — `permissions`, plus `sandbox` in global
-* mode when the `devin` override authors it.
+* mode and the plugin governance lists (`requiredPlugins` / `optionalPlugins` /
+* `forbiddenPlugins`) in project mode when the `devin` override authors them.
 *
 * The sibling `sandbox` block — which decides what a permitted command may
 * reach rather than which commands are permitted — has no canonical category
@@ -62726,7 +64099,8 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	/**
 	* config.json may carry the MCP/hooks features' keys, so it is never deleted;
 	* only the keys this feature manages are rewritten — `permissions`, plus
-	* `sandbox` in global mode when the `devin` override authors it.
+	* `sandbox` (global) and the plugin governance lists (project) when the
+	* `devin` override authors them.
 	*/
 	isDeletable() {
 		return false;
@@ -62821,6 +64195,13 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 				});
 			} else if (Object.keys(authoredSandboxRecord).length > 0) logger?.warn("Devin reads 'sandbox' from the user config only, so the 'devin.sandbox' override was dropped from the project config. Generate with --global to author it.");
 		}
+		applyPluginGovernanceOverride({
+			override: config.devin,
+			settings,
+			patch,
+			global,
+			logger
+		});
 		return new DevinPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -62835,7 +64216,7 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			validate
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		let settings;
 		try {
 			const parsed = JSON.parse(this.getFileContent());
@@ -62850,8 +64231,16 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 			deny: Array.isArray(permissions.deny) ? permissions.deny : []
 		});
 		const sandbox = asDevinRecord(settings.sandbox);
+		const devinOverride = {};
+		if (Object.keys(sandbox).length > 0) devinOverride.sandbox = sandbox;
+		for (const key of DEVIN_PLUGIN_GOVERNANCE_KEYS) {
+			const value = settings[key];
+			if (value === void 0) continue;
+			if (DEVIN_PLUGIN_GOVERNANCE_SCHEMAS[key].safeParse(value).success) devinOverride[key] = value;
+			else logger?.warn(`Skipped Devin \`${key}\` on import: ${key === "forbiddenPlugins" ? "expected an array of strings" : "expected an array of plugin sources (strings or objects)"}.`);
+		}
 		const result = { ...config };
-		if (Object.keys(sandbox).length > 0) result.devin = { sandbox };
+		if (Object.keys(devinOverride).length > 0) result.devin = devinOverride;
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(result, null, 2) });
 	}
 	validate() {
@@ -62871,6 +64260,42 @@ var DevinPermissions = class DevinPermissions extends ToolPermissions {
 	}
 };
 /**
+* The repo-level plugin governance lists of a checkout's `.devin/config.json`.
+*
+* @see https://docs.devin.ai/cli/extensibility/plugins/overview
+*/
+const DEVIN_PLUGIN_GOVERNANCE_KEYS = [
+	"requiredPlugins",
+	"optionalPlugins",
+	"forbiddenPlugins"
+];
+/**
+* Patch the plugin governance lists the `devin` override authors into the
+* project `.devin/config.json`. Each authored list replaces the file's list
+* whole; a list it does not author is left as the file holds it. Devin reads these
+* lists only from a checkout's `.devin/config.json`, so in global mode they are
+* dropped with a warning. Losing a `forbiddenPlugins` entry the file held is
+* announced, since that lifts a restriction. A non-empty `requiredPlugins` that changes the file
+* is announced, since Devin installs required plugins automatically and a
+* plugin can ship its own hooks and MCP servers.
+*/
+function applyPluginGovernanceOverride({ override, settings, patch, global, logger }) {
+	const authoredKeys = DEVIN_PLUGIN_GOVERNANCE_KEYS.filter((key) => override?.[key] !== void 0);
+	if (authoredKeys.length === 0) return;
+	if (global) {
+		logger?.warn(`Devin reads the plugin governance lists (${authoredKeys.join(", ")}) from a checkout's '.devin/config.json' only, so they were dropped from the user config. Generate without --global to author them.`);
+		return;
+	}
+	for (const key of authoredKeys) patch[key] = override?.[key];
+	const forbidden = override?.forbiddenPlugins;
+	if (Array.isArray(forbidden) && Array.isArray(settings.forbiddenPlugins)) {
+		const lost = settings.forbiddenPlugins.filter((entry) => !forbidden.includes(entry));
+		if (lost.length > 0) logger?.warn(`Replacing Devin \`forbiddenPlugins\` drops ${lost.map(quoteValueForWarning).join(", ")} from '.devin/config.json': those plugins are no longer forbidden at the repo level.`);
+	}
+	const required = override?.requiredPlugins;
+	if (Array.isArray(required) && required.length > 0 && !(0, node_util.isDeepStrictEqual)(required, settings.requiredPlugins)) logger?.warn(`Writing Devin \`requiredPlugins\` (${required.map(quoteValueForWarning).join(", ")}): Devin installs required plugins automatically, and a plugin can ship its own hooks and MCP servers.`);
+}
+/**
 * Collapse the pattern rules of a bare-only scope to the single action Devin
 * can hold for it, using deny > ask > allow precedence. A map without a
 * catch-all grants nothing to unmatched inputs, so an implicit `ask` joins the
@@ -63128,7 +64553,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 //#region src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$8 = "*";
+const CATCH_ALL_PATTERN$9 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
 const GOOSE_TO_RULESYNC_TOOL_NAMES = {
 	shell: ["bash"],
@@ -63140,7 +64565,7 @@ const ACTION_TO_GOOSE_LIST = {
 	ask: "ask_before",
 	deny: "never_allow"
 };
-const ACTION_RANK$4 = {
+const ACTION_RANK$5 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
@@ -63292,14 +64717,14 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
 		for (const [pattern, action] of Object.entries(rules)) {
-			if (pattern !== CATCH_ALL_PATTERN$8) {
+			if (pattern !== CATCH_ALL_PATTERN$9) {
 				logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 				continue;
 			}
 			const previous = assigned.get(toolName);
 			if (previous === action) continue;
 			if (previous !== void 0) {
-				const stricter = ACTION_RANK$4[action] > ACTION_RANK$4[previous] ? action : previous;
+				const stricter = ACTION_RANK$5[action] > ACTION_RANK$5[previous] ? action : previous;
 				logger?.warn(`Goose maps "${category}" onto the "${toolName}" tool, which already has a conflicting permission ("${previous}"). Keeping the stricter "${stricter}" (deny > ask > allow).`);
 				if (stricter === previous) continue;
 				const previousList = lists[ACTION_TO_GOOSE_LIST[previous]];
@@ -63323,7 +64748,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$8] = action;
+			permission[category][CATCH_ALL_PATTERN$9] = action;
 		}
 	}
 	return { permission };
@@ -63334,7 +64759,7 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$7 = "*";
+const CATCH_ALL_PATTERN$8 = "*";
 const MCP_CANONICAL_PREFIX$3 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
@@ -63380,15 +64805,15 @@ const GROKCLI_PERMISSION_RULES_KEY = "rules";
 * under it has no Grok spelling and returns `null`.
 */
 function buildGrokEntry(category, pattern) {
-	if (category === "*") return pattern === CATCH_ALL_PATTERN$7 ? GROK_ALL_TOOLS_ENTRY : null;
+	if (category === "*") return pattern === CATCH_ALL_PATTERN$8 ? GROK_ALL_TOOLS_ENTRY : null;
 	if (category.startsWith(MCP_CANONICAL_PREFIX$3)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$7 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$8 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$7 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$8 || pattern === "" ? tool : `${tool}(${pattern})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
@@ -63410,21 +64835,21 @@ function parseGrokEntry(entry) {
 	}
 	if (parenIndex === -1 && tool === GROK_ALL_TOOLS_ENTRY) return {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$7
+		pattern: CATCH_ALL_PATTERN$8
 	};
 	if (parenIndex === -1 && tool.startsWith(MCP_CANONICAL_PREFIX$3)) return parseClaudeStyleMcpEntry(tool);
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
 		category: `${MCP_CANONICAL_PREFIX$3}${inner}`,
-		pattern: CATCH_ALL_PATTERN$7
+		pattern: CATCH_ALL_PATTERN$8
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$7
+		pattern: CATCH_ALL_PATTERN$8
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$7
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$8
 	};
 }
 /**
@@ -63441,14 +64866,14 @@ function parseGrokEntry(entry) {
 function parseClaudeStyleMcpEntry(entry) {
 	const rest = entry.slice(5);
 	if (rest.length === 0) return null;
-	if (rest === CATCH_ALL_PATTERN$7) return {
+	if (rest === CATCH_ALL_PATTERN$8) return {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$7
+		pattern: CATCH_ALL_PATTERN$8
 	};
 	const address = rest.includes("__") ? rest : `${rest}__*`;
 	return {
 		category: `${MCP_CANONICAL_PREFIX$3}${address}`,
-		pattern: CATCH_ALL_PATTERN$7
+		pattern: CATCH_ALL_PATTERN$8
 	};
 }
 /**
@@ -63469,20 +64894,20 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$7;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$8;
 	const lowerTool = tool.trim().toLowerCase();
-	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$7 ? {
+	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$8 ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$7,
+		pattern: CATCH_ALL_PATTERN$8,
 		action
 	} : null;
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$7 ? {
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$8 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$7,
+		pattern: CATCH_ALL_PATTERN$8,
 		action
 	} : {
 		category: `${MCP_CANONICAL_PREFIX$3}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$7,
+		pattern: CATCH_ALL_PATTERN$8,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -63635,7 +65060,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord$1(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$7]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$8]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	validate() {
@@ -63655,7 +65080,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 		});
 	}
 };
-const ACTION_RANK$3 = {
+const ACTION_RANK$4 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
@@ -63690,7 +65115,7 @@ function buildGrokPermissionArrays(config, existingPermission, logger) {
 		}
 		const existing = ranked.get(entry);
 		if (existing !== void 0 && existing !== action) logger?.warn(`Grok permission entry '${entry}' received conflicting actions ('${existing}' and '${action}'); keeping the stricter one (deny > ask > allow).`);
-		if (existing === void 0 || ACTION_RANK$3[action] > ACTION_RANK$3[existing]) ranked.set(entry, action);
+		if (existing === void 0 || ACTION_RANK$4[action] > ACTION_RANK$4[existing]) ranked.set(entry, action);
 	}
 	warnRemovedAllToolsRestrictions({
 		existingPermission,
@@ -63726,7 +65151,7 @@ function warnRemovedAllToolsRestrictions({ existingPermission, ranked, logger })
 		const entries = existingPermission[action];
 		if (!isStringArray$1(entries)) continue;
 		if (!entries.some((entry) => parseGrokEntry(entry)?.category === "*")) continue;
-		if (generated !== void 0 && ACTION_RANK$3[generated] >= ACTION_RANK$3[action]) continue;
+		if (generated !== void 0 && ACTION_RANK$4[generated] >= ACTION_RANK$4[action]) continue;
 		logger.warn(`Grok CLI permissions: removing the existing bare '*' entry from the '${action}' array — Rulesync now manages it through the all-tools '*' category, and the canonical config has no '*' '${action}' rule. Add "*": { "*": "${action}" } to keep restricting every tool.`);
 	}
 }
@@ -63741,7 +65166,7 @@ function warnEntriesShadowedByAllTools({ ranked, logger }) {
 	if (!logger) return;
 	const allTools = ranked.get(GROK_ALL_TOOLS_ENTRY);
 	if (allTools === void 0 || allTools === "allow") return;
-	const shadowed = [...ranked].filter(([entry, action]) => entry !== GROK_ALL_TOOLS_ENTRY && ACTION_RANK$3[action] < ACTION_RANK$3[allTools]).map(([entry]) => entry).toSorted();
+	const shadowed = [...ranked].filter(([entry, action]) => entry !== GROK_ALL_TOOLS_ENTRY && ACTION_RANK$4[action] < ACTION_RANK$4[allTools]).map(([entry]) => entry).toSorted();
 	if (shadowed.length === 0) return;
 	logger.warn(`Grok CLI permissions: the bare '*' '${allTools}' rule applies to every tool, and Grok evaluates deny > ask > allow, so these less strict entries never take effect: ${shadowed.join(", ")}.`);
 }
@@ -63764,7 +65189,7 @@ function parseGrokPermissionArrays(permission) {
 	const record = ({ category, pattern, action }) => {
 		const bucket = result[category] ??= {};
 		const existing = bucket[pattern];
-		if (existing === void 0 || ACTION_RANK$3[action] > ACTION_RANK$3[existing]) bucket[pattern] = action;
+		if (existing === void 0 || ACTION_RANK$4[action] > ACTION_RANK$4[existing]) bucket[pattern] = action;
 	};
 	const applyEntries = (entries, action) => {
 		for (const entry of entries ?? []) {
@@ -64168,7 +65593,7 @@ const JUNIE_GROUP_TO_CANONICAL = {
 	mcpTools: "mcp",
 	readOutsideProject: "read"
 };
-function isPermissionAction$2(value) {
+function isPermissionAction$3(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
 /**
@@ -64354,7 +65779,7 @@ function convertJunieToRulesyncPermissions({ allowlist }) {
 		for (const rule of Array.isArray(ruleSet.rules) ? ruleSet.rules : []) {
 			if (!rule || typeof rule !== "object") continue;
 			const pattern = typeof rule.pattern === "string" ? rule.pattern : typeof rule.prefix === "string" ? rule.prefix : void 0;
-			if (pattern === void 0 || !isPermissionAction$2(rule.action)) continue;
+			if (pattern === void 0 || !isPermissionAction$3(rule.action)) continue;
 			(permission[category] ??= {})[pattern] = rule.action;
 		}
 	}
@@ -65314,7 +66739,7 @@ function rulesFromArrays(settings, allowKey, denyKey) {
 }
 //#endregion
 //#region src/features/permissions/kiro-capability-permissions.ts
-const CATCH_ALL_PATTERN$6 = "*";
+const CATCH_ALL_PATTERN$7 = "*";
 const CANONICAL_TO_KIRO_CAPABILITY = {
 	bash: "shell",
 	read: "fs_read",
@@ -65331,12 +66756,12 @@ const KIRO_CAPABILITY_TO_CANONICAL = {
 	web_search: "websearch"
 };
 const MANAGED_CAPABILITIES = new Set(Object.keys(KIRO_CAPABILITY_TO_CANONICAL));
-const ACTION_RANK$2 = {
+const ACTION_RANK$3 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
-function isPermissionAction$1(value) {
+function isPermissionAction$2(value) {
 	return value === "allow" || value === "ask" || value === "deny";
 }
 /**
@@ -65363,7 +66788,7 @@ function rulePatternKey(capability, pattern) {
 function classifyExistingEntry({ emitted, capability, pattern, effect }) {
 	const effects = emitted.get(rulePatternKey(capability, pattern));
 	if (effects === void 0) return "unrelated";
-	return isPermissionAction$1(effect) && effects.has(effect) ? "duplicate" : "conflict";
+	return isPermissionAction$2(effect) && effects.has(effect) ? "duplicate" : "conflict";
 }
 /**
 * Merge one existing rule against the generated entries (see
@@ -65378,7 +66803,7 @@ function mergeExistingRule({ rule, emitted, logger }) {
 	};
 	const capability = rule.capability;
 	const isCatchAll = rule.match === void 0;
-	const patterns = isStringArray$1(rule.match) ? rule.match : [CATCH_ALL_PATTERN$6];
+	const patterns = isStringArray$1(rule.match) ? rule.match : [CATCH_ALL_PATTERN$7];
 	if (patterns.length === 0) return {
 		rule,
 		unrelatedEntries: 0
@@ -65432,7 +66857,7 @@ function mergeExistingRule({ rule, emitted, logger }) {
 */
 function mergeKiroCapabilityRules({ existingRules, generatedRules, logger }) {
 	const emitted = /* @__PURE__ */ new Map();
-	for (const rule of generatedRules) for (const pattern of rule.match ?? [CATCH_ALL_PATTERN$6]) {
+	for (const rule of generatedRules) for (const pattern of rule.match ?? [CATCH_ALL_PATTERN$7]) {
 		const key = rulePatternKey(rule.capability, pattern);
 		const effects = emitted.get(key) ?? /* @__PURE__ */ new Set();
 		effects.add(rule.effect);
@@ -65560,13 +66985,13 @@ var KiroCapabilityPermissions = class KiroCapabilityPermissions extends ToolPerm
 		const rules = isRecord$1(parsed) && Array.isArray(parsed.rules) ? parsed.rules : [];
 		const permission = {};
 		for (const rule of rules) {
-			if (!isImportableRule(rule) || !isRecord$1(rule) || !isPermissionAction$1(rule.effect)) continue;
+			if (!isImportableRule(rule) || !isRecord$1(rule) || !isPermissionAction$2(rule.effect)) continue;
 			const category = KIRO_CAPABILITY_TO_CANONICAL[rule.capability];
-			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$6] : isStringArray$1(rule.match) ? rule.match : [];
+			const patterns = rule.match === void 0 ? [CATCH_ALL_PATTERN$7] : isStringArray$1(rule.match) ? rule.match : [];
 			const categoryRules = permission[category] ??= {};
 			for (const pattern of patterns) {
 				const previous = categoryRules[pattern];
-				if (previous === void 0 || ACTION_RANK$2[rule.effect] > ACTION_RANK$2[previous]) categoryRules[pattern] = rule.effect;
+				if (previous === void 0 || ACTION_RANK$3[rule.effect] > ACTION_RANK$3[previous]) categoryRules[pattern] = rule.effect;
 			}
 		}
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
@@ -65620,11 +67045,11 @@ function buildKiroCapabilityRules({ config, logger }) {
 	}
 	const result = [];
 	for (const { capability, effect, patterns } of buckets.values()) {
-		if (patterns.has(CATCH_ALL_PATTERN$6)) result.push({
+		if (patterns.has(CATCH_ALL_PATTERN$7)) result.push({
 			capability,
 			effect
 		});
-		const match = [...patterns].filter((pattern) => pattern !== CATCH_ALL_PATTERN$6);
+		const match = [...patterns].filter((pattern) => pattern !== CATCH_ALL_PATTERN$7);
 		if (match.length > 0) result.push({
 			capability,
 			match,
@@ -65649,7 +67074,7 @@ function serializeKiroPermissions({ next, parsed, existingContent }) {
 */
 function warnOnWorkspaceRelativeFsPattern({ capability, category, pattern, logger }) {
 	if (capability !== "fs_read" && capability !== "fs_write") return;
-	if (pattern === CATCH_ALL_PATTERN$6 || LOCATION_INDEPENDENT_FS_PATTERN.test(pattern)) return;
+	if (pattern === CATCH_ALL_PATTERN$7 || LOCATION_INDEPENDENT_FS_PATTERN.test(pattern)) return;
 	logger?.warn(`Kiro permissions.yaml is user-level and applies to every workspace, but the ${category} pattern "${pattern}" is relative. Use an absolute, ~-relative or **-prefixed pattern to target a specific location.`);
 }
 /**
@@ -65677,7 +67102,7 @@ const KiroScopedPermissions = {
 //#region src/features/permissions/lettacode-permissions.ts
 /** Top-level key of `.letta/settings.json` that rulesync owns. */
 const LETTACODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$5 = "*";
+const CATCH_ALL_PATTERN$6 = "*";
 /** Letta Code's `Bash(prefix:*)` prefix-match suffix. */
 const PREFIX_SUFFIX = ":*";
 const CATEGORY_TO_LETTACODE_TOOL = {
@@ -65722,12 +67147,12 @@ const LIST_TO_ACTION = {
 	alwaysAsk: "ask",
 	deny: "deny"
 };
-const ACTION_RANK$1 = {
+const ACTION_RANK$2 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
-function toStringList$1(value) {
+function toStringList$2(value) {
 	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
 /**
@@ -65770,7 +67195,7 @@ function categoryOfRule$1(rule) {
 *   widening it would grant commands the source never allowed.
 */
 function toLettacodeBashPayload({ pattern, action, logger }) {
-	if (pattern === CATCH_ALL_PATTERN$5) return "";
+	if (pattern === CATCH_ALL_PATTERN$6) return "";
 	const firstStar = pattern.indexOf("*");
 	if (firstStar === -1) return pattern;
 	if (pattern.endsWith(PREFIX_SUFFIX) && firstStar === pattern.length - 1) return pattern;
@@ -65791,7 +67216,7 @@ function toLettacodeRule({ category, pattern, action, logger }) {
 		pattern,
 		action,
 		logger
-	}) : pattern === CATCH_ALL_PATTERN$5 ? "" : pattern;
+	}) : pattern === CATCH_ALL_PATTERN$6 ? "" : pattern;
 	if (payload === null) return null;
 	return payload === "" ? tool : `${tool}(${payload})`;
 }
@@ -65802,7 +67227,7 @@ function fromLettacodeRule(rule) {
 	const { payload } = splitLettacodeRule(rule);
 	if (payload === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$5
+		pattern: CATCH_ALL_PATTERN$6
 	};
 	const trimmed = payload.trim();
 	if (trimmed === "") return null;
@@ -65810,7 +67235,7 @@ function fromLettacodeRule(rule) {
 		const prefix = trimmed.slice(0, -2).trimEnd();
 		return {
 			category,
-			pattern: prefix === "" ? CATCH_ALL_PATTERN$5 : `${prefix} *`
+			pattern: prefix === "" ? CATCH_ALL_PATTERN$6 : `${prefix} *`
 		};
 	}
 	return {
@@ -65845,11 +67270,11 @@ function buildLettacodeRuleLists({ config, existingPermissions, logger }) {
 			});
 			if (rule === null) continue;
 			const existing = ranked.get(rule);
-			if (existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing]) ranked.set(rule, action);
+			if (existing === void 0 || ACTION_RANK$2[action] > ACTION_RANK$2[existing]) ranked.set(rule, action);
 		}
 	}
 	const lists = {};
-	for (const key of Object.keys(LIST_TO_ACTION)) lists[key] = toStringList$1(existingPermissions[key]).filter((rule) => {
+	for (const key of Object.keys(LIST_TO_ACTION)) lists[key] = toStringList$2(existingPermissions[key]).filter((rule) => {
 		const category = categoryOfRule$1(rule);
 		return category === void 0 || !managedCategories.has(category);
 	});
@@ -65938,12 +67363,12 @@ var LettacodePermissions = class LettacodePermissions extends ToolPermissions {
 		});
 		const permissions = isRecord$1(settings[LETTACODE_PERMISSIONS_KEY]) ? settings[LETTACODE_PERMISSIONS_KEY] : {};
 		const permission = {};
-		for (const [key, action] of Object.entries(LIST_TO_ACTION)) for (const rule of toStringList$1(permissions[key])) {
+		for (const [key, action] of Object.entries(LIST_TO_ACTION)) for (const rule of toStringList$2(permissions[key])) {
 			const parsed = fromLettacodeRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.pattern)) continue;
 			const rules = permission[parsed.category] ??= {};
 			const existing = rules[parsed.pattern];
-			if (existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing]) rules[parsed.pattern] = action;
+			if (existing === void 0 || ACTION_RANK$2[action] > ACTION_RANK$2[existing]) rules[parsed.pattern] = action;
 		}
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
 	}
@@ -66127,7 +67552,11 @@ var OpencodePermissions = class extends ToolPermissions {
 			fileContent = await readFileContentOrNull(jsonPath);
 			if (fileContent) relativeFilePath = this.layout.jsonFileName;
 		}
-		const parsed = (0, jsonc_parser.parse)(fileContent ?? "{}");
+		const parsed = (await readOpencodeDotDirConfigLayers({
+			outputRoot,
+			global,
+			layout: this.layout
+		})).map(({ config }) => config).reduce(mergeOpencodeConfigValues, (0, jsonc_parser.parse)(fileContent ?? "{}"));
 		const record = isRecord$1(parsed) ? parsed : {};
 		const nextJson = {
 			...record,
@@ -66178,6 +67607,16 @@ var OpencodePermissions = class extends ToolPermissions {
 			value,
 			logger
 		});
+		warnOpencodeDotDirOverrides({
+			generated: { permission },
+			overlays: await readOpencodeDotDirConfigLayers({
+				outputRoot,
+				global,
+				layout: this.layout
+			}),
+			rootFileName: relativeFilePath,
+			logger
+		});
 		return new this({
 			outputRoot,
 			relativeDirPath: basePaths.relativeDirPath,
@@ -66267,7 +67706,7 @@ var MimocodePermissions = class extends OpencodePermissions {
 };
 //#endregion
 //#region src/features/permissions/omp-permissions.ts
-const CATCH_ALL_PATTERN$4 = "*";
+const CATCH_ALL_PATTERN$5 = "*";
 const APPROVAL_MODE_KEY = "approvalMode";
 const ACTION_TO_OMP_APPROVAL = {
 	allow: "allow",
@@ -66464,7 +67903,7 @@ function allToolsFloor(rules) {
 	let patternSpecific = false;
 	for (const [pattern, action] of Object.entries(rules ?? {})) {
 		if (action === "allow" || isPrototypePollutionKey(pattern)) continue;
-		if (pattern === CATCH_ALL_PATTERN$4) floor = stricter(floor, action);
+		if (pattern === CATCH_ALL_PATTERN$5) floor = stricter(floor, action);
 		else {
 			patternSpecific = true;
 			floor = stricter(floor, "ask");
@@ -66499,11 +67938,11 @@ function convertBashRules$1({ rules, logger }) {
 	const entries = Object.entries(rules).filter(([pattern]) => !isPrototypePollutionKey(pattern));
 	const hasAsk = entries.some(([, action]) => action === "ask");
 	let policy = hasAsk ? "ask" : void 0;
-	if (hasAsk && rules[CATCH_ALL_PATTERN$4] !== "ask") logger?.warn("oh-my-pi lets a critical command (such as `rm -rf /`) skip a bash prompt pattern unless the bash tool policy prompts, so `tools.approval.bash` was set to \"prompt\": a command no bash allow pattern matches now prompts in every approval mode.");
+	if (hasAsk && rules[CATCH_ALL_PATTERN$5] !== "ask") logger?.warn("oh-my-pi lets a critical command (such as `rm -rf /`) skip a bash prompt pattern unless the bash tool policy prompts, so `tools.approval.bash` was set to \"prompt\": a command no bash allow pattern matches now prompts in every approval mode.");
 	for (const [pattern, action] of entries) {
-		if (pattern === CATCH_ALL_PATTERN$4 && action === "allow") {
+		if (pattern === CATCH_ALL_PATTERN$5 && action === "allow") {
 			if (hasAsk) patterns.push({
-				match: CATCH_ALL_PATTERN$4,
+				match: CATCH_ALL_PATTERN$5,
 				approval: "allow"
 			});
 			else policy = "allow";
@@ -66606,12 +68045,12 @@ function toOmpApproval(value) {
 * ask rules (see `convertBashRules`), so it adds no catch-all.
 */
 function importBashPolicy(bashRules, action) {
-	const catchAll = bashRules[CATCH_ALL_PATTERN$4];
+	const catchAll = bashRules[CATCH_ALL_PATTERN$5];
 	const hasAskPattern = Object.values(bashRules).includes("ask");
-	if (action === "deny") bashRules[CATCH_ALL_PATTERN$4] = "deny";
+	if (action === "deny") bashRules[CATCH_ALL_PATTERN$5] = "deny";
 	else if (catchAll === void 0) {
-		if (action !== void 0 && !(action === "ask" && hasAskPattern)) bashRules[CATCH_ALL_PATTERN$4] = action;
-	} else if (catchAll === "allow" && action !== "allow" && !(action === "ask" && hasAskPattern)) bashRules[CATCH_ALL_PATTERN$4] = "ask";
+		if (action !== void 0 && !(action === "ask" && hasAskPattern)) bashRules[CATCH_ALL_PATTERN$5] = action;
+	} else if (catchAll === "allow" && action !== "allow" && !(action === "ask" && hasAskPattern)) bashRules[CATCH_ALL_PATTERN$5] = "ask";
 }
 /** `bash.patterns` as canonical `bash` rules, in first-match order. */
 function importBashPatterns(value) {
@@ -66639,7 +68078,7 @@ function convertOmpToRulesync(config) {
 		const action = OMP_APPROVAL_TO_ACTION[approval];
 		if (tool === "bash") continue;
 		const category = renamed(OMP_TOOL_TO_CATEGORY, tool);
-		permission[category] = { [CATCH_ALL_PATTERN$4]: stricter(permission[category]?.[CATCH_ALL_PATTERN$4], action) };
+		permission[category] = { [CATCH_ALL_PATTERN$5]: stricter(permission[category]?.[CATCH_ALL_PATTERN$5], action) };
 	}
 	if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
 	const approvalMode = tools[APPROVAL_MODE_KEY];
@@ -66769,7 +68208,7 @@ const POOL_DENY_KEY = "deny";
 const POOL_DISABLED_KEY = "disabled";
 const POOL_PATH_KEY = "path";
 const POOL_WRITE_KEY = "write";
-const CATCH_ALL_PATTERN$3 = "*";
+const CATCH_ALL_PATTERN$4 = "*";
 const PATHS_CATCH_ALL_PATTERN = "**";
 const CANONICAL_TO_POOL_TOOL_NAMES = {
 	bash: "shell",
@@ -67277,7 +68716,7 @@ function pathOfEntry(entry) {
 */
 function importPoolTool({ toolConfig, bucket }) {
 	if (toolConfig[POOL_DISABLED_KEY] === true) {
-		bucket[CATCH_ALL_PATTERN$3] = "deny";
+		bucket[CATCH_ALL_PATTERN$4] = "deny";
 		return;
 	}
 	const denied = isStringArray$1(toolConfig[POOL_DENY_KEY]) ? toolConfig[POOL_DENY_KEY] : [];
@@ -67334,9 +68773,58 @@ const QODER_PERMISSIONS_KEY = "permissions";
 * @see https://docs.qoder.com/cli/settings-reference
 */
 const QODER_OUTPUT_STYLE_KEY = "outputStyle";
-const CATCH_ALL_PATTERN$2 = "*";
+/**
+* The settings groups the `qoder` override may author, each with the only keys
+* of that group rulesync writes and imports. A group's other keys are kept as
+* the file has them; an override key not listed here is skipped with a
+* warning, so a shared permissions file cannot reach `tools.shell.pager`,
+* `general.preferredEditor` and the like.
+* @see https://docs.qoder.com/cli/settings-reference
+*/
+const QODER_OVERRIDE_GROUP_KEYS = {
+	general: ["defaultPermissionMode"],
+	tools: ["core", "exclude"],
+	mcp: [
+		"allowed",
+		"excluded",
+		"enableAllProjectMcpServers",
+		"enabledProjectMcpServers",
+		"lazyLoad"
+	],
+	agents: ["overrides"]
+};
+const QODER_OVERRIDE_GROUPS = Object.keys(QODER_OVERRIDE_GROUP_KEYS);
+/**
+* Top-level Auto-mode classifier guidance. Qoder reads it from the user
+* settings only (a workspace file could otherwise bias the classifier), so it
+* is written and imported in global mode alone.
+* @see https://docs.qoder.com/en/cli/permissions
+*/
+const QODER_AUTO_MODE_KEY = "autoMode";
+/** The `autoMode` keys rulesync writes and imports. */
+const QODER_AUTO_MODE_KEYS = [
+	"allow",
+	"soft_deny",
+	"environment"
+];
+/** Top-level globs that keep project/local memory files from loading. */
+const QODER_AGENTS_MD_EXCLUDES_KEY = "agentsMdExcludes";
+/**
+* `general.defaultPermissionMode` values (lower-cased; Qoder matches them
+* case-insensitively) that let actions run without a prompt.
+* @see https://docs.qoder.com/en/cli/permissions
+*/
+const QODER_PERMISSIVE_MODES = /* @__PURE__ */ new Set([
+	"accept_edits",
+	"acceptedits",
+	"auto",
+	"bypass_permissions",
+	"bypasspermissions",
+	"yolo"
+]);
+const CATCH_ALL_PATTERN$3 = "*";
 /** Prefix of the fully qualified MCP tool names (`mcp__<server>__<tool>`). */
-const MCP_TOOL_PREFIX = "mcp__";
+const MCP_TOOL_PREFIX$1 = "mcp__";
 const CATEGORY_TO_QODER_TOOL = {
 	bash: "Bash",
 	read: "Read",
@@ -67366,12 +68854,12 @@ const ACTIONS = [
 	"ask",
 	"deny"
 ];
-const ACTION_RANK = {
+const ACTION_RANK$1 = {
 	allow: 0,
 	ask: 1,
 	deny: 2
 };
-function toStringList(value) {
+function toStringList$1(value) {
 	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
 /**
@@ -67393,7 +68881,7 @@ function splitQoderRule(rule) {
 function categoryOfRule(rule) {
 	const { tool } = splitQoderRule(rule);
 	if (tool === null) return;
-	if (tool === "*" || tool.startsWith(MCP_TOOL_PREFIX)) return tool;
+	if (tool === "*" || tool.startsWith(MCP_TOOL_PREFIX$1)) return tool;
 	return Object.hasOwn(QODER_TOOL_TO_CATEGORY, tool) ? QODER_TOOL_TO_CATEGORY[tool] : void 0;
 }
 /**
@@ -67412,18 +68900,18 @@ function categoryOfRule(rule) {
 */
 function toQoderRule({ category, pattern, logger }) {
 	if (category === "*") {
-		if (pattern === CATCH_ALL_PATTERN$2) return CATCH_ALL_PATTERN$2;
+		if (pattern === CATCH_ALL_PATTERN$3) return CATCH_ALL_PATTERN$3;
 		logger?.warn(`Qoder permissions: skipping the all-tools '*' rule '${pattern}' — a Qoder rule with a payload names one tool. Write it under the categories it is meant for (for example 'bash' or 'read').`);
 		return null;
 	}
-	if (category.startsWith(MCP_TOOL_PREFIX)) {
-		if (pattern === CATCH_ALL_PATTERN$2) return category;
+	if (category.startsWith(MCP_TOOL_PREFIX$1)) {
+		if (pattern === CATCH_ALL_PATTERN$3) return category;
 		logger?.warn(`Qoder permissions: skipping the '${category}' rule '${pattern}' — Qoder matches MCP tools by name only.`);
 		return null;
 	}
 	const tool = CATEGORY_TO_QODER_TOOL[category];
 	if (tool === void 0) return null;
-	if (pattern === CATCH_ALL_PATTERN$2) return tool;
+	if (pattern === CATCH_ALL_PATTERN$3) return tool;
 	return `${QODER_PATH_RULE_ALIASES[tool] ?? tool}(${pattern})`;
 }
 /** Read a Qoder rule back into a canonical category and pattern. */
@@ -67433,9 +68921,9 @@ function fromQoderRule(rule) {
 	const { payload } = splitQoderRule(rule);
 	if (payload === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$2
+		pattern: CATCH_ALL_PATTERN$3
 	};
-	if (category === "*" || category.startsWith(MCP_TOOL_PREFIX)) return null;
+	if (category === "*" || category.startsWith(MCP_TOOL_PREFIX$1)) return null;
 	const trimmed = payload.trim();
 	if (trimmed === "") return null;
 	return {
@@ -67455,7 +68943,7 @@ function buildQoderRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		if (category !== "*" && !category.startsWith(MCP_TOOL_PREFIX) && !Object.hasOwn(CATEGORY_TO_QODER_TOOL, category)) {
+		if (category !== "*" && !category.startsWith(MCP_TOOL_PREFIX$1) && !Object.hasOwn(CATEGORY_TO_QODER_TOOL, category)) {
 			logger?.warn(`Qoder permissions: skipping the '${category}' category — Qoder has no permission rule for it.`);
 			continue;
 		}
@@ -67469,11 +68957,11 @@ function buildQoderRuleLists({ config, existingPermissions, logger }) {
 			});
 			if (rule === null) continue;
 			const existing = ranked.get(rule);
-			if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) ranked.set(rule, action);
+			if (existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing]) ranked.set(rule, action);
 		}
 	}
 	const lists = {};
-	for (const action of ACTIONS) lists[action] = toStringList(existingPermissions[action]).filter((rule) => {
+	for (const action of ACTIONS) lists[action] = toStringList$1(existingPermissions[action]).filter((rule) => {
 		if (ranked.has(rule)) return false;
 		const category = categoryOfRule(rule);
 		return category === void 0 || !managedCategories.has(category);
@@ -67483,6 +68971,130 @@ function buildQoderRuleLists({ config, existingPermissions, logger }) {
 	return lists;
 }
 /**
+* The keys of one authored override group that rulesync writes; any other key
+* is skipped with a warning.
+*/
+function pickQoderGroupKeys({ group, allowedKeys, authored, where, logger }) {
+	const picked = {};
+	for (const [key, value] of Object.entries(authored)) {
+		if (isPrototypePollutionKey(key) || value === void 0) continue;
+		if (!allowedKeys.includes(key)) {
+			logger?.warn(`Qoder permissions: skipping qoder.${group}.${key} — Rulesync writes only ${allowedKeys.map((k) => `${group}.${k}`).join(", ")} from the qoder override; set other keys in ${where} by hand.`);
+			continue;
+		}
+		picked[key] = value;
+	}
+	return picked;
+}
+/** Name every written override setting that lets Qoder act with fewer prompts. */
+function announcePermissiveQoderSettings({ patch, where, logger }) {
+	const mode = (isRecord$1(patch.general) ? patch.general : {}).defaultPermissionMode;
+	if (typeof mode === "string" && QODER_PERMISSIVE_MODES.has(mode.trim().toLowerCase())) logger?.warn(`Qoder permissions: qoder.general.defaultPermissionMode = ${JSON.stringify(mode)} was written to ${where}, so Qoder starts every session it applies to in a mode that runs actions without asking first.`);
+	const mcp = isRecord$1(patch.mcp) ? patch.mcp : {};
+	if (mcp.enableAllProjectMcpServers === true) logger?.warn(`Qoder permissions: qoder.mcp.enableAllProjectMcpServers = true was written to ${where}, so Qoder starts every project-level MCP server without asking for approval.`);
+	const enabledServers = toStringList$1(mcp.enabledProjectMcpServers);
+	if (enabledServers.length > 0) logger?.warn(`Qoder permissions: qoder.mcp.enabledProjectMcpServers was written to ${where}, so Qoder starts the project-level MCP servers ${enabledServers.map((name) => JSON.stringify(name)).join(", ")} without asking for approval.`);
+	if (toStringList$1((isRecord$1(patch[QODER_AUTO_MODE_KEY]) ? patch[QODER_AUTO_MODE_KEY] : {}).allow).length > 0) logger?.warn(`Qoder permissions: qoder.autoMode.allow was written to ${where}, so Qoder's Auto-mode classifier leans toward approving the actions it describes.`);
+}
+/**
+* The top-level keys the `qoder` override contributes to the settings patch,
+* besides `permissions` and `outputStyle`. Each group is the existing group
+* with the authored keys laid over it; a key is only in the patch when
+* authored. Every write that lets Qoder act with fewer prompts is announced.
+*/
+function buildQoderOverridePatch({ override, existing, global, filePath, logger }) {
+	const patch = {};
+	if (override === void 0) return patch;
+	const where = `${filePath}${global ? " in the home directory" : ""}`;
+	for (const group of QODER_OVERRIDE_GROUPS) {
+		const authored = override[group];
+		if (!isRecord$1(authored)) continue;
+		const picked = pickQoderGroupKeys({
+			group,
+			allowedKeys: QODER_OVERRIDE_GROUP_KEYS[group],
+			authored,
+			where,
+			logger
+		});
+		if (Object.keys(picked).length > 0) patch[group] = {
+			...isRecord$1(existing[group]) ? existing[group] : {},
+			...picked
+		};
+	}
+	const autoMode = override[QODER_AUTO_MODE_KEY];
+	if (isRecord$1(autoMode)) {
+		if (global) {
+			const picked = pickQoderGroupKeys({
+				group: QODER_AUTO_MODE_KEY,
+				allowedKeys: QODER_AUTO_MODE_KEYS,
+				authored: autoMode,
+				where,
+				logger
+			});
+			if (Object.keys(picked).length > 0) {
+				const existingAutoMode = isRecord$1(existing[QODER_AUTO_MODE_KEY]) ? existing[QODER_AUTO_MODE_KEY] : {};
+				patch[QODER_AUTO_MODE_KEY] = {
+					...existingAutoMode,
+					...picked
+				};
+			}
+		} else logger?.warn(`Qoder permissions: skipping qoder.autoMode in project mode — Qoder reads autoMode from the user settings only. Run 'rulesync generate --global' to write it to ~/.qoder/settings.json.`);
+	}
+	const excludes = override[QODER_AGENTS_MD_EXCLUDES_KEY];
+	if (Array.isArray(excludes)) patch[QODER_AGENTS_MD_EXCLUDES_KEY] = toStringList$1(excludes);
+	announcePermissiveQoderSettings({
+		patch: {
+			general: override.general,
+			mcp: override.mcp,
+			...global && { [QODER_AUTO_MODE_KEY]: autoMode }
+		},
+		where,
+		logger
+	});
+	return patch;
+}
+/**
+* Whether a settings value has the shape the `qoder` override schema accepts
+* for that key, so an off-spec value is left in the file instead of making the
+* imported permissions file fail validation.
+*/
+function isLiftableQoderValue(key, value) {
+	switch (key) {
+		case "defaultPermissionMode": return typeof value === "string" && value.trim() !== "";
+		case "enableAllProjectMcpServers":
+		case "lazyLoad": return typeof value === "boolean";
+		case "overrides": return isRecord$1(value) && Object.values(value).every(isRecord$1);
+		default: return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+	}
+}
+/**
+* Lift the settings the `qoder` override authors (other than `outputStyle`)
+* back out of a settings file. `autoMode` is lifted only from the user file,
+* the one Qoder reads it from.
+*/
+function liftQoderOverride({ settings, global }) {
+	const lifted = {};
+	for (const group of QODER_OVERRIDE_GROUPS) {
+		const existingGroup = settings[group];
+		if (!isRecord$1(existingGroup)) continue;
+		const picked = {};
+		for (const key of QODER_OVERRIDE_GROUP_KEYS[group]) {
+			const value = Object.hasOwn(existingGroup, key) ? existingGroup[key] : void 0;
+			if (isLiftableQoderValue(key, value)) picked[key] = value;
+		}
+		if (Object.keys(picked).length > 0) lifted[group] = picked;
+	}
+	const autoMode = settings[QODER_AUTO_MODE_KEY];
+	if (global && isRecord$1(autoMode)) {
+		const picked = {};
+		for (const key of QODER_AUTO_MODE_KEYS) if (Object.hasOwn(autoMode, key) && isLiftableQoderValue(key, autoMode[key])) picked[key] = autoMode[key];
+		if (Object.keys(picked).length > 0) lifted[QODER_AUTO_MODE_KEY] = picked;
+	}
+	const excludes = settings[QODER_AGENTS_MD_EXCLUDES_KEY];
+	if (isLiftableQoderValue(QODER_AGENTS_MD_EXCLUDES_KEY, excludes)) lifted[QODER_AGENTS_MD_EXCLUDES_KEY] = excludes;
+	return lifted;
+}
+/**
 * Qoder permissions.
 *
 * Rules live under the `permissions` key of `.qoder/settings.json` (project)
@@ -67494,7 +69106,9 @@ function buildQoderRuleLists({ config, existingPermissions, logger }) {
 * (`additionalDirectories`, `trustDirectories`) are kept, and the file is
 * never deleted. `.qoder/settings.local.json` (where `/allow` and `/deny`
 * persist) is left to the user. The `qoder` override's `outputStyle` is
-* written to (and imported from) the top-level `outputStyle` key.
+* written to (and imported from) the top-level `outputStyle` key, and its
+* other settings (`general`, `tools`, `mcp`, `agents`, `autoMode`,
+* `agentsMdExcludes`) through `buildQoderOverridePatch` / `liftQoderOverride`.
 *
 * @see https://docs.qoder.com/en/cli/permissions
 * @see https://docs.qoder.com/cli/output-styles
@@ -67557,7 +69171,14 @@ var QoderPermissions = class QoderPermissions extends ToolPermissions {
 				existingContent,
 				patch: {
 					[QODER_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0,
-					...outputStyle !== void 0 && { [QODER_OUTPUT_STYLE_KEY]: outputStyle }
+					...outputStyle !== void 0 && { [QODER_OUTPUT_STYLE_KEY]: outputStyle },
+					...buildQoderOverridePatch({
+						override: config.qoder,
+						existing,
+						global,
+						filePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath),
+						logger
+					})
 				},
 				filePath
 			}),
@@ -67572,18 +69193,24 @@ var QoderPermissions = class QoderPermissions extends ToolPermissions {
 		});
 		const permissions = isRecord$1(settings[QODER_PERMISSIONS_KEY]) ? settings[QODER_PERMISSIONS_KEY] : {};
 		const permission = {};
-		for (const action of ACTIONS) for (const rule of toStringList(permissions[action])) {
+		for (const action of ACTIONS) for (const rule of toStringList$1(permissions[action])) {
 			const parsed = fromQoderRule(rule);
 			if (parsed === null || isPrototypePollutionKey(parsed.category) || isPrototypePollutionKey(parsed.pattern)) continue;
 			const rules = permission[parsed.category] ??= {};
 			const existing = rules[parsed.pattern];
-			if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) rules[parsed.pattern] = action;
+			if (existing === void 0 || ACTION_RANK$1[action] > ACTION_RANK$1[existing]) rules[parsed.pattern] = action;
 		}
 		const outputStyle = settings[QODER_OUTPUT_STYLE_KEY];
-		const hasOutputStyle = typeof outputStyle === "string" && outputStyle.trim() !== "";
+		const qoder = {
+			...typeof outputStyle === "string" && outputStyle.trim() !== "" && { outputStyle },
+			...liftQoderOverride({
+				settings,
+				global: this.global
+			})
+		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
 			permission,
-			...hasOutputStyle && { qoder: { outputStyle } }
+			...Object.keys(qoder).length > 0 && { qoder }
 		}, null, 2) });
 	}
 	validate() {
@@ -68444,9 +70071,53 @@ const REASONIX_TRUST_AFFECTING_SANDBOX_PATHS = [
 		path: ["workspace_root"],
 		reason: "moves the root the file-writing tools and sandboxed Bash are confined to, so what they may reach is decided by this path rather than by the project directory",
 		widens: escapesTheProject
+	},
+	{
+		path: ["allow_devices"],
+		reason: "binds host device nodes into the Linux Bash sandbox, which otherwise sees a private /dev",
+		widens: isNonEmptyList
+	},
+	{
+		path: ["egress_unlisted"],
+		reason: "lets sandboxed Bash reach hosts that allowed_domains does not name without asking first",
+		widens: (value) => typeof value !== "string" || !["", "ask"].includes(value.trim().toLowerCase())
+	},
+	{
+		path: ["host_authorities"],
+		reason: "lets sandboxed Bash call host services beyond the SSH agent, such as a container daemon socket, which amounts to host-wide execution",
+		widens: (value) => !Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.trim() !== "ssh_agent")
 	}
 ];
 /**
+* `[sandbox]` keys Reasonix reads only from the user config. In project scope
+* `narrowSandbox` replaces each of them with the user's value (and reports a
+* project `egress_unlisted` as user-only), so a repository cannot hand itself a
+* device, a host service or unprompted egress. A project-scope generate skips
+* them with a warning, the way `applyPermissionsMode` treats `mode`.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.44.0/internal/contract/config/project_scope.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.44.0/internal/contract/config/config.go
+*/
+const REASONIX_USER_ONLY_SANDBOX_KEYS = [
+	"allow_devices",
+	"egress_unlisted",
+	"host_authorities"
+];
+/**
+* Removes the user-only `[sandbox]` keys from a project-scope override, warning
+* once about what was skipped. The keys are left alone in the file, so whatever
+* it already had survives the shallow merge. Global scope keeps them all, and
+* a non-table override is returned as is, so the trust check still reports its
+* shape rather than seeing nothing.
+*/
+function dropUserOnlySandboxKeys({ sandbox, global, relativeFilePath, logger }) {
+	if (global || !isRecord$1(sandbox)) return sandbox;
+	const skipped = REASONIX_USER_ONLY_SANDBOX_KEYS.filter((key) => sandbox[key] !== void 0);
+	if (skipped.length === 0) return sandbox;
+	logger?.warn(`Reasonix permissions: skipping ${skipped.map((key) => `reasonix.sandbox.${key}`).join(", ")} for the project-scoped ${relativeFilePath}; Reasonix reads ${skipped.length === 1 ? "this key" : "these keys"} only from the user config and replaces a project value with the user's, so generate it with --global instead.`);
+	return Object.fromEntries(Object.entries(sandbox).filter(([key]) => !skipped.includes(key)));
+}
+/**
 * Whether a `workspace_root` points somewhere other than inside the project the
 * generate runs in. The key moves the write confinement rather than adding to
 * it, so the ordinary value — the project directory, spelled relatively — would
@@ -68683,14 +70354,20 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		}));
 		const patch = { permissions: mergedPermissions };
 		if (override?.sandbox !== void 0) {
+			const authoredSandbox = dropUserOnlySandboxKeys({
+				sandbox: override.sandbox,
+				global,
+				relativeFilePath: relativeFilePathForLog,
+				logger
+			});
 			const mergedSandbox = {
 				...asReasonixRecord(parsed.sandbox),
-				...asReasonixRecord(override.sandbox)
+				...asReasonixRecord(authoredSandbox)
 			};
 			patch.sandbox = mergedSandbox;
 			trustAffecting.push(...collectSandboxOverlayEntries({
 				existing: parsed.sandbox,
-				authored: override.sandbox,
+				authored: authoredSandbox,
 				merged: mergedSandbox
 			}));
 		}
@@ -68743,7 +70420,7 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			ask: askSplit.translated,
 			deny: denySplit.translated
 		});
-		const sandbox = asReasonixRecord(this.toml.sandbox);
+		const sandbox = Object.fromEntries(Object.entries(asReasonixRecord(this.toml.sandbox)).filter(([key]) => this.global || !REASONIX_USER_ONLY_SANDBOX_KEYS.includes(key)));
 		const agentPlanMode = pickReasonixKeys(this.toml.agent, [...REASONIX_OVERRIDE_AGENT_KEYS, ...REASONIX_RETIRED_AGENT_KEYS]);
 		const reasonixOverride = {};
 		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
@@ -69049,7 +70726,7 @@ var RooPermissions = class extends ToolPermissions {
 };
 //#endregion
 //#region src/features/permissions/rovodev-permissions.ts
-const CATCH_ALL_PATTERN$1 = "*";
+const CATCH_ALL_PATTERN$2 = "*";
 const CATEGORY_TO_TOOL_KEYS = {
 	read: [
 		"open_files",
@@ -69380,7 +71057,7 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 		logger
 	});
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
-		if (category === CATCH_ALL_PATTERN$1) {
+		if (category === CATCH_ALL_PATTERN$2) {
 			const toolWideDefault = convertAllToolsRules({
 				rules,
 				logger
@@ -69399,7 +71076,7 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 			continue;
 		}
 		for (const [pattern, action] of Object.entries(rules)) {
-			if (pattern === CATCH_ALL_PATTERN$1) {
+			if (pattern === CATCH_ALL_PATTERN$2) {
 				toolPermissions.tools ??= {};
 				for (const toolKey of toolKeys) toolPermissions.tools[toolKey] = strictestAction(toolPermissions.tools[toolKey], action);
 				continue;
@@ -69422,8 +71099,8 @@ function convertRulesyncToRovodevToolPermissions({ config, logger }) {
 * resolution never grants more than the author asked for.
 */
 function warnOnEditWriteConflict({ config, logger }) {
-	const editCatchAll = config.permission.edit?.[CATCH_ALL_PATTERN$1];
-	const writeCatchAll = config.permission.write?.[CATCH_ALL_PATTERN$1];
+	const editCatchAll = config.permission.edit?.[CATCH_ALL_PATTERN$2];
+	const writeCatchAll = config.permission.write?.[CATCH_ALL_PATTERN$2];
 	if (editCatchAll && writeCatchAll && editCatchAll !== writeCatchAll) logger?.warn(`Rovo Dev maps both "edit" and "write" onto the same file-mutation tools, but they have conflicting catch-all permissions ("edit": "${editCatchAll}", "write": "${writeCatchAll}"). The stricter of the two ("${strictestAction(editCatchAll, writeCatchAll)}") is used.`);
 }
 /**
@@ -69436,7 +71113,7 @@ function warnOnEditWriteConflict({ config, logger }) {
 function convertAllToolsRules({ rules, logger }) {
 	let toolWideDefault;
 	for (const [pattern, action] of Object.entries(rules)) {
-		if (pattern === CATCH_ALL_PATTERN$1) {
+		if (pattern === CATCH_ALL_PATTERN$2) {
 			toolWideDefault = action;
 			continue;
 		}
@@ -69448,7 +71125,7 @@ function convertBashRules(rules) {
 	const bash = {};
 	const commands = [];
 	for (const [pattern, action] of Object.entries(rules)) {
-		if (pattern === CATCH_ALL_PATTERN$1) {
+		if (pattern === CATCH_ALL_PATTERN$2) {
 			bash.default = action;
 			continue;
 		}
@@ -69465,26 +71142,26 @@ function convertBashRules(rules) {
 */
 function convertRovodevToolPermissionsToRulesync(toolPermissions) {
 	const permission = {};
-	if (isPermissionAction(toolPermissions.default)) permission[CATCH_ALL_PATTERN$1] = { [CATCH_ALL_PATTERN$1]: toolPermissions.default };
+	if (isPermissionAction$1(toolPermissions.default)) permission[CATCH_ALL_PATTERN$2] = { [CATCH_ALL_PATTERN$2]: toolPermissions.default };
 	const bash = toolPermissions.bash;
 	if (isRecord$1(bash)) {
 		const bashRules = {};
-		if (isPermissionAction(bash.default)) bashRules[CATCH_ALL_PATTERN$1] = bash.default;
+		if (isPermissionAction$1(bash.default)) bashRules[CATCH_ALL_PATTERN$2] = bash.default;
 		if (Array.isArray(bash.commands)) {
-			for (const entry of bash.commands) if (isRecord$1(entry) && typeof entry.command === "string" && isPermissionAction(entry.permission)) bashRules[entry.command] = entry.permission;
+			for (const entry of bash.commands) if (isRecord$1(entry) && typeof entry.command === "string" && isPermissionAction$1(entry.permission)) bashRules[entry.command] = entry.permission;
 		}
 		if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
 	}
 	const nestedTools = isRecord$1(toolPermissions.tools) ? toolPermissions.tools : {};
-	const implicitLevel = isPermissionAction(toolPermissions.default) ? toolPermissions.default : "ask";
+	const implicitLevel = isPermissionAction$1(toolPermissions.default) ? toolPermissions.default : "ask";
 	for (const category of new Set(Object.values(TOOL_KEY_TO_CATEGORY))) {
 		const levels = Object.entries(TOOL_KEY_TO_CATEGORY).filter(([, mapped]) => mapped === category).map(([toolKey]) => {
 			const value = Object.hasOwn(nestedTools, toolKey) ? nestedTools[toolKey] : toolPermissions[toolKey];
-			return isPermissionAction(value) ? value : void 0;
+			return isPermissionAction$1(value) ? value : void 0;
 		});
 		if (levels.every((level) => level === void 0)) continue;
 		permission[category] ??= {};
-		permission[category][CATCH_ALL_PATTERN$1] = levels.reduce((strictest, level) => strictestAction(strictest, level ?? implicitLevel), permission[category][CATCH_ALL_PATTERN$1]);
+		permission[category][CATCH_ALL_PATTERN$2] = levels.reduce((strictest, level) => strictestAction(strictest, level ?? implicitLevel), permission[category][CATCH_ALL_PATTERN$2]);
 	}
 	if (isStringArray$1(toolPermissions.allowedExternalPaths)) for (const path of toolPermissions.allowedExternalPaths) {
 		permission.read ??= {};
@@ -69501,7 +71178,7 @@ function strictestAction(current, candidate) {
 	if (current === void 0) return candidate;
 	return ACTION_STRICTNESS.indexOf(current) <= ACTION_STRICTNESS.indexOf(candidate) ? current : candidate;
 }
-function isPermissionAction(value) {
+function isPermissionAction$1(value) {
 	return PermissionActionSchema.safeParse(value).success;
 }
 //#endregion
@@ -70208,7 +71885,7 @@ const TAKT_SECURITY_POLICIES = {
 const TAKT_SECURITY_POLICY_KEYS = Object.keys(TAKT_SECURITY_POLICIES);
 const TAKT_DEFAULT_PROVIDER = "claude-sdk";
 const TAKT_LEGACY_DEFAULT_PROVIDER = "claude";
-const CATCH_ALL_PATTERN = "*";
+const CATCH_ALL_PATTERN$1 = "*";
 /**
 * Permissions adapter for Takt (`.takt/config.yaml`).
 *
@@ -70829,9 +72506,9 @@ function deriveTaktPermissionMode(config) {
 */
 function taktModeToRulesyncConfig(mode) {
 	switch (mode) {
-		case "full": return { permission: { bash: { [CATCH_ALL_PATTERN]: "allow" } } };
-		case "edit": return { permission: { edit: { [CATCH_ALL_PATTERN]: "allow" } } };
-		default: return { permission: { bash: { [CATCH_ALL_PATTERN]: "deny" } } };
+		case "full": return { permission: { bash: { [CATCH_ALL_PATTERN$1]: "allow" } } };
+		case "edit": return { permission: { edit: { [CATCH_ALL_PATTERN$1]: "allow" } } };
+		default: return { permission: { bash: { [CATCH_ALL_PATTERN$1]: "deny" } } };
 	}
 }
 /**
@@ -70864,6 +72541,409 @@ function pickSecurityPolicies(source, report) {
 	return picked;
 }
 //#endregion
+//#region src/features/permissions/trae-permissions.ts
+const CUSTOM_PROFILES_KEY = "customProfiles";
+const DEFAULT_CUSTOM_PROFILE_KEY = "defaultCustomProfile";
+const APPROVAL_KEY = "approval";
+const COMMAND_RULES_KEY = "commandRules";
+const MCP_RULES_KEY = "mcpRules";
+const RESOURCE_AUTHORIZATION_KEY = "resourceAuthorization";
+const NETWORK_KEY = "network";
+const BASH_CATEGORY = "bash";
+const WEBFETCH_CATEGORY = "webfetch";
+const MCP_TOOL_PREFIX = "mcp__";
+const MCP_SEPARATOR = "__";
+const CATCH_ALL_PATTERN = "*";
+const REGEX_PREFIX = "r/";
+const REGEX_SUFFIX = "/";
+const ACTION_RANK = {
+	allow: 0,
+	ask: 1,
+	deny: 2
+};
+const NETWORK_ACTIONS = ["allow", "deny"];
+function isPermissionAction(value) {
+	return value === "allow" || value === "ask" || value === "deny";
+}
+function toStringList(value) {
+	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+function escapeRegex(text) {
+	return text.replace(/[\\^$.|?*+()[\]{}/]/g, "\\$&");
+}
+/** Build the anchored TRAE regex rule (`r/^...$/`) a canonical glob stands for. */
+function globToTraeRegex(pattern) {
+	const body = pattern.split(CATCH_ALL_PATTERN).map(escapeRegex).join(".*");
+	return `${REGEX_PREFIX}^${body}$${REGEX_SUFFIX}`;
+}
+/**
+* Translate a canonical `bash` glob into a TRAE `commandRules` key. TRAE
+* matches a key exactly (`git status`), as a prefix when it ends in `*`
+* (`git add *`), or as a regex when it is written `r/.../`. A glob whose only
+* `*` is the trailing one is already a TRAE prefix rule and a glob without
+* `*` an exact one; every other glob (a bare `*`, an inner `*`, or a literal
+* that would read as `r/.../`) becomes an anchored regex.
+*/
+function toTraeCommandKey(pattern) {
+	const starCount = pattern.split(CATCH_ALL_PATTERN).length - 1;
+	const looksLikeRegex = pattern.startsWith(REGEX_PREFIX) && pattern.endsWith(REGEX_SUFFIX);
+	if (!looksLikeRegex && starCount === 0) return pattern;
+	if (!looksLikeRegex && starCount === 1 && pattern.length > 1 && pattern.endsWith("*")) return pattern;
+	return globToTraeRegex(pattern);
+}
+/**
+* Read a `commandRules` key back into a canonical `bash` glob, or `null` for a
+* key with no glob spelling: a regex rulesync did not write, or an exact key
+* with an inner `*` (TRAE matches that `*` literally).
+*/
+function fromTraeCommandKey(key) {
+	if (!(key.startsWith(REGEX_PREFIX) && key.endsWith(REGEX_SUFFIX) && key.length > 2)) return toTraeCommandKey(key) === key ? key : null;
+	const anchored = key.slice(2, -1).match(/^\^([\s\S]*)\$$/);
+	if (!anchored) return null;
+	const glob = (anchored[1] ?? "").split(".*").map((part) => part.replace(/\\(.)/g, "$1")).join(CATCH_ALL_PATTERN);
+	return globToTraeRegex(glob) === key ? glob : null;
+}
+/**
+* Translate a canonical MCP category (`mcp__<server>__<tool>`,
+* `mcp__<server>__*` or `mcp__<server>`) into a TRAE `mcpRules` key
+* (`<server>__<tool>`, `<server>__*`, `<server>`). `null` when TRAE has no
+* spelling for it (`mcp__*`, which names no server).
+*/
+function toTraeMcpKey(category) {
+	const rest = category.slice(5);
+	const server = rest.split(MCP_SEPARATOR)[0] ?? "";
+	if (server === "" || server.includes(CATCH_ALL_PATTERN)) return null;
+	return rest;
+}
+/** Read a TRAE `mcpRules` key back into its canonical MCP category. */
+function fromTraeMcpKey(key) {
+	if (key === "" || key.startsWith(MCP_SEPARATOR)) return null;
+	return key.includes(MCP_SEPARATOR) ? `${MCP_TOOL_PREFIX}${key}` : `${MCP_TOOL_PREFIX}${key}${MCP_SEPARATOR}${CATCH_ALL_PATTERN}`;
+}
+function readRecord(source, path) {
+	let current = source;
+	for (const key of path) {
+		if (!isRecord$1(current)) return {};
+		current = current[key];
+	}
+	return isRecord$1(current) ? current : {};
+}
+/**
+* Return a copy of `root` with `value` at `path` (or the leaf removed when
+* `value` is `undefined`), creating the parent objects only when setting.
+*/
+function withPath(root, path, value) {
+	const [head, ...rest] = path;
+	if (head === void 0) return root;
+	const next = { ...root };
+	if (rest.length === 0) {
+		if (value === void 0) delete next[head];
+		else next[head] = value;
+		return next;
+	}
+	const child = next[head];
+	if (!isRecord$1(child)) {
+		if (value === void 0) return next;
+		next[head] = withPath({}, rest, value);
+		return next;
+	}
+	next[head] = withPath(child, rest, value);
+	return next;
+}
+const COMMAND_RULES_PATH = [
+	DEFAULT_CUSTOM_PROFILE_KEY,
+	APPROVAL_KEY,
+	COMMAND_RULES_KEY
+];
+const MCP_RULES_PATH = [
+	DEFAULT_CUSTOM_PROFILE_KEY,
+	APPROVAL_KEY,
+	MCP_RULES_KEY
+];
+function setRanked(ranked, key, action) {
+	const existing = ranked.get(key);
+	if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) ranked.set(key, action);
+}
+/**
+* Rebuild `commandRules` from the canonical `bash` category. An existing
+* entry rulesync cannot read back (a hand-written regex) is kept, and the
+* `execEnv` of an entry this run rewrites is carried over.
+*/
+function buildCommandRules({ bashRules, existing }) {
+	const ranked = /* @__PURE__ */ new Map();
+	for (const [pattern, action] of Object.entries(bashRules)) {
+		if (isPrototypePollutionKey(pattern)) continue;
+		setRanked(ranked, toTraeCommandKey(pattern), action);
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(existing)) if (!ranked.has(key) && fromTraeCommandKey(key) === null) result[key] = value;
+	for (const [key, action] of ranked) {
+		const previous = existing[key];
+		const execEnv = isRecord$1(previous) ? previous.execEnv : void 0;
+		result[key] = {
+			approval: action,
+			...typeof execEnv === "string" && { execEnv }
+		};
+	}
+	return result;
+}
+/**
+* Rebuild `mcpRules`: every MCP category of the canonical config is written,
+* and an existing entry whose category the config does not name is kept.
+*/
+function buildMcpRules({ permission, existing, logger }) {
+	const ranked = /* @__PURE__ */ new Map();
+	const managedCategories = /* @__PURE__ */ new Set();
+	for (const [category, rules] of Object.entries(permission)) {
+		if (!category.startsWith(MCP_TOOL_PREFIX)) continue;
+		const key = toTraeMcpKey(category);
+		if (key === null) {
+			logger?.warn(`TRAE permissions: skipping the '${category}' category — TRAE's mcpRules name an MCP server ('server', 'server__*' or 'server__tool').`);
+			continue;
+		}
+		managedCategories.add(category);
+		for (const [pattern, action] of Object.entries(rules)) {
+			if (pattern !== CATCH_ALL_PATTERN) {
+				logger?.warn(`TRAE permissions: skipping the '${category}' rule '${pattern}' — TRAE matches MCP tools by name only.`);
+				continue;
+			}
+			setRanked(ranked, key, action);
+		}
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(existing)) {
+		const category = fromTraeMcpKey(key);
+		if (!ranked.has(key) && (category === null || !managedCategories.has(category))) result[key] = value;
+	}
+	for (const [key, action] of ranked) result[key] = { approval: action };
+	return result;
+}
+/** Split the canonical `webfetch` rules into TRAE's network allow/deny lists. */
+function buildNetworkLists({ webfetchRules, logger }) {
+	const ranked = /* @__PURE__ */ new Map();
+	for (const [pattern, action] of Object.entries(webfetchRules)) {
+		if (isPrototypePollutionKey(pattern)) continue;
+		if (pattern === CATCH_ALL_PATTERN) {
+			logger?.warn(`TRAE permissions: skipping the 'webfetch' rule '*' — TRAE sets the default network policy in the custom permission mode ('customProfiles.defaultCustomProfile.network.default'), not in resourceAuthorization.`);
+			continue;
+		}
+		if (action === "ask") {
+			logger?.warn(`TRAE permissions: skipping the 'webfetch' ask rule '${pattern}' — resourceAuthorization.network has only allow and deny lists.`);
+			continue;
+		}
+		setRanked(ranked, pattern, action);
+	}
+	const lists = {
+		allow: [],
+		deny: []
+	};
+	for (const [pattern, action] of ranked) if (action === "allow" || action === "deny") lists[action].push(pattern);
+	return lists;
+}
+function warnUnmappedCategories({ permission, logger }) {
+	for (const category of Object.keys(permission)) if (category !== BASH_CATEGORY && category !== WEBFETCH_CATEGORY && !category.startsWith(MCP_TOOL_PREFIX)) logger?.warn(`TRAE permissions: skipping the '${category}' category — TRAE's global permission file has no rule for it (only 'bash', 'webfetch' and 'mcp__*' are mapped).`);
+}
+/** A rebuilt map, or `undefined` (remove the key) when it ended up empty. */
+function nonEmpty(value) {
+	return Object.keys(value).length > 0 ? value : void 0;
+}
+/**
+* The new `customProfiles` value: the existing one with `commandRules` and
+* `mcpRules` rebuilt for the categories the config names. The existing value
+* is returned untouched when the config names none of them.
+*/
+function buildCustomProfiles({ existing, permission, logger }) {
+	const bashRules = permission[BASH_CATEGORY];
+	const managesMcp = Object.keys(permission).some((category) => category.startsWith(MCP_TOOL_PREFIX));
+	if (bashRules === void 0 && !managesMcp) return existing;
+	let result = isRecord$1(existing) ? existing : {};
+	if (bashRules !== void 0) {
+		const commandRules = buildCommandRules({
+			bashRules,
+			existing: readRecord(result, COMMAND_RULES_PATH)
+		});
+		result = withPath(result, COMMAND_RULES_PATH, nonEmpty(commandRules));
+	}
+	if (managesMcp) {
+		const mcpRules = buildMcpRules({
+			permission,
+			existing: readRecord(result, MCP_RULES_PATH),
+			logger
+		});
+		result = withPath(result, MCP_RULES_PATH, nonEmpty(mcpRules));
+	}
+	return existing === void 0 ? nonEmpty(result) : result;
+}
+/**
+* The new `resourceAuthorization` value: the existing one with
+* `network.allow` / `deny` rebuilt from the `webfetch` category, or the
+* existing value untouched when the config has no `webfetch` category.
+*/
+function buildResourceAuthorization({ existing, permission, logger }) {
+	const webfetchRules = permission[WEBFETCH_CATEGORY];
+	if (webfetchRules === void 0) return existing;
+	const lists = buildNetworkLists({
+		webfetchRules,
+		logger
+	});
+	let result = isRecord$1(existing) ? existing : {};
+	for (const action of NETWORK_ACTIONS) result = withPath(result, [NETWORK_KEY, action], nonEmpty(lists[action]));
+	return existing === void 0 ? nonEmpty(result) : result;
+}
+/**
+* TRAE permissions (global scope only).
+*
+* TRAE keeps its global permission policy and its custom permission mode in
+* one user file, `~/.trae/permission/global.json`. Rulesync writes three parts
+* of it and leaves the rest (`shellSandbox`, `approval.reviewer`,
+* `sceneRules`, the default `filesystem` / `network` policy,
+* `resourceAuthorization.filesystem`) as it is:
+*
+* - `bash` → `customProfiles.defaultCustomProfile.approval.commandRules`,
+*   `{ "<pattern>": { "approval": "allow" | "ask" | "deny" } }`. A pattern is
+*   matched exactly, as a prefix when it ends in `*`, or as a regex written
+*   `r/.../`; other globs become anchored regexes.
+* - `mcp__<server>__<tool>` / `mcp__<server>__*` →
+*   `customProfiles.defaultCustomProfile.approval.mcpRules`
+*   (`<server>__<tool>` / `<server>__*`).
+* - `webfetch` domains → `resourceAuthorization.network.allow` / `deny`.
+*
+* The file is never deleted, and an unparseable file is an error rather than
+* being replaced.
+*
+* @see https://docs.trae.ai/ide/permission-and-approval?_lang=en
+* @see https://docs.trae.ai/ide/custom-global-permission-configuration-reference?_lang=en
+* @see https://docs.trae.ai/ide/custom-permission-mode-configuration-reference?_lang=en
+*/
+var TraePermissions = class TraePermissions extends ToolPermissions {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	isDeletable() {
+		return false;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: TRAE_PERMISSION_DIR_PATH,
+			relativeFilePath: TRAE_PERMISSION_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = true }) {
+		const paths = TraePermissions.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new TraePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, global = true, logger }) {
+		const paths = TraePermissions.getSettablePaths({ global });
+		const relativePath = (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath);
+		const filePath = (0, node_path.join)(outputRoot, relativePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const existing = parseTraePermissionConfig({
+			fileContent: existingContent,
+			relativePath
+		});
+		const permission = honorAllToolsOnBash(rulesyncPermissions.getJson().permission);
+		warnUnmappedCategories({
+			permission,
+			logger
+		});
+		return new TraePermissions({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "permissions",
+				existingContent,
+				patch: {
+					[CUSTOM_PROFILES_KEY]: buildCustomProfiles({
+						existing: existing[CUSTOM_PROFILES_KEY],
+						permission,
+						logger
+					}),
+					[RESOURCE_AUTHORIZATION_KEY]: buildResourceAuthorization({
+						existing: existing[RESOURCE_AUTHORIZATION_KEY],
+						permission,
+						logger
+					})
+				},
+				filePath
+			}),
+			validate: true,
+			global
+		});
+	}
+	toRulesyncPermissions() {
+		const config = parseTraePermissionConfig({
+			fileContent: this.getFileContent() || "{}",
+			relativePath: (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())
+		});
+		const customProfiles = readRecord(config, [CUSTOM_PROFILES_KEY]);
+		const permission = {};
+		const put = (category, pattern, action) => {
+			if (isPrototypePollutionKey(category) || isPrototypePollutionKey(pattern)) return;
+			const rules = permission[category] ??= {};
+			const existing = rules[pattern];
+			if (existing === void 0 || ACTION_RANK[action] > ACTION_RANK[existing]) rules[pattern] = action;
+		};
+		for (const [key, value] of Object.entries(readRecord(customProfiles, COMMAND_RULES_PATH))) {
+			const pattern = fromTraeCommandKey(key);
+			const approval = isRecord$1(value) ? value.approval : void 0;
+			if (pattern !== null && pattern.trim() !== "" && isPermissionAction(approval)) put(BASH_CATEGORY, pattern, approval);
+		}
+		for (const [key, value] of Object.entries(readRecord(customProfiles, MCP_RULES_PATH))) {
+			const category = fromTraeMcpKey(key);
+			const approval = isRecord$1(value) ? value.approval : void 0;
+			if (category !== null && isPermissionAction(approval)) put(category, CATCH_ALL_PATTERN, approval);
+		}
+		const network = readRecord(config, [RESOURCE_AUTHORIZATION_KEY, NETWORK_KEY]);
+		for (const action of NETWORK_ACTIONS) for (const pattern of toStringList(network[action])) if (pattern.trim() !== "") put(WEBFETCH_CATEGORY, pattern, action);
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = true }) {
+		return new TraePermissions({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+/**
+* Fail closed on a syntax error or non-object root, so a broken file is
+* surfaced rather than partially imported or overwritten.
+*/
+function parseTraePermissionConfig({ fileContent, relativePath }) {
+	try {
+		return parseSharedConfig({
+			format: "json",
+			fileContent,
+			filePath: relativePath,
+			invalidRootPolicy: "error"
+		});
+	} catch (error) {
+		throw new Error(`Failed to parse TRAE permission config in ${relativePath}: ${formatError(error)}`, { cause: error });
+	}
+}
+//#endregion
 //#region src/utils/display-width.ts
 /**
 * Characters a terminal draws two columns wide: the East Asian Wide and
@@ -74149,6 +76229,14 @@ const toolPermissionsFactories = /* @__PURE__ */ new Map([
 			supportsImport: true
 		}
 	}],
+	["trae", {
+		class: TraePermissions,
+		meta: {
+			supportsProject: false,
+			supportsGlobal: true,
+			supportsImport: true
+		}
+	}],
 	["zoocode", {
 		class: ZoocodePermissions,
 		meta: {
@@ -74253,7 +76341,7 @@ var PermissionsProcessor = class extends FeatureProcessor {
 		})];
 	}
 	async convertToolFilesToRulesyncFiles(toolFiles) {
-		return toolFiles.filter((f) => f instanceof ToolPermissions).map((p) => p.toRulesyncPermissions());
+		return toolFiles.filter((f) => f instanceof ToolPermissions).map((p) => p.toRulesyncPermissions({ logger: this.logger }));
 	}
 	static getToolTargets({ global = false, importOnly = false } = {}) {
 		return [...toolPermissionsFactories.entries()].filter(([, f]) => global ? f.meta.supportsGlobal : f.meta.supportsProject).filter(([, f]) => importOnly ? f.meta.supportsImport : true).map(([target]) => target);
@@ -79166,8 +81254,13 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 * slash command), so this target reuses {@link AgentsSkillsSkill} with GitLab's
 * locations:
 *
-* - Project skills live in a non-hidden `skills/<name>/SKILL.md` at the project
-*   root, which both the GitLab UI flows and the GitLab Duo CLI read.
+* - Project skills are written to the cross-tool `.agents/skills/<name>/SKILL.md`
+*   root, which both the GitLab UI flows and the GitLab Duo CLI read. GitLab
+*   Duo also reads a non-hidden `skills/<name>/SKILL.md` at the project root
+*   (`.agents/skills/` wins on a name clash); rulesync imports from it but
+*   never writes or sweeps it, because that directory routinely holds
+*   hand-authored skills. Earlier rulesync versions wrote there, so a skill
+*   generated by one of them has to be removed from `skills/` by hand.
 * - User skills live in `~/.gitlab/duo/skills/` and are loaded by the CLI only
 *   when started with `--enable-global-skills true` (or
 *   `GITLAB_ENABLE_GLOBAL_SKILLS=true`).
@@ -79176,18 +81269,20 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 */
 var GitlabduoSkill = class extends AgentsSkillsSkill {
 	static getSettablePaths({ global = false } = {}) {
-		return { relativeDirPath: global ? GITLABDUO_GLOBAL_SKILLS_DIR : GITLABDUO_SKILLS_DIR };
+		if (global) return { relativeDirPath: GITLABDUO_GLOBAL_SKILLS_DIR };
+		return {
+			relativeDirPath: GITLABDUO_SKILLS_DIR,
+			importOnlySkillRoots: [GITLABDUO_LEGACY_SKILLS_DIR]
+		};
 	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("gitlabduo");
 	}
 	/**
-	* The project skills root is a plain `skills/` directory that many
-	* repositories already use for unrelated content, so only a subdirectory
-	* holding a `SKILL.md` is treated as a skill. (At project scope the
-	* `--delete` orphan sweep skips that root entirely through the factory's
-	* `committedOutput` meta; this filter still applies to the global sweep.)
+	* The import-only project-root `skills/` directory is one many repositories
+	* already use for unrelated content, so only a subdirectory holding a
+	* `SKILL.md` is treated as a skill, in every root this target reads.
 	*/
 	static async isDirOwned({ outputRoot, relativeDirPath, dirName }) {
 		return await fileExists((0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME));
@@ -80740,9 +82835,44 @@ var MimocodeSkill = class extends OpenCodeSkill {
 //#region src/features/skills/musecode-skill.ts
 const MusecodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
-	description: zod_mini.z.string()
+	description: zod_mini.z.string(),
+	license: zod_mini.z.optional(zod_mini.z.string()),
+	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
+	metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 });
 /**
+* Build the Muse Code frontmatter. `license`, `compatibility` and `metadata`
+* come from the `musecode` section with the root-level values as fallback, and
+* are normalized exactly as the `agentsskills` writer normalizes them: at
+* project scope both targets write the same `.agents/skills/<name>/SKILL.md`,
+* so for a skill without per-target overrides the file no longer depends on
+* which of the two runs last.
+*/
+function buildMusecodeFrontmatter(rulesyncFrontmatter) {
+	const section = rulesyncFrontmatter.musecode;
+	const license = resolveLicense({
+		rootFrontmatter: rulesyncFrontmatter,
+		section
+	});
+	const compatibility = resolveCompatibility({
+		rootFrontmatter: rulesyncFrontmatter,
+		section
+	});
+	const metadata = resolveMetadata({
+		rootFrontmatter: rulesyncFrontmatter,
+		section
+	});
+	return {
+		name: rulesyncFrontmatter.name,
+		description: rulesyncFrontmatter.description,
+		...toSpecConformantAgentSkillFields({
+			...license !== void 0 && { license },
+			...compatibility !== void 0 && { compatibility },
+			...metadata !== void 0 && { metadata }
+		})
+	};
+}
+/**
 * Represents a Meta Muse Code skill directory.
 *
 * Muse Code reads Agent Skills as `<skill-id>/SKILL.md` directories from the
@@ -80799,10 +82929,16 @@ var MusecodeSkill = class MusecodeSkill extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
+		const musecodeSection = {
+			...frontmatter.license !== void 0 && { license: frontmatter.license },
+			...frontmatter.compatibility !== void 0 && { compatibility: frontmatter.compatibility },
+			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata }
+		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
 			description: frontmatter.description,
-			targets: ["*"]
+			targets: ["*"],
+			...Object.keys(musecodeSection).length > 0 && { musecode: musecodeSection }
 		};
 		return new RulesyncSkill({
 			outputRoot: this.outputRoot,
@@ -80817,11 +82953,7 @@ var MusecodeSkill = class MusecodeSkill extends ToolSkill {
 	}
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = MusecodeSkill.getSettablePaths({ global });
-		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
-		const musecodeFrontmatter = {
-			name: rulesyncFrontmatter.name,
-			description: rulesyncFrontmatter.description
-		};
+		const musecodeFrontmatter = buildMusecodeFrontmatter(rulesyncSkill.getFrontmatter());
 		return new MusecodeSkill({
 			outputRoot,
 			relativeDirPath: settablePaths.relativeDirPath,
@@ -83272,8 +85404,7 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			lenientImport: true,
-			committedOutput: true
+			lenientImport: true
 		}
 	}],
 	["grokcli", {
@@ -83886,10 +86017,6 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 	}
 	async loadToolDirsToDelete() {
 		const factory = this.getFactory(this.toolTarget);
-		if (factory.meta.committedOutput === true && !this.global) {
-			this.logger.debug(`Skipping the orphan sweep for ${this.toolTarget} skills: the project root is committed and user-owned`);
-			return [];
-		}
 		const paths = factory.class.getSettablePaths({ global: this.global });
 		const roots = toolSkillSearchRoots(paths);
 		const toolSkills = [];
@@ -85434,6 +87561,14 @@ const PLUGIN_FORBIDDEN_FIELDS = [
 	"mcpServers",
 	"permissionMode"
 ];
+/**
+* Claude Code ignores these for plugin-shipped agents without any security
+* rationale. They are dropped with a separate warning so the output does not
+* suggest a behavior the plugin agent never gets.
+*
+* @see https://code.claude.com/docs/en/sub-agents#supported-frontmatter-fields
+*/
+const PLUGIN_IGNORED_FIELDS = ["initialPrompt"];
 /** The only `isolation` value plugin agents accept. */
 const PLUGIN_ISOLATION_VALUE = "worktree";
 var ClaudecodePluginSubagent = class extends ClaudecodeSubagent {
@@ -85453,6 +87588,9 @@ var ClaudecodePluginSubagent = class extends ClaudecodeSubagent {
 		const dropped = PLUGIN_FORBIDDEN_FIELDS.filter((field) => sanitized[field] !== void 0);
 		for (const field of PLUGIN_FORBIDDEN_FIELDS) delete sanitized[field];
 		if (dropped.length > 0) logger?.warn(`Dropping ${dropped.join(", ")} from claudecode-plugin subagent ${relativeFilePath}: Claude Code does not support these fields for plugin-shipped agents.`);
+		const ignored = PLUGIN_IGNORED_FIELDS.filter((field) => sanitized[field] !== void 0);
+		for (const field of PLUGIN_IGNORED_FIELDS) delete sanitized[field];
+		if (ignored.length > 0) logger?.warn(`Dropping ${ignored.join(", ")} from claudecode-plugin subagent ${relativeFilePath}: Claude Code ignores these fields for plugin-shipped agents.`);
 		if (sanitized.isolation !== void 0 && sanitized.isolation !== PLUGIN_ISOLATION_VALUE) {
 			logger?.warn(`Dropping isolation "${sanitized.isolation}" from claudecode-plugin subagent ${relativeFilePath}: "${PLUGIN_ISOLATION_VALUE}" is the only value Claude Code accepts for plugin-shipped agents.`);
 			delete sanitized.isolation;
@@ -88906,6 +91044,32 @@ async function resolveOpenCodeAgentPrompt({ prompt, configDir }) {
 		configDir
 	});
 }
+/**
+* Resolves the `prompt` of each inline agent entry of one config file against
+* that file's directory, so entries from several files can be merged without
+* losing where a `"{file:./path}"` reference points.
+*/
+async function resolveOpenCodeAgentPrompts({ entries, configDir }) {
+	if (entries === null) return null;
+	const resolved = {};
+	for (const [name, rawEntry] of Object.entries(entries)) {
+		const entry = asOpencodeEntries(rawEntry);
+		const value = entry === null || !Object.hasOwn(entry, "prompt") ? rawEntry : {
+			...entry,
+			prompt: await resolveOpenCodeAgentPrompt({
+				prompt: entry.prompt,
+				configDir
+			})
+		};
+		Object.defineProperty(resolved, name, {
+			value,
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+	}
+	return resolved;
+}
 var OpenCodeSubagent = class extends OpenCodeStyleSubagent {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
 	static layout = OPENCODE_LAYOUT;
@@ -88977,8 +91141,9 @@ var OpenCodeSubagent = class extends OpenCodeStyleSubagent {
 		});
 	}
 	/**
-	* Imports agents defined inline in `opencode.json` / `opencode.jsonc` under
-	* the top-level `agent` key — or its V2 spelling `agents`, see
+	* Imports agents defined inline in `opencode.json` / `opencode.jsonc` (and,
+	* at project scope, `.opencode/opencode.json(c)`, which OpenCode merges over
+	* them) under the top-level `agent` key — or its V2 spelling `agents`, see
 	* `getOpencodeAgentEntries` — (in addition to the Markdown files under
 	* `.opencode/agents/`). Each entry's `prompt` becomes the subagent body
 	* (a `"{file:./path}"` reference is resolved relative to the config file's
@@ -88991,30 +91156,26 @@ var OpenCodeSubagent = class extends OpenCodeStyleSubagent {
 	* @see https://opencode.ai/docs/agents/#json
 	*/
 	static async loadAdditionalImportFiles({ outputRoot = process.cwd(), global = false } = {}) {
-		const agentEntries = getOpencodeAgentEntries({
-			config: await readOpencodeConfig({
-				outputRoot,
-				global,
-				layout: this.layout
-			}),
-			layout: this.layout
-		});
-		if (!agentEntries) return [];
-		const paths = this.getSettablePaths({ global });
-		const configDir = getOpencodeConfigDir({
+		const layers = await readOpencodeConfigLayers({
 			outputRoot,
 			global,
 			layout: this.layout
 		});
+		const agentEntries = mergeOpencodeEntryLayers(await Promise.all(layers.map(({ config, configDir }) => resolveOpenCodeAgentPrompts({
+			entries: getOpencodeAgentEntries({
+				config,
+				layout: this.layout
+			}),
+			configDir
+		}))));
+		if (!agentEntries) return [];
+		const paths = this.getSettablePaths({ global });
 		const subagents = [];
 		for (const [name, rawEntry] of Object.entries(agentEntries)) {
 			const entry = asOpencodeEntries(rawEntry);
 			if (!entry) continue;
 			const { prompt, ...frontmatterFields } = entry;
-			const body = await resolveOpenCodeAgentPrompt({
-				prompt,
-				configDir
-			});
+			const body = typeof prompt === "string" ? prompt : "";
 			const parseResult = OpenCodeSubagentFrontmatterSchema.safeParse(frontmatterFields);
 			if (!parseResult.success) continue;
 			const frontmatter = parseResult.data;
@@ -91774,7 +93935,7 @@ var ToolRule = class extends ToolFile {
 			body: this.getFileContent()
 		});
 	}
-	toRulesyncRuleDefault() {
+	toRulesyncRuleDefault({ body } = {}) {
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
@@ -91785,7 +93946,7 @@ var ToolRule = class extends ToolFile {
 				description: this.description,
 				globs: this.globs ?? (this.isRoot() ? ["**/*"] : [])
 			},
-			body: this.getFileContent()
+			body: body ?? this.getFileContent()
 		});
 	}
 	isRoot() {
@@ -92891,11 +95052,19 @@ var AntigravityIdeRule = class extends ToolRule {
 		}
 		super({
 			...rest,
-			fileContent: rest.root ? body : stringifyFrontmatter(body, frontmatter)
+			fileContent: rest.root && Object.keys(frontmatter).length === 0 ? body : stringifyFrontmatter(body, frontmatter)
 		});
 		this.frontmatter = frontmatter;
 		this.body = body;
 	}
+	/**
+	* Frontmatter written on the root rule. The project `AGENTS.md` and the
+	* global `GEMINI.md` take none; a subclass whose root rule sits inside a
+	* `rules/` directory, where every `.md` needs a `trigger`, overrides it.
+	*/
+	static getRootRuleFrontmatter() {
+		return {};
+	}
 	static getGlobalRootPath(excludeToolDir) {
 		return {
 			relativeDirPath: buildToolPath(ANTIGRAVITY_IDE_GEMINI_DIR, ".", excludeToolDir),
@@ -92922,13 +95091,16 @@ var AntigravityIdeRule = class extends ToolRule {
 		const paths = this.getSettablePaths({ global });
 		if (relativeFilePath === paths.root.relativeFilePath && (relativeDirPath === void 0 || relativeDirPath === paths.root.relativeDirPath)) {
 			const rootPath = paths.root;
-			const rootContent = await readFileContent((0, node_path.join)(outputRoot, rootPath.relativeDirPath, rootPath.relativeFilePath));
+			const rootFilePath = (0, node_path.join)(outputRoot, rootPath.relativeDirPath, rootPath.relativeFilePath);
+			const rootContent = await readFileContent(rootFilePath);
+			const rootFrontmatter = this.getRootRuleFrontmatter();
+			const rootBody = Object.keys(rootFrontmatter).length === 0 ? rootContent : parseFrontmatter(rootContent, rootFilePath).body;
 			return new this({
 				outputRoot,
 				relativeDirPath: rootPath.relativeDirPath,
 				relativeFilePath: rootPath.relativeFilePath,
-				frontmatter: {},
-				body: rootContent,
+				frontmatter: rootFrontmatter,
+				body: rootBody,
 				validate,
 				root: true,
 				global
@@ -92988,7 +95160,7 @@ var AntigravityIdeRule = class extends ToolRule {
 				outputRoot,
 				relativeDirPath: rootPath.relativeDirPath,
 				relativeFilePath: rootPath.relativeFilePath,
-				frontmatter: {},
+				frontmatter: this.getRootRuleFrontmatter(),
 				body: rulesyncRule.getBody(),
 				validate,
 				root: true,
@@ -93019,7 +95191,7 @@ var AntigravityIdeRule = class extends ToolRule {
 		});
 	}
 	toRulesyncRule() {
-		if (this.root) return this.toRulesyncRuleDefault();
+		if (this.root) return this.toRulesyncRuleDefault({ body: this.body });
 		const strategy = STRATEGIES$1.find((s) => s.canHandle(this.frontmatter.trigger));
 		let rulesyncData = {
 			globs: [],
@@ -93097,6 +95269,9 @@ var AntigravityPluginRule = class extends AntigravityIdeRule {
 	static supportsSubprojectRules() {
 		return false;
 	}
+	static getRootRuleFrontmatter() {
+		return { trigger: "always_on" };
+	}
 	static isTargetedByRulesyncRule(rulesyncRule) {
 		const targets = rulesyncRule.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("antigravity-plugin");
@@ -94686,8 +96861,11 @@ var CodexcliRule = class extends NestedAgentsmdRule {
 * `.codex/config.toml`, which Codex loads for trusted projects and which
 * overrides the 32 KiB default budget for project `AGENTS.md` files.
 *
-* Answers `undefined` when the file is missing, is not valid TOML, or does not
-* set the key to a positive integer, so the caller falls back to the default.
+* Answers `0` when the key is set to `0`, which Codex treats as "project docs
+* disabled" (`codex-rs/core/src/agents_md.rs` loads nothing for a zero
+* budget). Answers `undefined` when the file is missing, is not valid TOML, or
+* does not set the key to a non-negative integer, so the caller falls back to
+* the default.
 *
 * @see https://learn.chatgpt.com/docs/config-file/config-reference
 */
@@ -94702,7 +96880,7 @@ async function readCodexcliProjectDocMaxBytes(outputRoot) {
 	}
 	if (!isPlainObject$1(parsed)) return;
 	const value = parsed.project_doc_max_bytes;
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
 //#endregion
 //#region src/features/rules/commandcode-rule.ts
@@ -96064,10 +98242,13 @@ var DevinPluginRule = class extends DevinRule {
 * Project scope writes the root `AGENTS.md` plus nested `<dir>/AGENTS.md`
 * files — the project chain `dsh-agent-instructions` loads from the `.git`
 * root down to the session cwd, broad to specific, so a per-directory file
-* applies only while working under that directory. Global scope writes the
-* user-global `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness
-* reads as a single root file with no `.local.md` overlay, so non-root rules
-* fold into it.
+* applies only while working under that directory. A `localRoot` rule goes to
+* the project-root `AGENTS.local.md`, the additive local overlay the project
+* chain loads beside each `AGENTS.md`. Global scope writes the user-global
+* `~/.dsh/AGENTS.md` (`$DSH_HOME` default), which the harness reads as a single
+* root file with no `.local.md` overlay, so non-root rules fold into it. The
+* harness also reads a shared `~/.agents/AGENTS.md` (`$DSH_AGENTS_HOME`) after
+* it, which rulesync never writes.
 *
 * @see https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/context/agent-instructions/README.md
 */
@@ -97738,10 +99919,6 @@ var OmpRule = class OmpRule extends ToolRule {
 	}
 };
 //#endregion
-//#region src/constants/openclaw-paths.ts
-const OPENCLAW_WORKSPACE_DIR_PATH = (0, node_path.join)(".openclaw", "workspace");
-const OPENCLAW_RULE_FILE_NAME = "AGENTS.md";
-//#endregion
 //#region src/features/rules/openclaw-rule.ts
 var OpenclawRule = class OpenclawRule extends ToolRule {
 	constructor({ fileContent, root, ...rest }) {
@@ -99879,6 +102056,39 @@ const normalizeRelativeDir = (dir) => node_path.posix.normalize(toPosixPath(dir)
 /** A tool rule's output path relative to its output root, for comparison. */
 const toolOutputPath = (toolRule) => node_path.posix.join(normalizeRelativeDir(toolRule.getRelativeDirPath()), toolRule.getRelativeFilePath());
 const formatRulePaths = (rules) => rules.map((r) => (0, node_path.join)(r.getRelativeDirPath(), r.getRelativeFilePath())).join(", ");
+/**
+* The leading `---` frontmatter block (with its closing delimiter line) that
+* every one of `contents` starts with, or `undefined` when one lacks it or the
+* blocks differ.
+*/
+const findSharedLeadingFrontmatter = (contents) => {
+	const blocks = contents.map((content) => /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/.exec(content)?.[0]);
+	const first = blocks[0];
+	return first !== void 0 && blocks.every((block) => block === first) ? first : void 0;
+};
+/**
+* Whether a group of rules colliding on one output path is composed into one
+* file, and the frontmatter block the composed file keeps, if any.
+*/
+const decideRuleComposition = ({ group, collisionPolicy }) => {
+	const contents = group.map(({ toolRule }) => toolRule.getFileContent());
+	const allGeneratedRulesAreRoots = group.every(({ toolRule }) => toolRule.isRoot());
+	const allFragmentsArePlain = contents.every((content) => !/^---\r?\n/.test(content));
+	const sharedRootFrontmatter = allGeneratedRulesAreRoots ? findSharedLeadingFrontmatter(contents) : void 0;
+	return {
+		shouldCompose: (collisionPolicy === "fold" || collisionPolicy === "compose" || allGeneratedRulesAreRoots) && allFragmentsArePlain || sharedRootFrontmatter !== void 0,
+		sharedRootFrontmatter
+	};
+};
+/**
+* Concatenate colliding rule fragments. With `sharedFrontmatter` (the block
+* every fragment starts with), the block is stripped from each fragment and
+* written once at the top.
+*/
+const composeRuleFragments = ({ contents, sharedFrontmatter }) => {
+	const merged = contents.map((content) => content.slice(sharedFrontmatter?.length ?? 0).trim()).filter((content) => content.length > 0).join("\n\n");
+	return sharedFrontmatter === void 0 ? merged : `${sharedFrontmatter}${merged}\n`;
+};
 const RulesFeatureOptionsSchema = zod_mini.z.looseObject({
 	ruleDiscoveryMode: zod_mini.z.optional(zod_mini.z.enum(["none", "explicit"])),
 	includeLocalRoot: zod_mini.z.optional(zod_mini.z.boolean()),
@@ -100078,7 +102288,7 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold",
 			projectInstructionBudget: {
 				bytes: CODEXCLI_PROJECT_DOC_MAX_BYTES,
-				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default) and silently drops the rest. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (Codex reads that file only if the project is trusted).",
+				remedy: "Codex CLI stops reading project `AGENTS.md` files once their combined size on the root-to-working-directory chain reaches `project_doc_max_bytes` (32 KiB by default): it silently truncates the file that crosses the limit and skips the files after it. Move directory-scoped rules into nested `AGENTS.md` files with `agentsmd.subprojectPath` (or `deriveSubprojectPathFromGlobs: true` in rulesync.jsonc), trim the rules, or raise `project_doc_max_bytes` in `.codex/config.toml` (Codex reads that file only if the project is trusted).",
 				readConfiguredBytes: readCodexcliProjectDocMaxBytes,
 				configuredSource: "`project_doc_max_bytes` in `.codex/config.toml` (honored only if the project is trusted)",
 				defaultLimitHint: "Rulesync does not read `~/.codex/config.toml`; ignore this warning if you already raised `project_doc_max_bytes` there."
@@ -100488,7 +102698,9 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			extension: "md",
 			supportsGlobal: true,
 			ruleDiscoveryMode: "auto",
-			collisionPolicy: "fold"
+			collisionPolicy: "fold",
+			localRootMode: "separate-local-file",
+			localRootFileName: "AGENTS.local.md"
 		}
 	}]
 ]);
@@ -100650,14 +102862,22 @@ var RulesProcessor = class extends FeatureProcessor {
 	* estimate can come out low there. The budget checked is the value set in the
 	* output root's tool config when the tool supports one (Codex's
 	* `project_doc_max_bytes` in `.codex/config.toml`), else the tool's default;
-	* the warning names which one it used. Global scope is not
-	* checked because Codex loads the personal `~/.codex/AGENTS.md` outside the
-	* project budget.
+	* the warning names which one it used. A configured budget of `0` disables
+	* project docs in Codex, so that case gets a single warning saying the
+	* generated files will not be loaded instead of a size report. Global scope
+	* is not checked because Codex loads the personal `~/.codex/AGENTS.md`
+	* outside the project budget.
 	*/
 	async warnForInstructionBudget({ toolRules, meta }) {
 		const budget = meta.projectInstructionBudget;
-		if (budget === void 0 || this.global) return;
+		if (budget === void 0 || this.global || toolRules.length === 0) return;
 		const configuredBytes = await budget.readConfiguredBytes?.(this.outputRoot);
+		const location = this.outputRoot === process.cwd() ? "" : ` under '${this.outputRoot}'`;
+		if (configuredBytes === 0) {
+			const paths = toolRules.map((rule) => toPosixPath((0, node_path.join)(rule.getRelativeDirPath(), rule.getRelativeFilePath())));
+			this.logger.warn(`${budget.configuredSource ?? "The tool config"}${location} is set to 0, which disables ${this.toolTarget}'s project instruction files: the generated ${paths.join(", ")} will not be loaded. Remove the setting or set it to a positive byte count to load them.`);
+			return;
+		}
 		const limitBytes = configuredBytes ?? budget.bytes;
 		const limitLabel = budget.readConfiguredBytes === void 0 ? `${limitBytes}-byte limit` : configuredBytes === void 0 ? `${limitBytes}-byte default limit` : `${limitBytes}-byte limit set by ${budget.configuredSource ?? "the tool config"}`;
 		const remedy = configuredBytes === void 0 && budget.defaultLimitHint !== void 0 ? `${budget.remedy} ${budget.defaultLimitHint}` : budget.remedy;
@@ -100667,7 +102887,6 @@ var RulesProcessor = class extends FeatureProcessor {
 			bytes: Buffer.byteLength(addTrailingNewline(rule.getFileContent()), "utf8")
 		}));
 		const isAncestorOrSelf = (ancestor, dir) => ancestor === "." || ancestor === dir || dir.startsWith(`${ancestor}/`);
-		const location = this.outputRoot === process.cwd() ? "" : ` under '${this.outputRoot}'`;
 		const rootFiles = files.filter(({ dir }) => dir === ".");
 		const rootBytes = rootFiles.reduce((sum, { bytes }) => sum + bytes, 0);
 		if (rootBytes > limitBytes) {
@@ -100975,10 +103194,11 @@ var RulesProcessor = class extends FeatureProcessor {
 				continue;
 			}
 			const rootConversion = group.find(({ toolRule }) => toolRule.isRoot());
-			const allGeneratedRulesAreRoots = group.every(({ toolRule }) => toolRule.isRoot());
 			const hasSourceRoot = group.some(({ rulesyncRule }) => rulesyncRule.getFrontmatter().root === true);
-			const allFragmentsArePlain = group.every(({ toolRule }) => !/^---\r?\n/.test(toolRule.getFileContent()));
-			const shouldCompose = (collisionPolicy === "fold" || collisionPolicy === "compose" || allGeneratedRulesAreRoots) && allFragmentsArePlain;
+			const { shouldCompose, sharedRootFrontmatter } = decideRuleComposition({
+				group,
+				collisionPolicy
+			});
 			if (!shouldCompose && hasSourceRoot) throw new Error(`Multiple generated rules resolve to output path '${path}' for target '${this.toolTarget}', but this target cannot safely compose a collision involving a root rule. Source rules: ${formatRulePaths(group.map(({ rulesyncRule }) => rulesyncRule))}`);
 			if (!shouldCompose) {
 				for (const conversion of group) survivors.add(conversion);
@@ -100986,8 +103206,11 @@ var RulesProcessor = class extends FeatureProcessor {
 			}
 			const target = rootConversion ?? group[0];
 			if (!target) continue;
-			const mergedContent = [target, ...group.filter((rule) => rule !== target)].map(({ toolRule }) => toolRule.getFileContent().trim()).filter((content) => content.length > 0).join("\n\n");
-			target.toolRule.setFileContent(mergedContent);
+			const ordered = [target, ...group.filter((rule) => rule !== target)];
+			target.toolRule.setFileContent(composeRuleFragments({
+				contents: ordered.map(({ toolRule }) => toolRule.getFileContent()),
+				sharedFrontmatter: sharedRootFrontmatter
+			}));
 			survivors.add(target);
 		}
 		for (let i = convertedRules.length - 1; i >= 0; i--) {
@@ -101071,7 +103294,7 @@ var RulesProcessor = class extends FeatureProcessor {
 	/**
 	* Handle localRoot rule generation based on tool target.
 	* - `separate-local-file`: writes a dedicated `*.local.md` root file
-	*   (claudecode/legacy: `./CLAUDE.local.md`, rovodev: `./AGENTS.local.md`)
+	*   (claudecode/legacy: `./CLAUDE.local.md`, rovodev/dsh: `./AGENTS.local.md`)
 	* - `append-to-root` (default): appends the body to the root file
 	*/
 	handleLocalRootRule(toolRules, localRootRule, factory) {
@@ -101187,7 +103410,11 @@ var RulesProcessor = class extends FeatureProcessor {
 				localRoot
 			});
 		}
-		const workingRootClass = [CrushRule, ReasonixRule].find((base) => isClassOrSubclassOf({
+		const workingRootClass = [
+			CrushRule,
+			ReasonixRule,
+			DshRule
+		].find((base) => isClassOrSubclassOf({
 			candidate: factory.class,
 			base
 		}));