rulesync 38.0.0 → 40.0.0

package/dist/{import-CoFTCNq7.js → import-Chn7Nqnm.js}

@@ -522,6 +522,7 @@ const rulesProcessorToolTargetTuple = [
 	"cursor",
 	"deepagents",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -551,6 +552,7 @@ const rulesProcessorToolTargetTuple = [
 	"trae",
 	"vibe",
 	"warp",
+	"xum",
 	"devin",
 	"devin-plugin",
 	"zcode",
@@ -560,6 +562,7 @@ const rulesProcessorToolTargetTuple = [
 ];
 const ignoreProcessorToolTargetTuple = [
 	"aiassistant",
+	"androidstudio",
 	"antigravity-cli",
 	"augmentcode",
 	"bob",
@@ -570,6 +573,7 @@ const ignoreProcessorToolTargetTuple = [
 	"continue",
 	"crush",
 	"cursor",
+	"firebender",
 	"grokcli",
 	"hermesagent",
 	"junie",
@@ -617,6 +621,7 @@ const mcpProcessorToolTargetTuple = [
 	"deepagents",
 	"dsh",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -646,6 +651,7 @@ const mcpProcessorToolTargetTuple = [
 	"vibe-plugin",
 	"warp",
 	"warpcli",
+	"xum",
 	"devin",
 	"devin-plugin",
 	"zcode",
@@ -672,6 +678,7 @@ const commandsProcessorToolTargetTuple = [
 	"copilot",
 	"cursor",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -727,6 +734,7 @@ const subagentsProcessorToolTargetTuple = [
 	"devin",
 	"devin-plugin",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"hermesagent",
@@ -751,6 +759,7 @@ const subagentsProcessorToolTargetTuple = [
 	"takt",
 	"vibe",
 	"vibe-plugin",
+	"xum",
 	"zcode",
 	"zcode-plugin"
 ];
@@ -758,6 +767,7 @@ const skillsProcessorToolTargetTuple = [
 	"agentsmd",
 	"agentsskills",
 	"aiassistant",
+	"androidstudio",
 	"amp",
 	"antigravity-cli",
 	"antigravity-ide",
@@ -781,6 +791,7 @@ const skillsProcessorToolTargetTuple = [
 	"cursor",
 	"deepagents",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"grokcli",
 	"gitlabduo",
@@ -810,6 +821,7 @@ const skillsProcessorToolTargetTuple = [
 	"vibe",
 	"vibe-plugin",
 	"warp",
+	"xum",
 	"devin",
 	"devin-plugin",
 	"zcode",
@@ -844,6 +856,7 @@ const hooksProcessorToolTargetTuple = [
 	"pi",
 	"pool",
 	"factorydroid",
+	"firebender",
 	"goose",
 	"hermesagent",
 	"kimi-code",
@@ -1035,6 +1048,57 @@ async function assertWritablePathInsideRoot(params) {
 		existingPath = parentPath;
 	}
 }
+/**
+* Thrown by {@link assertPathResolvesInsideRoot} when a symbolic link leads
+* the target outside the root, or the target is reached through a dangling
+* link. Any other error it throws comes from the filesystem itself.
+*/
+var PathOutsideRootError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PathOutsideRootError";
+	}
+};
+/**
+* Refuse a write or removal target whose real location is outside `rootPath`.
+*
+* Unlike {@link assertWritablePathInsideRoot}, a symbolic link on the way is
+* allowed as long as it resolves inside the root: projects deliberately link a
+* skill directory to a shared one next to it. What this stops is a link that
+* leads elsewhere — a cloned repository committing `.rulesync/skills/x ->
+* ~/.ssh`, say — which a textual check such as {@link checkPathTraversal}
+* cannot see. The deepest existing ancestor of `targetPath` is resolved, and
+* an existing target that is itself a link is resolved too.
+*/
+async function assertPathResolvesInsideRoot(params) {
+	const { rootPath, targetPath } = params;
+	let realRoot;
+	try {
+		realRoot = await realpath(rootPath);
+	} catch (error) {
+		if (isFileNotFoundError(error)) {
+			if (await isSymlink(rootPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${rootPath}.`, { cause: error });
+			return;
+		}
+		throw error;
+	}
+	let existingPath = resolve(targetPath);
+	while (true) {
+		let realExisting;
+		try {
+			realExisting = await realpath(existingPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+			if (await isSymlink(existingPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${targetPath}.`, { cause: error });
+			const parentPath = dirname(existingPath);
+			if (parentPath === existingPath) throw error;
+			existingPath = parentPath;
+			continue;
+		}
+		if (pathEscapesRoot(relative(realRoot, realExisting))) throw new PathOutsideRootError(`Path resolves outside ${rootPath} through a symbolic link: ${targetPath}.`);
+		return;
+	}
+}
 async function assertTreeContainsNoSymlinks(dirPath) {
 	for (const entry of await readdir(dirPath, { withFileTypes: true })) {
 		const entryPath = join(dirPath, entry.name);
@@ -3758,6 +3822,8 @@ const SHARED_USER_MANAGED_CONFIG_PATHS = [
 	".devin/config.json",
 	".dsh/cordis.patch.yml",
 	".factory/settings.json",
+	"firebender.json",
+	".firebender/firebender.json",
 	".grok/config.toml",
 	".grok/sandbox.toml",
 	".letta/settings.json",
@@ -4219,14 +4285,103 @@ function stringifyFrontmatter(body, frontmatter, options) {
 	} } });
 	return matter.stringify(file, cleanFrontmatter);
 }
+/**
+* Thrown in place of gray-matter's built-in JavaScript engine.
+*
+* gray-matter picks the parser from the text after the opening fence, so a
+* file that opens with `---js` or `---javascript` has its frontmatter handed
+* to `eval()`. Frontmatter here comes from third-party skills, fetched sources
+* and untrusted repositories, so that would run arbitrary code on the machine
+* of whoever generates or imports it. Every engine name that resolves to code
+* execution is mapped to this refusal; {@link assertYamlFrontmatterLanguage}
+* refuses those fences earlier still, so this is the second line of defense.
+*/
+function refuseExecutableFrontmatter() {
+	throw new Error("Frontmatter written in an executable language (JavaScript / CoffeeScript) is not supported; use YAML");
+}
+const REFUSED_FRONTMATTER_ENGINE = {
+	parse: refuseExecutableFrontmatter,
+	stringify: refuseExecutableFrontmatter
+};
+/**
+* Engines passed to every gray-matter parse. Supplying them merges over
+* gray-matter's defaults, so the JavaScript engine (and the CoffeeScript names
+* a plugin could register) can never be reached through an alias.
+*
+* `patches/gray-matter@4.0.3.patch` also deletes the JavaScript engine, but a
+* pnpm patch only applies inside this repository: gray-matter is an external
+* dependency of the published package, so an installed rulesync runs the
+* unpatched gray-matter, and this override plus the language check are what
+* protect it. Exported for the test that pins that.
+*/
+const FRONTMATTER_PARSE_OPTIONS = { engines: {
+	javascript: REFUSED_FRONTMATTER_ENGINE,
+	js: REFUSED_FRONTMATTER_ENGINE,
+	coffee: REFUSED_FRONTMATTER_ENGINE,
+	coffeescript: REFUSED_FRONTMATTER_ENGINE,
+	cson: REFUSED_FRONTMATTER_ENGINE
+} };
+/** Frontmatter languages accepted after the opening `---` fence. */
+const ALLOWED_FRONTMATTER_LANGUAGE_PATTERN = /^(?:ya?ml)?$/i;
+/**
+* Read the opening frontmatter fence the way gray-matter does, or return
+* `undefined` when gray-matter would see no frontmatter at all.
+*
+* gray-matter strips one byte order mark, treats `---` as a fence only when a
+* fourth `-` does not follow, and takes the language from the text between the
+* fence and the first `\r?\n`, trimmed — dropping the last character when
+* there is no line break at all. Every check below that has to agree with
+* gray-matter on where the block is (the language check, the size guard, the
+* repair pass) goes through this one reading, so none of them can be bypassed
+* by a fence line gray-matter accepts and a stricter pattern would not (a
+* stray `\r` before the line break, say).
+*/
+function readFrontmatterFence(content) {
+	const offset = content.startsWith("") ? 1 : 0;
+	const text = content.slice(offset);
+	if (!text.startsWith("---") || text.charAt(3) === "-") return;
+	const afterFence = text.slice(3);
+	const lineBreak = /\r?\n/.exec(afterFence);
+	const language = afterFence.slice(0, lineBreak ? lineBreak.index : -1).trim();
+	const lineBreakStart = lineBreak ? offset + 3 + lineBreak.index : void 0;
+	return {
+		language,
+		lineBreakStart,
+		lineEnd: lineBreak && lineBreakStart !== void 0 ? lineBreakStart + lineBreak[0].length : void 0
+	};
+}
+/**
+* Refuse a frontmatter fence that names any language other than YAML.
+*
+* Only YAML is ever written by rulesync or by the tools it targets, so anything
+* else — `---js` above all, whose block gray-matter would `eval()` — is
+* rejected before gray-matter sees the content.
+*/
+function assertYamlFrontmatterLanguage(content) {
+	const fence = readFrontmatterFence(content);
+	if (fence && !ALLOWED_FRONTMATTER_LANGUAGE_PATTERN.test(fence.language)) throw new Error(`Unsupported frontmatter language ${JSON.stringify(fence.language.slice(0, 40))}; only YAML frontmatter is supported`);
+}
+/**
+* The number of characters gray-matter would hand to the YAML parser as the
+* frontmatter block. Unlike {@link findFrontmatterBlockBounds}, a missing
+* closing fence does not make this zero: gray-matter then parses everything
+* after the fence line, so that is what the size guard has to measure.
+*/
+function measureFrontmatterBlockChars(content) {
+	const fence = readFrontmatterFence(content);
+	if (fence?.lineBreakStart === void 0) return 0;
+	const rest = content.slice(fence.lineBreakStart);
+	const closeIndex = rest.indexOf("\n---");
+	return closeIndex === -1 ? rest.length : closeIndex;
+}
 function parseFrontmatter(content, filePath) {
 	let frontmatter;
 	let body;
 	let hasFrontmatter;
 	try {
-		const bounds = findFrontmatterBlockBounds(content);
-		if (bounds && bounds.blockEnd - bounds.blockStart > 65536) throw new Error(`Frontmatter block is larger than ${MAX_FRONTMATTER_RAW_CHARS} characters; refusing to parse it (a complex YAML key can cost memory while parsing, before any post-parse budget applies)`);
-		const result = matter(content, {});
+		assertYamlFrontmatterLanguage(content);
+		if (measureFrontmatterBlockChars(content) > 65536) throw new Error(`Frontmatter block is larger than ${MAX_FRONTMATTER_RAW_CHARS} characters; refusing to parse it (a complex YAML key can cost memory while parsing, before any post-parse budget applies)`);
+		const result = matter(content, FRONTMATTER_PARSE_OPTIONS);
 		frontmatter = deepRemoveNullishObject(result.data);
 		body = result.content;
 		hasFrontmatter = result.matter !== "" || content.trimStart().startsWith("---");
@@ -4285,22 +4440,28 @@ function repairFrontmatterLine(line) {
 }
 /**
 * Locate a raw `---`-delimited frontmatter block's bounds within `content`,
-* without parsing it. Shared by the size guard in {@link parseFrontmatter} and
-* the YAML repair pass below, so both agree on exactly what gray-matter would
-* treat as the block: gray-matter ends it at the first `\n---`, with no
-* requirement that the delimiter be alone on its line, so a stricter pattern
-* here would run past gray-matter's delimiter and act on text that is really
-* the body.
+* without parsing it, for the YAML repair pass below and the rule loaders that
+* pre-process `globs:`. The opening fence is read exactly as gray-matter reads
+* it ({@link readFrontmatterFence}); an explicit `yaml` / `yml` language is
+* still YAML, any other language yields no bounds. gray-matter ends the block
+* at the first `\n---`, with no requirement that the delimiter be alone on its
+* line, so a stricter pattern here would run past gray-matter's delimiter and
+* act on text that is really the body. A block with no closing fence has no
+* bounds; the size guard measures that case separately.
 */
 function findFrontmatterBlockBounds(content) {
-	const opening = /^\uFEFF?---[^\S\r\n]*\r?\n/.exec(content);
-	if (!opening) return;
-	const blockStart = opening[0].length;
-	const closing = /\r?\n---/.exec(content.slice(blockStart));
+	const fence = readFrontmatterFence(content);
+	if (fence?.lineBreakStart === void 0 || fence.lineEnd === void 0 || !ALLOWED_FRONTMATTER_LANGUAGE_PATTERN.test(fence.language)) return;
+	const blockStart = fence.lineEnd;
+	const closing = /\r?\n---/.exec(content.slice(fence.lineBreakStart));
 	if (!closing) return;
+	if (closing.index === 0) return {
+		blockStart,
+		blockEnd: blockStart
+	};
 	return {
 		blockStart,
-		blockEnd: blockStart + closing.index
+		blockEnd: fence.lineBreakStart + closing.index
 	};
 }
 /**
@@ -4332,8 +4493,9 @@ function repairMalformedFrontmatterYaml(content) {
 * narrow — one pass, top-level entries only, and the original error is what
 * surfaces if it does not help, so a genuinely broken file still fails with the
 * message that describes what is actually wrong with it. A file with no closing
-* `---`, or one whose opening fence carries a language tag, is not repaired at
-* all: neither is a frontmatter block gray-matter would have read.
+* `---` is not repaired at all, and one whose opening fence names a language
+* other than YAML is refused outright (an explicit `---yaml` / `---yml` fence
+* is repaired like a plain one).
 *
 * @see https://agentskills.io/client-implementation/adding-skills-support
 */
@@ -4698,6 +4860,29 @@ const CURSOR_HOOK_EVENTS = [
 	"workspaceOpen"
 ];
 /**
+* Hook events supported by Firebender.
+*
+* Firebender's `hooks.json` follows Cursor's layout, and every event it fires
+* is spelled like its canonical counterpart, so no name mapping is needed.
+* @see https://docs.firebender.com/multi-agent/hooks
+*/
+const FIREBENDER_HOOK_EVENTS = [
+	"sessionStart",
+	"sessionEnd",
+	"subagentStart",
+	"subagentStop",
+	"preToolUse",
+	"postToolUse",
+	"beforeShellExecution",
+	"afterShellExecution",
+	"beforeMCPExecution",
+	"afterMCPExecution",
+	"beforeReadFile",
+	"afterFileEdit",
+	"preCompact",
+	"stop"
+];
+/**
 * Hook events supported by Claude Code.
 *
 * Covers the full documented event surface.
@@ -4978,6 +5163,40 @@ const COPILOT_HOOK_EVENTS = [
 	"userPromptExpansion"
 ];
 /**
+* The {@link COPILOT_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex. The hooks reference documents matcher filtering on
+* `preToolUse` / `postToolUse` / `permissionRequest` (tool name), `preCompact`
+* (trigger) and `subagentStart` (agent name), plus `notification`; the last
+* two are not authorable for `copilot`, so they are not listed here. VS Code's
+* migration guide confirms the Copilot harness "applies documented matcher
+* rules" (only the legacy Local harness ignores them).
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/migrate-customizations
+*/
+const COPILOT_MATCHER_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"preCompact",
+	"subagentStart"
+];
+/**
+* The {@link COPILOTCLI_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex: the shared {@link COPILOT_MATCHER_HOOK_EVENTS} plus the two
+* CLI-only events, `permissionRequest` (tool name) and `notification`
+* (notification type).
+*
+* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
+* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
+* `Edit|Write`) are now honored instead of silently dropped").
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+*/
+const COPILOTCLI_MATCHER_HOOK_EVENTS = [
+	...COPILOT_MATCHER_HOOK_EVENTS,
+	"permissionRequest",
+	"notification"
+];
+/**
 * Hook events supported by the GitHub Copilot CLI (`copilotcli-hooks.ts`).
 *
 * The CLI documents a wider event surface than the shared cloud-agent set, so
@@ -5131,12 +5350,15 @@ const KIRO_IDE_HOOK_EVENTS = [
 /**
 * Hook events supported by Google Antigravity (both the IDE and the CLI).
 *
-* Antigravity exposes a Claude-style hooks surface covering the five
-* tool/model/turn lifecycle events it documents: `PreToolUse`, `PostToolUse`,
-* `PreInvocation`, `PostInvocation`, and `Stop`. The model-invocation events
-* (`PreInvocation`/`PostInvocation`) and `Stop` are matcher-less handler lists.
+* Antigravity exposes a Claude-style hooks surface covering the six
+* session/tool/model/turn lifecycle events it documents: `SessionStart`,
+* `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop`.
+* `SessionStart`, the model-invocation events (`PreInvocation`/`PostInvocation`)
+* and `Stop` are matcher-less handler lists.
+* https://antigravity.google/docs/hooks
 */
 const ANTIGRAVITY_HOOK_EVENTS = [
+	"sessionStart",
 	"preToolUse",
 	"postToolUse",
 	"preModelInvocation",
@@ -5909,8 +6131,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 44 entries as
-* of v0.21.6 (tag `v0.21.6`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 46 entries as
+* of v0.22.3 (tag `v0.22.3`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -5934,15 +6156,16 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v0.21.6`: `VALID_HOOKS` holds 44 entries, grown
+* Verified against the tag `v0.22.3`: `VALID_HOOKS` holds 46 entries, grown
 * from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16` (v0.20.2) — v0.21
 * added `agent_loop_stopped` and `on_room_member_activity`, v0.21.5 added
-* `pre_auxiliary_call` and `post_auxiliary_call`, and v0.21.6 added
+* `pre_auxiliary_call` and `post_auxiliary_call`, v0.21.6 added
 * `post_gateway_admission`, `on_human_input_request` and
-* `on_human_input_resolved`. This list holds 43 of them — see
+* `on_human_input_resolved`, and v0.22.3 added `on_session_delete` and
+* `post_compaction`. This list holds 45 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -5966,6 +6189,7 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_session_end",
 	"on_session_finalize",
 	"on_session_reset",
+	"on_session_delete",
 	"on_skill_lifecycle",
 	"subagent_start",
 	"subagent_stop",
@@ -5987,7 +6211,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_kanban_task_updated",
 	"on_kanban_dispatch_tick",
 	"gateway_platform_event",
-	"pre_command"
+	"pre_command",
+	"post_compaction"
 ];
 /**
 * `VALID_HOOKS` entries a SHELL hook may not register for. `VALID_HOOKS` doubles
@@ -5999,8 +6224,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -6045,6 +6270,7 @@ const HooksConfigSchema = z.looseObject({
 	version: z.optional(z.number()),
 	hooks: canonicalHooksRecordSchema,
 	cursor: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
+	firebender: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	claudecode: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	copilot: z.optional(z.looseObject({ hooks: z.optional(hooksRecordSchema) })),
 	copilotcli: z.optional(z.looseObject({
@@ -6181,10 +6407,11 @@ const CANONICAL_TO_AUGMENTCODE_EVENT_NAMES = {
 const AUGMENTCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENTCODE_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
 * Map canonical camelCase event names to Antigravity PascalCase.
-* Antigravity uses the same PascalCase names as Claude for its tool/turn events,
+* Antigravity uses the same PascalCase names as Claude for its session/tool/turn events,
 * plus `PreInvocation`/`PostInvocation` for the model-invocation lifecycle.
 */
 const CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES = {
+	sessionStart: "SessionStart",
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
 	preModelInvocation: "PreInvocation",
@@ -7148,7 +7375,7 @@ const McpServerSchema = z.looseObject({
 	crushSessionless: z.optional(z.boolean()),
 	crushChannelEnabled: z.optional(z.boolean()),
 	crushChannelReply: z.optional(CrushChannelReplySchema),
-	zcodeOauth: z.optional(z.looseObject({ type: z.string() })),
+	zcodeOauth: z.optional(z.looseObject({})),
 	poolAllow: z.optional(z.array(z.string())),
 	headers: z.optional(z.record(z.string(), z.string())),
 	/**
@@ -7203,14 +7430,19 @@ const toolScopedMcpSchema = z.looseObject({ mcpServers: z.optional(z.record(z.st
 /**
 * Kimi Code's tool-scoped block also carries the `[mcp]` defaults from its
 * shared user config: connect and per-tool-call timeouts that apply to *every*
-* MCP server, including ones rulesync did not write. Per-server
-* `startupTimeoutMs` / `toolTimeoutMs` in `mcpServers` still win.
+* MCP server, including ones rulesync did not write, and (Kimi Code 2.3.0)
+* `defaultDeferred`, which loads every server's tools on demand unless the
+* server opts out. Per-server `startupTimeoutMs` / `toolTimeoutMs` / `deferred`
+* in `mcpServers` still win. `defaultDeferred` only takes effect when Kimi's
+* experimental `tool-select` flag is on, and is captured when a server connects
+* (MoonshotAI/kimi-code#4210).
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
 */
 const kimiCodeScopedMcpSchema = z.extend(toolScopedMcpSchema, {
 	startupTimeoutMs: z.optional(z.number()),
-	toolTimeoutMs: z.optional(z.number())
+	toolTimeoutMs: z.optional(z.number()),
+	defaultDeferred: z.optional(z.boolean())
 });
 /**
 * Qwen Code's tool-scoped block also carries the server-level allow/deny lists
@@ -7250,6 +7482,7 @@ const RulesyncMcpFileSchema = z.looseObject({
 	devin: z.optional(toolScopedMcpSchema),
 	dsh: z.optional(toolScopedMcpSchema),
 	factorydroid: z.optional(toolScopedMcpSchema),
+	firebender: z.optional(toolScopedMcpSchema),
 	gitlabduo: z.optional(toolScopedMcpSchema),
 	goose: z.optional(toolScopedMcpSchema),
 	grokcli: z.optional(toolScopedMcpSchema),
@@ -7274,6 +7507,7 @@ const RulesyncMcpFileSchema = z.looseObject({
 	vibe: z.optional(toolScopedMcpSchema),
 	warp: z.optional(toolScopedMcpSchema),
 	warpcli: z.optional(toolScopedMcpSchema),
+	xum: z.optional(toolScopedMcpSchema),
 	zed: z.optional(toolScopedMcpSchema)
 });
 /**
@@ -7977,13 +8211,16 @@ const CopilotPermissionsOverrideSchema = z.looseObject({
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
-* before prompting. `always-ask` auto-approves only read-only tools, `write`
-* also workspace writes, and `yolo` (oh-my-pi's default) every tier.
+* before prompting. `always-ask` auto-approves only read-only tools,
+* `always-ask-cached` (Ask and remember) also prompts before file reads and
+* lets a prompt remember the granted file or folder, `write` also
+* auto-approves workspace writes, and `yolo` (oh-my-pi's default) every tier.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
 */
 const OMP_APPROVAL_MODES = [
 	"always-ask",
+	"always-ask-cached",
 	"write",
 	"yolo"
 ];
@@ -8004,10 +8241,13 @@ const KimiCodePermissionsOverrideSchema = z.looseObject({
 	])),
 	/**
 	* Kimi's `[permission] dangerous_command_guard` switch (Kimi Code 0.40.0,
-	* default `true`). `false` turns off the built-in dangerous-command policy
-	* (no confirmation for `rm -rf`, `shutdown` and the like).
+	* default `true`). Since Kimi Code 2.3.0, `false` turns off every built-in
+	* guard confirmation policy: dangerous commands (`rm -rf`, `shutdown` and the
+	* like), sensitive-file access (`.env`, `id_rsa`, ...) and git control-path
+	* access. Before 2.3.0 it only covered dangerous commands.
 	*
 	* @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
+	* @see https://github.com/MoonshotAI/kimi-code/pull/4250
 	*/
 	dangerousCommandGuard: z.optional(z.boolean()),
 	rules: z.optional(z.array(z.looseObject({
@@ -8367,6 +8607,8 @@ const TabninePermissionsOverrideSchema = z.looseObject({
 * { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 * @example
 * { "mode": "deny" }
+* @example
+* { "tools": { "disabled": ["web_fetch"] }, "askOnExternalOrigin": true }
 */
 const ReasonixPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
@@ -8380,7 +8622,9 @@ const ReasonixPermissionsOverrideSchema = z.looseObject({
 		"ask",
 		"allow",
 		"deny"
-	]))
+	])),
+	askOnExternalOrigin: z.optional(z.boolean()),
+	tools: z.optional(z.strictObject({ disabled: z.optional(z.array(z.string())) }))
 });
 /**
 * Tool-scoped override block for Qoder. `outputStyle` is written to the
@@ -11194,6 +11438,15 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
 		metadata: z.optional(z.looseObject({}))
 	})),
+	xum: z.optional(z.looseObject({
+		"disable-model-invocation": z.optional(z.boolean()),
+		advertise: z.optional(z.boolean()),
+		"user-invocable": z.optional(z.boolean()),
+		"argument-hint": z.optional(z.string()),
+		when_to_use: z.optional(z.string()),
+		"when-to-use": z.optional(z.string()),
+		paths: z.optional(z.union([z.string(), z.array(z.string())]))
+	})),
 	zcode: z.optional(z.looseObject({
 		when_to_use: z.optional(z.string()),
 		license: z.optional(z.string()),
@@ -11472,7 +11725,7 @@ async function getLocalSkillDirNames(sourceTree) {
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, zed, pi, omp, qwencode, vibe, grokcli, factorydroid, dsh, reasonix,
-* commandcode, lettacode, opencode, mimocode). Each tool's own section may override that
+* commandcode, lettacode, opencode, mimocode, xum). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -11492,7 +11745,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh, reasonix, commandcode,
-* lettacode). Each tool's own section may override that default with a
+* lettacode, xum). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -13069,6 +13322,35 @@ const CRUSH_CONFIG_DECLARATION = {
 	}
 };
 /**
+* Firebender's `firebender.json`, shared by the project (`<project>/firebender.json`)
+* and personal (`~/.firebender/firebender.json`) spellings so a policy edit
+* lands on both. The file also carries `rules`, `commands`, `mcpEnvFile`,
+* `worktrees` and `useCursorRules` keys rulesync does not own, so every writer
+* refuses to read-modify-write a file it could not parse. Each feature owns
+* one whole top-level key: `ignore` (recomputed from `.rulesync/.aiignore`),
+* `mcpServers` (the complete server map) and `agents` (recomputed from the
+* existing list, with the entries for rulesync's own agent directory replaced).
+* https://docs.firebender.com/api-reference/syntax
+*/
+const FIREBENDER_CONFIG_DECLARATION = {
+	format: "json",
+	invalidRootPolicy: "error",
+	features: {
+		ignore: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["ignore"]
+		},
+		subagents: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["agents"]
+		},
+		mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["mcpServers"]
+		}
+	}
+};
+/**
 * What the two Claude Code settings files have in common: both are plain JSON,
 * and both validate against the one published schema, which the gateway
 * points every file it writes at. `.claude/settings.local.json` is the same
@@ -13308,6 +13590,15 @@ const SHARED_CONFIG_OWNERSHIP = {
 			ownedKeys: ["servers"]
 		} }
 	},
+	".xum/mcp.jsonc": {
+		format: "jsonc",
+		invalidRootPolicy: "error",
+		jsoncParseErrors: "error",
+		features: { mcp: {
+			kind: "replace-owned-keys",
+			ownedKeys: ["servers"]
+		} }
+	},
 	".qwen/settings.json": {
 		format: "json",
 		features: {
@@ -13395,6 +13686,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 	".zcode/cli/config.json": ZCODE_CONFIG_DECLARATION,
 	"crush.json": CRUSH_CONFIG_DECLARATION,
 	".config/crush/crush.json": CRUSH_CONFIG_DECLARATION,
+	"firebender.json": FIREBENDER_CONFIG_DECLARATION,
+	".firebender/firebender.json": FIREBENDER_CONFIG_DECLARATION,
 	".bob/settings.json": {
 		format: "json",
 		invalidRootPolicy: "error",
@@ -13767,7 +14060,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -13788,7 +14082,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -20229,6 +20524,178 @@ var FactorydroidCommand = class FactorydroidCommand extends ToolCommand {
 	}
 };
 //#endregion
+//#region src/constants/firebender-paths.ts
+/**
+* Firebender (the coding agent plugin for Android Studio and other JetBrains
+* IDEs) keeps project configuration under `.firebender/` plus a project-root
+* `firebender.json`, and user configuration under `~/.firebender/` (including
+* `~/.firebender/firebender.json`).
+*
+* @see https://docs.firebender.com/api-reference/syntax
+* @see https://docs.firebender.com/api-reference/rules
+* @see https://docs.firebender.com/api-reference/commands
+* @see https://docs.firebender.com/api-reference/agents
+* @see https://docs.firebender.com/api-reference/skills
+* @see https://docs.firebender.com/api-reference/agents-md
+* @see https://docs.firebender.com/multi-agent/hooks
+*/
+const FIREBENDER_DIR = ".firebender";
+/**
+* `firebender.json`: at the project root for project scope, and under
+* `~/.firebender/` for the personal config. It is shared by the ignore
+* (`ignore`), MCP (`mcpServers`) and subagents (`agents`) features.
+*/
+const FIREBENDER_CONFIG_FILE_NAME = "firebender.json";
+/** `.firebender/AGENTS.md`, the first file Firebender looks for in both scopes. */
+const FIREBENDER_AGENTS_MD_FILE_NAME = "AGENTS.md";
+join(FIREBENDER_DIR, "rules");
+/** Commands: `.firebender/commands/*.mdc` (project) and `~/.firebender/commands/*.mdc` (global). */
+const FIREBENDER_COMMANDS_DIR_PATH = join(FIREBENDER_DIR, "commands");
+/** Agents: Markdown files registered through the `agents` array of `firebender.json`. */
+const FIREBENDER_AGENTS_DIR_NAME = "agents";
+const FIREBENDER_AGENTS_DIR_PATH = join(FIREBENDER_DIR, FIREBENDER_AGENTS_DIR_NAME);
+/** Skills: `.firebender/skills/<name>/SKILL.md` (project) and `~/.firebender/skills/` (global). */
+const FIREBENDER_SKILLS_DIR_PATH = join(FIREBENDER_DIR, "skills");
+/** Hooks: `.firebender/hooks.json` (project) and `~/.firebender/hooks.json` (global). */
+const FIREBENDER_HOOKS_FILE_NAME = "hooks.json";
+/**
+* The directory holding `firebender.json` for a scope: the project root, or
+* `~/.firebender/` for the personal config.
+*/
+function getFirebenderConfigDir({ global }) {
+	return global ? FIREBENDER_DIR : ".";
+}
+//#endregion
+//#region src/features/commands/firebender-command.ts
+/**
+* Frontmatter of a Firebender command. Every field is optional: `name`
+* defaults to the file name, `model` is `default`, `quick` or a model ID, and
+* `mode` is one of `auto`, `read`, `write` or `composer`. Unknown keys are
+* preserved.
+*
+* @see https://docs.firebender.com/api-reference/commands
+*/
+const FirebenderCommandFrontmatterSchema = z.looseObject({
+	name: z.optional(z.string()),
+	description: z.optional(z.string()),
+	model: z.optional(z.string()),
+	mode: z.optional(z.string())
+});
+const FIREBENDER_COMMAND_EXTENSION = ".mdc";
+/**
+* Command generator for Firebender: one `.mdc` file per command under
+* `.firebender/commands/` (project) and `~/.firebender/commands/` (global),
+* with optional `name` / `description` / `model` / `mode` frontmatter. The
+* canonical `description` is written as is; `name`, `model` and `mode` come
+* from the `firebender:` section of the rulesync command.
+*
+* @see https://docs.firebender.com/api-reference/commands
+*/
+var FirebenderCommand = class FirebenderCommand extends ToolCommand {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate) {
+			const result = FirebenderCommandFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({
+			...rest,
+			fileContent: stringifyFrontmatter(body, frontmatter, { avoidBlockScalars: true })
+		});
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: FIREBENDER_COMMANDS_DIR_PATH };
+	}
+	getBody() {
+		return this.body;
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	toRulesyncCommand() {
+		const { description, ...restFields } = this.frontmatter;
+		const rulesyncFrontmatter = {
+			targets: ["*"],
+			description,
+			...Object.keys(restFields).length > 0 && { firebender: restFields }
+		};
+		return new RulesyncCommand({
+			outputRoot: ".",
+			frontmatter: rulesyncFrontmatter,
+			body: this.body,
+			relativeDirPath: RulesyncCommand.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.relativeFilePath.replace(/\.mdc$/, ".md"),
+			fileContent: stringifyFrontmatter(this.body, rulesyncFrontmatter),
+			validate: true
+		});
+	}
+	static fromRulesyncCommand({ outputRoot = process.cwd(), rulesyncCommand, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncCommand.getFrontmatter();
+		const firebenderFields = rulesyncFrontmatter.firebender ?? {};
+		const frontmatter = {
+			...rulesyncFrontmatter.description && { description: rulesyncFrontmatter.description },
+			...firebenderFields
+		};
+		return new FirebenderCommand({
+			outputRoot,
+			frontmatter,
+			body: rulesyncCommand.getBody(),
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: rulesyncCommand.getRelativeFilePath().replace(/\.md$/, FIREBENDER_COMMAND_EXTENSION),
+			validate
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = FirebenderCommandFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncCommand(rulesyncCommand) {
+		return this.isTargetedByRulesyncCommandDefault({
+			rulesyncCommand,
+			toolTarget: "firebender"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const { frontmatter, body } = parseFrontmatter(await readFileContent(filePath), filePath);
+		const result = FirebenderCommandFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new FirebenderCommand({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new FirebenderCommand({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/commands/gitlabduo-command.ts
 /**
 * GitLab Duo CLI custom slash commands are Markdown files named after the
@@ -20821,6 +21288,60 @@ var GrokcliCommand = class GrokcliCommand extends ToolCommand {
 	}
 };
 //#endregion
+//#region src/features/shared/hermes-plugin-commands.ts
+/**
+* Normalize a name into a Hermes Agent plugin slash command name.
+*
+* `ctx.register_command()` lowercases the name, and Hermes' messaging gateway
+* looks plugin commands up with every `_` turned into `-`
+* (`gateway/run_inbound_hooks.py`), so only a lowercase, hyphenated name is
+* reachable from every surface.
+*/
+function hermesSlashName(value) {
+	return value.toLowerCase().replace(/[ _]/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-|-$/g, "");
+}
+/**
+* Python helpers shared by the generated Hermes command plugins.
+*
+* A plugin slash command runs outside any agent turn, so it cannot call
+* `delegate_task` (which requires a parent agent). Instead the handler queues
+* its prompt as a user message with `ctx.inject_message()`, passing the calling
+* session's key: a `session_key` handler keyword on newer Hermes, or
+* `HERMES_SESSION_KEY` from the session context the gateway binds around the
+* handler on older releases.
+*/
+function getHermesQueueUserMessagePython({ pluginName }) {
+	return `def _session_key(kwargs):
+    session_key = kwargs.get("session_key")
+    if session_key:
+        return session_key
+    try:
+        from gateway.session_context import get_session_env
+    except Exception:
+        return None
+    return get_session_env("HERMES_SESSION_KEY") or None
+
+
+def _queue_user_message(ctx, message, kwargs, label):
+    """Queue *message* as the session's next user turn; return an error reply, or None."""
+    session_key = _session_key(kwargs)
+    try:
+        if session_key:
+            queued = ctx.inject_message(message, role="user", session_key=session_key)
+        else:
+            queued = ctx.inject_message(message, role="user")
+    except Exception as error:
+        return f"Could not queue {label}: {error}"
+    if not queued:
+        return (
+            f"Hermes refused to queue {label}: there is no active session, or this plugin "
+            "may not inject messages. In gateway sessions, set "
+            "plugins.entries.${pluginName}.allow_gateway_injection: true in config.yaml."
+        )
+    return None
+`;
+}
+//#endregion
 //#region src/features/skills/agentsskills-skill.ts
 const AgentsSkillsSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -21303,9 +21824,6 @@ const HermesCommandSpecSchema = z.object({
 	description: z.string(),
 	prompt: z.string()
 });
-function hermesSlashName(value) {
-	return value.toLowerCase().replace(/[ _]/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-{2,}/g, "-").replace(/^-|-$/g, "");
-}
 function getPluginManifestContent$2() {
 	return [
 		"name: rulesync-commands",
@@ -21339,6 +21857,8 @@ def _load_commands():
     return commands
 
 
+${getHermesQueueUserMessagePython({ pluginName: "rulesync-commands" })}
+
 def _register_command(ctx, command):
     slug = command.get("slug")
     if not slug:
@@ -21348,31 +21868,22 @@ def _register_command(ctx, command):
     prompt = command.get("prompt") or ""
 
     def handler(args=None, **kwargs):
-        del kwargs
         raw_args = ""
         if isinstance(args, dict):
             raw_args = args.get("args") or args.get("context") or args.get("prompt") or ""
         elif args is not None:
             raw_args = str(args)
 
-        context_parts = [prompt] if prompt else []
+        parts = [prompt] if prompt else []
         if raw_args:
-            context_parts.append(f"User arguments:\\n{raw_args}")
+            parts.append(f"User arguments:\\n{raw_args}")
 
-        # delegate_task takes no model-facing "toolsets" argument: the child
-        # inherits the parent's enabled toolsets. "tasks" is the only shape its
-        # schema advertises; a top-level "goal" is an unadvertised legacy path.
-        return ctx.dispatch_tool(
-            "delegate_task",
-            {
-                "tasks": [
-                    {
-                        "goal": description,
-                        "context": "\\n\\n".join(context_parts),
-                    },
-                ],
-            },
-        )
+        # A slash command runs outside any agent turn, so calling delegate_task
+        # here fails with "delegate_task requires a parent agent context".
+        # Queue the command prompt as the session's next user message instead.
+        label = f"the /{slug} command"
+        error = _queue_user_message(ctx, "\\n\\n".join(parts) or description, kwargs, label)
+        return error or f"Queued {label}."
 
     ctx.register_command(slug, handler, description)
 
@@ -23697,6 +24208,7 @@ var QwencodeCommand = class QwencodeCommand extends ToolCommand {
 const REASONIX_PROJECT_MCP_FILE_NAME = "reasonix.toml";
 const REASONIX_GLOBAL_DIR = ".reasonix";
 const REASONIX_GLOBAL_MCP_FILE_NAME = "config.toml";
+const REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH = join(".reasonix", REASONIX_PROJECT_MCP_FILE_NAME);
 const REASONIX_PROJECT_PERMISSIONS_FILE_NAME = REASONIX_PROJECT_MCP_FILE_NAME;
 const REASONIX_GLOBAL_PERMISSIONS_FILE_NAME = REASONIX_GLOBAL_MCP_FILE_NAME;
 const REASONIX_DIR = REASONIX_GLOBAL_DIR;
@@ -25244,6 +25756,16 @@ const toolCommandFactories = /* @__PURE__ */ new Map([
 			supportsSubdirectory: false
 		}
 	}],
+	["firebender", {
+		class: FirebenderCommand,
+		meta: {
+			extension: "mdc",
+			supportsProject: true,
+			supportsGlobal: true,
+			isSimulated: false,
+			supportsSubdirectory: false
+		}
+	}],
 	["goose", {
 		class: GooseCommand,
 		meta: {
@@ -28034,25 +28556,65 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 //#endregion
 //#region src/features/hooks/antigravity-hooks.ts
 /**
-* Antigravity uses a Claude-Code-like `hooks.json` (matcher shape). The
-* `PreToolUse`/`PostToolUse` events use the matcher-based array shape, while
-* `PreInvocation`/`PostInvocation`/`Stop` are matcher-less handler lists.
-* `projectDirVar` is empty because Antigravity does not document a
-* project-directory variable for commands.
+* Canonical events whose Antigravity counterparts (`SessionStart`,
+* `PreInvocation`, `PostInvocation`, `Stop`) take no matcher.
+*/
+const ANTIGRAVITY_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"sessionStart",
+	"preModelInvocation",
+	"postModelInvocation",
+	"stop"
+]);
+/**
+* Antigravity event names whose value is a flat list of handlers
+* (`"Stop": [ { "type": "command", "command": "..." } ]`) rather than a list
+* of `{ "matcher", "hooks": [...] }` groups. Antigravity's loader rejects a
+* wrapped group under these events ("command hook must specify 'command'")
+* and then skips the whole `hooks.json`.
+* https://antigravity.google/docs/hooks
+*/
+const ANTIGRAVITY_FLAT_HANDLER_EVENTS = new Set([...ANTIGRAVITY_NO_MATCHER_EVENTS].map((event) => lookupOwn({
+	record: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
+	key: event
+}) ?? event));
+/**
+* Antigravity uses a Claude-Code-like `hooks.json`. The `PreToolUse` /
+* `PostToolUse` events use the matcher-based group shape, while `SessionStart`,
+* `PreInvocation`, `PostInvocation` and `Stop` are flat handler lists (see
+* {@link toAntigravityEventMap}). `projectDirVar` is empty because Antigravity
+* does not document a project-directory variable for commands.
 */
 const ANTIGRAVITY_CONVERTER_CONFIG = {
 	supportedEvents: ANTIGRAVITY_HOOK_EVENTS,
 	canonicalToToolEventNames: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
 	toolToCanonicalEventNames: ANTIGRAVITY_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"preModelInvocation",
-		"postModelInvocation",
-		"stop"
-	]),
+	noMatcherEvents: ANTIGRAVITY_NO_MATCHER_EVENTS,
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
 };
 /**
+* Turn the shared converter's matcher-group output into Antigravity's shape:
+* the matcher-less events get their handlers directly under the event key.
+*/
+function toAntigravityEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event)) return [event, entries];
+		return [event, entries.flatMap((entry) => isPlainObject$1(entry) && Array.isArray(entry.hooks) ? entry.hooks : [])];
+	}));
+}
+/**
+* Reverse of {@link toAntigravityEventMap} for import: wrap each flat handler
+* of a matcher-less event in a `{ hooks: [...] }` group so the shared converter
+* can read it. An entry that is already a group (`{ hooks: [...] }`, as older
+* rulesync versions wrote) is kept as is.
+*/
+function toMatcherGroupEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event) || !Array.isArray(entries)) return [event, entries];
+		return [event, entries.map((entry) => isPlainObject$1(entry) && !("hooks" in entry) ? { hooks: [entry] } : entry)];
+	}));
+}
+/**
 * Antigravity's `hooks.json` is keyed by a named hook whose value holds the
 * per-event map (plus an optional `enabled` flag). rulesync writes a single
 * generated hook under this stable name.
@@ -28089,8 +28651,8 @@ function flattenAntigravityHooks(parsed) {
 * Hooks generator for Google Antigravity (both the IDE and the CLI).
 *
 * Antigravity writes a dedicated `hooks.json` keyed by a named hook whose
-* value holds the Claude-Code-style event → matcher-entry map
-* (`{ "<name>": { "<Event>": [...] } }`). Project and global modes share the
+* value holds the event map (`{ "<name>": { "<Event>": [...] } }`): matcher
+* groups for the tool events, flat handler lists for the others. Project and global modes share the
 * same shape; only the location differs (`.agents/hooks.json` vs
 * `~/.gemini/config/hooks.json`).
 *
@@ -28134,12 +28696,12 @@ var AntigravityHooks = class extends ToolHooks {
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
-		const eventMap = canonicalToToolHooks({
+		const eventMap = toAntigravityEventMap(canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config[this.getOverrideKey()]?.hooks,
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
-		});
+		}));
 		const antigravityHooks = Object.keys(eventMap).length > 0 ? { [ANTIGRAVITY_HOOK_NAME]: eventMap } : {};
 		const fileContent = JSON.stringify(antigravityHooks, null, 2);
 		return new this({
@@ -28158,7 +28720,7 @@ var AntigravityHooks = class extends ToolHooks {
 			throw new Error(`Failed to parse Antigravity hooks content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: flattenAntigravityHooks(parsed),
+			hooks: toMatcherGroupEventMap(flattenAntigravityHooks(parsed)),
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
 		});
@@ -30622,11 +31184,17 @@ var ContinueHooks = class extends SettingsJsonHooks {
 * entry that uses them instead of a shell field is not mistaken for one
 * without a command.
 *
+* An optional `matcher` regex is honored on the events in
+* {@link COPILOT_MATCHER_HOOK_EVENTS}. The VS Code per-OS override fields come
+* from the legacy Local hooks reference and are kept for existing files.
+*
 * @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/hooks
 * @see https://code.visualstudio.com/docs/agents/reference/hooks-reference
 */
 const CopilotHookEntrySchema = z.looseObject({
 	type: z.string(),
+	matcher: z.optional(z.string()),
 	bash: z.optional(z.string()),
 	powershell: z.optional(z.string()),
 	command: z.optional(z.string()),
@@ -30660,8 +31228,10 @@ function canonicalToCopilotHooks(config) {
 		...sharedConfigHooks,
 		...config.copilot?.hooks
 	};
+	const matcherEvents = new Set(COPILOT_MATCHER_HOOK_EVENTS);
 	const copilot = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
+		const matcherSupported = matcherEvents.has(eventName);
 		const copilotEventName = lookupOwn({
 			record: CANONICAL_TO_COPILOT_EVENT_NAMES,
 			key: eventName
@@ -30669,7 +31239,7 @@ function canonicalToCopilotHooks(config) {
 		const entries = [];
 		for (const def of definitions) {
 			const hookType = def.type ?? "command";
-			if (def.matcher) continue;
+			if (def.matcher && !matcherSupported) continue;
 			if (hookType !== "command") continue;
 			const command = def.command;
 			const timeout = def.timeout;
@@ -30677,6 +31247,7 @@ function canonicalToCopilotHooks(config) {
 			const rest = Object.fromEntries(Object.entries(def).filter(([k]) => !canonicalSchemaKeys.includes(k)));
 			entries.push({
 				type: hookType,
+				...def.matcher && { matcher: def.matcher },
 				...command !== void 0 && command !== null && { [commandField]: command },
 				...def.env !== void 0 && { env: def.env },
 				...timeout !== void 0 && timeout !== null && { timeoutSec: timeout },
@@ -30771,6 +31342,7 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			if (command === void 0 && hasOsOverride(passthrough)) logger?.warn(`Copilot hook on '${copilotEventName}' has only VS Code per-OS overrides (windows/linux/osx) and no portable command; it is preserved for copilot, but other targets will generate it without a command until a \`command\` is added.`);
 			defs.push({
 				type: "command",
+				...entry.matcher !== void 0 && entry.matcher !== "" && { matcher: entry.matcher },
 				...command !== void 0 && { command },
 				...shell !== void 0 && { shell },
 				...timeout !== void 0 && { timeout },
@@ -30914,21 +31486,13 @@ var CopilotHooks = class CopilotHooks extends ToolHooks {
 */
 /**
 * Canonical events whose Copilot CLI hook entries honor an optional `matcher`
-* field (a regex compiled as `^(?:PATTERN)$`, tested against `toolName`).
-*
-* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
-* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
-* `Edit|Write`) are now honored instead of silently dropped").
-* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* field (a regex compiled as `^(?:PATTERN)$`). The hooks reference filters each
+* on a different field: the tool name for `preToolUse` / `postToolUse` /
+* `permissionRequest`, `notification_type`, the `preCompact` trigger
+* (`manual` | `auto`) and the `subagentStart` agent name.
+* See {@link COPILOTCLI_MATCHER_HOOK_EVENTS}.
 */
-const COPILOTCLI_MATCHER_EVENTS = /* @__PURE__ */ new Set([
-	"preToolUse",
-	"postToolUse",
-	"notification",
-	"permissionRequest",
-	"preCompact",
-	"subagentStart"
-]);
+const COPILOTCLI_MATCHER_EVENTS = new Set(COPILOTCLI_MATCHER_HOOK_EVENTS);
 /** Human-readable list of the matcher-aware events, for the drop warning. */
 const COPILOTCLI_MATCHER_EVENTS_LABEL = [...COPILOTCLI_MATCHER_EVENTS].join("/");
 const CopilotCliHookEntrySchema = z.looseObject({
@@ -32527,6 +33091,116 @@ var FactorydroidHooks = class FactorydroidHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/features/hooks/firebender-hooks.ts
+/**
+* Hooks generator for Firebender.
+*
+* Firebender reads `.firebender/hooks.json` (project) and
+* `~/.firebender/hooks.json` (global). The file follows Cursor's layout — a
+* `version` plus a `hooks` map from camelCase event names to lists of
+* `{ command, timeout?, loop_limit?, matcher? }` entries — and every event is
+* spelled like its canonical counterpart. The per-hook `type` accepts
+* `"command" | "prompt"`, but the docs never say what a prompt hook does, so
+* only command hooks are generated (the HooksProcessor warns about the rest).
+*
+* @see https://docs.firebender.com/multi-agent/hooks
+*/
+var FirebenderHooks = class FirebenderHooks extends ToolHooks {
+	constructor(params) {
+		super({
+			...params,
+			fileContent: params.fileContent ?? "{}"
+		});
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: FIREBENDER_DIR,
+			relativeFilePath: FIREBENDER_HOOKS_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = FirebenderHooks.getSettablePaths({ global });
+		const fileContent = await readFileContent(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		return new FirebenderHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, preserveUnowned = false, logger }) {
+		const config = rulesyncHooks.getJson();
+		const supportedEvents = new Set(FIREBENDER_HOOK_EVENTS);
+		const sharedHooks = {};
+		for (const [event, defs] of Object.entries(config.hooks)) if (supportedEvents.has(event)) sharedHooks[event] = defs;
+		const mergedHooks = {
+			...sharedHooks,
+			...config.firebender?.hooks
+		};
+		const firebenderHooks = {};
+		for (const [eventName, defs] of Object.entries(mergedHooks)) {
+			const mappedDefs = defs.filter((def) => (def.type ?? "command") === "command").filter((def) => typeof def.command === "string" && def.command.length > 0).map((def) => ({
+				command: def.command,
+				...def.timeout !== void 0 && def.timeout !== null && { timeout: def.timeout },
+				...def.loop_limit !== void 0 && { loop_limit: def.loop_limit },
+				...def.matcher !== void 0 && def.matcher !== null && { matcher: def.matcher }
+			}));
+			if (mappedDefs.length > 0) firebenderHooks[eventName] = mappedDefs;
+		}
+		const paths = FirebenderHooks.getSettablePaths({ global });
+		const merged = mergeGeneratedHookLists({
+			existingContent: await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "",
+			generatedHooks: firebenderHooks,
+			shape: "flat",
+			preserveUnowned,
+			previouslyOwned: preserveUnowned ? parseHooksOwnershipLock(await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, HOOKS_OWNERSHIP_LOCK_FILE_NAME))) : void 0,
+			logger
+		});
+		const fileContent = JSON.stringify({
+			version: config.version ?? 1,
+			hooks: merged.hooks
+		}, null, 2);
+		return new FirebenderHooks({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			ownedHookRefs: preserveUnowned ? merged.owned : void 0,
+			validate
+		});
+	}
+	static supportsPreserveUnowned() {
+		return true;
+	}
+	static async getAuxiliaryFiles({ toolHooks } = {}) {
+		return toolHooks instanceof FirebenderHooks ? toolHooks.getOwnershipLockFiles() : [];
+	}
+	toRulesyncHooks() {
+		const parsed = JSON.parse(this.getFileContent());
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+			hooks: parsed.hooks ?? {},
+			overrideKey: "firebender",
+			version: parsed.version ?? 1
+		}), null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new FirebenderHooks({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/hooks/gitlabduo-hooks.ts
 const GITLABDUO_CONVERTER_CONFIG = {
 	supportedEvents: GITLABDUO_HOOK_EVENTS,
@@ -32954,7 +33628,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.6; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.22.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -36937,6 +37611,17 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		supportedHookTypes: ["command", "prompt"],
 		supportsMatcher: true
 	}],
+	["firebender", {
+		class: FirebenderHooks,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsImport: true
+		},
+		supportedEvents: FIREBENDER_HOOK_EVENTS,
+		supportedHookTypes: ["command"],
+		supportsMatcher: true
+	}],
 	["claudecode", {
 		class: ClaudecodeHooks,
 		meta: {
@@ -37033,7 +37718,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: COPILOT_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: true,
+		matcherEvents: COPILOT_MATCHER_HOOK_EVENTS
 	}],
 	["copilotcli", {
 		class: CopilotcliHooks,
@@ -37048,7 +37734,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			"prompt",
 			"http"
 		],
-		supportsMatcher: false
+		supportsMatcher: true
 	}],
 	["kilo", {
 		class: KiloHooks,
@@ -37808,6 +38494,67 @@ var AiassistantIgnore = class AiassistantIgnore extends ToolIgnore {
 	}
 };
 //#endregion
+//#region src/constants/androidstudio-paths.ts
+/**
+* Gemini in Android Studio configuration-layout conventions.
+*
+* Only the Android Studio-specific files are owned by the `androidstudio`
+* target. The shared `AGENTS.md` and `.agents/skills/` surfaces Gemini also
+* reads belong to the `agentsmd` and `agentsskills` targets.
+*/
+const ANDROIDSTUDIO_IGNORE_FILE_NAME = ".aiexclude";
+const ANDROIDSTUDIO_SKILLS_DIR_PATH = join(".android-studio", "skills");
+//#endregion
+//#region src/features/ignore/androidstudio-ignore.ts
+/**
+* Ignore generator for Gemini in Android Studio.
+*
+* Gemini reads `.aiexclude` files (gitignore syntax) anywhere in the project;
+* each one applies to the files at or below its directory and blocks both the
+* chat and the editor AI features such as code completion. Rulesync writes the
+* project-root file only. There is no user-level variant.
+*
+* @see https://developer.android.com/studio/gemini/aiexclude
+*/
+var AndroidstudioIgnore = class AndroidstudioIgnore extends ToolIgnore {
+	static getSettablePaths() {
+		return {
+			relativeDirPath: ".",
+			relativeFilePath: ANDROIDSTUDIO_IGNORE_FILE_NAME
+		};
+	}
+	toRulesyncIgnore() {
+		return this.toRulesyncIgnoreDefault();
+	}
+	static fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore }) {
+		return new AndroidstudioIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent: rulesyncIgnore.getFileContent()
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true }) {
+		const fileContent = await readFileContent(join(outputRoot, this.getSettablePaths().relativeDirPath, this.getSettablePaths().relativeFilePath));
+		return new AndroidstudioIgnore({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths().relativeDirPath,
+			relativeFilePath: this.getSettablePaths().relativeFilePath,
+			fileContent,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new AndroidstudioIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/ignore/antigravity-cli-ignore.ts
 /**
 * Antigravity CLI is the successor to Gemini CLI and is built on the same
@@ -38469,6 +39216,95 @@ var DevinIgnore = class DevinIgnore extends ToolIgnore {
 	}
 };
 //#endregion
+//#region src/features/ignore/firebender-ignore.ts
+function readIgnorePatterns(fileContent) {
+	const ignore = parseSharedConfig({
+		format: "json",
+		fileContent
+	}).ignore;
+	if (!Array.isArray(ignore)) return [];
+	return ignore.filter((pattern) => typeof pattern === "string");
+}
+/**
+* Ignore generator for Firebender.
+*
+* Firebender reads gitignore-style patterns from the `ignore` array of
+* `firebender.json` (project root) and `~/.firebender/firebender.json`
+* (personal); the two lists are appended together. The file is shared with the
+* MCP (`mcpServers`) and subagents (`agents`) features and carries settings
+* rulesync does not own, so only the `ignore` key is written and the file is
+* never deleted.
+*
+* @see https://docs.firebender.com/api-reference/syntax
+*/
+var FirebenderIgnore = class FirebenderIgnore extends ToolIgnore {
+	constructor(params) {
+		super(params);
+		this.patterns = readIgnorePatterns(this.fileContent || "{}");
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME
+		};
+	}
+	/** `firebender.json` is a user-managed config file, so rulesync never deletes it. */
+	isDeletable() {
+		return false;
+	}
+	toRulesyncIgnore() {
+		return new RulesyncIgnore({
+			outputRoot: ".",
+			relativeDirPath: RulesyncIgnore.getSettablePaths().recommended.relativeDirPath,
+			relativeFilePath: RulesyncIgnore.getSettablePaths().recommended.relativeFilePath,
+			fileContent: this.patterns.filter((pattern) => pattern.length > 0).join("\n")
+		});
+	}
+	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+		const patterns = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const managedPatterns = [...new Set(patterns)];
+		return new FirebenderIgnore({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "ignore",
+				existingContent,
+				patch: { ignore: managedPatterns.length > 0 ? managedPatterns : void 0 },
+				filePath
+			}),
+			validate: true,
+			global
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContent(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath));
+		return new FirebenderIgnore({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new FirebenderIgnore({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/ignore/grokcli-ignore.ts
 /** The base built-in profile the rulesync profile extends (Grok's own default). */
 const GROKCLI_SANDBOX_BASE_PROFILE = "workspace";
@@ -39288,6 +40124,31 @@ const REASONIX_READ_TOOL_NAME = "read_file";
 * treated as rulesync-owned on generate so the dormant copy is replaced.
 */
 const REASONIX_LEGACY_READ_TOOL_NAME = "Read";
+async function isPathPresent(path) {
+	return await fileExists(path) || await isPresentButUnresolvable(path);
+}
+/**
+* Warns when a project-scope generate is about to create `./reasonix.toml`
+* next to an existing `.reasonix/reasonix.toml`.
+*
+* Since v2.46.0 Reasonix reads `.reasonix/reasonix.toml` as the project config
+* when `./reasonix.toml` is absent, and never merges the two: once the root
+* file exists it wins, so every setting in the nested file (permissions,
+* sandbox, disabled tools, MCP servers, ...) silently stops applying. rulesync
+* writes only the root file, so it cannot keep the nested one in effect; this
+* at least names the problem, once per run however many of the features that
+* write the file (mcp, permissions, ignore) are generated. Like Reasonix, anything at the root path
+* (including a broken symlink) counts as the root file being there.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/internal/contract/config/paths.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/CONFIG_PATHS.md
+*/
+async function warnIfReasonixNestedProjectConfigShadowed({ outputRoot, global, logger }) {
+	if (global) return;
+	if (await isPathPresent(join(outputRoot, "reasonix.toml"))) return;
+	if (!await isPathPresent(join(outputRoot, REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH))) return;
+	const nested = toPosixPath(REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH);
+	warnOnceWithFallback(logger, `Reasonix: ${nested} exists but ${REASONIX_PROJECT_MCP_FILE_NAME} does not. Generating creates ${REASONIX_PROJECT_MCP_FILE_NAME}, and Reasonix then reads it instead of ${nested} (the two are never merged), so every setting in ${nested} stops applying. Move those settings into ${REASONIX_PROJECT_MCP_FILE_NAME} or the rulesync sources.`);
+}
 //#endregion
 //#region src/features/ignore/reasonix-ignore.ts
 const permissionsTableOf = (document) => toReasonixTable(document.permissions);
@@ -39371,7 +40232,12 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 			fileContent: rulesyncPatterns.join("\n")
 		});
 	}
-	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const readDenies = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((pattern) => buildReadDenyEntry(pattern, REASONIX_READ_TOOL_NAME));
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -39786,6 +40652,7 @@ var ZedIgnore = class ZedIgnore extends ToolIgnore {
 const IgnoreProcessorToolTargetSchema = z.enum(ignoreProcessorToolTargetTuple);
 const toolIgnoreFactories = /* @__PURE__ */ new Map([
 	["aiassistant", { class: AiassistantIgnore }],
+	["androidstudio", { class: AndroidstudioIgnore }],
 	["antigravity-cli", { class: AntigravityCliIgnore }],
 	["augmentcode", { class: AugmentcodeIgnore }],
 	["bob", { class: BobIgnore }],
@@ -39796,6 +40663,7 @@ const toolIgnoreFactories = /* @__PURE__ */ new Map([
 	["continue", { class: ContinueIgnore }],
 	["crush", { class: CrushIgnore }],
 	["cursor", { class: CursorIgnore }],
+	["firebender", { class: FirebenderIgnore }],
 	["grokcli", { class: GrokcliIgnore }],
 	["hermesagent", { class: HermesagentIgnore }],
 	["junie", { class: JunieIgnore }],
@@ -39820,6 +40688,7 @@ const ignoreProcessorToolTargets = [...toolIgnoreFactories.keys()];
 const ignoreProcessorGlobalToolTargets = [
 	"continue",
 	"devin",
+	"firebender",
 	"grokcli",
 	"kilo",
 	"kiro",
@@ -39946,7 +40815,8 @@ var IgnoreProcessor = class extends FeatureProcessor {
 			outputRoot: this.outputRoot,
 			rulesyncIgnore,
 			options: this.featureOptions,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		});
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
 			toolIgnore,
@@ -40296,13 +41166,31 @@ function renameServerField(servers, from, to) {
 		return [name, Object.fromEntries(Object.entries(config).map(([key, value]) => key === from ? [to, value] : [key, value]))];
 	}));
 }
+function isEmptyValue(value) {
+	if (Array.isArray(value)) return value.length === 0;
+	return isPlainObject$1(value) && Object.keys(value).length === 0;
+}
 /**
 * Antigravity uses `serverUrl` (not the canonical `url`) for HTTP/SSE MCP
 * servers. Convert the canonical shape into Antigravity's on the way out, and
-* back to canonical on the way in, so round-tripping is lossless.
+* back to canonical on the way in.
+*
+* Antigravity documents no `type` field: the transport follows from `command`
+* (stdio) or `serverUrl` (Streamable HTTP / SSE), and `agy plugin validate`
+* reports the canonical `type` as an unknown field, so it is not written. A
+* remote server that carries `command`, `args` or `env` was also observed to be
+* refused at startup (runtime behavior reported by `agy plugin validate` 1.4.4,
+* not documented), so an empty `args` / `env` left on a `serverUrl` server is
+* dropped.
+* https://antigravity.google/docs/mcp
 */
 function toAntigravityMcpServers(servers) {
-	return renameServerField(servers, "url", "serverUrl");
+	const renamed = renameServerField(servers, "url", "serverUrl");
+	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
+		if (!isPlainObject$1(config)) return [name, config];
+		const isRemote = typeof config.serverUrl === "string";
+		return [name, Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value))))];
+	}));
 }
 function toCanonicalMcpServers(servers) {
 	return renameServerField(servers, "serverUrl", "url");
@@ -44492,6 +45380,60 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 	return true;
 }
 /**
+* Translate a canonical `oauth` block into dcode's custom Slack OAuth app
+* settings, or `undefined` (after warning) when it has to be left out.
+*
+* Since deepagents-code 0.1.87, `_validate_slack_oauth_config` accepts `oauth`
+* only as `{ client_id, client_secret? }` of non-empty strings, and only on a
+* `slack.com` / `*.slack.com` server with `auth: "oauth"`; anything else makes
+* dcode skip the whole server. The canonical block usually carries Claude
+* Code's `{ clientId, callbackPort, ... }` shape, so `clientId` becomes
+* `client_id` (a native `client_id` wins), `client_secret` passes through, and
+* every other key is dropped.
+*
+* @see https://github.com/langchain-ai/deepagents/blob/deepagents-code%3D%3D0.1.87/libs/code/deepagents_code/mcp_config.py
+*/
+function toDeepagentsOauth({ name, oauth, converted, logger }) {
+	if (!isSlackOauthServer(converted)) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		return;
+	}
+	const source = isRecord$1(oauth) ? oauth : {};
+	const result = {};
+	for (const [key, value] of Object.entries(source)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const nativeKey = key === "clientId" ? "client_id" : key;
+		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			continue;
+		}
+		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
+		if (!isDeepagentsOauthValue(value)) {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			continue;
+		}
+		result[nativeKey] = value;
+	}
+	if (result.client_id === void 0) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		return;
+	}
+	return result;
+}
+function isDeepagentsOauthValue(value) {
+	return typeof value === "string" && value.trim() !== "" && !/[\x00-\x1f\x7f]/.test(value);
+}
+function isSlackOauthServer(server) {
+	if (server.auth !== "oauth" || typeof server.url !== "string") return false;
+	let host;
+	try {
+		host = new URL(server.url).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return host === "slack.com" || host.endsWith(".slack.com");
+}
+/**
 * Translate one canonical server into dcode's `.mcp.json` shape, or `null` to
 * skip it.
 *
@@ -44514,7 +45456,7 @@ function toDeepagentsServer({ name, server, logger }) {
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
 	});
-	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, ...rest } = server;
+	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, oauth, ...rest } = server;
 	const converted = { ...rest };
 	if (!applyDeepagentsCommand({
 		name,
@@ -44529,6 +45471,15 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (transport !== void 0) converted.transport = normalized;
 		else converted.type = normalized;
 	}
+	if (oauth !== void 0) {
+		const deepagentsOauth = toDeepagentsOauth({
+			name,
+			oauth,
+			converted,
+			logger
+		});
+		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
+	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
 		toolName: TOOL_NAME,
 		serverName: name,
@@ -44555,6 +45506,13 @@ function toRulesyncServer(server) {
 	const converted = { ...rest };
 	for (const key of ["type", "transport"]) if (converted[key] === "streamable_http" || converted[key] === "streamable-http") converted[key] = "http";
 	if (Array.isArray(allowedTools)) converted.enabledTools = allowedTools;
+	if (isRecord$1(converted.oauth) && Object.hasOwn(converted.oauth, "client_id")) {
+		const { client_id: clientId, ...oauthRest } = converted.oauth;
+		converted.oauth = Object.hasOwn(oauthRest, "clientId") ? oauthRest : {
+			clientId,
+			...oauthRest
+		};
+	}
 	return converted;
 }
 var DeepagentsMcp = class DeepagentsMcp extends ToolMcp {
@@ -45317,6 +46275,171 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	}
 };
 //#endregion
+//#region src/features/mcp/firebender-mcp.ts
+/**
+* The keys of the canonical server schema. Firebender reads only `command`,
+* `args`, `env`, `url` and `headers` of them, so the rest are dropped; a key
+* NOT on this list is unknown to rulesync and passed through untouched, so a
+* Firebender-native field such as `deferLoading` written in the tool-scoped
+* `firebender.mcpServers` block (or on a shared server) survives.
+*/
+const CANONICAL_MCP_SERVER_KEYS$1 = new Set(Object.keys(McpServerSchema.def.shape));
+function passthroughNonCanonicalFields$1(serverConfig) {
+	return Object.fromEntries(Object.entries(serverConfig).filter(([key]) => !CANONICAL_MCP_SERVER_KEYS$1.has(key)));
+}
+/**
+* Translate one canonical server into Firebender's `mcpServers` entry, or
+* return `null` (with a warning) for a server Firebender cannot express. A
+* stdio server is `{ command, args?, env? }`, a remote one `{ url, headers? }`;
+* Firebender has no `type` field and no per-server disable switch.
+*
+* @see https://docs.firebender.com/api-reference/syntax
+*/
+function convertServerToFirebenderFormat({ serverName, serverConfig, logger }) {
+	if (serverConfig.disabled === true) return warnAndSkipMcpServer({
+		toolName: "Firebender",
+		serverName,
+		reason: "`disabled: true`, and Firebender has no per-server disable switch",
+		logger
+	});
+	if (declaresNoTransport(serverConfig)) return warnAndSkipMcpServer({
+		toolName: "Firebender",
+		serverName,
+		reason: "no command or url",
+		logger
+	});
+	const passthrough = passthroughNonCanonicalFields$1(serverConfig);
+	if (isRemoteMcpServer(serverConfig)) {
+		const url = resolveRemoteMcpUrl(serverConfig);
+		if (url === void 0) return warnAndSkipMcpServer({
+			toolName: "Firebender",
+			serverName,
+			reason: "a remote transport but no url",
+			logger
+		});
+		return {
+			...passthrough,
+			url,
+			...serverConfig.headers !== void 0 && { headers: serverConfig.headers }
+		};
+	}
+	const [command, ...args] = resolveLocalMcpCommand(serverConfig);
+	if (command === void 0) return warnAndSkipMcpServer({
+		toolName: "Firebender",
+		serverName,
+		reason: "a local transport but no command",
+		logger
+	});
+	return {
+		...passthrough,
+		command,
+		...args.length > 0 && { args },
+		...serverConfig.env !== void 0 && { env: serverConfig.env }
+	};
+}
+/**
+* MCP generator for Firebender.
+*
+* Firebender reads MCP servers from the `mcpServers` key of `firebender.json`
+* (project root) and `~/.firebender/firebender.json` (personal; it wins on
+* name clashes). The file is shared with the ignore (`ignore`) and subagents
+* (`agents`) features and carries settings rulesync does not own, so only the
+* `mcpServers` key is written and the file is never deleted.
+*
+* @see https://docs.firebender.com/api-reference/syntax
+*/
+var FirebenderMcp = class FirebenderMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseSharedConfig({
+			format: "json",
+			fileContent: this.fileContent || "{}"
+		});
+	}
+	getJson() {
+		return this.json;
+	}
+	static getSettablePaths({ global = false } = {}) {
+		return {
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "{}";
+		return new FirebenderMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
+		const mcpServers = {};
+		for (const [serverName, serverConfig] of Object.entries(rulesyncMcp.getMcpServers())) {
+			const converted = convertServerToFirebenderFormat({
+				serverName,
+				serverConfig,
+				logger
+			});
+			if (converted !== null) mcpServers[serverName] = converted;
+		}
+		return new FirebenderMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { mcpServers: Object.keys(mcpServers).length > 0 ? mcpServers : void 0 },
+				filePath
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const servers = this.json.mcpServers;
+		const mcpServers = {};
+		if (isMcpServers(servers)) {
+			for (const [serverName, server] of Object.entries(servers)) if (server !== null && typeof server === "object" && !Array.isArray(server)) mcpServers[serverName] = server;
+		}
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	/**
+	* `firebender.json` is a user-managed file shared with other features (the
+	* ignore feature's `ignore`, the subagents feature's `agents`), so it must
+	* not be deleted.
+	*/
+	isDeletable() {
+		return false;
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new FirebenderMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/gitlabduo-mcp.ts
 const CANONICAL_TO_GITLABDUO_TRANSPORT = {
 	local: "stdio",
@@ -46122,6 +47245,50 @@ function copyHermesOauth(source) {
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_COST_UNIT_MAX_LENGTH = 32;
+function describeHermesValue(value) {
+	return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
+}
+/**
+* Copies the per-server MCP cost keys Hermes v0.22.3 reads in
+* `tools/mcp_tool_costs.py`: `tool_costs` (declared per-tool costs keyed by
+* MCP tool name; each a number, a `[min, max]` range or `{credits, note}`),
+* `spend_limit` (per-chat budget for the server's costed tools; `0`/absent =
+* no limit) and `cost_unit` (label shown with costs; default `credits`).
+*
+* A costed call that would exceed `spend_limit` asks first even on a
+* `trust: full` server, so dropping the key on regenerate would silently
+* remove the guard. Values Hermes would reject when loading the server are
+* dropped with a warning instead of being written into a config Hermes then
+* refuses: `spend_limit` must be a finite non-negative number, `cost_unit` a
+* non-blank string of at most 32 characters, and `tool_costs` a mapping. The
+* mapping is rebuilt as an opaque object (so no reference is shared with the
+* source), with prototype-pollution keys removed at every depth since its
+* values may themselves be objects.
+*/
+function copyHermesCostFields({ source, target, logger }) {
+	let copied = false;
+	const { spend_limit: spendLimit, cost_unit: costUnit, tool_costs: toolCosts } = source;
+	if (spendLimit !== void 0) {
+		if (typeof spendLimit === "number" && Number.isFinite(spendLimit) && spendLimit >= 0) {
+			target.spend_limit = spendLimit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping spend_limit ${describeHermesValue(spendLimit)}; Hermes requires a non-negative number.`);
+	}
+	if (costUnit !== void 0) {
+		if (typeof costUnit === "string" && costUnit.trim() !== "" && costUnit.length <= HERMES_COST_UNIT_MAX_LENGTH) {
+			target.cost_unit = costUnit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping cost_unit ${describeHermesValue(costUnit)}; Hermes requires a non-empty string of at most ${HERMES_COST_UNIT_MAX_LENGTH} characters.`);
+	}
+	if (toolCosts !== void 0) {
+		if (isPlainObject$1(toolCosts)) {
+			target.tool_costs = omitPrototypePollutionKeysDeep(toolCosts);
+			copied = true;
+		} else logger?.warn("Hermes MCP: dropping tool_costs; Hermes requires a mapping of MCP tool names to costs.");
+	}
+	return copied;
+}
 const HERMES_OPAQUE_MAPPING_KEYS = [
 	"sampling",
 	"elicitation",
@@ -46133,13 +47300,18 @@ const HERMES_OPAQUE_MAPPING_KEYS = [
 * alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
 * path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
 * `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
-* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, `identity_header`, and
+* the cost keys (see {@link copyHermesCostFields}) —
 * verbatim from `source` to `target`. Field names are identical on both sides
 * (the canonical `McpServerSchema` is a `looseObject`), so this serves export
 * and import alike. See the Hermes mcp-config-reference.
 */
-function copyHermesAdvancedFields(source, target) {
-	let copied = false;
+function copyHermesAdvancedFields(source, target, logger) {
+	let copied = copyHermesCostFields({
+		source,
+		target,
+		logger
+	});
 	if (typeof source.auth === "string") {
 		target.auth = source.auth;
 		copied = true;
@@ -46248,7 +47420,7 @@ function applyHermesToolsBlock(hermesTools, server) {
 * as Hermes's own `transport: sse`, without which Hermes would connect to it
 * over Streamable HTTP.
 */
-function convertServerToHermes(config) {
+function convertServerToHermes(config, logger) {
 	const out = {};
 	const command = config.command;
 	const url = resolveHermesUrl(config);
@@ -46271,7 +47443,7 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
-	copyHermesAdvancedFields(config, out);
+	copyHermesAdvancedFields(config, out, logger);
 	const tools = buildHermesToolsBlock(config);
 	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
@@ -46279,11 +47451,11 @@ function convertServerToHermes(config) {
 /**
 * Converts rulesync canonical MCP servers into Hermes `mcp_servers:` entries.
 */
-function convertToHermesFormat(mcpServers) {
+function convertToHermesFormat(mcpServers, logger) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
-		result[name] = convertServerToHermes(config);
+		result[name] = convertServerToHermes(config, logger);
 	}
 	return result;
 }
@@ -46303,7 +47475,7 @@ function mergeHermesMcpServers(config, mcpServers) {
 * Mirrors {@link convertToHermesFormat}: `enabled: false` maps back to the
 * canonical `disabled: true`, and only recognized fields are carried over.
 */
-function convertFromHermesFormat(mcpServers) {
+function convertFromHermesFormat(mcpServers, logger) {
 	const result = {};
 	const hermesOverrides = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
@@ -46320,7 +47492,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (isRecord$1(config.tools)) applyHermesToolsBlock(config.tools, server);
 		result[name] = server;
 		const hermesServer = { ...server };
-		if (copyHermesAdvancedFields(config, hermesServer)) hermesOverrides[name] = hermesServer;
+		if (copyHermesAdvancedFields(config, hermesServer, logger)) hermesOverrides[name] = hermesServer;
 	}
 	return {
 		mcpServers: result,
@@ -46339,8 +47511,10 @@ function convertFromHermesFormat(mcpServers) {
 */
 var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
-	constructor(params) {
+	logger;
+	constructor({ logger, ...params }) {
 		super(params);
+		this.logger = logger;
 		this.config = this.fileContent !== void 0 ? parseSharedConfig({
 			format: "yaml",
 			fileContent: this.fileContent
@@ -46384,7 +47558,7 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static getExtraSharedWritePaths() {
 		return getHermesagentSharedConfigWritePaths();
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
@@ -46394,17 +47568,18 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			logger
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
 		const merged = mergeHermesMcpServers(parseSharedConfig({
 			format: "yaml",
 			fileContent
-		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers(), logger));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -46416,11 +47591,12 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 				patch: { mcp_servers: merged.mcp_servers }
 			}),
 			validate,
-			global
+			global,
+			logger
 		});
 	}
 	toRulesyncMcp() {
-		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {}, this.logger);
 		return this.toRulesyncMcpDefault({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
@@ -47304,14 +48480,15 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 	if (!config.parsed) return {};
 	return {
 		...typeof config.mcp.startup_timeout_ms === "number" && { startupTimeoutMs: config.mcp.startup_timeout_ms },
-		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms }
+		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms },
+		...typeof config.mcp.default_deferred === "boolean" && { defaultDeferred: config.mcp.default_deferred }
 	};
 }
 /**
 * Kimi's `[mcp]` section in the shared user config sets the default connect and
-* per-tool-call timeouts for *every* MCP server, including ones rulesync did not
-* write. Per-server values in `mcp.json` still take precedence; this only moves
-* the floor.
+* per-tool-call timeouts, and whether tools load on demand, for *every* MCP
+* server, including ones rulesync did not write. Per-server values in
+* `mcp.json` still take precedence; this only moves the default.
 *
 * Written as an auxiliary file so it goes through the normal write phase and
 * respects `--dry-run`, and merged through the shared-config gateway so the
@@ -47319,7 +48496,8 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 *
 * The gateway replaces an owned key wholesale, and `mcp` is a table, so the
 * section is recomputed from the existing file: authoring only
-* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms`. Same
+* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms` or
+* `default_deferred`. Same
 * approach the `.vibe/config.toml` `tools` writer takes.
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
@@ -47346,7 +48524,8 @@ var KimiCodeMcpConfigToml = class KimiCodeMcpConfigToml extends ToolFile {
 			patch: { mcp: {
 				...existingSection,
 				...defaults.startupTimeoutMs !== void 0 && { startup_timeout_ms: defaults.startupTimeoutMs },
-				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs }
+				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs },
+				...defaults.defaultDeferred !== void 0 && { default_deferred: defaults.defaultDeferred }
 			} },
 			filePath: relativeConfigPath
 		});
@@ -47444,18 +48623,20 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 		if (!isRecord$1(block)) return [];
 		const startupTimeoutMs = typeof block.startupTimeoutMs === "number" ? block.startupTimeoutMs : void 0;
 		const toolTimeoutMs = typeof block.toolTimeoutMs === "number" ? block.toolTimeoutMs : void 0;
-		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0) return [];
+		const defaultDeferred = typeof block.defaultDeferred === "boolean" ? block.defaultDeferred : void 0;
+		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0 && defaultDeferred === void 0) return [];
 		const existing = await readKimiCodeConfig({ outputRoot });
 		if (!existing.parsed) {
 			const paths = kimiCodeConfigRelativePath();
-			warnWithFallback(logger, `Skipping the Kimi Code MCP timeout defaults: ${join(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
+			warnWithFallback(logger, `Skipping the Kimi Code MCP [mcp] defaults: ${join(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
 			return [];
 		}
 		return [KimiCodeMcpConfigToml.fromDefaults({
 			outputRoot,
 			defaults: {
 				startupTimeoutMs,
-				toolTimeoutMs
+				toolTimeoutMs,
+				defaultDeferred
 			},
 			existing
 		})];
@@ -50031,6 +51212,11 @@ var ReasonixMcp = class ReasonixMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
@@ -52008,6 +53194,397 @@ var WarpcliMcp = class extends WarpMcp {
 	}
 };
 //#endregion
+//#region src/constants/xum-paths.ts
+/**
+* Xum configuration-layout conventions.
+*
+* Xum (Coder's desktop app and `xum run` CLI for running coding agents in
+* parallel workspaces, formerly Mux) keeps its project assets under a `.xum/`
+* directory at the project root and the matching user assets under `~/.xum/`.
+* Legacy `.mux/` files are still read when the matching `.xum/` file is
+* missing; rulesync writes only the `.xum/` paths.
+*
+* @see https://xum.cdr.dev/reference/mux-compatibility
+*/
+const XUM_DIR = ".xum";
+const XUM_RULE_FILE_NAME = "AGENTS.md";
+const XUM_LOCAL_RULE_FILE_NAME = "AGENTS.local.md";
+const XUM_MCP_FILE_NAME = "mcp.jsonc";
+const XUM_AGENTS_DIR_PATH = join(XUM_DIR, "agents");
+const XUM_SKILLS_DIR_PATH = join(XUM_DIR, "skills");
+//#endregion
+//#region src/features/mcp/xum-mcp.ts
+const EMPTY_XUM_MCP_CONFIG = JSON.stringify({ servers: {} }, null, 2);
+/** Characters that never need quoting in a POSIX shell word. */
+const SHELL_SAFE_WORD = /^[A-Za-z0-9_\-.,:/@%+=]+$/;
+/**
+* A command string free of quotes, escapes, expansions and operators, which
+* can be split on whitespace back into argv without changing its meaning.
+*/
+const SPLIT_SAFE_COMMAND = /^[^'"\\$`|&;<>(){}*?[\]~#!\n]+$/;
+/** Single-quote one argv element for the POSIX shell Xum runs commands in. */
+function quoteShellWord(value) {
+	if (SHELL_SAFE_WORD.test(value)) return value;
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/**
+* Build the shell command string a Xum stdio server is launched with. A
+* `command` string is kept verbatim (Xum itself treats it as a raw shell
+* string, so `npx -y pkg` authored as one string keeps working); an explicit
+* argv (`command` as an array) and every `args` element are quoted where
+* needed, so `/opt/my tools/srv` stays one word.
+*/
+function buildCommandString(server) {
+	const args = server.args ?? [];
+	if (Array.isArray(server.command)) {
+		const [executable] = server.command;
+		if (executable === void 0 || executable.trim() === "") return void 0;
+		return [...server.command, ...args].map(quoteShellWord).join(" ");
+	}
+	if (typeof server.command !== "string" || server.command.trim() === "") return void 0;
+	return [server.command, ...args.map(quoteShellWord)].join(" ");
+}
+/** A name bash accepts on the left of a `NAME=value` assignment. */
+const SHELL_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A canonical `${VAR}` reference whose name bash can expand. */
+const ENV_VAR_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/**
+* Quote an env value for a `NAME=value` assignment. Literal text is
+* single-quoted, so nothing in it is expanded or run, while every canonical
+* `${VAR}` reference is emitted as `"${VAR}"` so bash still expands it from
+* the environment Xum starts the server with. The pieces are concatenated into
+* one shell word: `Bearer ${TOKEN}` becomes `'Bearer '"${TOKEN}"`.
+*/
+function quoteEnvValue(value) {
+	if (value === "") return "''";
+	const parts = [];
+	let last = 0;
+	for (const match of value.matchAll(ENV_VAR_REFERENCE)) {
+		if (match.index > last) parts.push(quoteShellWord(value.slice(last, match.index)));
+		parts.push(`"\${${match[1]}}"`);
+		last = match.index + match[0].length;
+	}
+	if (last < value.length) parts.push(quoteShellWord(value.slice(last)));
+	return parts.join("");
+}
+/**
+* Build the `NAME=value ` prefix that sets a stdio server's `env` for its
+* command only (Xum runs the command string with bash). Returns the prefix
+* plus the entries left out: names that cannot be bash assignment targets and
+* entries whose value is not a string.
+*/
+function buildEnvPrefix(env) {
+	const assignments = [];
+	const invalidNames = [];
+	const nonStringNames = [];
+	for (const [name, value] of Object.entries(env)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!SHELL_ENV_NAME.test(name)) {
+			invalidNames.push(name);
+			continue;
+		}
+		if (typeof value !== "string") {
+			nonStringNames.push(name);
+			continue;
+		}
+		assignments.push(`${name}=${quoteEnvValue(value)}`);
+	}
+	return {
+		prefix: assignments.map((assignment) => `${assignment} `).join(""),
+		invalidNames,
+		nonStringNames
+	};
+}
+/** Bash reserved words; a command starting with one cannot take an assignment prefix. */
+const BASH_RESERVED_WORDS = /* @__PURE__ */ new Set([
+	"!",
+	"[[",
+	"]]",
+	"{",
+	"}",
+	"case",
+	"coproc",
+	"do",
+	"done",
+	"elif",
+	"else",
+	"esac",
+	"fi",
+	"for",
+	"function",
+	"if",
+	"in",
+	"select",
+	"then",
+	"time",
+	"until",
+	"while"
+]);
+/**
+* Explain why a `NAME=value` prefix would not reach the server, or return
+* `undefined` when it would. Bash applies such assignments to the first simple
+* command only: with a list or pipeline (`cd x && srv`) the server would not
+* see them, and in front of a group, parenthesized list or reserved word (`( srv )`,
+* `{ srv; }`, `if ...`) they are a syntax error that keeps the server from
+* starting. Only the verbatim `command` string is checked for operators,
+* outside complete single-quoted words; argv elements are quoted by
+* {@link quoteShellWord}.
+*/
+function envPrefixBlocker(server, baseCommand) {
+	if (typeof server.command === "string") {
+		const unquoted = server.command.replace(/'[^']*'/g, "");
+		if (unquoted.includes("'") || /[;&|(){}\n]/.test(unquoted)) return "its command string contains shell operators, grouping or a newline, so bash would not pass NAME=value assignments in front of it to the server";
+	}
+	const [firstWord] = baseCommand.trimStart().split(/\s+/);
+	if (firstWord !== void 0 && BASH_RESERVED_WORDS.has(firstWord)) return `its command starts with the bash reserved word ${quoteValueForWarning(firstWord)}, which cannot follow NAME=value assignments`;
+}
+/**
+* One leading `NAME=value` assignment in exactly the shape {@link quoteEnvValue}
+* writes: bare shell-safe characters, single-quoted text (with the `'\''`
+* escape) and `"${VAR}"` references, followed by spaces or tabs (a newline
+* would end the command, so the assignment would not apply to what follows). Bare characters
+* are matched one at a time, so every alternative starts with a distinct
+* character and the pattern cannot backtrack exponentially.
+*/
+const LEADING_ENV_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=((?:[A-Za-z0-9_\-.,:/@%+=]|'[^']*'|\\'|"\$\{[A-Za-z_][A-Za-z0-9_]*\}")*)[ \t]+/;
+/** Decode a value written by {@link quoteEnvValue} back into its canonical form. */
+function unquoteEnvValue(quoted) {
+	return quoted.replace(/'([^']*)'|\\'|"(\$\{[A-Za-z_][A-Za-z0-9_]*\})"/g, (_m, single, ref) => typeof single === "string" ? single : typeof ref === "string" ? ref : "'");
+}
+/**
+* Split leading `NAME=value` assignments off a command string, but only when
+* every one of them is in the shape rulesync writes and a plain command
+* follows (see {@link envPrefixBlocker}); anything else (for example a `$(...)` substitution) keeps the whole string as
+* the command.
+*/
+function splitEnvPrefix(command) {
+	const env = {};
+	let rest = command.trimStart();
+	for (;;) {
+		const match = LEADING_ENV_ASSIGNMENT.exec(rest);
+		if (match === null) break;
+		const [whole, name, quoted] = match;
+		if (name === void 0 || quoted === void 0 || PROTOTYPE_POLLUTION_KEYS.has(name)) break;
+		env[name] = unquoteEnvValue(quoted);
+		rest = rest.slice(whole.length);
+	}
+	if (Object.keys(env).length === 0 || rest.trim() === "" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest) || envPrefixBlocker({ command: rest }, rest) !== void 0) return { rest: command };
+	return {
+		env,
+		rest
+	};
+}
+/** Read a command string back into `env` + `command` + `args`. */
+function parseCommandString(command) {
+	const { env, rest } = splitEnvPrefix(command);
+	return {
+		...env !== void 0 && { env },
+		...splitCommandString(rest)
+	};
+}
+/** Split a plain command string back into `command` + `args` when it is safe to. */
+function splitCommandString(command) {
+	const trimmed = command.trim();
+	if (!SPLIT_SAFE_COMMAND.test(trimmed)) return { command };
+	const [head, ...rest] = trimmed.split(/\s+/);
+	if (head === void 0) return { command };
+	return rest.length > 0 ? {
+		command: head,
+		args: rest
+	} : { command: head };
+}
+function resolveXumServerKind(server) {
+	const candidate = server.type ?? server.transport;
+	if (candidate === "stdio" || candidate === "local") return "stdio";
+	if (candidate === "http" || candidate === "streamable-http") return "http";
+	if (candidate === "sse") return "sse";
+	if (candidate !== void 0) return { unsupported: candidate };
+	if (server.command !== void 0) return "stdio";
+	const url = server.url ?? server.httpUrl;
+	if (typeof url === "string") return /^wss?:\/\//i.test(url) ? { unsupported: "ws" } : "auto";
+}
+/** Convert one canonical server into a Xum `servers` entry, or `null` to skip it. */
+function convertServerToXum({ name, server, logger }) {
+	const skip = (reason) => {
+		warnWithFallback(logger, `Xum MCP: skipping ${quoteValueForWarning(name)} because ${reason}.`);
+		return null;
+	};
+	const kind = resolveXumServerKind(server);
+	if (kind === void 0) return skip("it has neither a command nor a URL");
+	if (typeof kind === "object") return skip(`it uses the "${kind.unsupported}" transport, which Xum does not support (only stdio, http and sse)`);
+	const settings = {};
+	if (server.disabled === true) settings.disabled = true;
+	if (isStringArray$1(server.enabledTools)) settings.toolAllowlist = server.enabledTools;
+	if (kind !== "stdio") {
+		const url = server.url ?? server.httpUrl;
+		if (typeof url !== "string" || url === "") return skip("it has no URL");
+		return {
+			...kind !== "auto" && { transport: kind },
+			url,
+			...isPlainObject$1(server.headers) && Object.keys(server.headers).length > 0 && { headers: server.headers },
+			...settings
+		};
+	}
+	const baseCommand = buildCommandString(server);
+	if (baseCommand === void 0) return skip("it has no command");
+	let command = baseCommand;
+	if (isPlainObject$1(server.env) && Object.keys(server.env).length > 0) {
+		const blocker = envPrefixBlocker(server, baseCommand);
+		if (blocker !== void 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env, but ${blocker}; the server is written without env.`);
+		else {
+			const { prefix, invalidNames, nonStringNames } = buildEnvPrefix(server.env);
+			command = `${prefix}${baseCommand}`;
+			if (invalidNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${invalidNames.map(quoteValueForWarning).join(", ")}, which cannot be a bash variable name; the server is written without it.`);
+			if (nonStringNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${nonStringNames.map(quoteValueForWarning).join(", ")} to a value that is not a string; the server is written without it.`);
+		}
+	}
+	if (typeof server.cwd === "string") warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets cwd, which Xum's mcp.jsonc cannot express; the server is written without it (Xum starts stdio servers in the workspace directory).`);
+	return Object.keys(settings).length > 0 ? {
+		command,
+		...settings
+	} : command;
+}
+/** Copy only the string values of a header map (secret references have no canonical form). */
+function copyStringHeaders(value) {
+	if (!isPlainObject$1(value)) return void 0;
+	const result = {};
+	for (const [key, entry] of Object.entries(value)) if (!PROTOTYPE_POLLUTION_KEYS.has(key) && typeof entry === "string") result[key] = entry;
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+/** Read a Xum `servers` map back into the canonical shape. */
+function convertFromXumFormat(servers) {
+	if (!isPlainObject$1(servers)) return {};
+	const result = {};
+	for (const [name, entry] of Object.entries(servers)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (typeof entry === "string") {
+			result[name] = parseCommandString(entry);
+			continue;
+		}
+		if (!isPlainObject$1(entry)) continue;
+		const server = {};
+		if (typeof entry.url === "string") {
+			if (entry.transport === "http" || entry.transport === "sse") server.type = entry.transport;
+			server.url = entry.url;
+			const headers = copyStringHeaders(entry.headers);
+			if (headers !== void 0) server.headers = headers;
+		} else if (typeof entry.command === "string") Object.assign(server, parseCommandString(entry.command));
+		else continue;
+		if (entry.disabled === true) server.disabled = true;
+		if (isStringArray$1(entry.toolAllowlist)) server.enabledTools = entry.toolAllowlist;
+		result[name] = server;
+	}
+	return result;
+}
+/**
+* Xum MCP configuration.
+*
+* Xum reads `~/.xum/mcp.jsonc` (user) and the repo override `.xum/mcp.jsonc`
+* (project; a server there wins over the user one of the same name). Both are
+* a JSONC document with a `servers` map:
+*
+* - a stdio server is a shell command string run with bash (the object form
+*   `{ command }` carries `disabled` / `toolAllowlist`); `env` is written as
+*   `NAME=value` assignments in front of the command, and `cwd`, which has no
+*   equivalent, is dropped with a warning;
+* - a remote server is `{ transport: "http" | "sse" | "auto", url, headers }`
+*   (the transport defaults to auto-detection).
+*
+* rulesync owns only `servers`; other top-level keys (Xum writes
+* `enabledPluginServers` into the user file) are preserved. The project file
+* may be removed by `--delete`; the user file never is.
+*
+* @see https://xum.cdr.dev/config/mcp-servers
+* @see https://github.com/coder/xum/blob/main/src/node/services/mcpConfigService.ts
+*/
+var XumMcp = class XumMcp extends ToolMcp {
+	json;
+	constructor(params) {
+		super(params);
+		this.json = parseSharedConfig({
+			format: "jsonc",
+			fileContent: this.fileContent,
+			filePath: join(this.relativeDirPath, this.relativeFilePath),
+			invalidRootPolicy: "error",
+			jsoncParseErrors: "error"
+		});
+	}
+	getJson() {
+		return this.json;
+	}
+	isDeletable() {
+		return !this.global;
+	}
+	static getSettablePaths(_options = {}) {
+		return {
+			relativeDirPath: XUM_DIR,
+			relativeFilePath: XUM_MCP_FILE_NAME
+		};
+	}
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? EMPTY_XUM_MCP_CONFIG;
+		return new XumMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
+		const existingContent = await readFileContentOrNull(filePath) ?? EMPTY_XUM_MCP_CONFIG;
+		const servers = {};
+		for (const [name, server] of Object.entries(rulesyncMcp.getMcpServers())) {
+			if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+			const entry = convertServerToXum({
+				name,
+				server,
+				logger
+			});
+			if (entry !== null) servers[name] = entry;
+		}
+		return new XumMcp({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath: paths.relativeFilePath,
+			fileContent: applySharedConfigPatch({
+				fileKey: sharedConfigFileKey(paths),
+				feature: "mcp",
+				existingContent,
+				patch: { servers },
+				filePath,
+				logger
+			}),
+			validate,
+			global
+		});
+	}
+	toRulesyncMcp() {
+		const mcpServers = convertFromXumFormat(this.json.servers);
+		return this.toRulesyncMcpDefault({ fileContent: JSON.stringify({ mcpServers }, null, 2) });
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
+		return new XumMcp({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "{}",
+			validate: false,
+			global
+		});
+	}
+};
+//#endregion
 //#region src/features/mcp/zcode-mcp.ts
 /**
 * Single spelling of the config.json codec/policy, matching the
@@ -52041,7 +53618,7 @@ function asZcodeRemoteType(stated, url) {
 }
 /**
 * The keys each OAuth flow of ZCode's per-server `oauth` union accepts on a
-* remote server, and which of them are required. Read off the 3.14.3/3.15.3
+* remote server, and which of them are required. Read off the 3.14.3–3.16.2
 * runtime config schema, since ZCode's MCP page only says to "enable OAuth for
 * the service in its configuration". Both variants are strict, so any other
 * key would make ZCode skip the server.
@@ -52145,7 +53722,11 @@ function resolveZcodeTimeoutMs({ serverName, config, logger }) {
 }
 /**
 * The per-server keys ZCode reads on every transport: `timeoutMs`,
-* `protocolVersion` and the enable toggle (`enableKey`).
+* `protocolVersion`, `alwaysLoad` and the enable toggle (`enableKey`).
+*
+* `alwaysLoad` (added in 3.16.2 alongside tool search) keeps a server's tools
+* loaded up front instead of deferring them behind tool search. ZCode's schema
+* types it as a boolean, so any other value is dropped with a warning.
 */
 function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const common = {};
@@ -52158,6 +53739,9 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const { protocolVersion } = config;
 	if (ZCODE_PROTOCOL_VERSIONS.has(protocolVersion)) common.protocolVersion = protocolVersion;
 	else if (protocolVersion !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping protocolVersion ${JSON.stringify(protocolVersion)}, as ZCode accepts only ${[...ZCODE_PROTOCOL_VERSIONS].map((v) => JSON.stringify(v)).join(", ")}.`);
+	const { alwaysLoad } = config;
+	if (typeof alwaysLoad === "boolean") common.alwaysLoad = alwaysLoad;
+	else if (alwaysLoad !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping alwaysLoad ${JSON.stringify(alwaysLoad)}, as it must be a boolean.`);
 	if (config.disabled === true) common[enableKey] = false;
 	return common;
 }
@@ -52170,11 +53754,11 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 * absent.
 *
 * Every server also carries `timeoutMs` (from the canonical `timeout`, or an
-* explicit `timeoutMs`) and an allow-listed `protocolVersion`; stdio servers
-* carry `cwd`, and remote servers an `oauth` built from the namespaced
-* `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
+* explicit `timeoutMs`), an allow-listed `protocolVersion` and a boolean
+* `alwaysLoad`; stdio servers carry `cwd`, and remote servers an `oauth` built
+* from the namespaced `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
 * is read from the authored server through `rawServerOf`. ZCode's docs do not
-* name these keys, so they follow the 3.14.3/3.15.3 runtime's per-server
+* name these keys, so they follow the 3.14.3–3.16.2 runtime's per-server
 * schema, which is strict: an unknown key makes ZCode skip the server, which
 * is why the output stays a whitelist.
 *
@@ -52269,8 +53853,8 @@ const ZCODE_ENABLE_KEYS = /* @__PURE__ */ new Set(["enable", "enabled"]);
 * and unknown keys pass through untouched so an import keeps whatever a
 * hand-authored entry declared. `timeoutMs` is lifted back into the canonical
 * `timeout` (milliseconds); when the server also states a `timeout`, ZCode
-* has already dropped that one, so `timeoutMs` replaces it. A ZCode-shaped
-* `oauth` is imported as the namespaced `zcodeOauth`, so its client secret is
+* has already dropped that one, so `timeoutMs` replaces it. Any record
+* `oauth` is imported as the namespaced `zcodeOauth`, so a client secret is
 * never emitted to another tool. Generation back out is a whitelist, so only
 * the keys `convertToZcodeFormat` writes are re-emitted.
 *
@@ -52296,7 +53880,7 @@ function convertFromZcodeFormat({ zcodeServers }) {
 				continue;
 			}
 			if (key === "timeout" && typeof config.timeoutMs === "number") continue;
-			if (key === "oauth" && isZcodeOauth(value)) {
+			if (key === "oauth" && isRecord$1(value)) {
 				converted[ZCODE_OAUTH_CANONICAL_KEY] = value;
 				continue;
 			}
@@ -52942,6 +54526,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: true
 		}
 	}],
+	["firebender", {
+		class: FirebenderMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: false,
+			supportsDisabledTools: false
+		}
+	}],
 	["goose", {
 		class: GooseMcp,
 		meta: {
@@ -53212,6 +54805,15 @@ const toolMcpFactories = /* @__PURE__ */ new Map([
 			supportsDisabledTools: false
 		}
 	}],
+	["xum", {
+		class: XumMcp,
+		meta: {
+			supportsProject: true,
+			supportsGlobal: true,
+			supportsEnabledTools: true,
+			supportsDisabledTools: false
+		}
+	}],
 	["devin", {
 		class: DevinMcp,
 		meta: {
@@ -57293,6 +58895,11 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
 		widens: isNotFalse
 	},
+	{
+		path: ["allowNestedUserNamespaces"],
+		reason: "lets sandboxed Linux commands create user namespaces, which gets around the sandbox's file protections",
+		widens: isNotFalse
+	},
 	{
 		path: ["allowUnsandboxedCommands"],
 		reason: "controls whether Claude may retry a blocked command outside the sandbox",
@@ -67742,7 +69349,7 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *   catch-all one at its own strictness, a pattern-specific one as `prompt`).
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
-* `write` or `yolo`); without it the key is left as it is in the file, and on
+* `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
 * import a recognized value is read back into the override.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
@@ -70014,6 +71621,8 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 const REASONIX_TOOL_LABEL = "Reasonix";
 /** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
 const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/** The `[permissions]` key the override's `askOnExternalOrigin` writes and reads. */
+const REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY = "ask_on_external_origin";
 /**
 * `[sandbox]` keys whose authored value loosens the enforcement layer beneath
 * the permission policy: they take Bash out of its OS jail, open that jail to
@@ -70216,6 +71825,95 @@ function applyPermissionsMode({ permissions, authored, global, relativeFilePath,
 		reason: "lets every writer call that no rule matches run without a prompt"
 	}];
 }
+/**
+* Writes the override's `askOnExternalOrigin` into `[permissions]`. Reasonix
+* honors the key only in the user config (`narrowPermissions` in
+* `project_scope.go`), so a project-scope generate skips it with a warning and
+* leaves whatever the file had. Turning it on only adds prompts, so that is
+* quiet; turning off a value the file had on is reported, since Auto and YOLO
+* then run calls that repeat text from a web page or tool result without asking.
+* As with `applyAllowDynamicBash`, only a literal `true` counts as quiet, so a
+* value a `--no-validate` run let through is never written in silence.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/GUIDE.md
+*/
+function applyAskOnExternalOrigin({ permissions, override, global, relativeFilePath, logger }) {
+	const authored = override?.askOnExternalOrigin;
+	if (authored === void 0) return [];
+	if (!global) {
+		logger?.warn(`Reasonix permissions: skipping reasonix.askOnExternalOrigin for the project-scoped ${relativeFilePath}; Reasonix honors [permissions] ask_on_external_origin only in the user config and ignores a project value, so generate it with --global instead.`);
+		return [];
+	}
+	const previous = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+	permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY] = authored;
+	if (authored === true || previous !== true && authored === false) return [];
+	return [{
+		label: `permissions.${REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY}`,
+		reason: "lets Auto and YOLO run a call that repeats text from a web page or tool result without asking first"
+	}];
+}
+/**
+* The `tools` patch entry — the `[tools]` table with the override's `disabled`
+* list laid over it, or nothing when the override does not author one — and the
+* trust rows it carries. Adding a name only removes a tool, and a project file
+* can only add to the user's list, so that stays quiet. The list is replaced
+* whole, though, so a name the file had turned off and the override leaves out
+* is turned back on, and that is reported, as are a `[tools]` or a `disabled`
+* the file holds in a shape that cannot be read. Only `disabled` is written:
+* the rest of `[tools]` (timeouts, search backends, ...) stays as it is.
+*/
+function applyToolsDisabled({ existing, override }) {
+	const disabled = override?.tools?.disabled;
+	if (disabled === void 0) return {
+		patch: {},
+		entries: []
+	};
+	const patch = { tools: {
+		...asReasonixRecord(existing),
+		disabled
+	} };
+	if (existing === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!isRecord$1(existing)) return {
+		patch,
+		entries: [{
+			label: "tools",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const before = existing.disabled;
+	if (before === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!Array.isArray(before)) return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: replacedUnreadableReason({
+				shape: "list",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const reEnabled = uniq(before.filter((name) => !disabled.includes(name)));
+	if (reEnabled.length === 0) return {
+		patch,
+		entries: []
+	};
+	return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: `turns back on ${reEnabled.map((name) => quoteValueForWarning(name)).join(", ")}, which the file had turned off`
+		}]
+	};
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -70271,6 +71969,11 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const relativeFilePathForLog = toPosixPath(join(paths.relativeDirPath, paths.relativeFilePath));
@@ -70330,7 +72033,20 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			relativeFilePath: relativeFilePathForLog,
 			logger
 		}));
+		trustAffecting.push(...applyAskOnExternalOrigin({
+			permissions: mergedPermissions,
+			override,
+			global,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		}));
 		const patch = { permissions: mergedPermissions };
+		const toolsDisabled = applyToolsDisabled({
+			existing: parsed.tools,
+			override
+		});
+		Object.assign(patch, toolsDisabled.patch);
+		trustAffecting.push(...toolsDisabled.entries);
 		if (override?.sandbox !== void 0) {
 			const authoredSandbox = dropUserOnlySandboxKeys({
 				sandbox: override.sandbox,
@@ -70404,6 +72120,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
 		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (this.global && typeof permissions.mode === "string" && REASONIX_PERMISSION_MODES.has(permissions.mode)) reasonixOverride.mode = permissions.mode;
+		const askOnExternalOrigin = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+		if (this.global && typeof askOnExternalOrigin === "boolean") reasonixOverride.askOnExternalOrigin = askOnExternalOrigin;
+		const toolsDisabled = asReasonixRecord(this.toml.tools).disabled;
+		if (Array.isArray(toolsDisabled)) {
+			const names = toReasonixStringArray(toolsDisabled);
+			if (names.length < toolsDisabled.length) warnWithFallback(void 0, `Reasonix permissions: ${this.getRelativePathFromCwd()} [tools] disabled holds ${toolsDisabled.length - names.length} non-string entries; they are not imported into reasonix.tools.disabled, so the next generate drops them.`);
+			reasonixOverride.tools = { disabled: names };
+		}
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;
@@ -71985,7 +73709,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 		const authoredProviderOptions = isPlainObject$1(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
 		const runtimeModeRefusesProviderOptions = authoredProviderOptions !== void 0 && runtime.active;
 		if (runtimeModeRefusesProviderOptions) logger?.warn(`Takt permissions: not writing "${TAKT_PROVIDER_OPTIONS_KEY}" to ${filePath} because ${runtime.filePaths.join(" + ")} puts Takt in runtime provider mode (Takt 0.56.0+), where any legacy provider setting in config.yaml makes Takt fail with "Mixed provider configuration detected". Move those options to \`provider.profiles.<profile>.options\` in runtime.yaml, and remove them from the \`takt\` block of the rulesync source. A "${TAKT_PROVIDER_OPTIONS_KEY}" already in ${filePath} is left untouched — rulesync does not own that key.`);
-		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : authoredProviderOptions;
+		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : dropUntrustedProviderOptions({
+			providerOptions: authoredProviderOptions,
+			global,
+			filePath,
+			logger
+		});
 		const authoredPolicies = pickSecurityPolicies(override, {
 			filePath,
 			logger,
@@ -72489,6 +74218,68 @@ function taktModeToRulesyncConfig(mode) {
 		default: return { permission: { bash: { [CATCH_ALL_PATTERN$1]: "deny" } } };
 	}
 }
+const TAKT_BASE_URL_PROVIDERS = [
+	"codex",
+	"claude",
+	"deepseek_harness"
+];
+const TAKT_DEEPSEEK_HARNESS_KEY = "deepseek_harness";
+/** Mirrors Takt's `isLoopbackBaseUrl`: localhost, *.localhost, ::1 or 127.x.x.x. */
+function isLoopbackBaseUrl(value) {
+	let hostname;
+	try {
+		hostname = new URL(value).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "[::1]") return true;
+	const octets = hostname.split(".");
+	return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d+$/.test(octet) && Number(octet) <= 255);
+}
+/** The keys of one `provider_options.<provider>` entry Takt rejects in config.yaml. */
+function untrustedProviderOptionKeys({ provider, options, global }) {
+	const keys = [];
+	if (provider === TAKT_DEEPSEEK_HARNESS_KEY) {
+		if (options.reasoning_effort !== void 0) keys.push("reasoning_effort");
+		const { plugins } = options;
+		if (!global && plugins !== void 0 && (!Array.isArray(plugins) || plugins.length > 0)) keys.push("plugins");
+	}
+	const baseUrl = options.base_url;
+	if (!global && TAKT_BASE_URL_PROVIDERS.includes(provider) && baseUrl !== void 0 && (typeof baseUrl !== "string" || !isLoopbackBaseUrl(baseUrl))) keys.push("base_url");
+	return keys;
+}
+/**
+* Drop the `provider_options` entries Takt refuses to load from `config.yaml`
+* (it fails at startup with a `Configuration error`), warning for each:
+*   - `deepseek_harness.reasoning_effort` in either scope — Takt accepts it only
+*     in runtime profile options or `TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT`.
+*   - at project scope, a non-empty `deepseek_harness.plugins` (Takt 0.71.0+,
+*     global config only) and a non-loopback `{codex,claude,deepseek_harness}.base_url`.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/providerOptions.ts
+* https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+function dropUntrustedProviderOptions({ providerOptions, global, filePath, logger }) {
+	if (providerOptions === void 0) return;
+	const dropped = [];
+	const result = {};
+	for (const [provider, options] of Object.entries(providerOptions)) {
+		if (!isPlainObject$1(options)) {
+			result[provider] = options;
+			continue;
+		}
+		const untrusted = untrustedProviderOptionKeys({
+			provider,
+			options,
+			global
+		});
+		const kept = Object.fromEntries(Object.entries(options).filter(([key]) => !untrusted.includes(key)));
+		dropped.push(...untrusted.map((key) => `${TAKT_PROVIDER_OPTIONS_KEY}.${provider}.${key}`));
+		if (Object.keys(kept).length > 0 || Object.keys(options).length === 0) result[provider] = kept;
+	}
+	if (dropped.length === 0) return providerOptions;
+	logger?.warn(`Takt permissions: not writing ${dropped.map((key) => `"${key}"`).join(", ")} to ${filePath} because Takt refuses to load ${dropped.length === 1 ? "it" : "them"} from ${global ? "config.yaml" : "a project config.yaml"} and fails at startup with a "Configuration error". Set non-loopback base URLs and DeepSeek Harness plugins in the global ~/.takt/config.yaml (or the TAKT_PROVIDER_OPTIONS_* environment variables), and DeepSeek Harness reasoning_effort in a runtime.yaml profile's options or TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT, then remove them from the \`takt\` block of the rulesync source.`);
+	return Object.keys(result).length > 0 ? result : void 0;
+}
 /**
 * Lift Takt's security-policy keys out of a source object, keeping only the
 * shapes Takt itself accepts (a boolean, or a table of booleans). Used in both
@@ -76423,6 +78214,11 @@ const TOOL_DISPLAY = [
 		label: "Factory Droid",
 		group: "ai"
 	},
+	{
+		key: "firebender",
+		label: "Firebender",
+		group: "ai"
+	},
 	{
 		key: "opencode",
 		label: "OpenCode",
@@ -76578,6 +78374,11 @@ const TOOL_DISPLAY = [
 		label: "JetBrains AI Assistant",
 		group: "ai"
 	},
+	{
+		key: "androidstudio",
+		label: "Gemini in Android Studio",
+		group: "ai"
+	},
 	{
 		key: "junie",
 		label: "JetBrains Junie",
@@ -76613,6 +78414,11 @@ const TOOL_DISPLAY = [
 		label: "Warp Agent CLI",
 		group: "ai"
 	},
+	{
+		key: "xum",
+		label: "Xum",
+		group: "ai"
+	},
 	{
 		key: "replit",
 		label: "Replit",
@@ -77757,6 +79563,27 @@ var AmpSkill = class AmpSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/androidstudio-skill.ts
+/**
+* Gemini in Android Studio skills follow the Agent Skills open standard
+* (`<name>/SKILL.md` with `name` and `description` frontmatter), so this target
+* reuses {@link AgentsSkillsSkill} with Android Studio's own location:
+* `.android-studio/skills/` at the project root (project) or in the home
+* directory (global). The shared `.agents/skills/` location Android Studio also
+* reads belongs to the `agentsskills` target.
+*
+* @see https://developer.android.com/studio/gemini/skills
+*/
+var AndroidstudioSkill = class extends AgentsSkillsSkill {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: ANDROIDSTUDIO_SKILLS_DIR_PATH };
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("androidstudio");
+	}
+};
+//#endregion
 //#region src/features/skills/antigravity-plugin-skill.ts
 var AntigravityPluginSkill = class extends AntigravityIdeSkill {
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
@@ -81225,6 +83052,26 @@ var FactorydroidSkill = class FactorydroidSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/firebender-skill.ts
+/**
+* Firebender skills follow the Agent Skills layout (`<name>/SKILL.md` with the
+* required `name` and `description` frontmatter, plus optional supporting
+* files), so this target reuses {@link AgentsSkillsSkill} with Firebender's
+* recommended locations: `.firebender/skills/` (project) and
+* `~/.firebender/skills/` (user).
+*
+* @see https://docs.firebender.com/api-reference/skills
+*/
+var FirebenderSkill = class extends AgentsSkillsSkill {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: FIREBENDER_SKILLS_DIR_PATH };
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("firebender");
+	}
+};
+//#endregion
 //#region src/features/skills/gitlabduo-skill.ts
 /**
 * GitLab Duo skills follow the Agent Skills standard (`name` and `description`
@@ -84760,6 +86607,110 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 	}
 };
 //#endregion
+//#region src/features/skills/xum-skill.ts
+/**
+* The Agent Skills standard keys the `agentsskills` section carries. On import
+* they go back there, exactly as for the `agentsskills` target, and every other
+* key besides `name` / `description` goes into the `xum` section.
+*/
+const AGENT_SKILLS_STANDARD_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"description",
+	"license",
+	"compatibility",
+	"metadata",
+	"allowed-tools"
+]);
+/**
+* Xum skills follow the Agent Skills layout (`<name>/SKILL.md` with the
+* required `name` and `description` frontmatter; the directory name is
+* lowercase letters, digits and single hyphens up to 64 characters, and
+* `name` must match it), so this target reuses {@link AgentsSkillsSkill} with
+* Xum's locations: `.xum/skills/` (project) and `~/.xum/skills/` (user).
+* Within one directory `.xum/skills` wins over `.agents/skills`.
+*
+* On top of the standard fields, Xum reads `disable-model-invocation` (and its
+* own `advertise: false` alias), `user-invocable`, `argument-hint`,
+* `when_to_use` / `when-to-use` and `paths` (globs that make the skill
+* path-scoped). Those come from the `xum` section of the rulesync skill and are
+* written verbatim; the two invocation gates fall back to the root-level
+* rulesync values.
+*
+* @see https://xum.cdr.dev/agents/agent-skills
+*/
+var XumSkill = class XumSkill extends AgentsSkillsSkill {
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: XUM_SKILLS_DIR_PATH };
+	}
+	toRulesyncSkill() {
+		const base = super.toRulesyncSkill();
+		const xumSection = Object.fromEntries(Object.entries(this.getFrontmatter()).filter(([key]) => !AGENT_SKILLS_STANDARD_KEYS.has(key)));
+		if (Object.keys(xumSection).length === 0) return base;
+		const rulesyncFrontmatter = {
+			...base.getFrontmatter(),
+			xum: xumSection
+		};
+		return new RulesyncSkill({
+			outputRoot: base.getOutputRoot(),
+			relativeDirPath: base.getRelativeDirPath(),
+			dirName: base.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: base.getBody(),
+			otherFiles: base.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = XumSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const xumSection = {};
+		const ignoredKeys = [];
+		for (const [key, value] of Object.entries(rulesyncFrontmatter.xum ?? {})) if (AGENT_SKILLS_STANDARD_KEYS.has(key)) ignoredKeys.push(key);
+		else xumSection[key] = value;
+		if (ignoredKeys.length > 0) warnWithFallback(logger, `${join(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)}: the xum section sets ${ignoredKeys.map(quoteValueForWarning).join(", ")}, which ${ignoredKeys.length === 1 ? "is" : "are"} ignored there; set name/description at the root and the Agent Skills standard fields at the root or in the agentsskills section.`);
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const frontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter)),
+			...xumSection,
+			...userInvocable !== void 0 && { "user-invocable": userInvocable },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation }
+		};
+		AgentsSkillsSkill.reportSpecViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			sourceAllowedTools: rulesyncFrontmatter.agentsskills?.["allowed-tools"],
+			logger
+		});
+		return new XumSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
+	static isTargetedByRulesyncSkill(rulesyncSkill) {
+		const targets = rulesyncSkill.getFrontmatter().targets;
+		return targets.includes("*") || targets.includes("xum");
+	}
+};
+//#endregion
 //#region src/features/skills/zcode-skill.ts
 const ZcodeSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -85175,6 +87126,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: false
 		}
 	}],
+	["androidstudio", {
+		class: AndroidstudioSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["amp", {
 		class: AmpSkill,
 		meta: {
@@ -85360,6 +87319,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["firebender", {
+		class: FirebenderSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["goose", {
 		class: GooseSkill,
 		meta: {
@@ -85610,6 +87577,14 @@ const toolSkillFactories = /* @__PURE__ */ new Map([
 			supportsGlobal: true
 		}
 	}],
+	["xum", {
+		class: XumSkill,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true
+		}
+	}],
 	["devin", {
 		class: DevinSkill,
 		meta: {
@@ -89456,6 +91431,338 @@ var FactorydroidSubagent = class FactorydroidSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/firebender-subagent.ts
+/**
+* Frontmatter of a Firebender agent file. `tools` is a comma-separated string
+* of tool groups (`read`, `edit`, `execution`, `other`) and MCP tools
+* (`mcp_<server>_<tool>`); `model` is `small`, `medium`, `large`, `inherit` or a
+* model ID; `callable` lets the main agent delegate to it. Unknown keys are
+* preserved.
+*
+* @see https://docs.firebender.com/api-reference/agents
+*/
+const FirebenderSubagentFrontmatterSchema = z.looseObject({
+	name: z.optional(z.string()),
+	description: z.optional(z.string()),
+	color: z.optional(z.string()),
+	icon: z.optional(z.string()),
+	tools: z.optional(z.string()),
+	model: z.optional(z.string()),
+	callable: z.optional(z.boolean())
+});
+/**
+* The `agents` entry Firebender resolves to an agent file rulesync writes:
+* relative to the project root for the project config, and to `~/.firebender`
+* for the personal one.
+*/
+function toAgentsEntry({ relativeFilePath, global }) {
+	const fileName = toPosixPath(relativeFilePath);
+	return global ? posix.join(FIREBENDER_AGENTS_DIR_NAME, fileName) : posix.join(toPosixPath(FIREBENDER_AGENTS_DIR_PATH), fileName);
+}
+/**
+* The agent file name an existing `agents` entry points at when it lies
+* directly inside the directory rulesync writes agents to
+* (`.firebender/agents/` in the project; `agents/` or `~/.firebender/agents/`
+* in the personal config), or `undefined` for any other entry
+* (`~/firebender-agents/...`, an absolute path, a nested path).
+*/
+function managedAgentFileName({ entry, global }) {
+	const normalized = toPosixPath(entry).replace(/^\.\//, "");
+	const prefix = global ? `${FIREBENDER_AGENTS_DIR_NAME}/` : `${toPosixPath(FIREBENDER_AGENTS_DIR_PATH)}/`;
+	const homePrefix = `~/${toPosixPath(FIREBENDER_AGENTS_DIR_PATH)}/`;
+	const rest = normalized.startsWith(prefix) ? normalized.slice(prefix.length) : global && normalized.startsWith(homePrefix) ? normalized.slice(homePrefix.length) : void 0;
+	return rest !== void 0 && rest.endsWith(".md") && !rest.includes("/") ? rest : void 0;
+}
+/**
+* Subagent generator for Firebender.
+*
+* Each agent is a Markdown file with YAML frontmatter, written to
+* `.firebender/agents/<name>.md` (project) or `~/.firebender/agents/<name>.md`
+* (global). Firebender only loads agents listed in the `agents` array of
+* `firebender.json`, so generation also registers every file there — see
+* {@link FirebenderAgentsRegistry}. Rulesync subagents are meant to be
+* delegated to, so `callable: true` is written unless the `firebender:`
+* section says otherwise.
+*
+* @see https://docs.firebender.com/api-reference/agents
+*/
+var FirebenderSubagent = class FirebenderSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate !== false) {
+			const result = FirebenderSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({ ...rest });
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: FIREBENDER_AGENTS_DIR_PATH };
+	}
+	/**
+	* Generation also read-modify-writes the `agents` key of `firebender.json`,
+	* so the write is declared for the shared-file order derivation.
+	*/
+	static getExtraSharedWritePaths({ global = false } = {}) {
+		return [{
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME
+		}];
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, callable, ...rest } = this.frontmatter;
+		const firebenderSection = {
+			...rest,
+			...callable !== true && { callable: callable ?? false }
+		};
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name: name ?? basename(this.getRelativeFilePath(), ".md"),
+				description,
+				...Object.keys(firebenderSection).length > 0 && { firebender: firebenderSection }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	/**
+	* Every targeted subagent becomes its own agent file, plus one
+	* {@link FirebenderAgentsRegistry} that lists them in `firebender.json`.
+	* The registry is emitted even when no subagent is targeted, so agents a
+	* previous run registered are retracted once their files are gone. The
+	* agent directory is listed up front so the registry can tell a registered
+	* file that still exists (kept, whoever wrote it) from a stale one.
+	*/
+	static async fromRulesyncSubagents({ outputRoot = process.cwd(), rulesyncSubagents, global = false, logger, deleteOrphans = false }) {
+		const agentsDirPath = this.getSettablePaths({ global }).relativeDirPath;
+		const agentsDirEscapesRoot = await writablePathEscapesRoot({
+			rootPath: outputRoot,
+			targetPath: join(outputRoot, agentsDirPath, "agent.md")
+		});
+		const existingAgentFileNames = new Set(agentsDirEscapesRoot ? [] : await listDirectoryEntryNames(join(outputRoot, agentsDirPath)));
+		const subagents = rulesyncSubagents.map((rulesyncSubagent) => this.fromRulesyncSubagent({
+			outputRoot,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			rulesyncSubagent,
+			global
+		}));
+		const registry = new FirebenderAgentsRegistry({
+			outputRoot,
+			relativeDirPath: getFirebenderConfigDir({ global }),
+			relativeFilePath: FIREBENDER_CONFIG_FILE_NAME,
+			entries: subagents.map((subagent) => toAgentsEntry({
+				relativeFilePath: subagent.getRelativeFilePath(),
+				global
+			})),
+			existingAgentFileNames,
+			deleteOrphans,
+			frozen: agentsDirEscapesRoot,
+			global,
+			logger
+		});
+		return [...subagents, registry];
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const firebenderSection = rulesyncFrontmatter.firebender ?? {};
+		const frontmatter = {
+			name: rulesyncFrontmatter.name,
+			...rulesyncFrontmatter.description !== void 0 && { description: rulesyncFrontmatter.description },
+			callable: true,
+			...firebenderSection
+		};
+		const body = rulesyncSubagent.getBody();
+		return new FirebenderSubagent({
+			outputRoot,
+			frontmatter,
+			body,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent: stringifyFrontmatter(body, frontmatter, { avoidBlockScalars: true }),
+			validate,
+			global
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = FirebenderSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "firebender"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body } = parseFrontmatter(fileContent, filePath);
+		const result = FirebenderSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new FirebenderSubagent({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			fileContent,
+			validate,
+			global
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new FirebenderSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+/**
+* The `agents` array of `firebender.json`, which Firebender requires to load
+* an agent file. Every generated agent is registered. An existing entry that
+* points into rulesync's agent directory is kept while its file exists (a
+* hand-written agent there stays registered) and dropped, with a warning, once
+* the file is gone. Under `--delete` the orphan sweep removes every agent file
+* there that this run does not generate, but only after this file is written,
+* so in that mode such entries are dropped here too and a single run
+* converges. Every other entry and every other key of the file is kept.
+* The array is merged into the file on disk at write time and the file itself
+* is never deleted.
+*/
+var FirebenderAgentsRegistry = class extends ToolSubagent {
+	entries;
+	existingAgentFileNames;
+	deleteOrphans;
+	frozen;
+	logger;
+	mergedContent = null;
+	constructor({ entries, existingAgentFileNames = /* @__PURE__ */ new Set(), deleteOrphans = false, frozen = false, logger, ...rest }) {
+		super({
+			...rest,
+			fileContent: ""
+		});
+		this.entries = entries;
+		this.existingAgentFileNames = existingAgentFileNames;
+		this.deleteOrphans = deleteOrphans;
+		this.frozen = frozen;
+		this.logger = logger;
+	}
+	getEntries() {
+		return this.entries;
+	}
+	isDeletable() {
+		return false;
+	}
+	shouldMergeExistingFileContent() {
+		return true;
+	}
+	setFileContent(newFileContent) {
+		this.mergedContent = this.mergeInto(newFileContent);
+	}
+	getFileContent() {
+		if (this.mergedContent === null) this.mergedContent = this.mergeInto("");
+		return this.mergedContent;
+	}
+	mergeInto(existingContent) {
+		const paths = {
+			relativeDirPath: this.getRelativeDirPath(),
+			relativeFilePath: this.getRelativeFilePath()
+		};
+		const filePath = join(this.getOutputRoot(), paths.relativeDirPath, paths.relativeFilePath);
+		const existing = parseSharedConfig({
+			format: "json",
+			fileContent: existingContent,
+			filePath,
+			invalidRootPolicy: "error"
+		});
+		if (this.frozen) return applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "subagents",
+			existingContent,
+			patch: { agents: existing.agents },
+			filePath,
+			logger: this.logger
+		});
+		const existingEntries = Array.isArray(existing.agents) ? existing.agents : [];
+		const generatedByFileName = new Map(this.entries.map((entry) => [managedAgentFileName({
+			entry,
+			global: this.global
+		}) ?? entry, entry]));
+		const agents = [];
+		const placed = /* @__PURE__ */ new Set();
+		const dropped = [];
+		for (const entry of existingEntries) {
+			const fileName = typeof entry === "string" ? managedAgentFileName({
+				entry,
+				global: this.global
+			}) : void 0;
+			if (fileName === void 0) {
+				agents.push(entry);
+				continue;
+			}
+			const generated = generatedByFileName.get(fileName);
+			if (generated !== void 0) {
+				if (!placed.has(fileName)) {
+					agents.push(generated);
+					placed.add(fileName);
+				}
+			} else if (!this.deleteOrphans && this.existingAgentFileNames.has(fileName)) agents.push(entry);
+			else dropped.push(String(entry));
+		}
+		for (const [fileName, entry] of generatedByFileName) if (!placed.has(fileName)) {
+			agents.push(entry);
+			placed.add(fileName);
+		}
+		if (dropped.length > 0) this.logger?.warn(`Unregistered Firebender agent(s) ${dropped.map((entry) => quoteValueForWarning(entry)).join(", ")} from ${filePath}: ` + (this.deleteOrphans ? "--delete removes agent files that .rulesync/subagents/ no longer generates." : "the agent file no longer exists."));
+		return applySharedConfigPatch({
+			fileKey: sharedConfigFileKey(paths),
+			feature: "subagents",
+			existingContent,
+			patch: { agents: agents.length > 0 ? agents : void 0 },
+			filePath,
+			logger: this.logger
+		});
+	}
+	toRulesyncSubagent() {
+		throw new Error(`${this.getRelativePathFromCwd()} registers Firebender agents and is not a subagent itself.`);
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+};
+//#endregion
 //#region src/features/subagents/goose-subagent.ts
 /**
 * Goose custom agents (v1.34.0+) are Markdown files with YAML frontmatter —
@@ -89743,13 +92050,13 @@ function subagentSlug(relativeFilePath) {
 	return basename(relativeFilePath, ".md").replace(/[^a-zA-Z0-9_-]/g, "_");
 }
 function hermesCommandName(slug) {
-	return `rulesync_subagent_${slug}`;
+	return hermesSlashName(`rulesync-subagent-${slug}`);
 }
 function getPluginManifestContent() {
 	return [
 		"name: rulesync-subagents",
 		"version: \"1.0.0\"",
-		"description: Exposes RuleSync subagents as Hermes native delegation commands.",
+		"description: Exposes RuleSync subagents as Hermes slash commands that queue a delegation prompt.",
 		""
 	].join("\n");
 }
@@ -89757,9 +92064,12 @@ function getPluginInitContent() {
 	return `"""RuleSync-generated Hermes subagent commands."""
 
 import json
+import logging
+import re
 from pathlib import Path
 
 
+logger = logging.getLogger(__name__)
 SUBAGENTS_DIR = Path(__file__).resolve().parents[2] / "rulesync" / "subagents"
 
 
@@ -89779,52 +92089,71 @@ def _load_subagents():
     return subagents
 
 
-def _register_subagent(ctx, subagent):
+def _command_name(subagent, slug):
+    # The spec carries the name Rulesync normalized; Hermes' messaging gateway
+    # resolves plugin commands with "_" turned into "-", so keep it hyphenated.
+    hermes = subagent.get("hermes")
+    name = hermes.get("command") if isinstance(hermes, dict) else None
+    name = name or f"rulesync-subagent-{slug}"
+    # Mirrors hermesSlashName() in src/features/shared/hermes-plugin-commands.ts.
+    name = re.sub(r"[ _]", "-", str(name).lower())
+    name = re.sub(r"[^a-z0-9-]", "", name)
+    return re.sub(r"-{2,}", "-", name).strip("-")
+
+
+${getHermesQueueUserMessagePython({ pluginName: "rulesync-subagents" })}
+
+def _register_subagent(ctx, subagent, registered):
     slug = subagent.get("slug")
     if not slug:
         return
 
-    command_name = f"rulesync_subagent_{slug}"
+    command_name = _command_name(subagent, slug)
+    if command_name in registered:
+        logger.warning(
+            "rulesync-subagents: %s and %s both map to /%s; keeping the first.",
+            registered[command_name],
+            subagent.get("_path"),
+            command_name,
+        )
+        return
+    registered[command_name] = subagent.get("_path")
+
     name = subagent.get("name") or slug
     description = subagent.get("description") or f"Delegate work to the {name} RuleSync subagent."
     system_prompt = subagent.get("prompt") or ""
 
     def handler(args=None, **kwargs):
-        del kwargs
         user_context = ""
         if isinstance(args, dict):
             user_context = args.get("context") or args.get("task") or args.get("prompt") or ""
         elif args is not None:
             user_context = str(args)
 
-        context_parts = []
+        # A slash command runs outside any agent turn, so calling delegate_task
+        # here fails with "delegate_task requires a parent agent context".
+        # Queue the brief as a user message instead; the agent then delegates.
+        parts = [
+            f"Use the delegate_task tool to hand the following task to a subagent "
+            f"acting as the {name} RuleSync subagent.",
+            f"Goal: {description}",
+        ]
         if system_prompt:
-            context_parts.append(system_prompt)
+            parts.append(f"Subagent instructions:\\n{system_prompt}")
         if user_context:
-            context_parts.append(user_context)
+            parts.append(f"Task details:\\n{user_context}")
 
-        # delegate_task takes no model-facing "toolsets" argument: a subagent
-        # inherits the parent's enabled toolsets (role="orchestrator" is the
-        # only knob that changes them). "tasks" is the only shape its schema
-        # advertises; a top-level "goal" is an unadvertised legacy path.
-        return ctx.dispatch_tool(
-            "delegate_task",
-            {
-                "tasks": [
-                    {
-                        "goal": description,
-                        "context": "\\n\\n".join(context_parts),
-                    },
-                ],
-            },
-        )
+        label = f"the {name} subagent task"
+        error = _queue_user_message(ctx, "\\n\\n".join(parts), kwargs, label)
+        return error or f"Queued {label}; the agent will delegate it."
 
     ctx.register_command(command_name, handler, description)
 
 
 def register(ctx):
+    registered = {}
     for subagent in _load_subagents():
-        _register_subagent(ctx, subagent)
+        _register_subagent(ctx, subagent, registered)
 `;
 }
 function getEnabledPluginConfigContent({ currentContent, global }) {
@@ -89855,7 +92184,7 @@ function getSubagentSpec(rulesyncSubagent) {
 		prompt: rulesyncSubagent.getBody(),
 		hermes: {
 			command: hermesCommandName(slug),
-			dispatch: "delegate_task"
+			dispatch: "inject_message"
 		}
 	};
 }
@@ -90531,6 +92860,15 @@ const KiroCliSubagentJsonSchema = z.looseObject({
 	allowedTools: z.optional(z.nullable(z.array(z.string()))),
 	includeMcpJson: z.optional(z.nullable(z.boolean()))
 });
+/**
+* The name Kiro gives an agent file: its path relative to the agents directory
+* without the extension, so a nested `team/planner.md` is `team/planner`.
+* https://kiro.dev/docs/custom-agents/
+*/
+function kiroAgentNameFromPath(relativeFilePath) {
+	const posixPath = toPosixPath(relativeFilePath);
+	return posixPath.slice(0, posixPath.length - extname(posixPath).length);
+}
 var KiroSubagent = class extends ToolSubagent {
 	body;
 	constructor({ body, ...rest }) {
@@ -90566,7 +92904,7 @@ var KiroSubagent = class extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: [toolTarget],
-				name: name ?? basename(this.getRelativeFilePath(), ".json"),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? void 0,
 				...Object.keys(kiroSection).length > 0 && { kiro: kiroSection }
 			},
@@ -90716,7 +93054,7 @@ var KiroIdeSubagent = class KiroIdeSubagent extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
-				name: name ?? this.getRelativeFilePath().replace(/\.md$/, ""),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? "",
 				...Object.keys(kiroIdeSection).length > 0 && { "kiro-ide": kiroIdeSection }
 			},
@@ -92647,6 +94985,166 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	}
 };
 //#endregion
+//#region src/features/subagents/xum-subagent.ts
+/**
+* The built-in agent a rulesync subagent inherits from when its `xum` block
+* names neither a `base` nor its own `tools`. Xum gives an agent no tools at
+* all unless some agent in its `base` chain declares them, so a definition
+* without either would be a prompt that cannot read or edit anything.
+*/
+const XUM_DEFAULT_BASE_AGENT = "exec";
+/**
+* Frontmatter of a Xum agent definition. `name` (the display name) is
+* required; the other documented fields are typed loosely and unknown keys are
+* kept (looseObject) so a round trip never drops them.
+*
+* @see https://xum.cdr.dev/agents
+*/
+const XumSubagentFrontmatterSchema = z.looseObject({
+	name: z.string(),
+	description: z.optional(z.string()),
+	base: z.optional(z.string()),
+	disabled: z.optional(z.boolean()),
+	ui: z.optional(z.looseObject({})),
+	prompt: z.optional(z.looseObject({})),
+	subagent: z.optional(z.looseObject({})),
+	ai: z.optional(z.looseObject({})),
+	tools: z.optional(z.looseObject({}))
+});
+/**
+* Subagent generator for Xum (formerly Mux).
+*
+* Xum reads custom agent definitions — Markdown with YAML frontmatter — from
+* the top level of `.xum/agents/` (project) and `~/.xum/agents/` (user); the
+* body is the agent's instruction prompt. The file name (without `.md`) is the
+* agent id, so it must be lowercase letters and digits with single `-` / `_`
+* separators; Xum skips other files with a warning.
+*
+* rulesync writes `name` and `description`, spreads the `xum` section (`base`,
+* `ui`, `prompt`, `subagent`, `ai`, `tools`, ...) on top, and fills two
+* defaults so the definition works as a delegated subagent out of the box:
+* `subagent.runnable: true` (required for `task({ agentId })` to spawn it) and,
+* when the section sets neither `base` nor `tools`, `base: exec`.
+*
+* @see https://xum.cdr.dev/agents
+*/
+var XumSubagent = class XumSubagent extends ToolSubagent {
+	frontmatter;
+	body;
+	constructor({ frontmatter, body, ...rest }) {
+		if (rest.validate !== false) {
+			const result = XumSubagentFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		super({ ...rest });
+		this.frontmatter = frontmatter;
+		this.body = body;
+	}
+	static getSettablePaths(_options = {}) {
+		return { relativeDirPath: XUM_AGENTS_DIR_PATH };
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	toRulesyncSubagent() {
+		const { name, description, ...restFields } = this.frontmatter;
+		return new RulesyncSubagent({
+			outputRoot: ".",
+			frontmatter: {
+				targets: ["*"],
+				name,
+				description,
+				...Object.keys(restFields).length > 0 && { xum: restFields }
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath(),
+			validate: true
+		});
+	}
+	static fromRulesyncSubagent({ outputRoot = process.cwd(), rulesyncSubagent, validate = true, global = false }) {
+		const rulesyncFrontmatter = rulesyncSubagent.getFrontmatter();
+		const xumSection = this.filterToolSpecificSection(rulesyncFrontmatter.xum ?? {}, ["name", "description"]);
+		const subagentSection = xumSection.subagent;
+		const result = XumSubagentFrontmatterSchema.safeParse({
+			name: rulesyncFrontmatter.name,
+			...rulesyncFrontmatter.description && { description: rulesyncFrontmatter.description },
+			...xumSection.base === void 0 && xumSection.tools === void 0 && { base: XUM_DEFAULT_BASE_AGENT },
+			...xumSection,
+			subagent: {
+				runnable: true,
+				...isPlainObject$1(subagentSection) ? subagentSection : {}
+			}
+		});
+		if (!result.success) throw new Error(`Invalid xum subagent frontmatter in ${rulesyncSubagent.getRelativeFilePath()}: ${formatError(result.error)}`);
+		const body = rulesyncSubagent.getBody();
+		return new XumSubagent({
+			outputRoot,
+			frontmatter: result.data,
+			body,
+			relativeDirPath: this.getSettablePaths({ global }).relativeDirPath,
+			relativeFilePath: rulesyncSubagent.getRelativeFilePath(),
+			fileContent: stringifyFrontmatter(body, result.data),
+			validate
+		});
+	}
+	validate() {
+		if (!this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = XumSubagentFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	static isTargetedByRulesyncSubagent(rulesyncSubagent) {
+		return this.isTargetedByRulesyncSubagentDefault({
+			rulesyncSubagent,
+			toolTarget: "xum"
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath, validate = true, global = false }) {
+		const paths = this.getSettablePaths({ global });
+		const filePath = join(outputRoot, paths.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body } = parseFrontmatter(fileContent, filePath);
+		const result = XumSubagentFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new XumSubagent({
+			outputRoot,
+			relativeDirPath: paths.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			fileContent,
+			validate
+		});
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new XumSubagent({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			frontmatter: {
+				name: "",
+				description: ""
+			},
+			body: "",
+			fileContent: "",
+			validate: false
+		});
+	}
+};
+//#endregion
 //#region src/features/subagents/zcode-subagent.ts
 const ZcodeSubagentFrontmatterSchema = z.looseObject({
 	name: z.string(),
@@ -93112,6 +95610,17 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.md"
 		}
 	}],
+	["firebender", {
+		class: FirebenderSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			emitsEmptyAggregate: true,
+			emitsEmptyAggregateOnDelete: true,
+			filePattern: "*.md"
+		}
+	}],
 	["goose", {
 		class: GooseSubagent,
 		meta: {
@@ -93163,7 +95672,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.json"
+			filePattern: "**/*.json",
+			supportsNestedPaths: true
 		}
 	}],
 	["kiro-ide", {
@@ -93172,7 +95682,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.md"
+			filePattern: "**/*.md",
+			supportsNestedPaths: true
 		}
 	}],
 	["lettacode", {
@@ -93339,6 +95850,15 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			filePattern: "*.toml"
 		}
 	}],
+	["xum", {
+		class: XumSubagent,
+		meta: {
+			supportsProject: true,
+			supportsSimulated: false,
+			supportsGlobal: true,
+			filePattern: "*.md"
+		}
+	}],
 	["zcode", {
 		class: ZcodeSubagent,
 		meta: {
@@ -93393,6 +95913,7 @@ function compareRelativePathsShallowestFirst(left, right) {
 var SubagentsProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
+	deleteOrphans;
 	getFactory;
 	/**
 	* Whether the last `loadRulesyncFiles` found a `subagents/` directory under
@@ -93400,13 +95921,14 @@ var SubagentsProcessor = class extends FeatureProcessor {
 	* agents in its Pool settings are its own and must not be retracted.
 	*/
 	rulesyncSourceDirFound = false;
-	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, logger }) {
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$1, dryRun = false, deleteOrphans = false, logger }) {
 		super({
 			outputRoot,
 			inputRoots,
 			dryRun,
 			logger
 		});
+		this.deleteOrphans = deleteOrphans;
 		const result = SubagentsProcessorToolTargetSchema.safeParse(toolTarget);
 		if (!result.success) throw new Error(`Invalid tool target for SubagentsProcessor: ${toolTarget}. ${formatError(result.error)}`);
 		this.toolTarget = result.data;
@@ -93414,7 +95936,9 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		this.getFactory = getFactory;
 	}
 	emitsToolFilesForEmptySource() {
-		return this.rulesyncSourceDirFound && this.getFactory(this.toolTarget).meta.emitsEmptyAggregate === true;
+		const { meta } = this.getFactory(this.toolTarget);
+		if (meta.emitsEmptyAggregate !== true) return false;
+		return this.rulesyncSourceDirFound || this.deleteOrphans && meta.emitsEmptyAggregateOnDelete === true;
 	}
 	async convertRulesyncFilesToToolFiles(rulesyncFiles) {
 		const rulesyncSubagents = rulesyncFiles.filter((file) => file instanceof RulesyncSubagent);
@@ -93430,11 +95954,12 @@ var SubagentsProcessor = class extends FeatureProcessor {
 		});
 		if (factory.class.fromRulesyncSubagents) {
 			if (targeted.length === 0 && !this.emitsToolFilesForEmptySource()) return [];
-			const toolSubagents = factory.class.fromRulesyncSubagents({
+			const toolSubagents = await factory.class.fromRulesyncSubagents({
 				outputRoot: this.outputRoot,
 				rulesyncSubagents: targeted,
 				global: this.global,
-				logger: this.logger
+				logger: this.logger,
+				deleteOrphans: this.deleteOrphans && !this.hasRulesyncSourceLoadFailure()
 			});
 			return Array.isArray(toolSubagents) ? toolSubagents : [toolSubagents];
 		}
@@ -94180,7 +96705,7 @@ const isAiassistantApply = (value) => AIASSISTANT_APPLY_VALUES.includes(value);
 /**
 * Globs that match the whole project and so say nothing beyond "always".
 */
-const UNIVERSAL_GLOBS$5 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const UNIVERSAL_GLOBS$6 = /* @__PURE__ */ new Set(["**/*", "*"]);
 const METADATA_DELIMITER = "---";
 /**
 * Splits text into lines that keep their own line terminator, so the body can
@@ -94305,7 +96830,7 @@ var AiassistantRule = class AiassistantRule extends ToolRule {
 	*/
 	static buildMetadata(frontmatter) {
 		const globs = (frontmatter.globs ?? []).map((glob) => flattenValue(glob)).filter((glob) => glob.length > 0).flatMap((glob) => expandBraceAlternations(glob));
-		const hasUniversalGlob = globs.some((glob) => UNIVERSAL_GLOBS$5.has(glob));
+		const hasUniversalGlob = globs.some((glob) => UNIVERSAL_GLOBS$6.has(glob));
 		const instructions = frontmatter.description && flattenValue(frontmatter.description);
 		const explicitApply = frontmatter.aiassistant?.apply && flattenValue(frontmatter.aiassistant.apply);
 		const apply = explicitApply ? explicitApply : frontmatter.root !== true && globs.length > 0 && !hasUniversalGlob ? "by file patterns" : frontmatter.root !== true && globs.length === 0 && instructions ? "by model decision" : "always";
@@ -96959,7 +99484,7 @@ function normalizePatternList(value) {
 * an always-on rule into a "when any file is in context" rule. Dropped on
 * generate and mapped back on import.
 */
-const UNIVERSAL_GLOBS$4 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const UNIVERSAL_GLOBS$5 = /* @__PURE__ */ new Set(["**/*", "*"]);
 /**
 * Rule generator for Continue (continuedev/continue), the open-source IDE
 * extension and CLI (`cn`).
@@ -97073,7 +99598,7 @@ var ContinueRule = class ContinueRule extends ToolRule {
 		if (alwaysApply === true) return;
 		const targetGlobs = continueGlobs ?? parentGlobs;
 		if (!targetGlobs || targetGlobs.length === 0) return;
-		if (targetGlobs.every((glob) => UNIVERSAL_GLOBS$4.has(glob.trim()))) return;
+		if (targetGlobs.every((glob) => UNIVERSAL_GLOBS$5.has(glob.trim()))) return;
 		return targetGlobs;
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
@@ -97565,7 +100090,7 @@ const CursorRuleFrontmatterSchema = z.object({
 * does not already say. Same pair the Cline and Qwen Code adapters treat as
 * universal.
 */
-const UNIVERSAL_GLOBS$3 = /* @__PURE__ */ new Set(["**/*", "*"]);
+const UNIVERSAL_GLOBS$4 = /* @__PURE__ */ new Set(["**/*", "*"]);
 var CursorRule = class CursorRule extends ToolRule {
 	frontmatter;
 	body;
@@ -97606,7 +100131,8 @@ var CursorRule = class CursorRule extends ToolRule {
 	}
 	/**
 	* Custom parse function for Cursor MDC files
-	* MDC files don't support quotes in YAML, so we need to handle patterns like *.ts specially
+	* MDC files don't support quotes in YAML, so we need to handle patterns like *.ts specially.
+	* Also used by Firebender, whose `.firebender/rules/*.mdc` files carry the same frontmatter.
 	*/
 	static parseCursorFrontmatter(fileContent, filePath) {
 		const bounds = findFrontmatterBlockBounds(fileContent);
@@ -97669,7 +100195,7 @@ var CursorRule = class CursorRule extends ToolRule {
 	static resolveCursorGlobs({ cursorSpecificGlobs, parentGlobs, alwaysApply }) {
 		const targetGlobs = cursorSpecificGlobs !== void 0 ? cursorSpecificGlobs : parentGlobs;
 		if (!targetGlobs || targetGlobs.length === 0) return;
-		if (alwaysApply && targetGlobs.every((glob) => UNIVERSAL_GLOBS$3.has(glob.trim()))) return;
+		if (alwaysApply && targetGlobs.every((glob) => UNIVERSAL_GLOBS$4.has(glob.trim()))) return;
 		return targetGlobs.join(",");
 	}
 	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
@@ -98583,6 +101109,211 @@ var FactorydroidRule = class FactorydroidRule extends ToolRule {
 	}
 };
 //#endregion
+//#region src/features/rules/firebender-rule.ts
+/**
+* Frontmatter of a Firebender `.mdc` rule. Every field is optional; `globs`
+* is one comma-separated string, and a YAML list is tolerated on import.
+*/
+const FirebenderRuleFrontmatterSchema = z.looseObject({
+	description: z.optional(z.nullable(z.string())),
+	globs: z.optional(z.nullable(z.union([z.string(), z.array(z.string())]))),
+	alwaysApply: z.optional(z.nullable(z.boolean()))
+});
+/** Globs that match every file, and so add nothing to an always-applied rule. */
+const UNIVERSAL_GLOBS$3 = /* @__PURE__ */ new Set(["**/*", "*"]);
+function normalizeGlobs$2(globs) {
+	if (globs === null || globs === void 0) return [];
+	return (typeof globs === "string" ? globs.split(",") : globs).map((glob) => glob.trim()).filter((glob) => glob.length > 0);
+}
+/**
+* Rule generator for Firebender.
+*
+* Root rule: Firebender looks for `.firebender/AGENTS.md` first (then the
+* project-root `AGENTS.md`, then the same pair in parent directories, then
+* `~/.firebender/AGENTS.md`) and uses the first file it finds, so the root rule
+* is written to `.firebender/AGENTS.md` in the project and to
+* `~/.firebender/AGENTS.md` globally, where it does not collide with the
+* project-root `AGENTS.md` the `agentsmd` target owns.
+*
+* Non-root rules: `.firebender/rules/*.mdc` (project) and
+* `~/.firebender/rules/*.mdc` (personal), each with optional Cursor-style
+* frontmatter: `description`, `globs` (one comma-separated string) and
+* `alwaysApply`. A rule with specific globs is written with
+* `alwaysApply: false` and those globs; every other rule is always applied.
+*
+* @see https://docs.firebender.com/api-reference/rules
+* @see https://docs.firebender.com/api-reference/agents-md
+*/
+var FirebenderRule = class FirebenderRule extends ToolRule {
+	frontmatter;
+	body;
+	constructor({ frontmatter = {}, body, ...rest }) {
+		if (rest.validate && !rest.root) {
+			const result = FirebenderRuleFrontmatterSchema.safeParse(frontmatter);
+			if (!result.success) throw new Error(`Invalid frontmatter in ${join(rest.relativeDirPath, rest.relativeFilePath)}: ${formatError(result.error)}`);
+		}
+		const resolvedBody = body ?? rest.fileContent;
+		super({
+			...rest,
+			fileContent: rest.root ? resolvedBody : stringifyFrontmatter(resolvedBody, FirebenderRule.toOutputFrontmatter(frontmatter), { avoidBlockScalars: true })
+		});
+		this.frontmatter = frontmatter;
+		this.body = resolvedBody;
+	}
+	static getSettablePaths({ excludeToolDir } = {}) {
+		return {
+			root: {
+				relativeDirPath: buildToolPath(FIREBENDER_DIR, ".", excludeToolDir),
+				relativeFilePath: FIREBENDER_AGENTS_MD_FILE_NAME
+			},
+			nonRoot: { relativeDirPath: buildToolPath(FIREBENDER_DIR, "rules", excludeToolDir) }
+		};
+	}
+	/**
+	* The frontmatter written to a `.mdc` file: `alwaysApply` first, then the
+	* flattened `description`, then the globs joined the way Firebender's docs
+	* spell them (`"*.kt, *.kts"`).
+	*/
+	static toOutputFrontmatter(frontmatter) {
+		const description = typeof frontmatter.description === "string" ? frontmatter.description.replace(/[\r\n\u0085\u2028\u2029]+/g, " ").trim() : "";
+		const globs = normalizeGlobs$2(frontmatter.globs);
+		return {
+			...typeof frontmatter.alwaysApply === "boolean" && { alwaysApply: frontmatter.alwaysApply },
+			...description !== "" && { description },
+			...globs.length > 0 && { globs: globs.join(", ") }
+		};
+	}
+	/**
+	* Derives the Firebender frontmatter from the canonical one: specific globs
+	* make a file-scoped rule, everything else (no globs, universal globs) is
+	* always applied. Firebender splits `globs` on every comma, so a brace
+	* alternation such as `*.{ts,tsx}` is expanded into one glob per branch.
+	*/
+	static buildFrontmatter(frontmatter) {
+		const globs = normalizeGlobs$2(frontmatter.globs ?? []).flatMap((glob) => expandBraceAlternations(glob));
+		const specificGlobs = globs.filter((glob) => !UNIVERSAL_GLOBS$3.has(glob));
+		const isFileScoped = specificGlobs.length > 0 && specificGlobs.length === globs.length;
+		const description = frontmatter.description?.trim() || void 0;
+		return {
+			alwaysApply: !isFileScoped,
+			...description !== void 0 && { description },
+			...isFileScoped && { globs: specificGlobs.join(", ") }
+		};
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true }) {
+		const paths = this.getSettablePaths();
+		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
+		if (rulesyncFrontmatter.root ?? false) return new FirebenderRule({
+			outputRoot,
+			relativeDirPath: paths.root.relativeDirPath,
+			relativeFilePath: paths.root.relativeFilePath,
+			fileContent: rulesyncRule.getBody(),
+			validate,
+			root: true,
+			description: rulesyncFrontmatter.description,
+			globs: rulesyncFrontmatter.globs
+		});
+		return new FirebenderRule({
+			outputRoot,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath: rulesyncRule.getRelativeFilePath().replace(/\.md$/, ".mdc"),
+			frontmatter: this.buildFrontmatter(rulesyncFrontmatter),
+			body: rulesyncRule.getBody(),
+			fileContent: "",
+			validate,
+			root: false
+		});
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, validate = true }) {
+		const paths = this.getSettablePaths();
+		if (relativeFilePath === paths.root.relativeFilePath && (relativeDirPath === void 0 || relativeDirPath === paths.root.relativeDirPath)) {
+			const fileContent = await readFileContent(join(outputRoot, paths.root.relativeDirPath, paths.root.relativeFilePath));
+			return new FirebenderRule({
+				outputRoot,
+				relativeDirPath: paths.root.relativeDirPath,
+				relativeFilePath: paths.root.relativeFilePath,
+				fileContent,
+				validate,
+				root: true
+			});
+		}
+		const filePath = join(outputRoot, paths.nonRoot.relativeDirPath, relativeFilePath);
+		const fileContent = await readFileContent(filePath);
+		const { frontmatter, body } = CursorRule.parseCursorFrontmatter(fileContent, filePath);
+		const result = FirebenderRuleFrontmatterSchema.safeParse(frontmatter);
+		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
+		return new FirebenderRule({
+			outputRoot,
+			relativeDirPath: paths.nonRoot.relativeDirPath,
+			relativeFilePath,
+			frontmatter: result.data,
+			body: body.trim(),
+			fileContent: "",
+			validate,
+			root: false
+		});
+	}
+	toRulesyncRule() {
+		if (this.isRoot()) return this.toRulesyncRuleDefault();
+		const sourceGlobs = normalizeGlobs$2(this.frontmatter.globs);
+		const alwaysApply = this.frontmatter.alwaysApply ?? void 0;
+		const description = this.frontmatter.description?.trim() || void 0;
+		const globs = alwaysApply === true || sourceGlobs.length === 0 ? ["**/*"] : sourceGlobs;
+		return new RulesyncRule({
+			outputRoot: process.cwd(),
+			frontmatter: {
+				targets: ["*"],
+				root: false,
+				...description !== void 0 && { description },
+				globs
+			},
+			body: this.body,
+			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
+			relativeFilePath: this.getRelativeFilePath().replace(/\.mdc$/, ".md"),
+			validate: true
+		});
+	}
+	validate() {
+		if (this.isRoot() || !this.frontmatter) return {
+			success: true,
+			error: null
+		};
+		const result = FirebenderRuleFrontmatterSchema.safeParse(this.frontmatter);
+		if (result.success) return {
+			success: true,
+			error: null
+		};
+		return {
+			success: false,
+			error: /* @__PURE__ */ new Error(`Invalid frontmatter in ${join(this.relativeDirPath, this.relativeFilePath)}: ${formatError(result.error)}`)
+		};
+	}
+	getFrontmatter() {
+		return this.frontmatter;
+	}
+	getBody() {
+		return this.body;
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		const paths = this.getSettablePaths();
+		const isRoot = relativeFilePath === paths.root.relativeFilePath && relativeDirPath === paths.root.relativeDirPath;
+		return new FirebenderRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: isRoot
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "firebender"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/gitlabduo-rule.ts
 /**
 * GitLab Duo CLI reads custom rules from a single plain-Markdown file:
@@ -101864,6 +104595,117 @@ var WarpRule = class extends NestedAgentsmdRule {
 	}
 };
 //#endregion
+//#region src/features/rules/xum-rule.ts
+/** An ATX level-1 heading line (`# Title`), which Xum's parser treats as an H1. */
+const ATX_H1_LINE = /^ {0,3}#(?:[ \t]|$)/;
+/**
+* Make `body` start at a level-1 heading, adding `# <heading>` when it does not
+* already open with one.
+*
+* Xum reads `.xum/AGENTS.md` (and appends `AGENTS.local.md`) as one Markdown
+* document and treats a `Mode:` / `Model:` / `Tool:` heading as a scoped
+* section that runs until the next heading of the same or a higher level.
+* Fragments rulesync concatenates into that document — folded topic rules and
+* the local overlay — would otherwise fall inside a scoped section the
+* preceding fragment ends with, and Xum would inject them only in that mode.
+* Only an H1 closes a section of any level, so each such fragment opens with
+* one.
+*
+* @see https://github.com/coder/xum/blob/main/src/node/utils/main/markdown.ts
+*/
+function ensureXumSectionBoundary({ body, heading }) {
+	const firstLine = body.split(/\r?\n/).find((line) => line.trim() !== "");
+	if (firstLine !== void 0 && ATX_H1_LINE.test(firstLine)) return body;
+	const safeHeading = heading.replaceAll(/[\r\n:]/g, " ").trim() || "Instructions";
+	return body.trim() === "" ? `# ${safeHeading}\n` : `# ${safeHeading}\n\n${body}`;
+}
+/** The heading a folded rule opens with: its file name without the extension. */
+function xumRuleHeading(rulesyncRule) {
+	const fileName = basename(rulesyncRule.getRelativeFilePath());
+	return fileName.slice(0, fileName.length - extname(fileName).length);
+}
+/**
+* Rule generator for Xum (Coder's parallel coding-agent app, formerly Mux).
+*
+* Xum layers its own `.xum/AGENTS.md` (project) and `~/.xum/AGENTS.md` (user)
+* on top of the shared root `AGENTS.md` / `AGENT.md` / `CLAUDE.md`, which the
+* `agentsmd` target already writes, so this target writes only the
+* Xum-dedicated file. Only these files honor the `## Model: <regex>` and
+* `## Mode: <mode>` scoped sections; rulesync passes the body through as-is,
+* so such sections authored in a rule keep working. The personal
+* `.xum/AGENTS.local.md` overlay is written for a `localRoot: true` rule.
+*
+* @see https://xum.cdr.dev/agents/instruction-files
+*/
+var XumRule = class XumRule extends ToolRule {
+	constructor({ fileContent, root, ...rest }) {
+		super({
+			...rest,
+			fileContent,
+			root: root ?? false
+		});
+	}
+	static getSettablePaths(_options = {}) {
+		return { root: {
+			relativeDirPath: XUM_DIR,
+			relativeFilePath: XUM_RULE_FILE_NAME
+		} };
+	}
+	static async fromFile({ outputRoot = process.cwd(), relativeFilePath: _relativeFilePath, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const relativePath = join(root.relativeDirPath, root.relativeFilePath);
+		const fileContent = await readFileContent(join(outputRoot, relativePath));
+		return new XumRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent,
+			validate,
+			root: true
+		});
+	}
+	static fromRulesyncRule({ outputRoot = process.cwd(), rulesyncRule, validate = true, global = false }) {
+		const { root } = this.getSettablePaths({ global });
+		const isRoot = rulesyncRule.getFrontmatter().root ?? false;
+		return new XumRule({
+			outputRoot,
+			relativeDirPath: root.relativeDirPath,
+			relativeFilePath: root.relativeFilePath,
+			fileContent: isRoot ? rulesyncRule.getBody() : ensureXumSectionBoundary({
+				body: rulesyncRule.getBody(),
+				heading: xumRuleHeading(rulesyncRule)
+			}),
+			validate,
+			root: isRoot
+		});
+	}
+	toRulesyncRule() {
+		return this.toRulesyncRuleDefault();
+	}
+	validate() {
+		return {
+			success: true,
+			error: null
+		};
+	}
+	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath }) {
+		return new XumRule({
+			outputRoot,
+			relativeDirPath,
+			relativeFilePath,
+			fileContent: "",
+			validate: false,
+			root: relativeFilePath === "AGENTS.md" && relativeDirPath === ".xum"
+		});
+	}
+	static isTargetedByRulesyncRule(rulesyncRule) {
+		return this.isTargetedByRulesyncRuleDefault({
+			rulesyncRule,
+			toolTarget: "xum"
+		});
+	}
+};
+//#endregion
 //#region src/features/rules/zcode-rule.ts
 var ZcodeRule = class ZcodeRule extends ToolRule {
 	constructor({ fileContent, root, ...rest }) {
@@ -102352,6 +105194,14 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "compose"
 		}
 	}],
+	["firebender", {
+		class: FirebenderRule,
+		meta: {
+			extension: "mdc",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto"
+		}
+	}],
 	["goose", {
 		class: GooseRule,
 		meta: {
@@ -102635,6 +105485,17 @@ const toolRuleFactories = /* @__PURE__ */ new Map([
 			collisionPolicy: "fold"
 		}
 	}],
+	["xum", {
+		class: XumRule,
+		meta: {
+			extension: "md",
+			supportsGlobal: true,
+			ruleDiscoveryMode: "auto",
+			collisionPolicy: "fold",
+			localRootMode: "separate-local-file",
+			localRootFileName: XUM_LOCAL_RULE_FILE_NAME
+		}
+	}],
 	["devin", {
 		class: DevinRule,
 		meta: {
@@ -103405,18 +106266,39 @@ var RulesProcessor = class extends FeatureProcessor {
 			root: true,
 			localRoot
 		});
-		if (isClassOrSubclassOf({
-			candidate: factory.class,
-			base: QwencodeRule
-		})) return new QwencodeRule({
-			outputRoot: this.outputRoot,
-			relativeDirPath: relativeDirPath ?? ".qwen",
-			relativeFilePath: fileName,
-			fileContent: body,
-			validate: true,
-			root: true,
+		return this.buildToolDirLocalRootFile({
+			factory,
+			fileName,
+			body,
+			relativeDirPath,
 			localRoot
 		});
+	}
+	/**
+	* Qwen Code and Xum read the personal local file from their tool directory
+	* (`.qwen/QWEN.local.md`, `.xum/AGENTS.local.md`), not the project root
+	* (project scope only; global handling never reaches here).
+	*/
+	buildToolDirLocalRootFile({ factory, fileName, body, relativeDirPath, localRoot }) {
+		const toolDirEntry = [[QwencodeRule, QWENCODE_DIR], [XumRule, XUM_DIR]].find(([base]) => isClassOrSubclassOf({
+			candidate: factory.class,
+			base
+		}));
+		if (toolDirEntry) {
+			const [toolDirClass, toolDir] = toolDirEntry;
+			return new toolDirClass({
+				outputRoot: this.outputRoot,
+				relativeDirPath: relativeDirPath ?? toolDir,
+				relativeFilePath: fileName,
+				fileContent: toolDirClass === XumRule && !localRoot ? ensureXumSectionBoundary({
+					body,
+					heading: "Local instructions"
+				}) : body,
+				validate: true,
+				root: true,
+				localRoot
+			});
+		}
 		return null;
 	}
 	/**
@@ -106168,6 +109050,7 @@ async function generateSubagentsCore(params) {
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
+			deleteOrphans: config.getDelete(),
 			logger
 		});
 		const result = await processFeatureWithRulesyncFiles({
@@ -106790,6 +109673,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { RulesyncHooks as $, removeDirectoryStrict as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, parseCommaSeparatedList as Bn, getFileSizeAndExecutableBit as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_IGNORE_RELATIVE_FILE_PATH as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, truncateText as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, ALL_FEATURES_WITH_WILDCARD as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as In, directoryExists as It, RulesyncRule as J, quoteForLog as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, hasDeceptiveHiddenCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_PERMISSIONS_SCHEMA_URL as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_RELATIVE_DIR_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_MCP_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_RULES_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectory as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, RULESYNC_USER_CONFIG_DIR_NAME as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_CONFIG_SCHEMA_URL as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, DEPRECATED_FEATURE_REPLACEMENTS as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, ALL_FEATURES as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, formatError as Wn, isSymlink as Wt, RulesyncPermissions as X, stripControlCharactersKeepingLineFeeds as Xn, readFileContent as Xt, RulesyncRuleFrontmatterSchema as Y, stripControlCharacters as Yn, posixRelativePathEscapesRoot as Yt, RulesyncMcp as Z, stripHiddenCharacters as Zn, readFileContentOrNull as Zt, CRUSH_LOCAL_RULE_FILE_NAME as _, MAX_FILE_SIZE as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, runWithDirectoryRollback as an, RulesyncCheck as at, LETTACODE_DIR as b, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, writeFileBuffer as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ALL_TOOL_TARGETS as dn, ConfigResolver as dt, removeFile as en, getRulesyncSourceCandidates as et, displayWidthOf as f, ALL_TOOL_TARGETS_WITH_WILDCARD as fn, mergeInputRootConfigs as ft, HooksProcessor as g, FEATURE_SOURCE_TREE_ENTRIES as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, CURATED_RULES_FEATURE_SUBDIR as hn, ConfigFileSchema as ht, inspectInputRoots as i, resolvedRelativePath as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_MCP_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, writeFileContent as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, ToolTargetSchema as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, removeTempDirectory as nn, parseJsonc as nt, convertFromTool as o, splitPathSegments as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, PACKAGING_TOOL_TARGETS as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, hasEnclosingMarkOutsideKeycap as qn, listSubdirectoryNames as qt, generate as r, resolvePath as rn, RulesyncCommand as rt, isPackagingToolTarget as s, toPosixPath as sn, stringifyFrontmatter as st, importFromTool as t, removeFileStrict as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, mapWithConcurrency as un, SKILL_FILE_NAME as ut, CommandsProcessor as v, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as wn, warnOnConflictingFlags as wt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as x, RULESYNC_CONFIG_RELATIVE_FILE_PATH as xn, JsonLogger as xt, REASONIX_LOCAL_RULE_FILE_NAME as y, RULESYNC_CHECKS_RELATIVE_DIR_PATH as yn, findControlCharacter as yt, QWENCODE_DIR as z, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as zn, findFilesByGlobs as zt };
+export { RulesyncHooks as $, stripHiddenCharacters as $n, readFileContentOrNull as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_MCP_RELATIVE_FILE_PATH as An, PathOutsideRootError as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_USER_CONFIG_DIR_NAME as Bn, fileExists as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_RELATIVE_DIR_PATH as Fn, assertWritablePathInsideRoot as Ft, RulesyncSubagentFrontmatterSchema as G, DEPRECATED_FEATURE_REPLACEMENTS as Gn, isFileSystemError as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, parseCommaSeparatedList as Hn, getFileSizeAndExecutableBit as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_RULES_RELATIVE_DIR_PATH as In, checkPathTraversal as It, RulesyncRule as J, hasDeceptiveHiddenCharacters as Jn, listFilePathsRecursively as Jt, RulesyncSkill as K, formatError as Kn, isSymlink as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Ln, createTempDirectory as Lt, CODEXCLI_DIR as M, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Mn, assertDirectoryIfExists as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Nn, assertPathResolvesInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_IGNORE_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_PERMISSIONS_SCHEMA_URL as Pn, assertTreeContainsNoSymlinks as Pt, RulesyncIgnore as Q, stripControlCharactersKeepingLineFeeds as Qn, readFileContent as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Rn, directoryExists as Rt, COMMANDCODE_DIR as S, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, ALL_FEATURES as Un, getHomeDirectory as Ut, AUGMENTCODE_DIR as V, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Vn, findFilesByGlobs as Vt, RulesyncSubagent as W, ALL_FEATURES_WITH_WILDCARD as Wn, isFileNotFoundError as Wt, RulesyncPermissions as X, quoteForLog as Xn, pathEscapesRoot as Xt, RulesyncRuleFrontmatterSchema as Y, hasEnclosingMarkOutsideKeycap as Yn, listSubdirectoryNames as Yt, RulesyncMcp as Z, stripControlCharacters as Zn, posixRelativePathEscapesRoot as Zt, CRUSH_LOCAL_RULE_FILE_NAME as _, CURATED_RULES_FEATURE_SUBDIR as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, resolvePath as an, RulesyncCheck as at, LETTACODE_DIR as b, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, splitPathSegments as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, writeFileContent as dn, ConfigResolver as dt, removeDirectory as en, getRulesyncSourceCandidates as et, displayWidthOf as f, mapWithConcurrency as fn, mergeInputRootConfigs as ft, HooksProcessor as g, ToolTargetSchema as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, PACKAGING_TOOL_TARGETS as hn, ConfigFileSchema as ht, inspectInputRoots as i, removeTempDirectory as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_MCP_SCHEMA_URL as jn, applyFileMode as jt, caseFoldIdentity as k, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as kn, ErrorCodes as kt, SubagentsProcessor as l, toPosixPath as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, ALL_TOOL_TARGETS_WITH_WILDCARD as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, removeFile as nn, parseJsonc as nt, convertFromTool as o, resolvedRelativePath as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, ALL_TOOL_TARGETS as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, truncateText as qn, listDirectoryEntryNames as qt, generate as r, removeFileStrict as rn, RulesyncCommand as rt, isPackagingToolTarget as s, runWithDirectoryRollback as sn, stringifyFrontmatter as st, importFromTool as t, removeDirectoryStrict as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, writeFileBuffer as un, SKILL_FILE_NAME as ut, CommandsProcessor as v, FEATURE_SOURCE_TREE_ENTRIES as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_CONFIG_SCHEMA_URL as wn, warnOnConflictingFlags as wt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as x, RULESYNC_CHECKS_RELATIVE_DIR_PATH as xn, JsonLogger as xt, REASONIX_LOCAL_RULE_FILE_NAME as y, MAX_FILE_SIZE as yn, findControlCharacter as yt, QWENCODE_DIR as z, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as zn, ensureDir as zt };
 
-//# sourceMappingURL=import-CoFTCNq7.js.map
+//# sourceMappingURL=import-Chn7Nqnm.js.map