rulesync 38.0.0 → 40.0.0

package/dist/{import-B9NOtObR.cjs → import-BRZzK3w5.cjs}

@@ -457,36 +457,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$426 } = node_path.posix;
+const { join: join$441 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$426(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$441(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$426(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$426(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$441(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$441(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$426(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -544,6 +544,7 @@ const rulesProcessorToolTargetTuple = [
 	"cursor",
 	"deepagents",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -573,6 +574,7 @@ const rulesProcessorToolTargetTuple = [
 	"trae",
 	"vibe",
 	"warp",
+	"xum",
 	"devin",
 	"devin-plugin",
 	"zcode",
@@ -582,6 +584,7 @@ const rulesProcessorToolTargetTuple = [
 ];
 const ignoreProcessorToolTargetTuple = [
 	"aiassistant",
+	"androidstudio",
 	"antigravity-cli",
 	"augmentcode",
 	"bob",
@@ -592,6 +595,7 @@ const ignoreProcessorToolTargetTuple = [
 	"continue",
 	"crush",
 	"cursor",
+	"firebender",
 	"grokcli",
 	"hermesagent",
 	"junie",
@@ -639,6 +643,7 @@ const mcpProcessorToolTargetTuple = [
 	"deepagents",
 	"dsh",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -668,6 +673,7 @@ const mcpProcessorToolTargetTuple = [
 	"vibe-plugin",
 	"warp",
 	"warpcli",
+	"xum",
 	"devin",
 	"devin-plugin",
 	"zcode",
@@ -694,6 +700,7 @@ const commandsProcessorToolTargetTuple = [
 	"copilot",
 	"cursor",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -749,6 +756,7 @@ const subagentsProcessorToolTargetTuple = [
 	"devin",
 	"devin-plugin",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"hermesagent",
@@ -773,6 +781,7 @@ const subagentsProcessorToolTargetTuple = [
 	"takt",
 	"vibe",
 	"vibe-plugin",
+	"xum",
 	"zcode",
 	"zcode-plugin"
 ];
@@ -780,6 +789,7 @@ const skillsProcessorToolTargetTuple = [
 	"agentsmd",
 	"agentsskills",
 	"aiassistant",
+	"androidstudio",
 	"amp",
 	"antigravity-cli",
 	"antigravity-ide",
@@ -803,6 +813,7 @@ const skillsProcessorToolTargetTuple = [
 	"cursor",
 	"deepagents",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -832,6 +843,7 @@ const skillsProcessorToolTargetTuple = [
 	"vibe",
 	"vibe-plugin",
 	"warp",
+	"xum",
 	"devin",
 	"devin-plugin",
 	"zcode",
@@ -866,6 +878,7 @@ const hooksProcessorToolTargetTuple = [
 	"pi",
 	"pool",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"hermesagent",
 	"kimi-code",
@@ -1057,6 +1070,57 @@ async function assertWritablePathInsideRoot(params) {
 		existingPath = parentPath;
 	}
 }
+/**
+* Thrown by {@link assertPathResolvesInsideRoot} when a symbolic link leads
+* the target outside the root, or the target is reached through a dangling
+* link. Any other error it throws comes from the filesystem itself.
+*/
+var PathOutsideRootError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PathOutsideRootError";
+	}
+};
+/**
+* Refuse a write or removal target whose real location is outside `rootPath`.
+*
+* Unlike {@link assertWritablePathInsideRoot}, a symbolic link on the way is
+* allowed as long as it resolves inside the root: projects deliberately link a
+* skill directory to a shared one next to it. What this stops is a link that
+* leads elsewhere — a cloned repository committing `.rulesync/skills/x ->
+* ~/.ssh`, say — which a textual check such as {@link checkPathTraversal}
+* cannot see. The deepest existing ancestor of `targetPath` is resolved, and
+* an existing target that is itself a link is resolved too.
+*/
+async function assertPathResolvesInsideRoot(params) {
+	const { rootPath, targetPath } = params;
+	let realRoot;
+	try {
+		realRoot = await (0, node_fs_promises.realpath)(rootPath);
+	} catch (error) {
+		if (isFileNotFoundError(error)) {
+			if (await isSymlink(rootPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${rootPath}.`, { cause: error });
+			return;
+		}
+		throw error;
+	}
+	let existingPath = (0, node_path.resolve)(targetPath);
+	while (true) {
+		let realExisting;
+		try {
+			realExisting = await (0, node_fs_promises.realpath)(existingPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+			if (await isSymlink(existingPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${targetPath}.`, { cause: error });
+			const parentPath = (0, node_path.dirname)(existingPath);
+			if (parentPath === existingPath) throw error;
+			existingPath = parentPath;
+			continue;
+		}
+		if (pathEscapesRoot((0, node_path.relative)(realRoot, realExisting))) throw new PathOutsideRootError(`Path resolves outside ${rootPath} through a symbolic link: ${targetPath}.`);
+		return;
+	}
+}
 async function assertTreeContainsNoSymlinks(dirPath) {
 	for (const entry of await (0, node_fs_promises.readdir)(dirPath, { withFileTypes: true })) {
 		const entryPath = (0, node_path.join)(dirPath, entry.name);
@@ -3780,6 +3844,8 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".devin/config.json",
 	".dsh/cordis.patch.yml",
 	".factory/settings.json",
+	"firebender.json",
+	".firebender/firebender.json",
 	".grok/config.toml",
 	".grok/sandbox.toml",
 	".letta/settings.json",
@@ -4241,14 +4307,103 @@ function stringifyFrontmatter(body, frontmatter, options) {
 	} } });
 	return gray_matter.default.stringify(file, cleanFrontmatter);
 }
+/**
+* Thrown in place of gray-matter's built-in JavaScript engine.
+*
+* gray-matter picks the parser from the text after the opening fence, so a
+* file that opens with `---js` or `---javascript` has its frontmatter handed
+* to `eval()`. Frontmatter here comes from third-party skills, fetched sources
+* and untrusted repositories, so that would run arbitrary code on the machine
+* of whoever generates or imports it. Every engine name that resolves to code
+* execution is mapped to this refusal; {@link assertYamlFrontmatterLanguage}
+* refuses those fences earlier still, so this is the second line of defense.
+*/
+function refuseExecutableFrontmatter() {
+	throw new Error("Frontmatter written in an executable language (JavaScript / CoffeeScript) is not supported; use YAML");
+}
+const REFUSED_FRONTMATTER_ENGINE = {
+	parse: refuseExecutableFrontmatter,
+	stringify: refuseExecutableFrontmatter
+};
+/**
+* Engines passed to every gray-matter parse. Supplying them merges over
+* gray-matter's defaults, so the JavaScript engine (and the CoffeeScript names
+* a plugin could register) can never be reached through an alias.
+*
+* `patches/gray-matter@4.0.3.patch` also deletes the JavaScript engine, but a
+* pnpm patch only applies inside this repository: gray-matter is an external
+* dependency of the published package, so an installed rulesync runs the
+* unpatched gray-matter, and this override plus the language check are what
+* protect it. Exported for the test that pins that.
+*/
+const FRONTMATTER_PARSE_OPTIONS = { engines: {
+	javascript: REFUSED_FRONTMATTER_ENGINE,
+	js: REFUSED_FRONTMATTER_ENGINE,
+	coffee: REFUSED_FRONTMATTER_ENGINE,
+	coffeescript: REFUSED_FRONTMATTER_ENGINE,
+	cson: REFUSED_FRONTMATTER_ENGINE
+} };
+/** Frontmatter languages accepted after the opening `---` fence. */
+const ALLOWED_FRONTMATTER_LANGUAGE_PATTERN = /^(?:ya?ml)?$/i;
+/**
+* Read the opening frontmatter fence the way gray-matter does, or return
+* `undefined` when gray-matter would see no frontmatter at all.
+*
+* gray-matter strips one byte order mark, treats `---` as a fence only when a
+* fourth `-` does not follow, and takes the language from the text between the
+* fence and the first `\r?\n`, trimmed — dropping the last character when
+* there is no line break at all. Every check below that has to agree with
+* gray-matter on where the block is (the language check, the size guard, the
+* repair pass) goes through this one reading, so none of them can be bypassed
+* by a fence line gray-matter accepts and a stricter pattern would not (a
+* stray `\r` before the line break, say).
+*/
+function readFrontmatterFence(content) {
+	const offset = content.startsWith("") ? 1 : 0;
+	const text = content.slice(offset);
+	if (!text.startsWith("---") || text.charAt(3) === "-") return;
+	const afterFence = text.slice(3);
+	const lineBreak = /\r?\n/.exec(afterFence);
+	const language = afterFence.slice(0, lineBreak ? lineBreak.index : -1).trim();
+	const lineBreakStart = lineBreak ? offset + 3 + lineBreak.index : void 0;
+	return {
+		language,
+		lineBreakStart,
+		lineEnd: lineBreak && lineBreakStart !== void 0 ? lineBreakStart + lineBreak[0].length : void 0
+	};
+}
+/**
+* Refuse a frontmatter fence that names any language other than YAML.
+*
+* Only YAML is ever written by rulesync or by the tools it targets, so anything
+* else — `---js` above all, whose block gray-matter would `eval()` — is
+* rejected before gray-matter sees the content.
+*/
+function assertYamlFrontmatterLanguage(content) {
+	const fence = readFrontmatterFence(content);
+	if (fence && !ALLOWED_FRONTMATTER_LANGUAGE_PATTERN.test(fence.language)) throw new Error(`Unsupported frontmatter language ${JSON.stringify(fence.language.slice(0, 40))}; only YAML frontmatter is supported`);
+}
+/**
+* The number of characters gray-matter would hand to the YAML parser as the
+* frontmatter block. Unlike {@link findFrontmatterBlockBounds}, a missing
+* closing fence does not make this zero: gray-matter then parses everything
+* after the fence line, so that is what the size guard has to measure.
+*/
+function measureFrontmatterBlockChars(content) {
+	const fence = readFrontmatterFence(content);
+	if (fence?.lineBreakStart === void 0) return 0;
+	const rest = content.slice(fence.lineBreakStart);
+	const closeIndex = rest.indexOf("\n---");
+	return closeIndex === -1 ? rest.length : closeIndex;
+}
 function parseFrontmatter(content, filePath) {
 	let frontmatter;
 	let body;
 	let hasFrontmatter;
 	try {
-		const bounds = findFrontmatterBlockBounds(content);
-		if (bounds && bounds.blockEnd - bounds.blockStart > 65536) throw new Error(`Frontmatter block is larger than ${MAX_FRONTMATTER_RAW_CHARS} characters; refusing to parse it (a complex YAML key can cost memory while parsing, before any post-parse budget applies)`);
-		const result = (0, gray_matter.default)(content, {});
+		assertYamlFrontmatterLanguage(content);
+		if (measureFrontmatterBlockChars(content) > 65536) throw new Error(`Frontmatter block is larger than ${MAX_FRONTMATTER_RAW_CHARS} characters; refusing to parse it (a complex YAML key can cost memory while parsing, before any post-parse budget applies)`);
+		const result = (0, gray_matter.default)(content, FRONTMATTER_PARSE_OPTIONS);
 		frontmatter = deepRemoveNullishObject(result.data);
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
@@ -4307,22 +4462,28 @@ function repairFrontmatterLine(line) {
 }
 /**
 * Locate a raw `---`-delimited frontmatter block's bounds within `content`,
-* without parsing it. Shared by the size guard in {@link parseFrontmatter} and
-* the YAML repair pass below, so both agree on exactly what gray-matter would
-* treat as the block: gray-matter ends it at the first `\n---`, with no
-* requirement that the delimiter be alone on its line, so a stricter pattern
-* here would run past gray-matter's delimiter and act on text that is really
-* the body.
+* without parsing it, for the YAML repair pass below and the rule loaders that
+* pre-process `globs:`. The opening fence is read exactly as gray-matter reads
+* it ({@link readFrontmatterFence}); an explicit `yaml` / `yml` language is
+* still YAML, any other language yields no bounds. gray-matter ends the block
+* at the first `\n---`, with no requirement that the delimiter be alone on its
+* line, so a stricter pattern here would run past gray-matter's delimiter and
+* act on text that is really the body. A block with no closing fence has no
+* bounds; the size guard measures that case separately.
 */
 function findFrontmatterBlockBounds(content) {
-	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
-	if (!opening) return;
-	const blockStart = opening[0].length;
-	const closing = /\r?\n---/.exec(content.slice(blockStart));
+	const fence = readFrontmatterFence(content);
+	if (fence?.lineBreakStart === void 0 || fence.lineEnd === void 0 || !ALLOWED_FRONTMATTER_LANGUAGE_PATTERN.test(fence.language)) return;
+	const blockStart = fence.lineEnd;
+	const closing = /\r?\n---/.exec(content.slice(fence.lineBreakStart));
 	if (!closing) return;
+	if (closing.index === 0) return {
+		blockStart,
+		blockEnd: blockStart
+	};
 	return {
 		blockStart,
-		blockEnd: blockStart + closing.index
+		blockEnd: fence.lineBreakStart + closing.index
 	};
 }
 /**
@@ -4354,8 +4515,9 @@ function repairMalformedFrontmatterYaml(content) {
 * narrow — one pass, top-level entries only, and the original error is what
 * surfaces if it does not help, so a genuinely broken file still fails with the
 * message that describes what is actually wrong with it. A file with no closing
-* `---`, or one whose opening fence carries a language tag, is not repaired at
-* all: neither is a frontmatter block gray-matter would have read.
+* `---` is not repaired at all, and one whose opening fence names a language
+* other than YAML is refused outright (an explicit `---yaml` / `---yml` fence
+* is repaired like a plain one).
 *
 * @see https://agentskills.io/client-implementation/adding-skills-support
 */
@@ -4720,6 +4882,29 @@ const CURSOR_HOOK_EVENTS = [
 	"workspaceOpen"
 ];
 /**
+* Hook events supported by Firebender.
+*
+* Firebender's `hooks.json` follows Cursor's layout, and every event it fires
+* is spelled like its canonical counterpart, so no name mapping is needed.
+* @see https://docs.firebender.com/multi-agent/hooks
+*/
+const FIREBENDER_HOOK_EVENTS = [
+	"sessionStart",
+	"sessionEnd",
+	"subagentStart",
+	"subagentStop",
+	"preToolUse",
+	"postToolUse",
+	"beforeShellExecution",
+	"afterShellExecution",
+	"beforeMCPExecution",
+	"afterMCPExecution",
+	"beforeReadFile",
+	"afterFileEdit",
+	"preCompact",
+	"stop"
+];
+/**
 * Hook events supported by Claude Code.
 *
 * Covers the full documented event surface.
@@ -5000,6 +5185,40 @@ const COPILOT_HOOK_EVENTS = [
 	"userPromptExpansion"
 ];
 /**
+* The {@link COPILOT_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex. The hooks reference documents matcher filtering on
+* `preToolUse` / `postToolUse` / `permissionRequest` (tool name), `preCompact`
+* (trigger) and `subagentStart` (agent name), plus `notification`; the last
+* two are not authorable for `copilot`, so they are not listed here. VS Code's
+* migration guide confirms the Copilot harness "applies documented matcher
+* rules" (only the legacy Local harness ignores them).
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/migrate-customizations
+*/
+const COPILOT_MATCHER_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"preCompact",
+	"subagentStart"
+];
+/**
+* The {@link COPILOTCLI_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex: the shared {@link COPILOT_MATCHER_HOOK_EVENTS} plus the two
+* CLI-only events, `permissionRequest` (tool name) and `notification`
+* (notification type).
+*
+* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
+* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
+* `Edit|Write`) are now honored instead of silently dropped").
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+*/
+const COPILOTCLI_MATCHER_HOOK_EVENTS = [
+	...COPILOT_MATCHER_HOOK_EVENTS,
+	"permissionRequest",
+	"notification"
+];
+/**
 * Hook events supported by the GitHub Copilot CLI (`copilotcli-hooks.ts`).
 *
 * The CLI documents a wider event surface than the shared cloud-agent set, so
@@ -5153,12 +5372,15 @@ const KIRO_IDE_HOOK_EVENTS = [
 /**
 * Hook events supported by Google Antigravity (both the IDE and the CLI).
 *
-* Antigravity exposes a Claude-style hooks surface covering the five
-* tool/model/turn lifecycle events it documents: `PreToolUse`, `PostToolUse`,
-* `PreInvocation`, `PostInvocation`, and `Stop`. The model-invocation events
-* (`PreInvocation`/`PostInvocation`) and `Stop` are matcher-less handler lists.
+* Antigravity exposes a Claude-style hooks surface covering the six
+* session/tool/model/turn lifecycle events it documents: `SessionStart`,
+* `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop`.
+* `SessionStart`, the model-invocation events (`PreInvocation`/`PostInvocation`)
+* and `Stop` are matcher-less handler lists.
+* https://antigravity.google/docs/hooks
 */
 const ANTIGRAVITY_HOOK_EVENTS = [
+	"sessionStart",
 	"preToolUse",
 	"postToolUse",
 	"preModelInvocation",
@@ -5931,8 +6153,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 44 entries as
-* of v0.21.6 (tag `v0.21.6`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 46 entries as
+* of v0.22.3 (tag `v0.22.3`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5956,15 +6178,16 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v0.21.6`: `VALID_HOOKS` holds 44 entries, grown
+* Verified against the tag `v0.22.3`: `VALID_HOOKS` holds 46 entries, grown
 * from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16` (v0.20.2) — v0.21
 * added `agent_loop_stopped` and `on_room_member_activity`, v0.21.5 added
-* `pre_auxiliary_call` and `post_auxiliary_call`, and v0.21.6 added
+* `pre_auxiliary_call` and `post_auxiliary_call`, v0.21.6 added
 * `post_gateway_admission`, `on_human_input_request` and
-* `on_human_input_resolved`. This list holds 43 of them — see
+* `on_human_input_resolved`, and v0.22.3 added `on_session_delete` and
+* `post_compaction`. This list holds 45 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5988,6 +6211,7 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_session_end",
 	"on_session_finalize",
 	"on_session_reset",
+	"on_session_delete",
 	"on_skill_lifecycle",
 	"subagent_start",
 	"subagent_stop",
@@ -6009,7 +6233,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_kanban_task_updated",
 	"on_kanban_dispatch_tick",
 	"gateway_platform_event",
-	"pre_command"
+	"pre_command",
+	"post_compaction"
 ];
 /**
 * `VALID_HOOKS` entries a SHELL hook may not register for. `VALID_HOOKS` doubles
@@ -6021,8 +6246,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -6067,6 +6292,7 @@ const HooksConfigSchema = zod_mini.z.looseObject({
 	version: zod_mini.z.optional(zod_mini.z.number()),
 	hooks: canonicalHooksRecordSchema,
 	cursor: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
+	firebender: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	claudecode: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	copilot: zod_mini.z.optional(zod_mini.z.looseObject({ hooks: zod_mini.z.optional(hooksRecordSchema) })),
 	copilotcli: zod_mini.z.optional(zod_mini.z.looseObject({
@@ -6203,10 +6429,11 @@ const CANONICAL_TO_AUGMENTCODE_EVENT_NAMES = {
 const AUGMENTCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENTCODE_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
 * Map canonical camelCase event names to Antigravity PascalCase.
-* Antigravity uses the same PascalCase names as Claude for its tool/turn events,
+* Antigravity uses the same PascalCase names as Claude for its session/tool/turn events,
 * plus `PreInvocation`/`PostInvocation` for the model-invocation lifecycle.
 */
 const CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES = {
+	sessionStart: "SessionStart",
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
 	preModelInvocation: "PreInvocation",
@@ -7170,7 +7397,7 @@ const McpServerSchema = zod_mini.z.looseObject({
 	crushSessionless: zod_mini.z.optional(zod_mini.z.boolean()),
 	crushChannelEnabled: zod_mini.z.optional(zod_mini.z.boolean()),
 	crushChannelReply: zod_mini.z.optional(CrushChannelReplySchema),
-	zcodeOauth: zod_mini.z.optional(zod_mini.z.looseObject({ type: zod_mini.z.string() })),
+	zcodeOauth: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	poolAllow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
 	headers: zod_mini.z.optional(zod_mini.z.record(zod_mini.z.string(), zod_mini.z.string())),
 	/**
@@ -7225,14 +7452,19 @@ const toolScopedMcpSchema = zod_mini.z.looseObject({ mcpServers: zod_mini.z.opti
 /**
 * Kimi Code's tool-scoped block also carries the `[mcp]` defaults from its
 * shared user config: connect and per-tool-call timeouts that apply to *every*
-* MCP server, including ones rulesync did not write. Per-server
-* `startupTimeoutMs` / `toolTimeoutMs` in `mcpServers` still win.
+* MCP server, including ones rulesync did not write, and (Kimi Code 2.3.0)
+* `defaultDeferred`, which loads every server's tools on demand unless the
+* server opts out. Per-server `startupTimeoutMs` / `toolTimeoutMs` / `deferred`
+* in `mcpServers` still win. `defaultDeferred` only takes effect when Kimi's
+* experimental `tool-select` flag is on, and is captured when a server connects
+* (MoonshotAI/kimi-code#4210).
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
 */
 const kimiCodeScopedMcpSchema = zod_mini.z.extend(toolScopedMcpSchema, {
 	startupTimeoutMs: zod_mini.z.optional(zod_mini.z.number()),
-	toolTimeoutMs: zod_mini.z.optional(zod_mini.z.number())
+	toolTimeoutMs: zod_mini.z.optional(zod_mini.z.number()),
+	defaultDeferred: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
 * Qwen Code's tool-scoped block also carries the server-level allow/deny lists
@@ -7272,6 +7504,7 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	devin: zod_mini.z.optional(toolScopedMcpSchema),
 	dsh: zod_mini.z.optional(toolScopedMcpSchema),
 	factorydroid: zod_mini.z.optional(toolScopedMcpSchema),
+	firebender: zod_mini.z.optional(toolScopedMcpSchema),
 	gitlabduo: zod_mini.z.optional(toolScopedMcpSchema),
 	goose: zod_mini.z.optional(toolScopedMcpSchema),
 	grokcli: zod_mini.z.optional(toolScopedMcpSchema),
@@ -7296,6 +7529,7 @@ const RulesyncMcpFileSchema = zod_mini.z.looseObject({
 	vibe: zod_mini.z.optional(toolScopedMcpSchema),
 	warp: zod_mini.z.optional(toolScopedMcpSchema),
 	warpcli: zod_mini.z.optional(toolScopedMcpSchema),
+	xum: zod_mini.z.optional(toolScopedMcpSchema),
 	zed: zod_mini.z.optional(toolScopedMcpSchema)
 });
 /**
@@ -7999,13 +8233,16 @@ const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
-* before prompting. `always-ask` auto-approves only read-only tools, `write`
-* also workspace writes, and `yolo` (oh-my-pi's default) every tier.
+* before prompting. `always-ask` auto-approves only read-only tools,
+* `always-ask-cached` (Ask and remember) also prompts before file reads and
+* lets a prompt remember the granted file or folder, `write` also
+* auto-approves workspace writes, and `yolo` (oh-my-pi's default) every tier.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
 */
 const OMP_APPROVAL_MODES = [
 	"always-ask",
+	"always-ask-cached",
 	"write",
 	"yolo"
 ];
@@ -8026,10 +8263,13 @@ const KimiCodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	])),
 	/**
 	* Kimi's `[permission] dangerous_command_guard` switch (Kimi Code 0.40.0,
-	* default `true`). `false` turns off the built-in dangerous-command policy
-	* (no confirmation for `rm -rf`, `shutdown` and the like).
+	* default `true`). Since Kimi Code 2.3.0, `false` turns off every built-in
+	* guard confirmation policy: dangerous commands (`rm -rf`, `shutdown` and the
+	* like), sensitive-file access (`.env`, `id_rsa`, ...) and git control-path
+	* access. Before 2.3.0 it only covered dangerous commands.
 	*
 	* @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
+	* @see https://github.com/MoonshotAI/kimi-code/pull/4250
 	*/
 	dangerousCommandGuard: zod_mini.z.optional(zod_mini.z.boolean()),
 	rules: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.looseObject({
@@ -8389,6 +8629,8 @@ const TabninePermissionsOverrideSchema = zod_mini.z.looseObject({
 * { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 * @example
 * { "mode": "deny" }
+* @example
+* { "tools": { "disabled": ["web_fetch"] }, "askOnExternalOrigin": true }
 */
 const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -8402,7 +8644,9 @@ const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 		"ask",
 		"allow",
 		"deny"
-	]))
+	])),
+	askOnExternalOrigin: zod_mini.z.optional(zod_mini.z.boolean()),
+	tools: zod_mini.z.optional(zod_mini.z.strictObject({ disabled: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) }))
 });
 /**
 * Tool-scoped override block for Qoder. `outputStyle` is written to the
@@ -11216,6 +11460,15 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	})),
+	xum: zod_mini.z.optional(zod_mini.z.looseObject({
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+		advertise: zod_mini.z.optional(zod_mini.z.boolean()),
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+		"argument-hint": zod_mini.z.optional(zod_mini.z.string()),
+		when_to_use: zod_mini.z.optional(zod_mini.z.string()),
+		"when-to-use": zod_mini.z.optional(zod_mini.z.string()),
+		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	})),
 	zcode: zod_mini.z.optional(zod_mini.z.looseObject({
 		when_to_use: zod_mini.z.optional(zod_mini.z.string()),
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -11494,7 +11747,7 @@ async function getLocalSkillDirNames(sourceTree) {
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, zed, pi, omp, qwencode, vibe, grokcli, factorydroid, dsh, reasonix,
-* commandcode, lettacode, opencode, mimocode). Each tool's own section may override that
+* commandcode, lettacode, opencode, mimocode, xum). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -11514,7 +11767,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh, reasonix, commandcode,
-* lettacode). Each tool's own section may override that default with a
+* lettacode, xum). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -13091,6 +13344,35 @@ const CRUSH_CONFIG_DECLARATION = {
 	}
 };
 /**
+* Firebender's `firebender.json`, shared by the project (`<project>/firebender.json`)
+* and personal (`~/.firebender/firebender.json`) spellings so a policy edit
+* lands on both. The file also carries `rules`, `commands`, `mcpEnvFile`,
+* `worktrees` and `useCursorRules` keys rulesync does not own, so every writer
+* refuses to read-modify-write a file it could not parse. Each feature owns
+* one whole top-level key: `ignore` (recomputed from `.rulesync/.aiignore`),
+* `mcpServers` (the complete server map) and `agents` (recomputed from the
+* existing list, with the entries for rulesync's own agent directory replaced).
+* https://docs.firebender.com/api-reference/syntax
+*/
+const FIREBENDER_CONFIG_DECLARATION = {
+	format: "json",
+	invalidRootPolicy: "error",
+	features: {
+		ignore: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["ignore"]
+		},
+		subagents: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["agents"]
+		},
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcpServers"]
+		}
+	}
+};
+/**
 * What the two Claude Code settings files have in common: both are plain JSON,
 * and both validate against the one published schema, which the gateway
 * points every file it writes at. `.claude/settings.local.json` is the same
@@ -13330,6 +13612,15 @@ const SHARED_CONFIG_OWNERSHIP = {
 			ownedKeys: ["servers"]
 		} }
 	},
+	".xum/mcp.jsonc": {
+		format: "jsonc",
+		invalidRootPolicy: "error",
+		jsoncParseErrors: "error",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["servers"]
+		} }
+	},
 	".qwen/settings.json": {
 		format: "json",
 		features: {
@@ -13417,6 +13708,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 	".zcode/cli/config.json": ZCODE_CONFIG_DECLARATION,
 	"crush.json": CRUSH_CONFIG_DECLARATION,
 	".config/crush/crush.json": CRUSH_CONFIG_DECLARATION,
+	"firebender.json": FIREBENDER_CONFIG_DECLARATION,
+	".firebender/firebender.json": FIREBENDER_CONFIG_DECLARATION,
 	".bob/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -13789,7 +14082,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -13810,7 +14104,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -20251,6 +20546,178 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	}
 };
 //#endregion
+//#region src/constants/firebender-paths.ts
+/**
+* Firebender (the coding agent plugin for Android Studio and other JetBrains
+* IDEs) keeps project configuration under `.firebender/` plus a project-root
+* `firebender.json`, and user configuration under `~/.firebender/` (including
+* `~/.firebender/firebender.json`).
+*
+* @see https://docs.firebender.com/api-reference/syntax
+* @see https://docs.firebender.com/api-reference/rules
+* @see https://docs.firebender.com/api-reference/commands
+* @see https://docs.firebender.com/api-reference/agents
+* @see https://docs.firebender.com/api-reference/skills
+* @see https://docs.firebender.com/api-reference/agents-md
+* @see https://docs.firebender.com/multi-agent/hooks
+*/
+const FIREBENDER_DIR = ".firebender";
+/**
+* `firebender.json`: at the project root for project scope, and under
+* `~/.firebender/` for the personal config. It is shared by the ignore
+* (`ignore`), MCP (`mcpServers`) and subagents (`agents`) features.
+*/
+const FIREBENDER_CONFIG_FILE_NAME = "firebender.json";
+/** `.firebender/AGENTS.md`, the first file Firebender looks for in both scopes. */
+const FIREBENDER_AGENTS_MD_FILE_NAME = "AGENTS.md";
+(0, node_path.join)(FIREBENDER_DIR, "rules");
+/** Commands: `.firebender/commands/*.mdc` (project) and `~/.firebender/commands/*.mdc` (global). */
+const FIREBENDER_COMMANDS_DIR_PATH = (0, node_path.join)(FIREBENDER_DIR, "commands");
+/** Agents: Markdown files registered through the `agents` array of `firebender.json`. */
+const FIREBENDER_AGENTS_DIR_NAME = "agents";
+const FIREBENDER_AGENTS_DIR_PATH = (0, node_path.join)(FIREBENDER_DIR, FIREBENDER_AGENTS_DIR_NAME);
+/** Skills: `.firebender/skills/<name>/SKILL.md` (project) and `~/.firebender/skills/` (global). */
+const FIREBENDER_SKILLS_DIR_PATH = (0, node_path.join)(FIREBENDER_DIR, "skills");
+/** Hooks: `.firebender/hooks.json` (project) and `~/.firebender/hooks.json` (global). */
+const FIREBENDER_HOOKS_FILE_NAME = "hooks.json";
+/**
+* The directory holding `firebender.json` for a scope: the project root, or
+* `~/.firebender/` for the personal config.
+*/
+function getFirebenderConfigDir({ global }) {
+	return global ? FIREBENDER_DIR : ".";
+}
+//#endregion
+//#region src/features/commands/firebender-command.ts
+/**
+* Frontmatter of a Firebender command. Every field is optional: `name`
+* defaults to the file name, `model` is `default`, `quick` or a model ID, and
+* `mode` is one of `auto`, `read`, `write` or `composer`. Unknown keys are
+* preserved.
+*
+* @see https://docs.firebender.com/api-reference/commands
+*/
+const FirebenderCommandFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.optional(zod_mini.z.string()),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	model: zod_mini.z.optional(zod_mini.z.string()),
+	mode: zod_mini.z.optional(zod_mini.z.string())
+});
+const FIREBENDER_COMMAND_EXTENSION = ".mdc";
+/**
+* Command generator for Firebender: one `.mdc` file per command under
+* `.firebender/commands/` (project) and `~/.firebender/commands/` (global),
+* with optional `name` / `description` / `model` / `mode` frontmatter. The
+* canonical `description` is written as is; `name`, `model` and `mode` come
+* from the `firebender:` section of the rulesync command.
+*
+* @see https://docs.firebender.com/api-reference/commands
+*/
+var FirebenderCommand = class FirebenderCommand extends ToolCommand {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate) {
+			const result = FirebenderCommandFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: stringifyFrontmatter(body, frontmatter, { avoidBlockScalars: true })
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: FIREBENDER_COMMANDS_DIR_PATH };
+	}
+	getBody() {
+		return this.body;
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	toRulesyncCommand() {
+		const { description, ...restFields } = this.frontmatter;
+		const rulesyncFrontmatter = {
+			targets: ["*"],
+			description,
+			...Object.keys(restFields).length > 0 && { firebender: restFields }
+		};
+		return new RulesyncCommand({
+			outputRoot: ".",
+			frontmatter: rulesyncFrontmatter,
+			body: this.body,
+			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.relativeFilePath.replace(/\.mdc$/, ".md"),
+			fileContent: stringifyFrontmatter(this.body, rulesyncFrontmatter),
+			validate: true
+		});
+	}
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
+		const firebenderFields = rulesyncFrontmatter.firebender ?? {};
+		const frontmatter = {
+			...rulesyncFrontmatter.description && { description: rulesyncFrontmatter.description },
+			...firebenderFields
+		};
+		return new FirebenderCommand({
+			outputRoot,
+			frontmatter,
+			body: rulesyncCommand.getBody(),
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath().replace(/\.md$/, FIREBENDER_COMMAND_EXTENSION),
+			validate
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = FirebenderCommandFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncCommand(rulesyncCommand) {
+		return this.isTargetedByRulesyncCommandDefault({
+			rulesyncCommand,
+			toolTarget: "firebender"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const result = FirebenderCommandFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new FirebenderCommand({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new FirebenderCommand({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/commands/gitlabduo-command.ts
 /**
 * GitLab Duo CLI custom slash commands are Markdown files named after the
@@ -20843,6 +21310,60 @@ var GrokcliCommand = class GrokcliCommand extends ToolCommand {
 	}
 };
 //#endregion
+//#region src/features/shared/hermes-plugin-commands.ts
+/**
+* Normalize a name into a Hermes Agent plugin slash command name.
+*
+* `ctx.register_command()` lowercases the name, and Hermes' messaging gateway
+* looks plugin commands up with every `_` turned into `-`
+* (`gateway/run_inbound_hooks.py`), so only a lowercase, hyphenated name is
+* reachable from every surface.
+*/
+function hermesSlashName(value) {
+	return value.toLowerCase().replace(/[ _]/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-|-$/g, "");
+}
+/**
+* Python helpers shared by the generated Hermes command plugins.
+*
+* A plugin slash command runs outside any agent turn, so it cannot call
+* `delegate_task` (which requires a parent agent). Instead the handler queues
+* its prompt as a user message with `ctx.inject_message()`, passing the calling
+* session's key: a `session_key` handler keyword on newer Hermes, or
+* `HERMES_SESSION_KEY` from the session context the gateway binds around the
+* handler on older releases.
+*/
+function getHermesQueueUserMessagePython({ pluginName }) {
+	return `def _session_key(kwargs):
+    session_key = kwargs.get("session_key")
+    if session_key:
+        return session_key
+    try:
+        from gateway.session_context import get_session_env
+    except Exception:
+        return None
+    return get_session_env("HERMES_SESSION_KEY") or None
+
+
+def _queue_user_message(ctx, message, kwargs, label):
+    """Queue *message* as the session's next user turn; return an error reply, or None."""
+    session_key = _session_key(kwargs)
+    try:
+        if session_key:
+            queued = ctx.inject_message(message, role="user", session_key=session_key)
+        else:
+            queued = ctx.inject_message(message, role="user")
+    except Exception as error:
+        return f"Could not queue {label}: {error}"
+    if not queued:
+        return (
+            f"Hermes refused to queue {label}: there is no active session, or this plugin "
+            "may not inject messages. In gateway sessions, set "
+            "plugins.entries.${pluginName}.allow_gateway_injection: true in config.yaml."
+        )
+    return None
+`;
+}
+//#endregion
 //#region src/features/skills/agentsskills-skill.ts
 const AgentsSkillsSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -21325,9 +21846,6 @@ const HermesCommandSpecSchema = zod_mini.z.object({
 	description: zod_mini.z.string(),
 	prompt: zod_mini.z.string()
 });
-function hermesSlashName(value) {
-	return value.toLowerCase().replace(/[ _]/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-|-$/g, "");
-}
 function getPluginManifestContent$2() {
 	return [
 		"name: rulesync-commands",
@@ -21361,6 +21879,8 @@ def _load_commands():
     return commands
 
 
+${getHermesQueueUserMessagePython({ pluginName: "rulesync-commands" })}
+
 def _register_command(ctx, command):
     slug = command.get("slug")
     if not slug:
@@ -21370,31 +21890,22 @@ def _register_command(ctx, command):
     prompt = command.get("prompt") or ""
 
     def handler(args=None, **kwargs):
-        del kwargs
         raw_args = ""
         if isinstance(args, dict):
             raw_args = args.get("args") or args.get("context") or args.get("prompt") or ""
         elif args is not None:
             raw_args = str(args)
 
-        context_parts = [prompt] if prompt else []
+        parts = [prompt] if prompt else []
         if raw_args:
-            context_parts.append(f"User arguments:\\n{raw_args}")
+            parts.append(f"User arguments:\\n{raw_args}")
 
-        # delegate_task takes no model-facing "toolsets" argument: the child
-        # inherits the parent's enabled toolsets. "tasks" is the only shape its
-        # schema advertises; a top-level "goal" is an unadvertised legacy path.
-        return ctx.dispatch_tool(
-            "delegate_task",
-            {
-                "tasks": [
-                    {
-                        "goal": description,
-                        "context": "\\n\\n".join(context_parts),
-                    },
-                ],
-            },
-        )
+        # A slash command runs outside any agent turn, so calling delegate_task
+        # here fails with "delegate_task requires a parent agent context".
+        # Queue the command prompt as the session's next user message instead.
+        label = f"the /{slug} command"
+        error = _queue_user_message(ctx, "\\n\\n".join(parts) or description, kwargs, label)
+        return error or f"Queued {label}."
 
     ctx.register_command(slug, handler, description)
 
@@ -23719,6 +24230,7 @@ var QwencodeCommand = class QwencodeCommand extends ToolCommand {
 const REASONIX_PROJECT_MCP_FILE_NAME = "reasonix.toml";
 const REASONIX_GLOBAL_DIR = ".reasonix";
 const REASONIX_GLOBAL_MCP_FILE_NAME = "config.toml";
+const REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH = (0, node_path.join)(".reasonix", REASONIX_PROJECT_MCP_FILE_NAME);
 const REASONIX_PROJECT_PERMISSIONS_FILE_NAME = REASONIX_PROJECT_MCP_FILE_NAME;
 const REASONIX_GLOBAL_PERMISSIONS_FILE_NAME = REASONIX_GLOBAL_MCP_FILE_NAME;
 const REASONIX_DIR = REASONIX_GLOBAL_DIR;
@@ -25266,6 +25778,16 @@ const toolCommandFactories = /* @__PURE__ */ new Map([
 			supportsSubdirectory: false
 		}
 	}],
+	["firebender", {
+		class: FirebenderCommand,
+		meta: {
+			extension: "mdc",
+			supportsProject: true,
+			supportsGlobal: true,
+			isSimulated: false,
+			supportsSubdirectory: false
+		}
+	}],
 	["goose", {
 		class: GooseCommand,
 		meta: {
@@ -28056,25 +28578,65 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 //#endregion
 //#region src/features/hooks/antigravity-hooks.ts
 /**
-* Antigravity uses a Claude-Code-like `hooks.json` (matcher shape). The
-* `PreToolUse`/`PostToolUse` events use the matcher-based array shape, while
-* `PreInvocation`/`PostInvocation`/`Stop` are matcher-less handler lists.
-* `projectDirVar` is empty because Antigravity does not document a
-* project-directory variable for commands.
+* Canonical events whose Antigravity counterparts (`SessionStart`,
+* `PreInvocation`, `PostInvocation`, `Stop`) take no matcher.
+*/
+const ANTIGRAVITY_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"sessionStart",
+	"preModelInvocation",
+	"postModelInvocation",
+	"stop"
+]);
+/**
+* Antigravity event names whose value is a flat list of handlers
+* (`"Stop": [ { "type": "command", "command": "..." } ]`) rather than a list
+* of `{ "matcher", "hooks": [...] }` groups. Antigravity's loader rejects a
+* wrapped group under these events ("command hook must specify 'command'")
+* and then skips the whole `hooks.json`.
+* https://antigravity.google/docs/hooks
+*/
+const ANTIGRAVITY_FLAT_HANDLER_EVENTS = new Set([...ANTIGRAVITY_NO_MATCHER_EVENTS].map((event) => lookupOwn({
+	record: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
+	key: event
+}) ?? event));
+/**
+* Antigravity uses a Claude-Code-like `hooks.json`. The `PreToolUse` /
+* `PostToolUse` events use the matcher-based group shape, while `SessionStart`,
+* `PreInvocation`, `PostInvocation` and `Stop` are flat handler lists (see
+* {@link toAntigravityEventMap}). `projectDirVar` is empty because Antigravity
+* does not document a project-directory variable for commands.
 */
 const ANTIGRAVITY_CONVERTER_CONFIG = {
 	supportedEvents: ANTIGRAVITY_HOOK_EVENTS,
 	canonicalToToolEventNames: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
 	toolToCanonicalEventNames: ANTIGRAVITY_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"preModelInvocation",
-		"postModelInvocation",
-		"stop"
-	]),
+	noMatcherEvents: ANTIGRAVITY_NO_MATCHER_EVENTS,
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
 };
 /**
+* Turn the shared converter's matcher-group output into Antigravity's shape:
+* the matcher-less events get their handlers directly under the event key.
+*/
+function toAntigravityEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event)) return [event, entries];
+		return [event, entries.flatMap((entry) => isPlainObject$1(entry) && Array.isArray(entry.hooks) ? entry.hooks : [])];
+	}));
+}
+/**
+* Reverse of {@link toAntigravityEventMap} for import: wrap each flat handler
+* of a matcher-less event in a `{ hooks: [...] }` group so the shared converter
+* can read it. An entry that is already a group (`{ hooks: [...] }`, as older
+* rulesync versions wrote) is kept as is.
+*/
+function toMatcherGroupEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event) || !Array.isArray(entries)) return [event, entries];
+		return [event, entries.map((entry) => isPlainObject$1(entry) && !("hooks" in entry) ? { hooks: [entry] } : entry)];
+	}));
+}
+/**
 * Antigravity's `hooks.json` is keyed by a named hook whose value holds the
 * per-event map (plus an optional `enabled` flag). rulesync writes a single
 * generated hook under this stable name.
@@ -28111,8 +28673,8 @@ function flattenAntigravityHooks(parsed) {
 * Hooks generator for Google Antigravity (both the IDE and the CLI).
 *
 * Antigravity writes a dedicated `hooks.json` keyed by a named hook whose
-* value holds the Claude-Code-style event → matcher-entry map
-* (`{ "<name>": { "<Event>": [...] } }`). Project and global modes share the
+* value holds the event map (`{ "<name>": { "<Event>": [...] } }`): matcher
+* groups for the tool events, flat handler lists for the others. Project and global modes share the
 * same shape; only the location differs (`.agents/hooks.json` vs
 * `~/.gemini/config/hooks.json`).
 *
@@ -28156,12 +28718,12 @@ var AntigravityHooks = class extends ToolHooks {
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
-		const eventMap = canonicalToToolHooks({
+		const eventMap = toAntigravityEventMap(canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config[this.getOverrideKey()]?.hooks,
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
-		});
+		}));
 		const antigravityHooks = Object.keys(eventMap).length > 0 ? { [ANTIGRAVITY_HOOK_NAME]: eventMap } : {};
 		const fileContent = JSON.stringify(antigravityHooks, null, 2);
 		return new this({
@@ -28180,7 +28742,7 @@ var AntigravityHooks = class extends ToolHooks {
 			throw new Error(`Failed to parse Antigravity hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: flattenAntigravityHooks(parsed),
+			hooks: toMatcherGroupEventMap(flattenAntigravityHooks(parsed)),
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
 		});
@@ -30644,11 +31206,17 @@ var ContinueHooks = class extends SettingsJsonHooks {
 * entry that uses them instead of a shell field is not mistaken for one
 * without a command.
 *
+* An optional `matcher` regex is honored on the events in
+* {@link COPILOT_MATCHER_HOOK_EVENTS}. The VS Code per-OS override fields come
+* from the legacy Local hooks reference and are kept for existing files.
+*
 * @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/hooks
 * @see https://code.visualstudio.com/docs/agents/reference/hooks-reference
 */
 const CopilotHookEntrySchema = zod_mini.z.looseObject({
 	type: zod_mini.z.string(),
+	matcher: zod_mini.z.optional(zod_mini.z.string()),
 	bash: zod_mini.z.optional(zod_mini.z.string()),
 	powershell: zod_mini.z.optional(zod_mini.z.string()),
 	command: zod_mini.z.optional(zod_mini.z.string()),
@@ -30682,8 +31250,10 @@ function canonicalToCopilotHooks(config) {
 		...sharedConfigHooks,
 		...config.copilot?.hooks
 	};
+	const matcherEvents = new Set(COPILOT_MATCHER_HOOK_EVENTS);
 	const copilot = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
+		const matcherSupported = matcherEvents.has(eventName);
 		const copilotEventName = lookupOwn({
 			record: CANONICAL_TO_COPILOT_EVENT_NAMES,
 			key: eventName
@@ -30691,7 +31261,7 @@ function canonicalToCopilotHooks(config) {
 		const entries = [];
 		for (const def of definitions) {
 			const hookType = def.type ?? "command";
-			if (def.matcher) continue;
+			if (def.matcher && !matcherSupported) continue;
 			if (hookType !== "command") continue;
 			const command = def.command;
 			const timeout = def.timeout;
@@ -30699,6 +31269,7 @@ function canonicalToCopilotHooks(config) {
 			const rest = Object.fromEntries(Object.entries(def).filter(([k]) => !canonicalSchemaKeys.includes(k)));
 			entries.push({
 				type: hookType,
+				...def.matcher && { matcher: def.matcher },
 				...command !== void 0 && command !== null && { [commandField]: command },
 				...def.env !== void 0 && { env: def.env },
 				...timeout !== void 0 && timeout !== null && { timeoutSec: timeout },
@@ -30793,6 +31364,7 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			if (command === void 0 && hasOsOverride(passthrough)) logger?.warn(`Copilot hook on '${copilotEventName}' has only VS Code per-OS overrides (windows/linux/osx) and no portable command; it is preserved for copilot, but other targets will generate it without a command until a \`command\` is added.`);
 			defs.push({
 				type: "command",
+				...entry.matcher !== void 0 && entry.matcher !== "" && { matcher: entry.matcher },
 				...command !== void 0 && { command },
 				...shell !== void 0 && { shell },
 				...timeout !== void 0 && { timeout },
@@ -30936,21 +31508,13 @@ var CopilotHooks = class CopilotHooks extends ToolHooks {
 */
 /**
 * Canonical events whose Copilot CLI hook entries honor an optional `matcher`
-* field (a regex compiled as `^(?:PATTERN)$`, tested against `toolName`).
-*
-* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
-* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
-* `Edit|Write`) are now honored instead of silently dropped").
-* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* field (a regex compiled as `^(?:PATTERN)$`). The hooks reference filters each
+* on a different field: the tool name for `preToolUse` / `postToolUse` /
+* `permissionRequest`, `notification_type`, the `preCompact` trigger
+* (`manual` | `auto`) and the `subagentStart` agent name.
+* See {@link COPILOTCLI_MATCHER_HOOK_EVENTS}.
 */
-const COPILOTCLI_MATCHER_EVENTS = /* @__PURE__ */ new Set([
-	"preToolUse",
-	"postToolUse",
-	"notification",
-	"permissionRequest",
-	"preCompact",
-	"subagentStart"
-]);
+const COPILOTCLI_MATCHER_EVENTS = new Set(COPILOTCLI_MATCHER_HOOK_EVENTS);
 /** Human-readable list of the matcher-aware events, for the drop warning. */
 const COPILOTCLI_MATCHER_EVENTS_LABEL = [...COPILOTCLI_MATCHER_EVENTS].join("/");
 const CopilotCliHookEntrySchema = zod_mini.z.looseObject({
@@ -32549,6 +33113,116 @@ var FactorydroidHooks = class FactorydroidHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/features/hooks/firebender-hooks.ts
+/**
+* Hooks generator for Firebender.
+*
+* Firebender reads `.firebender/hooks.json` (project) and
+* `~/.firebender/hooks.json` (global). The file follows Cursor's layout — a
+* `version` plus a `hooks` map from camelCase event names to lists of
+* `{ command, timeout?, loop_limit?, matcher? }` entries — and every event is
+* spelled like its canonical counterpart. The per-hook `type` accepts
+* `"command" | "prompt"`, but the docs never say what a prompt hook does, so
+* only command hooks are generated (the HooksProcessor warns about the rest).
+*
+* @see https://docs.firebender.com/multi-agent/hooks
+*/
+var FirebenderHooks = class FirebenderHooks extends ToolHooks {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: FIREBENDER_DIR,
+			relativeFilePath: FIREBENDER_HOOKS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = FirebenderHooks.getSettablePaths({ global });
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		return new FirebenderHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
+		const config = rulesyncHooks.getJson();
+		const supportedEvents = new Set(FIREBENDER_HOOK_EVENTS);
+		const sharedHooks = {};
+		for (const [event, defs] of Object.entries(config.hooks)) if (supportedEvents.has(event)) sharedHooks[event] = defs;
+		const mergedHooks = {
+			...sharedHooks,
+			...config.firebender?.hooks
+		};
+		const firebenderHooks = {};
+		for (const [eventName, defs] of Object.entries(mergedHooks)) {
+			const mappedDefs = defs.filter((def) => (def.type ?? "command") === "command").filter((def) => typeof def.command === "string" && def.command.length > 0).map((def) => ({
+				command: def.command,
+				...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout },
+				...def.loop_limit !== void 0 && { loop_limit: def.loop_limit },
+				...def.matcher !== void 0 && def.matcher !== null && { matcher: def.matcher }
+			}));
+			if (mappedDefs.length > 0) firebenderHooks[eventName] = mappedDefs;
+		}
+		const paths = FirebenderHooks.getSettablePaths({ global });
+		const merged = mergeGeneratedHookLists({
+			existingContent: await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "",
+			generatedHooks: firebenderHooks,
+			shape: "flat",
+			preserveUnowned,
+			previouslyOwned: preserveUnowned ? parseHooksOwnershipLock(await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0,
+			logger
+		});
+		const fileContent = JSON.stringify({
+			version: config.version ?? 1,
+			hooks: merged.hooks
+		}, null, 2);
+		return new FirebenderHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			ownedHookRefs: preserveUnowned ? merged.owned : void 0,
+			validate
+		});
+	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+	static async getAuxiliaryFiles({ toolHooks } = {}) {
+		return toolHooks instanceof FirebenderHooks ? toolHooks.getOwnershipLockFiles() : [];
+	}
+	toRulesyncHooks() {
+		const parsed = JSON.parse(this.getFileContent());
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+			hooks: parsed.hooks ?? {},
+			overrideKey: "firebender",
+			version: parsed.version ?? 1
+		}), null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new FirebenderHooks({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/hooks/gitlabduo-hooks.ts
 const GITLABDUO_CONVERTER_CONFIG = {
 	supportedEvents: GITLABDUO_HOOK_EVENTS,
@@ -32976,7 +33650,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.6; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.22.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -36959,6 +37633,17 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command", "prompt"],
 		supportsMatcher: true
 	}],
+	["firebender", {
+		class: FirebenderHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: FIREBENDER_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: true
+	}],
 	["claudecode", {
 		class: ClaudecodeHooks,
 		meta: {
@@ -37055,7 +37740,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: COPILOT_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: true,
+		matcherEvents: COPILOT_MATCHER_HOOK_EVENTS
 	}],
 	["copilotcli", {
 		class: CopilotcliHooks,
@@ -37070,7 +37756,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			"prompt",
 			"http"
 		],
-		supportsMatcher: false
+		supportsMatcher: true
 	}],
 	["kilo", {
 		class: KiloHooks,
@@ -37830,6 +38516,67 @@ var AiassistantIgnore = class AiassistantIgnore extends ToolIgnore {
 	}
 };
 //#endregion
+//#region src/constants/androidstudio-paths.ts
+/**
+* Gemini in Android Studio configuration-layout conventions.
+*
+* Only the Android Studio-specific files are owned by the `androidstudio`
+* target. The shared `AGENTS.md` and `.agents/skills/` surfaces Gemini also
+* reads belong to the `agentsmd` and `agentsskills` targets.
+*/
+const ANDROIDSTUDIO_IGNORE_FILE_NAME = ".aiexclude";
+const ANDROIDSTUDIO_SKILLS_DIR_PATH = (0, node_path.join)(".android-studio", "skills");
+//#endregion
+//#region src/features/ignore/androidstudio-ignore.ts
+/**
+* Ignore generator for Gemini in Android Studio.
+*
+* Gemini reads `.aiexclude` files (gitignore syntax) anywhere in the project;
+* each one applies to the files at or below its directory and blocks both the
+* chat and the editor AI features such as code completion. Rulesync writes the
+* project-root file only. There is no user-level variant.
+*
+* @see https://developer.android.com/studio/gemini/aiexclude
+*/
+var AndroidstudioIgnore = class AndroidstudioIgnore extends ToolIgnore {
+	static getSettablePaths() {
+		return {
+			relativeDirPath: ".",
+			relativeFilePath: ANDROIDSTUDIO_IGNORE_FILE_NAME
+		};
+	}
+	toRulesyncIgnore() {
+		return this.toRulesyncIgnoreDefault();
+	}
+	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore }) {
+		return new AndroidstudioIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent: rulesyncIgnore.getFileContent()
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, this.getSettablePaths().relativeDirPath, this.getSettablePaths().relativeFilePath));
+		return new AndroidstudioIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new AndroidstudioIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/ignore/antigravity-cli-ignore.ts
 /**
 * Antigravity CLI is the successor to Gemini CLI and is built on the same
@@ -38491,6 +39238,95 @@ var DevinIgnore = class DevinIgnore extends ToolIgnore {
 	}
 };
 //#endregion
+//#region src/features/ignore/firebender-ignore.ts
+function readIgnorePatterns(fileContent) {
+	const ignore = parseSharedConfig({
+		format: "json",
+		fileContent
+	}).ignore;
+	if (!Array.isArray(ignore)) return [];
+	return ignore.filter((pattern) => typeof pattern === "string");
+}
+/**
+* Ignore generator for Firebender.
+*
+* Firebender reads gitignore-style patterns from the `ignore` array of
+* `firebender.json` (project root) and `~/.firebender/firebender.json`
+* (personal); the two lists are appended together. The file is shared with the
+* MCP (`mcpServers`) and subagents (`agents`) features and carries settings
+* rulesync does not own, so only the `ignore` key is written and the file is
+* never deleted.
+*
+* @see https://docs.firebender.com/api-reference/syntax
+*/
+var FirebenderIgnore = class FirebenderIgnore extends ToolIgnore {
+	constructor(params) {
+		super(params);
+		this.patterns = readIgnorePatterns(this.fileContent || "{}");
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME
+		};
+	}
+	/** `firebender.json` is a user-managed config file, so rulesync never deletes it. */
+	isDeletable() {
+		return false;
+	}
+	toRulesyncIgnore() {
+		return new RulesyncIgnore({
+			outputRoot: ".",
+			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
+			relativeFilePath: RulesyncIgnore.getSettablePaths().recommended.relativeFilePath,
+			fileContent: this.patterns.filter((pattern) => pattern.length > 0).join("\n")
+		});
+	}
+	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+		const patterns = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const managedPatterns = [...new Set(patterns)];
+		return new FirebenderIgnore({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "ignore",
+				existingContent,
+				patch: { ignore: managedPatterns.length > 0 ? managedPatterns : void 0 },
+				filePath
+			}),
+			validate: true,
+			global
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		return new FirebenderIgnore({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new FirebenderIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/ignore/grokcli-ignore.ts
 /** The base built-in profile the rulesync profile extends (Grok's own default). */
 const GROKCLI_SANDBOX_BASE_PROFILE = "workspace";
@@ -39310,6 +40146,31 @@ const REASONIX_READ_TOOL_NAME = "read_file";
 * treated as rulesync-owned on generate so the dormant copy is replaced.
 */
 const REASONIX_LEGACY_READ_TOOL_NAME = "Read";
+async function isPathPresent(path) {
+	return await fileExists(path) || await isPresentButUnresolvable(path);
+}
+/**
+* Warns when a project-scope generate is about to create `./reasonix.toml`
+* next to an existing `.reasonix/reasonix.toml`.
+*
+* Since v2.46.0 Reasonix reads `.reasonix/reasonix.toml` as the project config
+* when `./reasonix.toml` is absent, and never merges the two: once the root
+* file exists it wins, so every setting in the nested file (permissions,
+* sandbox, disabled tools, MCP servers, ...) silently stops applying. rulesync
+* writes only the root file, so it cannot keep the nested one in effect; this
+* at least names the problem, once per run however many of the features that
+* write the file (mcp, permissions, ignore) are generated. Like Reasonix, anything at the root path
+* (including a broken symlink) counts as the root file being there.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/internal/contract/config/paths.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/CONFIG_PATHS.md
+*/
+async function warnIfReasonixNestedProjectConfigShadowed({ outputRoot, global, logger }) {
+	if (global) return;
+	if (await isPathPresent((0, node_path.join)(outputRoot, "reasonix.toml"))) return;
+	if (!await isPathPresent((0, node_path.join)(outputRoot, REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH))) return;
+	const nested = toPosixPath(REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH);
+	warnOnceWithFallback(logger, `Reasonix: ${nested} exists but ${REASONIX_PROJECT_MCP_FILE_NAME} does not. Generating creates ${REASONIX_PROJECT_MCP_FILE_NAME}, and Reasonix then reads it instead of ${nested} (the two are never merged), so every setting in ${nested} stops applying. Move those settings into ${REASONIX_PROJECT_MCP_FILE_NAME} or the rulesync sources.`);
+}
 //#endregion
 //#region src/features/ignore/reasonix-ignore.ts
 const permissionsTableOf = (document) => toReasonixTable(document.permissions);
@@ -39393,7 +40254,12 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 			fileContent: rulesyncPatterns.join("\n")
 		});
 	}
-	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const readDenies = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((pattern) => buildReadDenyEntry(pattern, REASONIX_READ_TOOL_NAME));
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -39808,6 +40674,7 @@ var ZedIgnore = class ZedIgnore extends ToolIgnore {
 const IgnoreProcessorToolTargetSchema = zod_mini.z.enum(ignoreProcessorToolTargetTuple);
 const toolIgnoreFactories = /* @__PURE__ */ new Map([
 	["aiassistant", { class: AiassistantIgnore }],
+	["androidstudio", { class: AndroidstudioIgnore }],
 	["antigravity-cli", { class: AntigravityCliIgnore }],
 	["augmentcode", { class: AugmentcodeIgnore }],
 	["bob", { class: BobIgnore }],
@@ -39818,6 +40685,7 @@ const toolIgnoreFactories = /* @__PURE__ */ new Map([
 	["continue", { class: ContinueIgnore }],
 	["crush", { class: CrushIgnore }],
 	["cursor", { class: CursorIgnore }],
+	["firebender", { class: FirebenderIgnore }],
 	["grokcli", { class: GrokcliIgnore }],
 	["hermesagent", { class: HermesagentIgnore }],
 	["junie", { class: JunieIgnore }],
@@ -39842,6 +40710,7 @@ const ignoreProcessorToolTargets = [...toolIgnoreFactories.keys()];
 const ignoreProcessorGlobalToolTargets = [
 	"continue",
 	"devin",
+	"firebender",
 	"grokcli",
 	"kilo",
 	"kiro",
@@ -39968,7 +40837,8 @@ var IgnoreProcessor = class extends FeatureProcessor {
 			outputRoot: this.outputRoot,
 			rulesyncIgnore,
 			options: this.featureOptions,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		});
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
 			toolIgnore,
@@ -40318,13 +41188,31 @@ function renameServerField(servers, from, to) {
 		return [name, Object.fromEntries(Object.entries(config).map(([key, value]) => key === from ? [to, value] : [key, value]))];
 	}));
 }
+function isEmptyValue(value) {
+	if (Array.isArray(value)) return value.length === 0;
+	return isPlainObject$1(value) && Object.keys(value).length === 0;
+}
 /**
 * Antigravity uses `serverUrl` (not the canonical `url`) for HTTP/SSE MCP
 * servers. Convert the canonical shape into Antigravity's on the way out, and
-* back to canonical on the way in, so round-tripping is lossless.
+* back to canonical on the way in.
+*
+* Antigravity documents no `type` field: the transport follows from `command`
+* (stdio) or `serverUrl` (Streamable HTTP / SSE), and `agy plugin validate`
+* reports the canonical `type` as an unknown field, so it is not written. A
+* remote server that carries `command`, `args` or `env` was also observed to be
+* refused at startup (runtime behavior reported by `agy plugin validate` 1.4.4,
+* not documented), so an empty `args` / `env` left on a `serverUrl` server is
+* dropped.
+* https://antigravity.google/docs/mcp
 */
 function toAntigravityMcpServers(servers) {
-	return renameServerField(servers, "url", "serverUrl");
+	const renamed = renameServerField(servers, "url", "serverUrl");
+	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
+		if (!isPlainObject$1(config)) return [name, config];
+		const isRemote = typeof config.serverUrl === "string";
+		return [name, Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value))))];
+	}));
 }
 function toCanonicalMcpServers(servers) {
 	return renameServerField(servers, "serverUrl", "url");
@@ -44514,6 +45402,60 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 	return true;
 }
 /**
+* Translate a canonical `oauth` block into dcode's custom Slack OAuth app
+* settings, or `undefined` (after warning) when it has to be left out.
+*
+* Since deepagents-code 0.1.87, `_validate_slack_oauth_config` accepts `oauth`
+* only as `{ client_id, client_secret? }` of non-empty strings, and only on a
+* `slack.com` / `*.slack.com` server with `auth: "oauth"`; anything else makes
+* dcode skip the whole server. The canonical block usually carries Claude
+* Code's `{ clientId, callbackPort, ... }` shape, so `clientId` becomes
+* `client_id` (a native `client_id` wins), `client_secret` passes through, and
+* every other key is dropped.
+*
+* @see https://github.com/langchain-ai/deepagents/blob/deepagents-code%3D%3D0.1.87/libs/code/deepagents_code/mcp_config.py
+*/
+function toDeepagentsOauth({ name, oauth, converted, logger }) {
+	if (!isSlackOauthServer(converted)) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		return;
+	}
+	const source = isRecord$1(oauth) ? oauth : {};
+	const result = {};
+	for (const [key, value] of Object.entries(source)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const nativeKey = key === "clientId" ? "client_id" : key;
+		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			continue;
+		}
+		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
+		if (!isDeepagentsOauthValue(value)) {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			continue;
+		}
+		result[nativeKey] = value;
+	}
+	if (result.client_id === void 0) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		return;
+	}
+	return result;
+}
+function isDeepagentsOauthValue(value) {
+	return typeof value === "string" && value.trim() !== "" && !/[\x00-\x1f\x7f]/.test(value);
+}
+function isSlackOauthServer(server) {
+	if (server.auth !== "oauth" || typeof server.url !== "string") return false;
+	let host;
+	try {
+		host = new URL(server.url).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return host === "slack.com" || host.endsWith(".slack.com");
+}
+/**
 * Translate one canonical server into dcode's `.mcp.json` shape, or `null` to
 * skip it.
 *
@@ -44536,7 +45478,7 @@ function toDeepagentsServer({ name, server, logger }) {
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
 	});
-	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, ...rest } = server;
+	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, oauth, ...rest } = server;
 	const converted = { ...rest };
 	if (!applyDeepagentsCommand({
 		name,
@@ -44551,6 +45493,15 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (transport !== void 0) converted.transport = normalized;
 		else converted.type = normalized;
 	}
+	if (oauth !== void 0) {
+		const deepagentsOauth = toDeepagentsOauth({
+			name,
+			oauth,
+			converted,
+			logger
+		});
+		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
+	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
 		toolName: TOOL_NAME,
 		serverName: name,
@@ -44577,6 +45528,13 @@ function toRulesyncServer(server) {
 	const converted = { ...rest };
 	for (const key of ["type", "transport"]) if (converted[key] === "streamable_http" || converted[key] === "streamable-http") converted[key] = "http";
 	if (Array.isArray(allowedTools)) converted.enabledTools = allowedTools;
+	if (isRecord$1(converted.oauth) && Object.hasOwn(converted.oauth, "client_id")) {
+		const { client_id: clientId, ...oauthRest } = converted.oauth;
+		converted.oauth = Object.hasOwn(oauthRest, "clientId") ? oauthRest : {
+			clientId,
+			...oauthRest
+		};
+	}
 	return converted;
 }
 var DeepagentsMcp = class DeepagentsMcp extends ToolMcp {
@@ -45339,6 +46297,171 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/firebender-mcp.ts
+/**
+* The keys of the canonical server schema. Firebender reads only `command`,
+* `args`, `env`, `url` and `headers` of them, so the rest are dropped; a key
+* NOT on this list is unknown to rulesync and passed through untouched, so a
+* Firebender-native field such as `deferLoading` written in the tool-scoped
+* `firebender.mcpServers` block (or on a shared server) survives.
+*/
+const CANONICAL_MCP_SERVER_KEYS$1 = new Set(Object.keys(McpServerSchema.def.shape));
+function passthroughNonCanonicalFields$1(serverConfig) {
+	return Object.fromEntries(Object.entries(serverConfig).filter(([key]) => !CANONICAL_MCP_SERVER_KEYS$1.has(key)));
+}
+/**
+* Translate one canonical server into Firebender's `mcpServers` entry, or
+* return `null` (with a warning) for a server Firebender cannot express. A
+* stdio server is `{ command, args?, env? }`, a remote one `{ url, headers? }`;
+* Firebender has no `type` field and no per-server disable switch.
+*
+* @see https://docs.firebender.com/api-reference/syntax
+*/
+function convertServerToFirebenderFormat({ serverName, serverConfig, logger }) {
+	if (serverConfig.disabled === true) return warnAndSkipMcpServer({
+		toolName: "Firebender",
+		serverName,
+		reason: "`disabled: true`, and Firebender has no per-server disable switch",
+		logger
+	});
+	if (declaresNoTransport(serverConfig)) return warnAndSkipMcpServer({
+		toolName: "Firebender",
+		serverName,
+		reason: "no command or url",
+		logger
+	});
+	const passthrough = passthroughNonCanonicalFields$1(serverConfig);
+	if (isRemoteMcpServer(serverConfig)) {
+		const url = resolveRemoteMcpUrl(serverConfig);
+		if (url === void 0) return warnAndSkipMcpServer({
+			toolName: "Firebender",
+			serverName,
+			reason: "a remote transport but no url",
+			logger
+		});
+		return {
+			...passthrough,
+			url,
+			...serverConfig.headers !== void 0 && { headers: serverConfig.headers }
+		};
+	}
+	const [command, ...args] = resolveLocalMcpCommand(serverConfig);
+	if (command === void 0) return warnAndSkipMcpServer({
+		toolName: "Firebender",
+		serverName,
+		reason: "a local transport but no command",
+		logger
+	});
+	return {
+		...passthrough,
+		command,
+		...args.length > 0 && { args },
+		...serverConfig.env !== void 0 && { env: serverConfig.env }
+	};
+}
+/**
+* MCP generator for Firebender.
+*
+* Firebender reads MCP servers from the `mcpServers` key of `firebender.json`
+* (project root) and `~/.firebender/firebender.json` (personal; it wins on
+* name clashes). The file is shared with the ignore (`ignore`) and subagents
+* (`agents`) features and carries settings rulesync does not own, so only the
+* `mcpServers` key is written and the file is never deleted.
+*
+* @see https://docs.firebender.com/api-reference/syntax
+*/
+var FirebenderMcp = class FirebenderMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseSharedConfig({
+			format: "json",
+			fileContent: this.fileContent || "{}"
+		});
+	}
+	getJson() {
+		return this.json;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new FirebenderMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const mcpServers = {};
+		for (const [serverName, serverConfig] of Object.entries(rulesyncMcp.getMcpServers())) {
+			const converted = convertServerToFirebenderFormat({
+				serverName,
+				serverConfig,
+				logger
+			});
+			if (converted !== null) mcpServers[serverName] = converted;
+		}
+		return new FirebenderMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { mcpServers: Object.keys(mcpServers).length > 0 ? mcpServers : void 0 },
+				filePath
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const servers = this.json.mcpServers;
+		const mcpServers = {};
+		if (isMcpServers(servers)) {
+			for (const [serverName, server] of Object.entries(servers)) if (server !== null && typeof server === "object" && !Array.isArray(server)) mcpServers[serverName] = server;
+		}
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	/**
+	* `firebender.json` is a user-managed file shared with other features (the
+	* ignore feature's `ignore`, the subagents feature's `agents`), so it must
+	* not be deleted.
+	*/
+	isDeletable() {
+		return false;
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new FirebenderMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/gitlabduo-mcp.ts
 const CANONICAL_TO_GITLABDUO_TRANSPORT = {
 	local: "stdio",
@@ -46144,6 +47267,50 @@ function copyHermesOauth(source) {
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_COST_UNIT_MAX_LENGTH = 32;
+function describeHermesValue(value) {
+	return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
+}
+/**
+* Copies the per-server MCP cost keys Hermes v0.22.3 reads in
+* `tools/mcp_tool_costs.py`: `tool_costs` (declared per-tool costs keyed by
+* MCP tool name; each a number, a `[min, max]` range or `{credits, note}`),
+* `spend_limit` (per-chat budget for the server's costed tools; `0`/absent =
+* no limit) and `cost_unit` (label shown with costs; default `credits`).
+*
+* A costed call that would exceed `spend_limit` asks first even on a
+* `trust: full` server, so dropping the key on regenerate would silently
+* remove the guard. Values Hermes would reject when loading the server are
+* dropped with a warning instead of being written into a config Hermes then
+* refuses: `spend_limit` must be a finite non-negative number, `cost_unit` a
+* non-blank string of at most 32 characters, and `tool_costs` a mapping. The
+* mapping is rebuilt as an opaque object (so no reference is shared with the
+* source), with prototype-pollution keys removed at every depth since its
+* values may themselves be objects.
+*/
+function copyHermesCostFields({ source, target, logger }) {
+	let copied = false;
+	const { spend_limit: spendLimit, cost_unit: costUnit, tool_costs: toolCosts } = source;
+	if (spendLimit !== void 0) {
+		if (typeof spendLimit === "number" && Number.isFinite(spendLimit) && spendLimit >= 0) {
+			target.spend_limit = spendLimit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping spend_limit ${describeHermesValue(spendLimit)}; Hermes requires a non-negative number.`);
+	}
+	if (costUnit !== void 0) {
+		if (typeof costUnit === "string" && costUnit.trim() !== "" && costUnit.length <= HERMES_COST_UNIT_MAX_LENGTH) {
+			target.cost_unit = costUnit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping cost_unit ${describeHermesValue(costUnit)}; Hermes requires a non-empty string of at most ${HERMES_COST_UNIT_MAX_LENGTH} characters.`);
+	}
+	if (toolCosts !== void 0) {
+		if (isPlainObject$1(toolCosts)) {
+			target.tool_costs = omitPrototypePollutionKeysDeep(toolCosts);
+			copied = true;
+		} else logger?.warn("Hermes MCP: dropping tool_costs; Hermes requires a mapping of MCP tool names to costs.");
+	}
+	return copied;
+}
 const HERMES_OPAQUE_MAPPING_KEYS = [
 	"sampling",
 	"elicitation",
@@ -46155,13 +47322,18 @@ const HERMES_OPAQUE_MAPPING_KEYS = [
 * alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
 * path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
 * `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
-* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, `identity_header`, and
+* the cost keys (see {@link copyHermesCostFields}) —
 * verbatim from `source` to `target`. Field names are identical on both sides
 * (the canonical `McpServerSchema` is a `looseObject`), so this serves export
 * and import alike. See the Hermes mcp-config-reference.
 */
-function copyHermesAdvancedFields(source, target) {
-	let copied = false;
+function copyHermesAdvancedFields(source, target, logger) {
+	let copied = copyHermesCostFields({
+		source,
+		target,
+		logger
+	});
 	if (typeof source.auth === "string") {
 		target.auth = source.auth;
 		copied = true;
@@ -46270,7 +47442,7 @@ function applyHermesToolsBlock(hermesTools, server) {
 * as Hermes's own `transport: sse`, without which Hermes would connect to it
 * over Streamable HTTP.
 */
-function convertServerToHermes(config) {
+function convertServerToHermes(config, logger) {
 	const out = {};
 	const command = config.command;
 	const url = resolveHermesUrl(config);
@@ -46293,7 +47465,7 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
-	copyHermesAdvancedFields(config, out);
+	copyHermesAdvancedFields(config, out, logger);
 	const tools = buildHermesToolsBlock(config);
 	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
@@ -46301,11 +47473,11 @@ function convertServerToHermes(config) {
 /**
 * Converts rulesync canonical MCP servers into Hermes `mcp_servers:` entries.
 */
-function convertToHermesFormat(mcpServers) {
+function convertToHermesFormat(mcpServers, logger) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
-		result[name] = convertServerToHermes(config);
+		result[name] = convertServerToHermes(config, logger);
 	}
 	return result;
 }
@@ -46325,7 +47497,7 @@ function mergeHermesMcpServers(config, mcpServers) {
 * Mirrors {@link convertToHermesFormat}: `enabled: false` maps back to the
 * canonical `disabled: true`, and only recognized fields are carried over.
 */
-function convertFromHermesFormat(mcpServers) {
+function convertFromHermesFormat(mcpServers, logger) {
 	const result = {};
 	const hermesOverrides = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
@@ -46342,7 +47514,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (isRecord$1(config.tools)) applyHermesToolsBlock(config.tools, server);
 		result[name] = server;
 		const hermesServer = { ...server };
-		if (copyHermesAdvancedFields(config, hermesServer)) hermesOverrides[name] = hermesServer;
+		if (copyHermesAdvancedFields(config, hermesServer, logger)) hermesOverrides[name] = hermesServer;
 	}
 	return {
 		mcpServers: result,
@@ -46361,8 +47533,10 @@ function convertFromHermesFormat(mcpServers) {
 */
 var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
-	constructor(params) {
+	logger;
+	constructor({ logger, ...params }) {
 		super(params);
+		this.logger = logger;
 		this.config = this.fileContent !== void 0 ? parseSharedConfig({
 			format: "yaml",
 			fileContent: this.fileContent
@@ -46406,7 +47580,7 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static getExtraSharedWritePaths() {
 		return getHermesagentSharedConfigWritePaths();
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
@@ -46416,17 +47590,18 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			logger
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
 		const merged = mergeHermesMcpServers(parseSharedConfig({
 			format: "yaml",
 			fileContent
-		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers(), logger));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -46438,11 +47613,12 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 				patch: { mcp_servers: merged.mcp_servers }
 			}),
 			validate,
-			global
+			global,
+			logger
 		});
 	}
 	toRulesyncMcp() {
-		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {}, this.logger);
 		return this.toRulesyncMcpDefault({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
@@ -47326,14 +48502,15 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 	if (!config.parsed) return {};
 	return {
 		...typeof config.mcp.startup_timeout_ms === "number" && { startupTimeoutMs: config.mcp.startup_timeout_ms },
-		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms }
+		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms },
+		...typeof config.mcp.default_deferred === "boolean" && { defaultDeferred: config.mcp.default_deferred }
 	};
 }
 /**
 * Kimi's `[mcp]` section in the shared user config sets the default connect and
-* per-tool-call timeouts for *every* MCP server, including ones rulesync did not
-* write. Per-server values in `mcp.json` still take precedence; this only moves
-* the floor.
+* per-tool-call timeouts, and whether tools load on demand, for *every* MCP
+* server, including ones rulesync did not write. Per-server values in
+* `mcp.json` still take precedence; this only moves the default.
 *
 * Written as an auxiliary file so it goes through the normal write phase and
 * respects `--dry-run`, and merged through the shared-config gateway so the
@@ -47341,7 +48518,8 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 *
 * The gateway replaces an owned key wholesale, and `mcp` is a table, so the
 * section is recomputed from the existing file: authoring only
-* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms`. Same
+* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms` or
+* `default_deferred`. Same
 * approach the `.vibe/config.toml` `tools` writer takes.
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
@@ -47368,7 +48546,8 @@ var KimiCodeMcpConfigToml = class KimiCodeMcpConfigToml extends ToolFile {
 			patch: { mcp: {
 				...existingSection,
 				...defaults.startupTimeoutMs !== void 0 && { startup_timeout_ms: defaults.startupTimeoutMs },
-				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs }
+				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs },
+				...defaults.defaultDeferred !== void 0 && { default_deferred: defaults.defaultDeferred }
 			} },
 			filePath: relativeConfigPath
 		});
@@ -47466,18 +48645,20 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 		if (!isRecord$1(block)) return [];
 		const startupTimeoutMs = typeof block.startupTimeoutMs === "number" ? block.startupTimeoutMs : void 0;
 		const toolTimeoutMs = typeof block.toolTimeoutMs === "number" ? block.toolTimeoutMs : void 0;
-		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0) return [];
+		const defaultDeferred = typeof block.defaultDeferred === "boolean" ? block.defaultDeferred : void 0;
+		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0 && defaultDeferred === void 0) return [];
 		const existing = await readKimiCodeConfig({ outputRoot });
 		if (!existing.parsed) {
 			const paths = kimiCodeConfigRelativePath();
-			warnWithFallback(logger, `Skipping the Kimi Code MCP timeout defaults: ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
+			warnWithFallback(logger, `Skipping the Kimi Code MCP [mcp] defaults: ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
 			return [];
 		}
 		return [KimiCodeMcpConfigToml.fromDefaults({
 			outputRoot,
 			defaults: {
 				startupTimeoutMs,
-				toolTimeoutMs
+				toolTimeoutMs,
+				defaultDeferred
 			},
 			existing
 		})];
@@ -50053,6 +51234,11 @@ var ReasonixMcp = class ReasonixMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
@@ -52030,6 +53216,397 @@ var WarpcliMcp = class extends WarpMcp {
 	}
 };
 //#endregion
+//#region src/constants/xum-paths.ts
+/**
+* Xum configuration-layout conventions.
+*
+* Xum (Coder's desktop app and `xum run` CLI for running coding agents in
+* parallel workspaces, formerly Mux) keeps its project assets under a `.xum/`
+* directory at the project root and the matching user assets under `~/.xum/`.
+* Legacy `.mux/` files are still read when the matching `.xum/` file is
+* missing; rulesync writes only the `.xum/` paths.
+*
+* @see https://xum.cdr.dev/reference/mux-compatibility
+*/
+const XUM_DIR = ".xum";
+const XUM_RULE_FILE_NAME = "AGENTS.md";
+const XUM_LOCAL_RULE_FILE_NAME = "AGENTS.local.md";
+const XUM_MCP_FILE_NAME = "mcp.jsonc";
+const XUM_AGENTS_DIR_PATH = (0, node_path.join)(XUM_DIR, "agents");
+const XUM_SKILLS_DIR_PATH = (0, node_path.join)(XUM_DIR, "skills");
+//#endregion
+//#region src/features/mcp/xum-mcp.ts
+const EMPTY_XUM_MCP_CONFIG = JSON.stringify({ servers: {} }, null, 2);
+/** Characters that never need quoting in a POSIX shell word. */
+const SHELL_SAFE_WORD = /^[A-Za-z0-9_\-.,:/@%+=]+$/;
+/**
+* A command string free of quotes, escapes, expansions and operators, which
+* can be split on whitespace back into argv without changing its meaning.
+*/
+const SPLIT_SAFE_COMMAND = /^[^'"\\$`|&;<>(){}*?[\]~#!\n]+$/;
+/** Single-quote one argv element for the POSIX shell Xum runs commands in. */
+function quoteShellWord(value) {
+	if (SHELL_SAFE_WORD.test(value)) return value;
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/**
+* Build the shell command string a Xum stdio server is launched with. A
+* `command` string is kept verbatim (Xum itself treats it as a raw shell
+* string, so `npx -y pkg` authored as one string keeps working); an explicit
+* argv (`command` as an array) and every `args` element are quoted where
+* needed, so `/opt/my tools/srv` stays one word.
+*/
+function buildCommandString(server) {
+	const args = server.args ?? [];
+	if (Array.isArray(server.command)) {
+		const [executable] = server.command;
+		if (executable === void 0 || executable.trim() === "") return void 0;
+		return [...server.command, ...args].map(quoteShellWord).join(" ");
+	}
+	if (typeof server.command !== "string" || server.command.trim() === "") return void 0;
+	return [server.command, ...args.map(quoteShellWord)].join(" ");
+}
+/** A name bash accepts on the left of a `NAME=value` assignment. */
+const SHELL_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A canonical `${VAR}` reference whose name bash can expand. */
+const ENV_VAR_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/**
+* Quote an env value for a `NAME=value` assignment. Literal text is
+* single-quoted, so nothing in it is expanded or run, while every canonical
+* `${VAR}` reference is emitted as `"${VAR}"` so bash still expands it from
+* the environment Xum starts the server with. The pieces are concatenated into
+* one shell word: `Bearer ${TOKEN}` becomes `'Bearer '"${TOKEN}"`.
+*/
+function quoteEnvValue(value) {
+	if (value === "") return "''";
+	const parts = [];
+	let last = 0;
+	for (const match of value.matchAll(ENV_VAR_REFERENCE)) {
+		if (match.index > last) parts.push(quoteShellWord(value.slice(last, match.index)));
+		parts.push(`"\${${match[1]}}"`);
+		last = match.index + match[0].length;
+	}
+	if (last < value.length) parts.push(quoteShellWord(value.slice(last)));
+	return parts.join("");
+}
+/**
+* Build the `NAME=value ` prefix that sets a stdio server's `env` for its
+* command only (Xum runs the command string with bash). Returns the prefix
+* plus the entries left out: names that cannot be bash assignment targets and
+* entries whose value is not a string.
+*/
+function buildEnvPrefix(env) {
+	const assignments = [];
+	const invalidNames = [];
+	const nonStringNames = [];
+	for (const [name, value] of Object.entries(env)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!SHELL_ENV_NAME.test(name)) {
+			invalidNames.push(name);
+			continue;
+		}
+		if (typeof value !== "string") {
+			nonStringNames.push(name);
+			continue;
+		}
+		assignments.push(`${name}=${quoteEnvValue(value)}`);
+	}
+	return {
+		prefix: assignments.map((assignment) => `${assignment} `).join(""),
+		invalidNames,
+		nonStringNames
+	};
+}
+/** Bash reserved words; a command starting with one cannot take an assignment prefix. */
+const BASH_RESERVED_WORDS = /* @__PURE__ */ new Set([
+	"!",
+	"[[",
+	"]]",
+	"{",
+	"}",
+	"case",
+	"coproc",
+	"do",
+	"done",
+	"elif",
+	"else",
+	"esac",
+	"fi",
+	"for",
+	"function",
+	"if",
+	"in",
+	"select",
+	"then",
+	"time",
+	"until",
+	"while"
+]);
+/**
+* Explain why a `NAME=value` prefix would not reach the server, or return
+* `undefined` when it would. Bash applies such assignments to the first simple
+* command only: with a list or pipeline (`cd x && srv`) the server would not
+* see them, and in front of a group, parenthesized list or reserved word (`( srv )`,
+* `{ srv; }`, `if ...`) they are a syntax error that keeps the server from
+* starting. Only the verbatim `command` string is checked for operators,
+* outside complete single-quoted words; argv elements are quoted by
+* {@link quoteShellWord}.
+*/
+function envPrefixBlocker(server, baseCommand) {
+	if (typeof server.command === "string") {
+		const unquoted = server.command.replace(/'[^']*'/g, "");
+		if (unquoted.includes("'") || /[;&|(){}\n]/.test(unquoted)) return "its command string contains shell operators, grouping or a newline, so bash would not pass NAME=value assignments in front of it to the server";
+	}
+	const [firstWord] = baseCommand.trimStart().split(/\s+/);
+	if (firstWord !== void 0 && BASH_RESERVED_WORDS.has(firstWord)) return `its command starts with the bash reserved word ${quoteValueForWarning(firstWord)}, which cannot follow NAME=value assignments`;
+}
+/**
+* One leading `NAME=value` assignment in exactly the shape {@link quoteEnvValue}
+* writes: bare shell-safe characters, single-quoted text (with the `'\''`
+* escape) and `"${VAR}"` references, followed by spaces or tabs (a newline
+* would end the command, so the assignment would not apply to what follows). Bare characters
+* are matched one at a time, so every alternative starts with a distinct
+* character and the pattern cannot backtrack exponentially.
+*/
+const LEADING_ENV_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=((?:[A-Za-z0-9_\-.,:/@%+=]|'[^']*'|\\'|"\$\{[A-Za-z_][A-Za-z0-9_]*\}")*)[ \t]+/;
+/** Decode a value written by {@link quoteEnvValue} back into its canonical form. */
+function unquoteEnvValue(quoted) {
+	return quoted.replace(/'([^']*)'|\\'|"(\$\{[A-Za-z_][A-Za-z0-9_]*\})"/g, (_m, single, ref) => typeof single === "string" ? single : typeof ref === "string" ? ref : "'");
+}
+/**
+* Split leading `NAME=value` assignments off a command string, but only when
+* every one of them is in the shape rulesync writes and a plain command
+* follows (see {@link envPrefixBlocker}); anything else (for example a `$(...)` substitution) keeps the whole string as
+* the command.
+*/
+function splitEnvPrefix(command) {
+	const env = {};
+	let rest = command.trimStart();
+	for (;;) {
+		const match = LEADING_ENV_ASSIGNMENT.exec(rest);
+		if (match === null) break;
+		const [whole, name, quoted] = match;
+		if (name === void 0 || quoted === void 0 || PROTOTYPE_POLLUTION_KEYS.has(name)) break;
+		env[name] = unquoteEnvValue(quoted);
+		rest = rest.slice(whole.length);
+	}
+	if (Object.keys(env).length === 0 || rest.trim() === "" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest) || envPrefixBlocker({ command: rest }, rest) !== void 0) return { rest: command };
+	return {
+		env,
+		rest
+	};
+}
+/** Read a command string back into `env` + `command` + `args`. */
+function parseCommandString(command) {
+	const { env, rest } = splitEnvPrefix(command);
+	return {
+		...env !== void 0 && { env },
+		...splitCommandString(rest)
+	};
+}
+/** Split a plain command string back into `command` + `args` when it is safe to. */
+function splitCommandString(command) {
+	const trimmed = command.trim();
+	if (!SPLIT_SAFE_COMMAND.test(trimmed)) return { command };
+	const [head, ...rest] = trimmed.split(/\s+/);
+	if (head === void 0) return { command };
+	return rest.length > 0 ? {
+		command: head,
+		args: rest
+	} : { command: head };
+}
+function resolveXumServerKind(server) {
+	const candidate = server.type ?? server.transport;
+	if (candidate === "stdio" || candidate === "local") return "stdio";
+	if (candidate === "http" || candidate === "streamable-http") return "http";
+	if (candidate === "sse") return "sse";
+	if (candidate !== void 0) return { unsupported: candidate };
+	if (server.command !== void 0) return "stdio";
+	const url = server.url ?? server.httpUrl;
+	if (typeof url === "string") return /^wss?:\/\//i.test(url) ? { unsupported: "ws" } : "auto";
+}
+/** Convert one canonical server into a Xum `servers` entry, or `null` to skip it. */
+function convertServerToXum({ name, server, logger }) {
+	const skip = (reason) => {
+		warnWithFallback(logger, `Xum MCP: skipping ${quoteValueForWarning(name)} because ${reason}.`);
+		return null;
+	};
+	const kind = resolveXumServerKind(server);
+	if (kind === void 0) return skip("it has neither a command nor a URL");
+	if (typeof kind === "object") return skip(`it uses the "${kind.unsupported}" transport, which Xum does not support (only stdio, http and sse)`);
+	const settings = {};
+	if (server.disabled === true) settings.disabled = true;
+	if (isStringArray$1(server.enabledTools)) settings.toolAllowlist = server.enabledTools;
+	if (kind !== "stdio") {
+		const url = server.url ?? server.httpUrl;
+		if (typeof url !== "string" || url === "") return skip("it has no URL");
+		return {
+			...kind !== "auto" && { transport: kind },
+			url,
+			...isPlainObject$1(server.headers) && Object.keys(server.headers).length > 0 && { headers: server.headers },
+			...settings
+		};
+	}
+	const baseCommand = buildCommandString(server);
+	if (baseCommand === void 0) return skip("it has no command");
+	let command = baseCommand;
+	if (isPlainObject$1(server.env) && Object.keys(server.env).length > 0) {
+		const blocker = envPrefixBlocker(server, baseCommand);
+		if (blocker !== void 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env, but ${blocker}; the server is written without env.`);
+		else {
+			const { prefix, invalidNames, nonStringNames } = buildEnvPrefix(server.env);
+			command = `${prefix}${baseCommand}`;
+			if (invalidNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${invalidNames.map(quoteValueForWarning).join(", ")}, which cannot be a bash variable name; the server is written without it.`);
+			if (nonStringNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${nonStringNames.map(quoteValueForWarning).join(", ")} to a value that is not a string; the server is written without it.`);
+		}
+	}
+	if (typeof server.cwd === "string") warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets cwd, which Xum's mcp.jsonc cannot express; the server is written without it (Xum starts stdio servers in the workspace directory).`);
+	return Object.keys(settings).length > 0 ? {
+		command,
+		...settings
+	} : command;
+}
+/** Copy only the string values of a header map (secret references have no canonical form). */
+function copyStringHeaders(value) {
+	if (!isPlainObject$1(value)) return void 0;
+	const result = {};
+	for (const [key, entry] of Object.entries(value)) if (!PROTOTYPE_POLLUTION_KEYS.has(key) && typeof entry === "string") result[key] = entry;
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+/** Read a Xum `servers` map back into the canonical shape. */
+function convertFromXumFormat(servers) {
+	if (!isPlainObject$1(servers)) return {};
+	const result = {};
+	for (const [name, entry] of Object.entries(servers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (typeof entry === "string") {
+			result[name] = parseCommandString(entry);
+			continue;
+		}
+		if (!isPlainObject$1(entry)) continue;
+		const server = {};
+		if (typeof entry.url === "string") {
+			if (entry.transport === "http" || entry.transport === "sse") server.type = entry.transport;
+			server.url = entry.url;
+			const headers = copyStringHeaders(entry.headers);
+			if (headers !== void 0) server.headers = headers;
+		} else if (typeof entry.command === "string") Object.assign(server, parseCommandString(entry.command));
+		else continue;
+		if (entry.disabled === true) server.disabled = true;
+		if (isStringArray$1(entry.toolAllowlist)) server.enabledTools = entry.toolAllowlist;
+		result[name] = server;
+	}
+	return result;
+}
+/**
+* Xum MCP configuration.
+*
+* Xum reads `~/.xum/mcp.jsonc` (user) and the repo override `.xum/mcp.jsonc`
+* (project; a server there wins over the user one of the same name). Both are
+* a JSONC document with a `servers` map:
+*
+* - a stdio server is a shell command string run with bash (the object form
+*   `{ command }` carries `disabled` / `toolAllowlist`); `env` is written as
+*   `NAME=value` assignments in front of the command, and `cwd`, which has no
+*   equivalent, is dropped with a warning;
+* - a remote server is `{ transport: "http" | "sse" | "auto", url, headers }`
+*   (the transport defaults to auto-detection).
+*
+* rulesync owns only `servers`; other top-level keys (Xum writes
+* `enabledPluginServers` into the user file) are preserved. The project file
+* may be removed by `--delete`; the user file never is.
+*
+* @see https://xum.cdr.dev/config/mcp-servers
+* @see https://github.com/coder/xum/blob/main/src/node/services/mcpConfigService.ts
+*/
+var XumMcp = class XumMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseSharedConfig({
+			format: "jsonc",
+			fileContent: this.fileContent,
+			filePath: (0, node_path.join)(this.relativeDirPath, this.relativeFilePath),
+			invalidRootPolicy: "error",
+			jsoncParseErrors: "error"
+		});
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return !this.global;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: XUM_DIR,
+			relativeFilePath: XUM_MCP_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? EMPTY_XUM_MCP_CONFIG;
+		return new XumMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? EMPTY_XUM_MCP_CONFIG;
+		const servers = {};
+		for (const [name, server] of Object.entries(rulesyncMcp.getMcpServers())) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+			const entry = convertServerToXum({
+				name,
+				server,
+				logger
+			});
+			if (entry !== null) servers[name] = entry;
+		}
+		return new XumMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { servers },
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const mcpServers = convertFromXumFormat(this.json.servers);
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new XumMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/zcode-mcp.ts
 /**
 * Single spelling of the config.json codec/policy, matching the
@@ -52063,7 +53640,7 @@ function asZcodeRemoteType(stated, url) {
 }
 /**
 * The keys each OAuth flow of ZCode's per-server `oauth` union accepts on a
-* remote server, and which of them are required. Read off the 3.14.3/3.15.3
+* remote server, and which of them are required. Read off the 3.14.3–3.16.2
 * runtime config schema, since ZCode's MCP page only says to "enable OAuth for
 * the service in its configuration". Both variants are strict, so any other
 * key would make ZCode skip the server.
@@ -52167,7 +53744,11 @@ function resolveZcodeTimeoutMs({ serverName, config, logger }) {
 }
 /**
 * The per-server keys ZCode reads on every transport: `timeoutMs`,
-* `protocolVersion` and the enable toggle (`enableKey`).
+* `protocolVersion`, `alwaysLoad` and the enable toggle (`enableKey`).
+*
+* `alwaysLoad` (added in 3.16.2 alongside tool search) keeps a server's tools
+* loaded up front instead of deferring them behind tool search. ZCode's schema
+* types it as a boolean, so any other value is dropped with a warning.
 */
 function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const common = {};
@@ -52180,6 +53761,9 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const { protocolVersion } = config;
 	if (ZCODE_PROTOCOL_VERSIONS.has(protocolVersion)) common.protocolVersion = protocolVersion;
 	else if (protocolVersion !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping protocolVersion ${JSON.stringify(protocolVersion)}, as ZCode accepts only ${[...ZCODE_PROTOCOL_VERSIONS].map((v) => JSON.stringify(v)).join(", ")}.`);
+	const { alwaysLoad } = config;
+	if (typeof alwaysLoad === "boolean") common.alwaysLoad = alwaysLoad;
+	else if (alwaysLoad !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping alwaysLoad ${JSON.stringify(alwaysLoad)}, as it must be a boolean.`);
 	if (config.disabled === true) common[enableKey] = false;
 	return common;
 }
@@ -52192,11 +53776,11 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 * absent.
 *
 * Every server also carries `timeoutMs` (from the canonical `timeout`, or an
-* explicit `timeoutMs`) and an allow-listed `protocolVersion`; stdio servers
-* carry `cwd`, and remote servers an `oauth` built from the namespaced
-* `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
+* explicit `timeoutMs`), an allow-listed `protocolVersion` and a boolean
+* `alwaysLoad`; stdio servers carry `cwd`, and remote servers an `oauth` built
+* from the namespaced `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
 * is read from the authored server through `rawServerOf`. ZCode's docs do not
-* name these keys, so they follow the 3.14.3/3.15.3 runtime's per-server
+* name these keys, so they follow the 3.14.3–3.16.2 runtime's per-server
 * schema, which is strict: an unknown key makes ZCode skip the server, which
 * is why the output stays a whitelist.
 *
@@ -52291,8 +53875,8 @@ const ZCODE_ENABLE_KEYS = /* @__PURE__ */ new Set(["enable", "enabled"]);
 * and unknown keys pass through untouched so an import keeps whatever a
 * hand-authored entry declared. `timeoutMs` is lifted back into the canonical
 * `timeout` (milliseconds); when the server also states a `timeout`, ZCode
-* has already dropped that one, so `timeoutMs` replaces it. A ZCode-shaped
-* `oauth` is imported as the namespaced `zcodeOauth`, so its client secret is
+* has already dropped that one, so `timeoutMs` replaces it. Any record
+* `oauth` is imported as the namespaced `zcodeOauth`, so a client secret is
 * never emitted to another tool. Generation back out is a whitelist, so only
 * the keys `convertToZcodeFormat` writes are re-emitted.
 *
@@ -52318,7 +53902,7 @@ function convertFromZcodeFormat({ zcodeServers }) {
 				continue;
 			}
 			if (key === "timeout" && typeof config.timeoutMs === "number") continue;
-			if (key === "oauth" && isZcodeOauth(value)) {
+			if (key === "oauth" && isRecord$1(value)) {
 				converted[ZCODE_OAUTH_CANONICAL_KEY] = value;
 				continue;
 			}
@@ -52964,6 +54548,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: true
 		}
 	}],
+	["firebender", {
+		class: FirebenderMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: false,
+			supportsDisabledTools: false
+		}
+	}],
 	["goose", {
 		class: GooseMcp,
 		meta: {
@@ -53234,6 +54827,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: false
 		}
 	}],
+	["xum", {
+		class: XumMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: false
+		}
+	}],
 	["devin", {
 		class: DevinMcp,
 		meta: {
@@ -57315,6 +58917,11 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
 		widens: isNotFalse
 	},
+	{
+		path: ["allowNestedUserNamespaces"],
+		reason: "lets sandboxed Linux commands create user namespaces, which gets around the sandbox's file protections",
+		widens: isNotFalse
+	},
 	{
 		path: ["allowUnsandboxedCommands"],
 		reason: "controls whether Claude may retry a blocked command outside the sandbox",
@@ -67764,7 +69371,7 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *   catch-all one at its own strictness, a pattern-specific one as `prompt`).
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
-* `write` or `yolo`); without it the key is left as it is in the file, and on
+* `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
 * import a recognized value is read back into the override.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
@@ -70036,6 +71643,8 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 const REASONIX_TOOL_LABEL = "Reasonix";
 /** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
 const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/** The `[permissions]` key the override's `askOnExternalOrigin` writes and reads. */
+const REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY = "ask_on_external_origin";
 /**
 * `[sandbox]` keys whose authored value loosens the enforcement layer beneath
 * the permission policy: they take Bash out of its OS jail, open that jail to
@@ -70238,6 +71847,95 @@ function applyPermissionsMode({ permissions, authored, global, relativeFilePath,
 		reason: "lets every writer call that no rule matches run without a prompt"
 	}];
 }
+/**
+* Writes the override's `askOnExternalOrigin` into `[permissions]`. Reasonix
+* honors the key only in the user config (`narrowPermissions` in
+* `project_scope.go`), so a project-scope generate skips it with a warning and
+* leaves whatever the file had. Turning it on only adds prompts, so that is
+* quiet; turning off a value the file had on is reported, since Auto and YOLO
+* then run calls that repeat text from a web page or tool result without asking.
+* As with `applyAllowDynamicBash`, only a literal `true` counts as quiet, so a
+* value a `--no-validate` run let through is never written in silence.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/GUIDE.md
+*/
+function applyAskOnExternalOrigin({ permissions, override, global, relativeFilePath, logger }) {
+	const authored = override?.askOnExternalOrigin;
+	if (authored === void 0) return [];
+	if (!global) {
+		logger?.warn(`Reasonix permissions: skipping reasonix.askOnExternalOrigin for the project-scoped ${relativeFilePath}; Reasonix honors [permissions] ask_on_external_origin only in the user config and ignores a project value, so generate it with --global instead.`);
+		return [];
+	}
+	const previous = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+	permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY] = authored;
+	if (authored === true || previous !== true && authored === false) return [];
+	return [{
+		label: `permissions.${REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY}`,
+		reason: "lets Auto and YOLO run a call that repeats text from a web page or tool result without asking first"
+	}];
+}
+/**
+* The `tools` patch entry — the `[tools]` table with the override's `disabled`
+* list laid over it, or nothing when the override does not author one — and the
+* trust rows it carries. Adding a name only removes a tool, and a project file
+* can only add to the user's list, so that stays quiet. The list is replaced
+* whole, though, so a name the file had turned off and the override leaves out
+* is turned back on, and that is reported, as are a `[tools]` or a `disabled`
+* the file holds in a shape that cannot be read. Only `disabled` is written:
+* the rest of `[tools]` (timeouts, search backends, ...) stays as it is.
+*/
+function applyToolsDisabled({ existing, override }) {
+	const disabled = override?.tools?.disabled;
+	if (disabled === void 0) return {
+		patch: {},
+		entries: []
+	};
+	const patch = { tools: {
+		...asReasonixRecord(existing),
+		disabled
+	} };
+	if (existing === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!isRecord$1(existing)) return {
+		patch,
+		entries: [{
+			label: "tools",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const before = existing.disabled;
+	if (before === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!Array.isArray(before)) return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: replacedUnreadableReason({
+				shape: "list",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const reEnabled = (0, es_toolkit.uniq)(before.filter((name) => !disabled.includes(name)));
+	if (reEnabled.length === 0) return {
+		patch,
+		entries: []
+	};
+	return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: `turns back on ${reEnabled.map((name) => quoteValueForWarning(name)).join(", ")}, which the file had turned off`
+		}]
+	};
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -70293,6 +71991,11 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const relativeFilePathForLog = toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath));
@@ -70352,7 +72055,20 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			relativeFilePath: relativeFilePathForLog,
 			logger
 		}));
+		trustAffecting.push(...applyAskOnExternalOrigin({
+			permissions: mergedPermissions,
+			override,
+			global,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		}));
 		const patch = { permissions: mergedPermissions };
+		const toolsDisabled = applyToolsDisabled({
+			existing: parsed.tools,
+			override
+		});
+		Object.assign(patch, toolsDisabled.patch);
+		trustAffecting.push(...toolsDisabled.entries);
 		if (override?.sandbox !== void 0) {
 			const authoredSandbox = dropUserOnlySandboxKeys({
 				sandbox: override.sandbox,
@@ -70426,6 +72142,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
 		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (this.global && typeof permissions.mode === "string" && REASONIX_PERMISSION_MODES.has(permissions.mode)) reasonixOverride.mode = permissions.mode;
+		const askOnExternalOrigin = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+		if (this.global && typeof askOnExternalOrigin === "boolean") reasonixOverride.askOnExternalOrigin = askOnExternalOrigin;
+		const toolsDisabled = asReasonixRecord(this.toml.tools).disabled;
+		if (Array.isArray(toolsDisabled)) {
+			const names = toReasonixStringArray(toolsDisabled);
+			if (names.length < toolsDisabled.length) warnWithFallback(void 0, `Reasonix permissions: ${this.getRelativePathFromCwd()} [tools] disabled holds ${toolsDisabled.length - names.length} non-string entries; they are not imported into reasonix.tools.disabled, so the next generate drops them.`);
+			reasonixOverride.tools = { disabled: names };
+		}
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;
@@ -72007,7 +73731,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 		const authoredProviderOptions = isPlainObject$1(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
 		const runtimeModeRefusesProviderOptions = authoredProviderOptions !== void 0 && runtime.active;
 		if (runtimeModeRefusesProviderOptions) logger?.warn(`Takt permissions: not writing "${TAKT_PROVIDER_OPTIONS_KEY}" to ${filePath} because ${runtime.filePaths.join(" + ")} puts Takt in runtime provider mode (Takt 0.56.0+), where any legacy provider setting in config.yaml makes Takt fail with "Mixed provider configuration detected". Move those options to \`provider.profiles.<profile>.options\` in runtime.yaml, and remove them from the \`takt\` block of the rulesync source. A "${TAKT_PROVIDER_OPTIONS_KEY}" already in ${filePath} is left untouched — rulesync does not own that key.`);
-		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : authoredProviderOptions;
+		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : dropUntrustedProviderOptions({
+			providerOptions: authoredProviderOptions,
+			global,
+			filePath,
+			logger
+		});
 		const authoredPolicies = pickSecurityPolicies(override, {
 			filePath,
 			logger,
@@ -72511,6 +74240,68 @@ function taktModeToRulesyncConfig(mode) {
 		default: return { permission: { bash: { [CATCH_ALL_PATTERN$1]: "deny" } } };
 	}
 }
+const TAKT_BASE_URL_PROVIDERS = [
+	"codex",
+	"claude",
+	"deepseek_harness"
+];
+const TAKT_DEEPSEEK_HARNESS_KEY = "deepseek_harness";
+/** Mirrors Takt's `isLoopbackBaseUrl`: localhost, *.localhost, ::1 or 127.x.x.x. */
+function isLoopbackBaseUrl(value) {
+	let hostname;
+	try {
+		hostname = new URL(value).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "[::1]") return true;
+	const octets = hostname.split(".");
+	return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d+$/.test(octet) && Number(octet) <= 255);
+}
+/** The keys of one `provider_options.<provider>` entry Takt rejects in config.yaml. */
+function untrustedProviderOptionKeys({ provider, options, global }) {
+	const keys = [];
+	if (provider === TAKT_DEEPSEEK_HARNESS_KEY) {
+		if (options.reasoning_effort !== void 0) keys.push("reasoning_effort");
+		const { plugins } = options;
+		if (!global && plugins !== void 0 && (!Array.isArray(plugins) || plugins.length > 0)) keys.push("plugins");
+	}
+	const baseUrl = options.base_url;
+	if (!global && TAKT_BASE_URL_PROVIDERS.includes(provider) && baseUrl !== void 0 && (typeof baseUrl !== "string" || !isLoopbackBaseUrl(baseUrl))) keys.push("base_url");
+	return keys;
+}
+/**
+* Drop the `provider_options` entries Takt refuses to load from `config.yaml`
+* (it fails at startup with a `Configuration error`), warning for each:
+*   - `deepseek_harness.reasoning_effort` in either scope — Takt accepts it only
+*     in runtime profile options or `TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT`.
+*   - at project scope, a non-empty `deepseek_harness.plugins` (Takt 0.71.0+,
+*     global config only) and a non-loopback `{codex,claude,deepseek_harness}.base_url`.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/providerOptions.ts
+* https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+function dropUntrustedProviderOptions({ providerOptions, global, filePath, logger }) {
+	if (providerOptions === void 0) return;
+	const dropped = [];
+	const result = {};
+	for (const [provider, options] of Object.entries(providerOptions)) {
+		if (!isPlainObject$1(options)) {
+			result[provider] = options;
+			continue;
+		}
+		const untrusted = untrustedProviderOptionKeys({
+			provider,
+			options,
+			global
+		});
+		const kept = Object.fromEntries(Object.entries(options).filter(([key]) => !untrusted.includes(key)));
+		dropped.push(...untrusted.map((key) => `${TAKT_PROVIDER_OPTIONS_KEY}.${provider}.${key}`));
+		if (Object.keys(kept).length > 0 || Object.keys(options).length === 0) result[provider] = kept;
+	}
+	if (dropped.length === 0) return providerOptions;
+	logger?.warn(`Takt permissions: not writing ${dropped.map((key) => `"${key}"`).join(", ")} to ${filePath} because Takt refuses to load ${dropped.length === 1 ? "it" : "them"} from ${global ? "config.yaml" : "a project config.yaml"} and fails at startup with a "Configuration error". Set non-loopback base URLs and DeepSeek Harness plugins in the global ~/.takt/config.yaml (or the TAKT_PROVIDER_OPTIONS_* environment variables), and DeepSeek Harness reasoning_effort in a runtime.yaml profile's options or TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT, then remove them from the \`takt\` block of the rulesync source.`);
+	return Object.keys(result).length > 0 ? result : void 0;
+}
 /**
 * Lift Takt's security-policy keys out of a source object, keeping only the
 * shapes Takt itself accepts (a boolean, or a table of booleans). Used in both
@@ -76445,6 +78236,11 @@ const TOOL_DISPLAY = [
 		label: "Factory Droid",
 		group: "ai"
 	},
+	{
+		key: "firebender",
+		label: "Firebender",
+		group: "ai"
+	},
 	{
 		key: "opencode",
 		label: "OpenCode",
@@ -76600,6 +78396,11 @@ const TOOL_DISPLAY = [
 		label: "JetBrains AI Assistant",
 		group: "ai"
 	},
+	{
+		key: "androidstudio",
+		label: "Gemini in Android Studio",
+		group: "ai"
+	},
 	{
 		key: "junie",
 		label: "JetBrains Junie",
@@ -76635,6 +78436,11 @@ const TOOL_DISPLAY = [
 		label: "Warp Agent CLI",
 		group: "ai"
 	},
+	{
+		key: "xum",
+		label: "Xum",
+		group: "ai"
+	},
 	{
 		key: "replit",
 		label: "Replit",
@@ -77779,6 +79585,27 @@ var AmpSkill = class AmpSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/androidstudio-skill.ts
+/**
+* Gemini in Android Studio skills follow the Agent Skills open standard
+* (`<name>/SKILL.md` with `name` and `description` frontmatter), so this target
+* reuses {@link AgentsSkillsSkill} with Android Studio's own location:
+* `.android-studio/skills/` at the project root (project) or in the home
+* directory (global). The shared `.agents/skills/` location Android Studio also
+* reads belongs to the `agentsskills` target.
+*
+* @see https://developer.android.com/studio/gemini/skills
+*/
+var AndroidstudioSkill = class extends AgentsSkillsSkill {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: ANDROIDSTUDIO_SKILLS_DIR_PATH };
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("androidstudio");
+	}
+};
+//#endregion
 //#region src/features/skills/antigravity-plugin-skill.ts
 var AntigravityPluginSkill = class extends AntigravityIdeSkill {
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
@@ -81247,6 +83074,26 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/firebender-skill.ts
+/**
+* Firebender skills follow the Agent Skills layout (`<name>/SKILL.md` with the
+* required `name` and `description` frontmatter, plus optional supporting
+* files), so this target reuses {@link AgentsSkillsSkill} with Firebender's
+* recommended locations: `.firebender/skills/` (project) and
+* `~/.firebender/skills/` (user).
+*
+* @see https://docs.firebender.com/api-reference/skills
+*/
+var FirebenderSkill = class extends AgentsSkillsSkill {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: FIREBENDER_SKILLS_DIR_PATH };
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("firebender");
+	}
+};
+//#endregion
 //#region src/features/skills/gitlabduo-skill.ts
 /**
 * GitLab Duo skills follow the Agent Skills standard (`name` and `description`
@@ -84782,6 +86629,110 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/xum-skill.ts
+/**
+* The Agent Skills standard keys the `agentsskills` section carries. On import
+* they go back there, exactly as for the `agentsskills` target, and every other
+* key besides `name` / `description` goes into the `xum` section.
+*/
+const AGENT_SKILLS_STANDARD_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"description",
+	"license",
+	"compatibility",
+	"metadata",
+	"allowed-tools"
+]);
+/**
+* Xum skills follow the Agent Skills layout (`<name>/SKILL.md` with the
+* required `name` and `description` frontmatter; the directory name is
+* lowercase letters, digits and single hyphens up to 64 characters, and
+* `name` must match it), so this target reuses {@link AgentsSkillsSkill} with
+* Xum's locations: `.xum/skills/` (project) and `~/.xum/skills/` (user).
+* Within one directory `.xum/skills` wins over `.agents/skills`.
+*
+* On top of the standard fields, Xum reads `disable-model-invocation` (and its
+* own `advertise: false` alias), `user-invocable`, `argument-hint`,
+* `when_to_use` / `when-to-use` and `paths` (globs that make the skill
+* path-scoped). Those come from the `xum` section of the rulesync skill and are
+* written verbatim; the two invocation gates fall back to the root-level
+* rulesync values.
+*
+* @see https://xum.cdr.dev/agents/agent-skills
+*/
+var XumSkill = class XumSkill extends AgentsSkillsSkill {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: XUM_SKILLS_DIR_PATH };
+	}
+	toRulesyncSkill() {
+		const base = super.toRulesyncSkill();
+		const xumSection = Object.fromEntries(Object.entries(this.getFrontmatter()).filter(([key]) => !AGENT_SKILLS_STANDARD_KEYS.has(key)));
+		if (Object.keys(xumSection).length === 0) return base;
+		const rulesyncFrontmatter = {
+			...base.getFrontmatter(),
+			xum: xumSection
+		};
+		return new RulesyncSkill({
+			outputRoot: base.getOutputRoot(),
+			relativeDirPath: base.getRelativeDirPath(),
+			dirName: base.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: base.getBody(),
+			otherFiles: base.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = XumSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const xumSection = {};
+		const ignoredKeys = [];
+		for (const [key, value] of Object.entries(rulesyncFrontmatter.xum ?? {})) if (AGENT_SKILLS_STANDARD_KEYS.has(key)) ignoredKeys.push(key);
+		else xumSection[key] = value;
+		if (ignoredKeys.length > 0) warnWithFallback(logger, `${(0, node_path.join)(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)}: the xum section sets ${ignoredKeys.map(quoteValueForWarning).join(", ")}, which ${ignoredKeys.length === 1 ? "is" : "are"} ignored there; set name/description at the root and the Agent Skills standard fields at the root or in the agentsskills section.`);
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const frontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter)),
+			...xumSection,
+			...userInvocable !== void 0 && { "user-invocable": userInvocable },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation }
+		};
+		AgentsSkillsSkill.reportSpecViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			sourceAllowedTools: rulesyncFrontmatter.agentsskills?.["allowed-tools"],
+			logger
+		});
+		return new XumSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("xum");
+	}
+};
+//#endregion
 //#region src/features/skills/zcode-skill.ts
 const ZcodeSkillFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -85197,6 +87148,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: false
 		}
 	}],
+	["androidstudio", {
+		class: AndroidstudioSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["amp", {
 		class: AmpSkill,
 		meta: {
@@ -85382,6 +87341,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["firebender", {
+		class: FirebenderSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["goose", {
 		class: GooseSkill,
 		meta: {
@@ -85632,6 +87599,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["xum", {
+		class: XumSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["devin", {
 		class: DevinSkill,
 		meta: {
@@ -89478,6 +91453,338 @@ var FactorydroidSubagent = class FactorydroidSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/firebender-subagent.ts
+/**
+* Frontmatter of a Firebender agent file. `tools` is a comma-separated string
+* of tool groups (`read`, `edit`, `execution`, `other`) and MCP tools
+* (`mcp_<server>_<tool>`); `model` is `small`, `medium`, `large`, `inherit` or a
+* model ID; `callable` lets the main agent delegate to it. Unknown keys are
+* preserved.
+*
+* @see https://docs.firebender.com/api-reference/agents
+*/
+const FirebenderSubagentFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.optional(zod_mini.z.string()),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	color: zod_mini.z.optional(zod_mini.z.string()),
+	icon: zod_mini.z.optional(zod_mini.z.string()),
+	tools: zod_mini.z.optional(zod_mini.z.string()),
+	model: zod_mini.z.optional(zod_mini.z.string()),
+	callable: zod_mini.z.optional(zod_mini.z.boolean())
+});
+/**
+* The `agents` entry Firebender resolves to an agent file rulesync writes:
+* relative to the project root for the project config, and to `~/.firebender`
+* for the personal one.
+*/
+function toAgentsEntry({ relativeFilePath, global }) {
+	const fileName = toPosixPath(relativeFilePath);
+	return global ? node_path.posix.join(FIREBENDER_AGENTS_DIR_NAME, fileName) : node_path.posix.join(toPosixPath(FIREBENDER_AGENTS_DIR_PATH), fileName);
+}
+/**
+* The agent file name an existing `agents` entry points at when it lies
+* directly inside the directory rulesync writes agents to
+* (`.firebender/agents/` in the project; `agents/` or `~/.firebender/agents/`
+* in the personal config), or `undefined` for any other entry
+* (`~/firebender-agents/...`, an absolute path, a nested path).
+*/
+function managedAgentFileName({ entry, global }) {
+	const normalized = toPosixPath(entry).replace(/^\.\//, "");
+	const prefix = global ? `${FIREBENDER_AGENTS_DIR_NAME}/` : `${toPosixPath(FIREBENDER_AGENTS_DIR_PATH)}/`;
+	const homePrefix = `~/${toPosixPath(FIREBENDER_AGENTS_DIR_PATH)}/`;
+	const rest = normalized.startsWith(prefix) ? normalized.slice(prefix.length) : global && normalized.startsWith(homePrefix) ? normalized.slice(homePrefix.length) : void 0;
+	return rest !== void 0 && rest.endsWith(".md") && !rest.includes("/") ? rest : void 0;
+}
+/**
+* Subagent generator for Firebender.
+*
+* Each agent is a Markdown file with YAML frontmatter, written to
+* `.firebender/agents/<name>.md` (project) or `~/.firebender/agents/<name>.md`
+* (global). Firebender only loads agents listed in the `agents` array of
+* `firebender.json`, so generation also registers every file there — see
+* {@link FirebenderAgentsRegistry}. Rulesync subagents are meant to be
+* delegated to, so `callable: true` is written unless the `firebender:`
+* section says otherwise.
+*
+* @see https://docs.firebender.com/api-reference/agents
+*/
+var FirebenderSubagent = class FirebenderSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate !== false) {
+			const result = FirebenderSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({ ...rest });
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: FIREBENDER_AGENTS_DIR_PATH };
+	}
+	/**
+	* Generation also read-modify-writes the `agents` key of `firebender.json`,
+	* so the write is declared for the shared-file order derivation.
+	*/
+	static getExtraSharedWritePaths({ global = false } = {}) {
+		return [{
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME
+		}];
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, callable, ...rest } = this.frontmatter;
+		const firebenderSection = {
+			...rest,
+			...callable !== true && { callable: callable ?? false }
+		};
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name: name ?? (0, node_path.basename)(this.getRelativeFilePath(), ".md"),
+				description,
+				...Object.keys(firebenderSection).length > 0 && { firebender: firebenderSection }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	/**
+	* Every targeted subagent becomes its own agent file, plus one
+	* {@link FirebenderAgentsRegistry} that lists them in `firebender.json`.
+	* The registry is emitted even when no subagent is targeted, so agents a
+	* previous run registered are retracted once their files are gone. The
+	* agent directory is listed up front so the registry can tell a registered
+	* file that still exists (kept, whoever wrote it) from a stale one.
+	*/
+	static async fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, global = false, logger, deleteOrphans = false }) {
+		const agentsDirPath = this.getSettablePaths({ global }).relativeDirPath;
+		const agentsDirEscapesRoot = await writablePathEscapesRoot({
+			rootPath: outputRoot,
+			targetPath: (0, node_path.join)(outputRoot, agentsDirPath, "agent.md")
+		});
+		const existingAgentFileNames = new Set(agentsDirEscapesRoot ? [] : await listDirectoryEntryNames((0, node_path.join)(outputRoot, agentsDirPath)));
+		const subagents = rulesyncSubagents.map((rulesyncSubagent) => this.fromRulesyncSubagent({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			rulesyncSubagent,
+			global
+		}));
+		const registry = new FirebenderAgentsRegistry({
+			outputRoot,
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME,
+			entries: subagents.map((subagent) => toAgentsEntry({
+				relativeFilePath: subagent.getRelativeFilePath(),
+				global
+			})),
+			existingAgentFileNames,
+			deleteOrphans,
+			frozen: agentsDirEscapesRoot,
+			global,
+			logger
+		});
+		return [...subagents, registry];
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const firebenderSection = rulesyncFrontmatter.firebender ?? {};
+		const frontmatter = {
+			name: rulesyncFrontmatter.name,
+			...rulesyncFrontmatter.description !== void 0 && { description: rulesyncFrontmatter.description },
+			callable: true,
+			...firebenderSection
+		};
+		const body = rulesyncSubagent.getBody();
+		return new FirebenderSubagent({
+			outputRoot,
+			frontmatter,
+			body,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent: stringifyFrontmatter(body, frontmatter, { avoidBlockScalars: true }),
+			validate,
+			global
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = FirebenderSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "firebender"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body } = parseFrontmatter(fileContent, filePath);
+		const result = FirebenderSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new FirebenderSubagent({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new FirebenderSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+/**
+* The `agents` array of `firebender.json`, which Firebender requires to load
+* an agent file. Every generated agent is registered. An existing entry that
+* points into rulesync's agent directory is kept while its file exists (a
+* hand-written agent there stays registered) and dropped, with a warning, once
+* the file is gone. Under `--delete` the orphan sweep removes every agent file
+* there that this run does not generate, but only after this file is written,
+* so in that mode such entries are dropped here too and a single run
+* converges. Every other entry and every other key of the file is kept.
+* The array is merged into the file on disk at write time and the file itself
+* is never deleted.
+*/
+var FirebenderAgentsRegistry = class extends ToolSubagent {
+	entries;
+	existingAgentFileNames;
+	deleteOrphans;
+	frozen;
+	logger;
+	mergedContent = null;
+	constructor({ entries, existingAgentFileNames = /* @__PURE__ */ new Set(), deleteOrphans = false, frozen = false, logger, ...rest }) {
+		super({
+			...rest,
+			fileContent: ""
+		});
+		this.entries = entries;
+		this.existingAgentFileNames = existingAgentFileNames;
+		this.deleteOrphans = deleteOrphans;
+		this.frozen = frozen;
+		this.logger = logger;
+	}
+	getEntries() {
+		return this.entries;
+	}
+	isDeletable() {
+		return false;
+	}
+	shouldMergeExistingFileContent() {
+		return true;
+	}
+	setFileContent(newFileContent) {
+		this.mergedContent = this.mergeInto(newFileContent);
+	}
+	getFileContent() {
+		if (this.mergedContent === null) this.mergedContent = this.mergeInto("");
+		return this.mergedContent;
+	}
+	mergeInto(existingContent) {
+		const paths = {
+			relativeDirPath: this.getRelativeDirPath(),
+			relativeFilePath: this.getRelativeFilePath()
+		};
+		const filePath = (0, node_path.join)(this.getOutputRoot(), paths.relativeDirPath, paths.relativeFilePath);
+		const existing = parseSharedConfig({
+			format: "json",
+			fileContent: existingContent,
+			filePath,
+			invalidRootPolicy: "error"
+		});
+		if (this.frozen) return applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "subagents",
+			existingContent,
+			patch: { agents: existing.agents },
+			filePath,
+			logger: this.logger
+		});
+		const existingEntries = Array.isArray(existing.agents) ? existing.agents : [];
+		const generatedByFileName = new Map(this.entries.map((entry) => [managedAgentFileName({
+			entry,
+			global: this.global
+		}) ?? entry, entry]));
+		const agents = [];
+		const placed = /* @__PURE__ */ new Set();
+		const dropped = [];
+		for (const entry of existingEntries) {
+			const fileName = typeof entry === "string" ? managedAgentFileName({
+				entry,
+				global: this.global
+			}) : void 0;
+			if (fileName === void 0) {
+				agents.push(entry);
+				continue;
+			}
+			const generated = generatedByFileName.get(fileName);
+			if (generated !== void 0) {
+				if (!placed.has(fileName)) {
+					agents.push(generated);
+					placed.add(fileName);
+				}
+			} else if (!this.deleteOrphans && this.existingAgentFileNames.has(fileName)) agents.push(entry);
+			else dropped.push(String(entry));
+		}
+		for (const [fileName, entry] of generatedByFileName) if (!placed.has(fileName)) {
+			agents.push(entry);
+			placed.add(fileName);
+		}
+		if (dropped.length > 0) this.logger?.warn(`Unregistered Firebender agent(s) ${dropped.map((entry) => quoteValueForWarning(entry)).join(", ")} from ${filePath}: ` + (this.deleteOrphans ? "--delete removes agent files that .rulesync/subagents/ no longer generates." : "the agent file no longer exists."));
+		return applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "subagents",
+			existingContent,
+			patch: { agents: agents.length > 0 ? agents : void 0 },
+			filePath,
+			logger: this.logger
+		});
+	}
+	toRulesyncSubagent() {
+		throw new Error(`${this.getRelativePathFromCwd()} registers Firebender agents and is not a subagent itself.`);
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+//#endregion
 //#region src/features/subagents/goose-subagent.ts
 /**
 * Goose custom agents (v1.34.0+) are Markdown files with YAML frontmatter —
@@ -89765,13 +92072,13 @@ function subagentSlug(relativeFilePath) {
 	return (0, node_path.basename)(relativeFilePath, ".md").replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function hermesCommandName(slug) {
-	return `rulesync_subagent_${slug}`;
+	return hermesSlashName(`rulesync-subagent-${slug}`);
 }
 function getPluginManifestContent() {
 	return [
 		"name: rulesync-subagents",
 		"version: \"1.0.0\"",
-		"description: Exposes RuleSync subagents as Hermes native delegation commands.",
+		"description: Exposes RuleSync subagents as Hermes slash commands that queue a delegation prompt.",
 		""
 	].join("\n");
 }
@@ -89779,9 +92086,12 @@ function getPluginInitContent() {
 	return `"""RuleSync-generated Hermes subagent commands."""
 
 import json
+import logging
+import re
 from pathlib import Path
 
 
+logger = logging.getLogger(__name__)
 SUBAGENTS_DIR = Path(__file__).resolve().parents[2] / "rulesync" / "subagents"
 
 
@@ -89801,52 +92111,71 @@ def _load_subagents():
     return subagents
 
 
-def _register_subagent(ctx, subagent):
+def _command_name(subagent, slug):
+    # The spec carries the name Rulesync normalized; Hermes' messaging gateway
+    # resolves plugin commands with "_" turned into "-", so keep it hyphenated.
+    hermes = subagent.get("hermes")
+    name = hermes.get("command") if isinstance(hermes, dict) else None
+    name = name or f"rulesync-subagent-{slug}"
+    # Mirrors hermesSlashName() in src/features/shared/hermes-plugin-commands.ts.
+    name = re.sub(r"[ _]", "-", str(name).lower())
+    name = re.sub(r"[^a-z0-9-]", "", name)
+    return re.sub(r"-{2,}", "-", name).strip("-")
+
+
+${getHermesQueueUserMessagePython({ pluginName: "rulesync-subagents" })}
+
+def _register_subagent(ctx, subagent, registered):
     slug = subagent.get("slug")
     if not slug:
         return
 
-    command_name = f"rulesync_subagent_{slug}"
+    command_name = _command_name(subagent, slug)
+    if command_name in registered:
+        logger.warning(
+            "rulesync-subagents: %s and %s both map to /%s; keeping the first.",
+            registered[command_name],
+            subagent.get("_path"),
+            command_name,
+        )
+        return
+    registered[command_name] = subagent.get("_path")
+
     name = subagent.get("name") or slug
     description = subagent.get("description") or f"Delegate work to the {name} RuleSync subagent."
     system_prompt = subagent.get("prompt") or ""
 
     def handler(args=None, **kwargs):
-        del kwargs
         user_context = ""
         if isinstance(args, dict):
             user_context = args.get("context") or args.get("task") or args.get("prompt") or ""
         elif args is not None:
             user_context = str(args)
 
-        context_parts = []
+        # A slash command runs outside any agent turn, so calling delegate_task
+        # here fails with "delegate_task requires a parent agent context".
+        # Queue the brief as a user message instead; the agent then delegates.
+        parts = [
+            f"Use the delegate_task tool to hand the following task to a subagent "
+            f"acting as the {name} RuleSync subagent.",
+            f"Goal: {description}",
+        ]
         if system_prompt:
-            context_parts.append(system_prompt)
+            parts.append(f"Subagent instructions:\\n{system_prompt}")
         if user_context:
-            context_parts.append(user_context)
+            parts.append(f"Task details:\\n{user_context}")
 
-        # delegate_task takes no model-facing "toolsets" argument: a subagent
-        # inherits the parent's enabled toolsets (role="orchestrator" is the
-        # only knob that changes them). "tasks" is the only shape its schema
-        # advertises; a top-level "goal" is an unadvertised legacy path.
-        return ctx.dispatch_tool(
-            "delegate_task",
-            {
-                "tasks": [
-                    {
-                        "goal": description,
-                        "context": "\\n\\n".join(context_parts),
-                    },
-                ],
-            },
-        )
+        label = f"the {name} subagent task"
+        error = _queue_user_message(ctx, "\\n\\n".join(parts), kwargs, label)
+        return error or f"Queued {label}; the agent will delegate it."
 
     ctx.register_command(command_name, handler, description)
 
 
 def register(ctx):
+    registered = {}
     for subagent in _load_subagents():
-        _register_subagent(ctx, subagent)
+        _register_subagent(ctx, subagent, registered)
 `;
 }
 function getEnabledPluginConfigContent({ currentContent, global }) {
@@ -89877,7 +92206,7 @@ function getSubagentSpec(rulesyncSubagent) {
 		prompt: rulesyncSubagent.getBody(),
 		hermes: {
 			command: hermesCommandName(slug),
-			dispatch: "delegate_task"
+			dispatch: "inject_message"
 		}
 	};
 }
@@ -90553,6 +92882,15 @@ const KiroCliSubagentJsonSchema = zod_mini.z.looseObject({
 	allowedTools: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.array(zod_mini.z.string()))),
 	includeMcpJson: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.boolean()))
 });
+/**
+* The name Kiro gives an agent file: its path relative to the agents directory
+* without the extension, so a nested `team/planner.md` is `team/planner`.
+* https://kiro.dev/docs/custom-agents/
+*/
+function kiroAgentNameFromPath(relativeFilePath) {
+	const posixPath = toPosixPath(relativeFilePath);
+	return posixPath.slice(0, posixPath.length - (0, node_path.extname)(posixPath).length);
+}
 var KiroSubagent = class extends ToolSubagent {
 	body;
 	constructor({ body, ...rest }) {
@@ -90588,7 +92926,7 @@ var KiroSubagent = class extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: [toolTarget],
-				name: name ?? (0, node_path.basename)(this.getRelativeFilePath(), ".json"),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? void 0,
 				...Object.keys(kiroSection).length > 0 && { kiro: kiroSection }
 			},
@@ -90738,7 +93076,7 @@ var KiroIdeSubagent = class KiroIdeSubagent extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
-				name: name ?? this.getRelativeFilePath().replace(/\.md$/, ""),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? "",
 				...Object.keys(kiroIdeSection).length > 0 && { "kiro-ide": kiroIdeSection }
 			},
@@ -92669,6 +95007,166 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/xum-subagent.ts
+/**
+* The built-in agent a rulesync subagent inherits from when its `xum` block
+* names neither a `base` nor its own `tools`. Xum gives an agent no tools at
+* all unless some agent in its `base` chain declares them, so a definition
+* without either would be a prompt that cannot read or edit anything.
+*/
+const XUM_DEFAULT_BASE_AGENT = "exec";
+/**
+* Frontmatter of a Xum agent definition. `name` (the display name) is
+* required; the other documented fields are typed loosely and unknown keys are
+* kept (looseObject) so a round trip never drops them.
+*
+* @see https://xum.cdr.dev/agents
+*/
+const XumSubagentFrontmatterSchema = zod_mini.z.looseObject({
+	name: zod_mini.z.string(),
+	description: zod_mini.z.optional(zod_mini.z.string()),
+	base: zod_mini.z.optional(zod_mini.z.string()),
+	disabled: zod_mini.z.optional(zod_mini.z.boolean()),
+	ui: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	prompt: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	subagent: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	ai: zod_mini.z.optional(zod_mini.z.looseObject({})),
+	tools: zod_mini.z.optional(zod_mini.z.looseObject({}))
+});
+/**
+* Subagent generator for Xum (formerly Mux).
+*
+* Xum reads custom agent definitions — Markdown with YAML frontmatter — from
+* the top level of `.xum/agents/` (project) and `~/.xum/agents/` (user); the
+* body is the agent's instruction prompt. The file name (without `.md`) is the
+* agent id, so it must be lowercase letters and digits with single `-` / `_`
+* separators; Xum skips other files with a warning.
+*
+* rulesync writes `name` and `description`, spreads the `xum` section (`base`,
+* `ui`, `prompt`, `subagent`, `ai`, `tools`, ...) on top, and fills two
+* defaults so the definition works as a delegated subagent out of the box:
+* `subagent.runnable: true` (required for `task({ agentId })` to spawn it) and,
+* when the section sets neither `base` nor `tools`, `base: exec`.
+*
+* @see https://xum.cdr.dev/agents
+*/
+var XumSubagent = class XumSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate !== false) {
+			const result = XumSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({ ...rest });
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: XUM_AGENTS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, ...restFields } = this.frontmatter;
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name,
+				description,
+				...Object.keys(restFields).length > 0 && { xum: restFields }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const xumSection = this.filterToolSpecificSection(rulesyncFrontmatter.xum ?? {}, ["name", "description"]);
+		const subagentSection = xumSection.subagent;
+		const result = XumSubagentFrontmatterSchema.safeParse({
+			name: rulesyncFrontmatter.name,
+			...rulesyncFrontmatter.description && { description: rulesyncFrontmatter.description },
+			...xumSection.base === void 0 && xumSection.tools === void 0 && { base: XUM_DEFAULT_BASE_AGENT },
+			...xumSection,
+			subagent: {
+				runnable: true,
+				...isPlainObject$1(subagentSection) ? subagentSection : {}
+			}
+		});
+		if (!result.success) throw new Error(`Invalid xum subagent frontmatter in ${rulesyncSubagent.getRelativeFilePath()}: ${formatError(result.error)}`);
+		const body = rulesyncSubagent.getBody();
+		return new XumSubagent({
+			outputRoot,
+			frontmatter: result.data,
+			body,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent: stringifyFrontmatter(body, result.data),
+			validate
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = XumSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "xum"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body } = parseFrontmatter(fileContent, filePath);
+		const result = XumSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new XumSubagent({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			fileContent,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new XumSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/zcode-subagent.ts
 const ZcodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
 	name: zod_mini.z.string(),
@@ -93134,6 +95632,17 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.md"
 		}
 	}],
+	["firebender", {
+		class: FirebenderSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			emitsEmptyAggregate: true,
+			emitsEmptyAggregateOnDelete: true,
+			filePattern: "*.md"
+		}
+	}],
 	["goose", {
 		class: GooseSubagent,
 		meta: {
@@ -93185,7 +95694,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.json"
+			filePattern: "**/*.json",
+			supportsNestedPaths: true
 		}
 	}],
 	["kiro-ide", {
@@ -93194,7 +95704,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.md"
+			filePattern: "**/*.md",
+			supportsNestedPaths: true
 		}
 	}],
 	["lettacode", {
@@ -93361,6 +95872,15 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.toml"
 		}
 	}],
+	["xum", {
+		class: XumSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			filePattern: "*.md"
+		}
+	}],
 	["zcode", {
 		class: ZcodeSubagent,
 		meta: {
@@ -93415,6 +95935,7 @@ function compareRelativePathsShallowestFirst(left, right) {
 var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	deleteOrphans;
 	getFactory;
 	/**
 	* Whether the last `loadRulesyncFiles` found a `subagents/` directory under
@@ -93422,13 +95943,14 @@ var SubagentsProcessor = class extends FeatureProcessor {
 	* agents in its Pool settings are its own and must not be retracted.
 	*/
 	rulesyncSourceDirFound = false;
-	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, deleteOrphans = false, logger }) {
 		super({
 			outputRoot,
 			inputRoots,
 			dryRun,
 			logger
 		});
+		this.deleteOrphans = deleteOrphans;
 		const result = SubagentsProcessorToolTargetSchema.safeParse(toolTarget);
 		if (!result.success) throw new Error(`Invalid tool target for SubagentsProcessor: ${toolTarget}. ${formatError(result.error)}`);
 		this.toolTarget = result.data;
@@ -93436,7 +95958,9 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		this.getFactory = getFactory;
 	}
 	emitsToolFilesForEmptySource() {
-		return this.rulesyncSourceDirFound && this.getFactory(this.toolTarget).meta.emitsEmptyAggregate === true;
+		const { meta } = this.getFactory(this.toolTarget);
+		if (meta.emitsEmptyAggregate !== true) return false;
+		return this.rulesyncSourceDirFound || this.deleteOrphans && meta.emitsEmptyAggregateOnDelete === true;
 	}
 	async convertRulesyncFilesToToolFiles(rulesyncFiles) {
 		const rulesyncSubagents = rulesyncFiles.filter((file) => file instanceof RulesyncSubagent);
@@ -93452,11 +95976,12 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		});
 		if (factory.class.fromRulesyncSubagents) {
 			if (targeted.length === 0 && !this.emitsToolFilesForEmptySource()) return [];
-			const toolSubagents = factory.class.fromRulesyncSubagents({
+			const toolSubagents = await factory.class.fromRulesyncSubagents({
 				outputRoot: this.outputRoot,
 				rulesyncSubagents: targeted,
 				global: this.global,
-				logger: this.logger
+				logger: this.logger,
+				deleteOrphans: this.deleteOrphans && !this.hasRulesyncSourceLoadFailure()
 			});
 			return Array.isArray(toolSubagents) ? toolSubagents : [toolSubagents];
 		}
@@ -94202,7 +96727,7 @@ const isAiassistantApply = (value) => AIASSISTANT_APPLY_VALUES.includes(value);
 /**
 * Globs that match the whole project and so say nothing beyond "always".
 */
-const UNIVERSAL_GLOBS$5 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const UNIVERSAL_GLOBS$6 = /* @__PURE__ */ new Set(["**/*", "*"]);
 const METADATA_DELIMITER = "---";
 /**
 * Splits text into lines that keep their own line terminator, so the body can
@@ -94327,7 +96852,7 @@ var AiassistantRule = class AiassistantRule extends ToolRule {
 	*/
 	static buildMetadata(frontmatter) {
 		const globs = (frontmatter.globs ?? []).map((glob) => flattenValue(glob)).filter((glob) => glob.length > 0).flatMap((glob) => expandBraceAlternations(glob));
-		const hasUniversalGlob = globs.some((glob) => UNIVERSAL_GLOBS$5.has(glob));
+		const hasUniversalGlob = globs.some((glob) => UNIVERSAL_GLOBS$6.has(glob));
 		const instructions = frontmatter.description && flattenValue(frontmatter.description);
 		const explicitApply = frontmatter.aiassistant?.apply && flattenValue(frontmatter.aiassistant.apply);
 		const apply = explicitApply ? explicitApply : frontmatter.root !== true && globs.length > 0 && !hasUniversalGlob ? "by file patterns" : frontmatter.root !== true && globs.length === 0 && instructions ? "by model decision" : "always";
@@ -96981,7 +99506,7 @@ function normalizePatternList(value) {
 * an always-on rule into a "when any file is in context" rule. Dropped on
 * generate and mapped back on import.
 */
-const UNIVERSAL_GLOBS$4 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const UNIVERSAL_GLOBS$5 = /* @__PURE__ */ new Set(["**/*", "*"]);
 /**
 * Rule generator for Continue (continuedev/continue), the open-source IDE
 * extension and CLI (`cn`).
@@ -97095,7 +99620,7 @@ var ContinueRule = class ContinueRule extends ToolRule {
 		if (alwaysApply === true) return;
 		const targetGlobs = continueGlobs ?? parentGlobs;
 		if (!targetGlobs || targetGlobs.length === 0) return;
-		if (targetGlobs.every((glob) => UNIVERSAL_GLOBS$4.has(glob.trim()))) return;
+		if (targetGlobs.every((glob) => UNIVERSAL_GLOBS$5.has(glob.trim()))) return;
 		return targetGlobs;
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
@@ -97587,7 +100112,7 @@ const CursorRuleFrontmatterSchema = zod_mini.z.object({
 * does not already say. Same pair the Cline and Qwen Code adapters treat as
 * universal.
 */
-const UNIVERSAL_GLOBS$3 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const UNIVERSAL_GLOBS$4 = /* @__PURE__ */ new Set(["**/*", "*"]);
 var CursorRule = class CursorRule extends ToolRule {
 	frontmatter;
 	body;
@@ -97628,7 +100153,8 @@ var CursorRule = class CursorRule extends ToolRule {
 	}
 	/**
 	* Custom parse function for Cursor MDC files
-	* MDC files don't support quotes in YAML, so we need to handle patterns like *.ts specially
+	* MDC files don't support quotes in YAML, so we need to handle patterns like *.ts specially.
+	* Also used by Firebender, whose `.firebender/rules/*.mdc` files carry the same frontmatter.
 	*/
 	static parseCursorFrontmatter(fileContent, filePath) {
 		const bounds = findFrontmatterBlockBounds(fileContent);
@@ -97691,7 +100217,7 @@ var CursorRule = class CursorRule extends ToolRule {
 	static resolveCursorGlobs({ cursorSpecificGlobs, parentGlobs, alwaysApply }) {
 		const targetGlobs = cursorSpecificGlobs !== void 0 ? cursorSpecificGlobs : parentGlobs;
 		if (!targetGlobs || targetGlobs.length === 0) return;
-		if (alwaysApply && targetGlobs.every((glob) => UNIVERSAL_GLOBS$3.has(glob.trim()))) return;
+		if (alwaysApply && targetGlobs.every((glob) => UNIVERSAL_GLOBS$4.has(glob.trim()))) return;
 		return targetGlobs.join(",");
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
@@ -98605,6 +101131,211 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/features/rules/firebender-rule.ts
+/**
+* Frontmatter of a Firebender `.mdc` rule. Every field is optional; `globs`
+* is one comma-separated string, and a YAML list is tolerated on import.
+*/
+const FirebenderRuleFrontmatterSchema = zod_mini.z.looseObject({
+	description: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.string())),
+	globs: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))),
+	alwaysApply: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.boolean()))
+});
+/** Globs that match every file, and so add nothing to an always-applied rule. */
+const UNIVERSAL_GLOBS$3 = /* @__PURE__ */ new Set(["**/*", "*"]);
+function normalizeGlobs$2(globs) {
+	if (globs === null || globs === void 0) return [];
+	return (typeof globs === "string" ? globs.split(",") : globs).map((glob) => glob.trim()).filter((glob) => glob.length > 0);
+}
+/**
+* Rule generator for Firebender.
+*
+* Root rule: Firebender looks for `.firebender/AGENTS.md` first (then the
+* project-root `AGENTS.md`, then the same pair in parent directories, then
+* `~/.firebender/AGENTS.md`) and uses the first file it finds, so the root rule
+* is written to `.firebender/AGENTS.md` in the project and to
+* `~/.firebender/AGENTS.md` globally, where it does not collide with the
+* project-root `AGENTS.md` the `agentsmd` target owns.
+*
+* Non-root rules: `.firebender/rules/*.mdc` (project) and
+* `~/.firebender/rules/*.mdc` (personal), each with optional Cursor-style
+* frontmatter: `description`, `globs` (one comma-separated string) and
+* `alwaysApply`. A rule with specific globs is written with
+* `alwaysApply: false` and those globs; every other rule is always applied.
+*
+* @see https://docs.firebender.com/api-reference/rules
+* @see https://docs.firebender.com/api-reference/agents-md
+*/
+var FirebenderRule = class FirebenderRule extends ToolRule {
+	frontmatter;
+	body;
+	constructor({ frontmatter = {}, body, ...rest }) {
+		if (rest.validate && !rest.root) {
+			const result = FirebenderRuleFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${(0, node_path.join)(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		const resolvedBody = body ?? rest.fileContent;
+		super({
+			...rest,
+			fileContent: rest.root ? resolvedBody : stringifyFrontmatter(resolvedBody, FirebenderRule.toOutputFrontmatter(frontmatter), { avoidBlockScalars: true })
+		});
+		this.frontmatter = frontmatter;
+		this.body = resolvedBody;
+	}
+	static getSettablePaths({ excludeToolDir } = {}) {
+		return {
+			root: {
+				relativeDirPath: buildToolPath(FIREBENDER_DIR, ".", excludeToolDir),
+				relativeFilePath: FIREBENDER_AGENTS_MD_FILE_NAME
+			},
+			nonRoot: { relativeDirPath: buildToolPath(FIREBENDER_DIR, "rules", excludeToolDir) }
+		};
+	}
+	/**
+	* The frontmatter written to a `.mdc` file: `alwaysApply` first, then the
+	* flattened `description`, then the globs joined the way Firebender's docs
+	* spell them (`"*.kt, *.kts"`).
+	*/
+	static toOutputFrontmatter(frontmatter) {
+		const description = typeof frontmatter.description === "string" ? frontmatter.description.replace(/[\r\n\u0085\u2028\u2029]+/g, " ").trim() : "";
+		const globs = normalizeGlobs$2(frontmatter.globs);
+		return {
+			...typeof frontmatter.alwaysApply === "boolean" && { alwaysApply: frontmatter.alwaysApply },
+			...description !== "" && { description },
+			...globs.length > 0 && { globs: globs.join(", ") }
+		};
+	}
+	/**
+	* Derives the Firebender frontmatter from the canonical one: specific globs
+	* make a file-scoped rule, everything else (no globs, universal globs) is
+	* always applied. Firebender splits `globs` on every comma, so a brace
+	* alternation such as `*.{ts,tsx}` is expanded into one glob per branch.
+	*/
+	static buildFrontmatter(frontmatter) {
+		const globs = normalizeGlobs$2(frontmatter.globs ?? []).flatMap((glob) => expandBraceAlternations(glob));
+		const specificGlobs = globs.filter((glob) => !UNIVERSAL_GLOBS$3.has(glob));
+		const isFileScoped = specificGlobs.length > 0 && specificGlobs.length === globs.length;
+		const description = frontmatter.description?.trim() || void 0;
+		return {
+			alwaysApply: !isFileScoped,
+			...description !== void 0 && { description },
+			...isFileScoped && { globs: specificGlobs.join(", ") }
+		};
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
+		const paths = this.getSettablePaths();
+		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
+		if (rulesyncFrontmatter.root ?? false) return new FirebenderRule({
+			outputRoot,
+			relativeDirPath: paths.root.relativeDirPath,
+			relativeFilePath: paths.root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: true,
+			description: rulesyncFrontmatter.description,
+			globs: rulesyncFrontmatter.globs
+		});
+		return new FirebenderRule({
+			outputRoot,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath: rulesyncRule.getRelativeFilePath().replace(/\.md$/, ".mdc"),
+			frontmatter: this.buildFrontmatter(rulesyncFrontmatter),
+			body: rulesyncRule.getBody(),
+			fileContent: "",
+			validate,
+			root: false
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true }) {
+		const paths = this.getSettablePaths();
+		if (relativeFilePath === paths.root.relativeFilePath && (relativeDirPath === void 0 || relativeDirPath === paths.root.relativeDirPath)) {
+			const fileContent = await readFileContent((0, node_path.join)(outputRoot, paths.root.relativeDirPath, paths.root.relativeFilePath));
+			return new FirebenderRule({
+				outputRoot,
+				relativeDirPath: paths.root.relativeDirPath,
+				relativeFilePath: paths.root.relativeFilePath,
+				fileContent,
+				validate,
+				root: true
+			});
+		}
+		const filePath = (0, node_path.join)(outputRoot, paths.nonRoot.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body } = CursorRule.parseCursorFrontmatter(fileContent, filePath);
+		const result = FirebenderRuleFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new FirebenderRule({
+			outputRoot,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			fileContent: "",
+			validate,
+			root: false
+		});
+	}
+	toRulesyncRule() {
+		if (this.isRoot()) return this.toRulesyncRuleDefault();
+		const sourceGlobs = normalizeGlobs$2(this.frontmatter.globs);
+		const alwaysApply = this.frontmatter.alwaysApply ?? void 0;
+		const description = this.frontmatter.description?.trim() || void 0;
+		const globs = alwaysApply === true || sourceGlobs.length === 0 ? ["**/*"] : sourceGlobs;
+		return new RulesyncRule({
+			outputRoot: process.cwd(),
+			frontmatter: {
+				targets: ["*"],
+				root: false,
+				...description !== void 0 && { description },
+				globs
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath().replace(/\.mdc$/, ".md"),
+			validate: true
+		});
+	}
+	validate() {
+		if (this.isRoot() || !this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = FirebenderRuleFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${(0, node_path.join)(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const paths = this.getSettablePaths();
+		const isRoot = relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
+		return new FirebenderRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: isRoot
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "firebender"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/gitlabduo-rule.ts
 /**
 * GitLab Duo CLI reads custom rules from a single plain-Markdown file:
@@ -101886,6 +104617,117 @@ var WarpRule = class extends NestedAgentsmdRule {
 	}
 };
 //#endregion
+//#region src/features/rules/xum-rule.ts
+/** An ATX level-1 heading line (`# Title`), which Xum's parser treats as an H1. */
+const ATX_H1_LINE = /^ {0,3}#(?:[ \t]|$)/;
+/**
+* Make `body` start at a level-1 heading, adding `# <heading>` when it does not
+* already open with one.
+*
+* Xum reads `.xum/AGENTS.md` (and appends `AGENTS.local.md`) as one Markdown
+* document and treats a `Mode:` / `Model:` / `Tool:` heading as a scoped
+* section that runs until the next heading of the same or a higher level.
+* Fragments rulesync concatenates into that document — folded topic rules and
+* the local overlay — would otherwise fall inside a scoped section the
+* preceding fragment ends with, and Xum would inject them only in that mode.
+* Only an H1 closes a section of any level, so each such fragment opens with
+* one.
+*
+* @see https://github.com/coder/xum/blob/main/src/node/utils/main/markdown.ts
+*/
+function ensureXumSectionBoundary({ body, heading }) {
+	const firstLine = body.split(/\r?\n/).find((line) => line.trim() !== "");
+	if (firstLine !== void 0 && ATX_H1_LINE.test(firstLine)) return body;
+	const safeHeading = heading.replaceAll(/[\r\n:]/g, " ").trim() || "Instructions";
+	return body.trim() === "" ? `# ${safeHeading}\n` : `# ${safeHeading}\n\n${body}`;
+}
+/** The heading a folded rule opens with: its file name without the extension. */
+function xumRuleHeading(rulesyncRule) {
+	const fileName = (0, node_path.basename)(rulesyncRule.getRelativeFilePath());
+	return fileName.slice(0, fileName.length - (0, node_path.extname)(fileName).length);
+}
+/**
+* Rule generator for Xum (Coder's parallel coding-agent app, formerly Mux).
+*
+* Xum layers its own `.xum/AGENTS.md` (project) and `~/.xum/AGENTS.md` (user)
+* on top of the shared root `AGENTS.md` / `AGENT.md` / `CLAUDE.md`, which the
+* `agentsmd` target already writes, so this target writes only the
+* Xum-dedicated file. Only these files honor the `## Model: <regex>` and
+* `## Mode: <mode>` scoped sections; rulesync passes the body through as-is,
+* so such sections authored in a rule keep working. The personal
+* `.xum/AGENTS.local.md` overlay is written for a `localRoot: true` rule.
+*
+* @see https://xum.cdr.dev/agents/instruction-files
+*/
+var XumRule = class XumRule extends ToolRule {
+	constructor({ fileContent, root, ...rest }) {
+		super({
+			...rest,
+			fileContent,
+			root: root ?? false
+		});
+	}
+	static getSettablePaths(_options = {}) {
+		return { root: {
+			relativeDirPath: XUM_DIR,
+			relativeFilePath: XUM_RULE_FILE_NAME
+		} };
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const relativePath = (0, node_path.join)(root.relativeDirPath, root.relativeFilePath);
+		const fileContent = await readFileContent((0, node_path.join)(outputRoot, relativePath));
+		return new XumRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = rulesyncRule.getFrontmatter().root ?? false;
+		return new XumRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: isRoot ? rulesyncRule.getBody() : ensureXumSectionBoundary({
+				body: rulesyncRule.getBody(),
+				heading: xumRuleHeading(rulesyncRule)
+			}),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		return this.toRulesyncRuleDefault();
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new XumRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: relativeFilePath === "AGENTS.md" && relativeDirPath === ".xum"
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "xum"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/zcode-rule.ts
 var ZcodeRule = class ZcodeRule extends ToolRule {
 	constructor({ fileContent, root, ...rest }) {
@@ -102374,6 +105216,14 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "compose"
 		}
 	}],
+	["firebender", {
+		class: FirebenderRule,
+		meta: {
+			extension: "mdc",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto"
+		}
+	}],
 	["goose", {
 		class: GooseRule,
 		meta: {
@@ -102657,6 +105507,17 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold"
 		}
 	}],
+	["xum", {
+		class: XumRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold",
+			localRootMode: "separate-local-file",
+			localRootFileName: XUM_LOCAL_RULE_FILE_NAME
+		}
+	}],
 	["devin", {
 		class: DevinRule,
 		meta: {
@@ -103427,18 +106288,39 @@ var RulesProcessor = class extends FeatureProcessor {
 			root: true,
 			localRoot
 		});
-		if (isClassOrSubclassOf({
-			candidate: factory.class,
-			base: QwencodeRule
-		})) return new QwencodeRule({
-			outputRoot: this.outputRoot,
-			relativeDirPath: relativeDirPath ?? ".qwen",
-			relativeFilePath: fileName,
-			fileContent: body,
-			validate: true,
-			root: true,
+		return this.buildToolDirLocalRootFile({
+			factory,
+			fileName,
+			body,
+			relativeDirPath,
 			localRoot
 		});
+	}
+	/**
+	* Qwen Code and Xum read the personal local file from their tool directory
+	* (`.qwen/QWEN.local.md`, `.xum/AGENTS.local.md`), not the project root
+	* (project scope only; global handling never reaches here).
+	*/
+	buildToolDirLocalRootFile({ factory, fileName, body, relativeDirPath, localRoot }) {
+		const toolDirEntry = [[QwencodeRule, QWENCODE_DIR], [XumRule, XUM_DIR]].find(([base]) => isClassOrSubclassOf({
+			candidate: factory.class,
+			base
+		}));
+		if (toolDirEntry) {
+			const [toolDirClass, toolDir] = toolDirEntry;
+			return new toolDirClass({
+				outputRoot: this.outputRoot,
+				relativeDirPath: relativeDirPath ?? toolDir,
+				relativeFilePath: fileName,
+				fileContent: toolDirClass === XumRule && !localRoot ? ensureXumSectionBoundary({
+					body,
+					heading: "Local instructions"
+				}) : body,
+				validate: true,
+				root: true,
+				localRoot
+			});
+		}
 		return null;
 	}
 	/**
@@ -106190,6 +109072,7 @@ async function generateSubagentsCore(params) {
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
+			deleteOrphans: config.getDelete(),
 			logger
 		});
 		const result = await processFeatureWithRulesyncFiles({
@@ -107064,6 +109947,12 @@ Object.defineProperty(exports, "PACKAGING_TOOL_TARGETS", {
 		return PACKAGING_TOOL_TARGETS;
 	}
 });
+Object.defineProperty(exports, "PathOutsideRootError", {
+	enumerable: true,
+	get: function() {
+		return PathOutsideRootError;
+	}
+});
 Object.defineProperty(exports, "QWENCODE_DIR", {
 	enumerable: true,
 	get: function() {
@@ -107364,6 +110253,12 @@ Object.defineProperty(exports, "assertDirectoryIfExists", {
 		return assertDirectoryIfExists;
 	}
 });
+Object.defineProperty(exports, "assertPathResolvesInsideRoot", {
+	enumerable: true,
+	get: function() {
+		return assertPathResolvesInsideRoot;
+	}
+});
 Object.defineProperty(exports, "assertTargetsFeaturesExclusive", {
 	enumerable: true,
 	get: function() {