rulesync 39.0.0 → 40.0.0

package/dist/{import-HHSMWQi-.cjs → import-BRZzK3w5.cjs}

@@ -457,36 +457,36 @@ const isFeatureValueEnabled = (value) => {
 const parseCommaSeparatedList = (value) => value.split(",").map((s) => s.trim()).filter(Boolean);
 //#endregion
 //#region src/constants/rulesync-paths.ts
-const { join: join$439 } = node_path.posix;
+const { join: join$441 } = node_path.posix;
 const RULESYNC_CONFIG_RELATIVE_FILE_PATH = "rulesync.jsonc";
 const RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH = "rulesync.local.jsonc";
 const RULESYNC_USER_CONFIG_DIR_NAME = "rulesync";
 const RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME = ".config";
 const RULESYNC_RELATIVE_DIR_PATH = ".rulesync";
 const RULES_FEATURE_SUBDIR = "rules";
-const CURATED_RULES_FEATURE_SUBDIR = join$439(RULES_FEATURE_SUBDIR, ".curated");
+const CURATED_RULES_FEATURE_SUBDIR = join$441(RULES_FEATURE_SUBDIR, ".curated");
 const COMMANDS_FEATURE_SUBDIR = "commands";
 const SUBAGENTS_FEATURE_SUBDIR = "subagents";
 const CHECKS_FEATURE_SUBDIR = "checks";
 const SKILLS_FEATURE_SUBDIR = "skills";
-const CURATED_SKILLS_FEATURE_SUBDIR = join$439(SKILLS_FEATURE_SUBDIR, ".curated");
-const RULESYNC_RULES_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
-const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
-const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
-const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
-const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
-const RULESYNC_MCP_RELATIVE_FILE_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
-const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
-const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
-join$439(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
-const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
-const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
+const CURATED_SKILLS_FEATURE_SUBDIR = join$441(SKILLS_FEATURE_SUBDIR, ".curated");
+const RULESYNC_RULES_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, RULES_FEATURE_SUBDIR);
+const RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, CURATED_RULES_FEATURE_SUBDIR);
+const RULESYNC_COMMANDS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, COMMANDS_FEATURE_SUBDIR);
+const RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, SUBAGENTS_FEATURE_SUBDIR);
+const RULESYNC_CHECKS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, CHECKS_FEATURE_SUBDIR);
+const RULESYNC_MCP_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "mcp.jsonc");
+const RULESYNC_HOOKS_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "hooks.jsonc");
+const RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "permissions.jsonc");
+join$441(RULESYNC_RELATIVE_DIR_PATH, "mcp.json");
+const RULESYNC_HOOKS_LEGACY_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "hooks.json");
+const RULESYNC_PERMISSIONS_LEGACY_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, "permissions.json");
 const RULESYNC_AIIGNORE_FILE_NAME = ".aiignore";
-const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
+const RULESYNC_AIIGNORE_RELATIVE_FILE_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, ".aiignore");
 const RULESYNC_IGNORE_RELATIVE_FILE_PATH = ".rulesyncignore";
 const RULESYNC_OVERVIEW_FILE_NAME = "overview.md";
-const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
-const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$439(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
+const RULESYNC_SKILLS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, SKILLS_FEATURE_SUBDIR);
+const RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH = join$441(RULESYNC_RELATIVE_DIR_PATH, CURATED_SKILLS_FEATURE_SUBDIR);
 const RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync.lock";
 const RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH = "rulesync-npm.lock.json";
 const RULESYNC_MCP_FILE_NAME = "mcp.jsonc";
@@ -1070,6 +1070,57 @@ async function assertWritablePathInsideRoot(params) {
 		existingPath = parentPath;
 	}
 }
+/**
+* Thrown by {@link assertPathResolvesInsideRoot} when a symbolic link leads
+* the target outside the root, or the target is reached through a dangling
+* link. Any other error it throws comes from the filesystem itself.
+*/
+var PathOutsideRootError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PathOutsideRootError";
+	}
+};
+/**
+* Refuse a write or removal target whose real location is outside `rootPath`.
+*
+* Unlike {@link assertWritablePathInsideRoot}, a symbolic link on the way is
+* allowed as long as it resolves inside the root: projects deliberately link a
+* skill directory to a shared one next to it. What this stops is a link that
+* leads elsewhere — a cloned repository committing `.rulesync/skills/x ->
+* ~/.ssh`, say — which a textual check such as {@link checkPathTraversal}
+* cannot see. The deepest existing ancestor of `targetPath` is resolved, and
+* an existing target that is itself a link is resolved too.
+*/
+async function assertPathResolvesInsideRoot(params) {
+	const { rootPath, targetPath } = params;
+	let realRoot;
+	try {
+		realRoot = await (0, node_fs_promises.realpath)(rootPath);
+	} catch (error) {
+		if (isFileNotFoundError(error)) {
+			if (await isSymlink(rootPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${rootPath}.`, { cause: error });
+			return;
+		}
+		throw error;
+	}
+	let existingPath = (0, node_path.resolve)(targetPath);
+	while (true) {
+		let realExisting;
+		try {
+			realExisting = await (0, node_fs_promises.realpath)(existingPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+			if (await isSymlink(existingPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${targetPath}.`, { cause: error });
+			const parentPath = (0, node_path.dirname)(existingPath);
+			if (parentPath === existingPath) throw error;
+			existingPath = parentPath;
+			continue;
+		}
+		if (pathEscapesRoot((0, node_path.relative)(realRoot, realExisting))) throw new PathOutsideRootError(`Path resolves outside ${rootPath} through a symbolic link: ${targetPath}.`);
+		return;
+	}
+}
 async function assertTreeContainsNoSymlinks(dirPath) {
 	for (const entry of await (0, node_fs_promises.readdir)(dirPath, { withFileTypes: true })) {
 		const entryPath = (0, node_path.join)(dirPath, entry.name);
@@ -5134,6 +5185,40 @@ const COPILOT_HOOK_EVENTS = [
 	"userPromptExpansion"
 ];
 /**
+* The {@link COPILOT_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex. The hooks reference documents matcher filtering on
+* `preToolUse` / `postToolUse` / `permissionRequest` (tool name), `preCompact`
+* (trigger) and `subagentStart` (agent name), plus `notification`; the last
+* two are not authorable for `copilot`, so they are not listed here. VS Code's
+* migration guide confirms the Copilot harness "applies documented matcher
+* rules" (only the legacy Local harness ignores them).
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/migrate-customizations
+*/
+const COPILOT_MATCHER_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"preCompact",
+	"subagentStart"
+];
+/**
+* The {@link COPILOTCLI_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex: the shared {@link COPILOT_MATCHER_HOOK_EVENTS} plus the two
+* CLI-only events, `permissionRequest` (tool name) and `notification`
+* (notification type).
+*
+* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
+* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
+* `Edit|Write`) are now honored instead of silently dropped").
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+*/
+const COPILOTCLI_MATCHER_HOOK_EVENTS = [
+	...COPILOT_MATCHER_HOOK_EVENTS,
+	"permissionRequest",
+	"notification"
+];
+/**
 * Hook events supported by the GitHub Copilot CLI (`copilotcli-hooks.ts`).
 *
 * The CLI documents a wider event surface than the shared cloud-agent set, so
@@ -5287,12 +5372,15 @@ const KIRO_IDE_HOOK_EVENTS = [
 /**
 * Hook events supported by Google Antigravity (both the IDE and the CLI).
 *
-* Antigravity exposes a Claude-style hooks surface covering the five
-* tool/model/turn lifecycle events it documents: `PreToolUse`, `PostToolUse`,
-* `PreInvocation`, `PostInvocation`, and `Stop`. The model-invocation events
-* (`PreInvocation`/`PostInvocation`) and `Stop` are matcher-less handler lists.
+* Antigravity exposes a Claude-style hooks surface covering the six
+* session/tool/model/turn lifecycle events it documents: `SessionStart`,
+* `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop`.
+* `SessionStart`, the model-invocation events (`PreInvocation`/`PostInvocation`)
+* and `Stop` are matcher-less handler lists.
+* https://antigravity.google/docs/hooks
 */
 const ANTIGRAVITY_HOOK_EVENTS = [
+	"sessionStart",
 	"preToolUse",
 	"postToolUse",
 	"preModelInvocation",
@@ -6065,8 +6153,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 44 entries as
-* of v0.21.6 (tag `v0.21.6`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 46 entries as
+* of v0.22.3 (tag `v0.22.3`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -6090,15 +6178,16 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v0.21.6`: `VALID_HOOKS` holds 44 entries, grown
+* Verified against the tag `v0.22.3`: `VALID_HOOKS` holds 46 entries, grown
 * from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16` (v0.20.2) — v0.21
 * added `agent_loop_stopped` and `on_room_member_activity`, v0.21.5 added
-* `pre_auxiliary_call` and `post_auxiliary_call`, and v0.21.6 added
+* `pre_auxiliary_call` and `post_auxiliary_call`, v0.21.6 added
 * `post_gateway_admission`, `on_human_input_request` and
-* `on_human_input_resolved`. This list holds 43 of them — see
+* `on_human_input_resolved`, and v0.22.3 added `on_session_delete` and
+* `post_compaction`. This list holds 45 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -6122,6 +6211,7 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_session_end",
 	"on_session_finalize",
 	"on_session_reset",
+	"on_session_delete",
 	"on_skill_lifecycle",
 	"subagent_start",
 	"subagent_stop",
@@ -6143,7 +6233,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_kanban_task_updated",
 	"on_kanban_dispatch_tick",
 	"gateway_platform_event",
-	"pre_command"
+	"pre_command",
+	"post_compaction"
 ];
 /**
 * `VALID_HOOKS` entries a SHELL hook may not register for. `VALID_HOOKS` doubles
@@ -6155,8 +6246,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -6338,10 +6429,11 @@ const CANONICAL_TO_AUGMENTCODE_EVENT_NAMES = {
 const AUGMENTCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENTCODE_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
 * Map canonical camelCase event names to Antigravity PascalCase.
-* Antigravity uses the same PascalCase names as Claude for its tool/turn events,
+* Antigravity uses the same PascalCase names as Claude for its session/tool/turn events,
 * plus `PreInvocation`/`PostInvocation` for the model-invocation lifecycle.
 */
 const CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES = {
+	sessionStart: "SessionStart",
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
 	preModelInvocation: "PreInvocation",
@@ -7360,14 +7452,19 @@ const toolScopedMcpSchema = zod_mini.z.looseObject({ mcpServers: zod_mini.z.opti
 /**
 * Kimi Code's tool-scoped block also carries the `[mcp]` defaults from its
 * shared user config: connect and per-tool-call timeouts that apply to *every*
-* MCP server, including ones rulesync did not write. Per-server
-* `startupTimeoutMs` / `toolTimeoutMs` in `mcpServers` still win.
+* MCP server, including ones rulesync did not write, and (Kimi Code 2.3.0)
+* `defaultDeferred`, which loads every server's tools on demand unless the
+* server opts out. Per-server `startupTimeoutMs` / `toolTimeoutMs` / `deferred`
+* in `mcpServers` still win. `defaultDeferred` only takes effect when Kimi's
+* experimental `tool-select` flag is on, and is captured when a server connects
+* (MoonshotAI/kimi-code#4210).
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
 */
 const kimiCodeScopedMcpSchema = zod_mini.z.extend(toolScopedMcpSchema, {
 	startupTimeoutMs: zod_mini.z.optional(zod_mini.z.number()),
-	toolTimeoutMs: zod_mini.z.optional(zod_mini.z.number())
+	toolTimeoutMs: zod_mini.z.optional(zod_mini.z.number()),
+	defaultDeferred: zod_mini.z.optional(zod_mini.z.boolean())
 });
 /**
 * Qwen Code's tool-scoped block also carries the server-level allow/deny lists
@@ -8136,13 +8233,16 @@ const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
-* before prompting. `always-ask` auto-approves only read-only tools, `write`
-* also workspace writes, and `yolo` (oh-my-pi's default) every tier.
+* before prompting. `always-ask` auto-approves only read-only tools,
+* `always-ask-cached` (Ask and remember) also prompts before file reads and
+* lets a prompt remember the granted file or folder, `write` also
+* auto-approves workspace writes, and `yolo` (oh-my-pi's default) every tier.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
 */
 const OMP_APPROVAL_MODES = [
 	"always-ask",
+	"always-ask-cached",
 	"write",
 	"yolo"
 ];
@@ -8163,10 +8263,13 @@ const KimiCodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	])),
 	/**
 	* Kimi's `[permission] dangerous_command_guard` switch (Kimi Code 0.40.0,
-	* default `true`). `false` turns off the built-in dangerous-command policy
-	* (no confirmation for `rm -rf`, `shutdown` and the like).
+	* default `true`). Since Kimi Code 2.3.0, `false` turns off every built-in
+	* guard confirmation policy: dangerous commands (`rm -rf`, `shutdown` and the
+	* like), sensitive-file access (`.env`, `id_rsa`, ...) and git control-path
+	* access. Before 2.3.0 it only covered dangerous commands.
 	*
 	* @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
+	* @see https://github.com/MoonshotAI/kimi-code/pull/4250
 	*/
 	dangerousCommandGuard: zod_mini.z.optional(zod_mini.z.boolean()),
 	rules: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.looseObject({
@@ -8526,6 +8629,8 @@ const TabninePermissionsOverrideSchema = zod_mini.z.looseObject({
 * { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 * @example
 * { "mode": "deny" }
+* @example
+* { "tools": { "disabled": ["web_fetch"] }, "askOnExternalOrigin": true }
 */
 const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -8539,7 +8644,9 @@ const ReasonixPermissionsOverrideSchema = zod_mini.z.looseObject({
 		"ask",
 		"allow",
 		"deny"
-	]))
+	])),
+	askOnExternalOrigin: zod_mini.z.optional(zod_mini.z.boolean()),
+	tools: zod_mini.z.optional(zod_mini.z.strictObject({ disabled: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())) }))
 });
 /**
 * Tool-scoped override block for Qoder. `outputStyle` is written to the
@@ -11353,6 +11460,15 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({}))
 	})),
+	xum: zod_mini.z.optional(zod_mini.z.looseObject({
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean()),
+		advertise: zod_mini.z.optional(zod_mini.z.boolean()),
+		"user-invocable": zod_mini.z.optional(zod_mini.z.boolean()),
+		"argument-hint": zod_mini.z.optional(zod_mini.z.string()),
+		when_to_use: zod_mini.z.optional(zod_mini.z.string()),
+		"when-to-use": zod_mini.z.optional(zod_mini.z.string()),
+		paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	})),
 	zcode: zod_mini.z.optional(zod_mini.z.looseObject({
 		when_to_use: zod_mini.z.optional(zod_mini.z.string()),
 		license: zod_mini.z.optional(zod_mini.z.string()),
@@ -11631,7 +11747,7 @@ async function getLocalSkillDirNames(sourceTree) {
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, zed, pi, omp, qwencode, vibe, grokcli, factorydroid, dsh, reasonix,
-* commandcode, lettacode, opencode, mimocode). Each tool's own section may override that
+* commandcode, lettacode, opencode, mimocode, xum). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -11651,7 +11767,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh, reasonix, commandcode,
-* lettacode). Each tool's own section may override that default with a
+* lettacode, xum). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -13966,7 +14082,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -13987,7 +14104,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -24112,6 +24230,7 @@ var QwencodeCommand = class QwencodeCommand extends ToolCommand {
 const REASONIX_PROJECT_MCP_FILE_NAME = "reasonix.toml";
 const REASONIX_GLOBAL_DIR = ".reasonix";
 const REASONIX_GLOBAL_MCP_FILE_NAME = "config.toml";
+const REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH = (0, node_path.join)(".reasonix", REASONIX_PROJECT_MCP_FILE_NAME);
 const REASONIX_PROJECT_PERMISSIONS_FILE_NAME = REASONIX_PROJECT_MCP_FILE_NAME;
 const REASONIX_GLOBAL_PERMISSIONS_FILE_NAME = REASONIX_GLOBAL_MCP_FILE_NAME;
 const REASONIX_DIR = REASONIX_GLOBAL_DIR;
@@ -28459,25 +28578,65 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 //#endregion
 //#region src/features/hooks/antigravity-hooks.ts
 /**
-* Antigravity uses a Claude-Code-like `hooks.json` (matcher shape). The
-* `PreToolUse`/`PostToolUse` events use the matcher-based array shape, while
-* `PreInvocation`/`PostInvocation`/`Stop` are matcher-less handler lists.
-* `projectDirVar` is empty because Antigravity does not document a
-* project-directory variable for commands.
+* Canonical events whose Antigravity counterparts (`SessionStart`,
+* `PreInvocation`, `PostInvocation`, `Stop`) take no matcher.
+*/
+const ANTIGRAVITY_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"sessionStart",
+	"preModelInvocation",
+	"postModelInvocation",
+	"stop"
+]);
+/**
+* Antigravity event names whose value is a flat list of handlers
+* (`"Stop": [ { "type": "command", "command": "..." } ]`) rather than a list
+* of `{ "matcher", "hooks": [...] }` groups. Antigravity's loader rejects a
+* wrapped group under these events ("command hook must specify 'command'")
+* and then skips the whole `hooks.json`.
+* https://antigravity.google/docs/hooks
+*/
+const ANTIGRAVITY_FLAT_HANDLER_EVENTS = new Set([...ANTIGRAVITY_NO_MATCHER_EVENTS].map((event) => lookupOwn({
+	record: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
+	key: event
+}) ?? event));
+/**
+* Antigravity uses a Claude-Code-like `hooks.json`. The `PreToolUse` /
+* `PostToolUse` events use the matcher-based group shape, while `SessionStart`,
+* `PreInvocation`, `PostInvocation` and `Stop` are flat handler lists (see
+* {@link toAntigravityEventMap}). `projectDirVar` is empty because Antigravity
+* does not document a project-directory variable for commands.
 */
 const ANTIGRAVITY_CONVERTER_CONFIG = {
 	supportedEvents: ANTIGRAVITY_HOOK_EVENTS,
 	canonicalToToolEventNames: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
 	toolToCanonicalEventNames: ANTIGRAVITY_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"preModelInvocation",
-		"postModelInvocation",
-		"stop"
-	]),
+	noMatcherEvents: ANTIGRAVITY_NO_MATCHER_EVENTS,
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
 };
 /**
+* Turn the shared converter's matcher-group output into Antigravity's shape:
+* the matcher-less events get their handlers directly under the event key.
+*/
+function toAntigravityEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event)) return [event, entries];
+		return [event, entries.flatMap((entry) => isPlainObject$1(entry) && Array.isArray(entry.hooks) ? entry.hooks : [])];
+	}));
+}
+/**
+* Reverse of {@link toAntigravityEventMap} for import: wrap each flat handler
+* of a matcher-less event in a `{ hooks: [...] }` group so the shared converter
+* can read it. An entry that is already a group (`{ hooks: [...] }`, as older
+* rulesync versions wrote) is kept as is.
+*/
+function toMatcherGroupEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event) || !Array.isArray(entries)) return [event, entries];
+		return [event, entries.map((entry) => isPlainObject$1(entry) && !("hooks" in entry) ? { hooks: [entry] } : entry)];
+	}));
+}
+/**
 * Antigravity's `hooks.json` is keyed by a named hook whose value holds the
 * per-event map (plus an optional `enabled` flag). rulesync writes a single
 * generated hook under this stable name.
@@ -28514,8 +28673,8 @@ function flattenAntigravityHooks(parsed) {
 * Hooks generator for Google Antigravity (both the IDE and the CLI).
 *
 * Antigravity writes a dedicated `hooks.json` keyed by a named hook whose
-* value holds the Claude-Code-style event → matcher-entry map
-* (`{ "<name>": { "<Event>": [...] } }`). Project and global modes share the
+* value holds the event map (`{ "<name>": { "<Event>": [...] } }`): matcher
+* groups for the tool events, flat handler lists for the others. Project and global modes share the
 * same shape; only the location differs (`.agents/hooks.json` vs
 * `~/.gemini/config/hooks.json`).
 *
@@ -28559,12 +28718,12 @@ var AntigravityHooks = class extends ToolHooks {
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
-		const eventMap = canonicalToToolHooks({
+		const eventMap = toAntigravityEventMap(canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config[this.getOverrideKey()]?.hooks,
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
-		});
+		}));
 		const antigravityHooks = Object.keys(eventMap).length > 0 ? { [ANTIGRAVITY_HOOK_NAME]: eventMap } : {};
 		const fileContent = JSON.stringify(antigravityHooks, null, 2);
 		return new this({
@@ -28583,7 +28742,7 @@ var AntigravityHooks = class extends ToolHooks {
 			throw new Error(`Failed to parse Antigravity hooks content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: flattenAntigravityHooks(parsed),
+			hooks: toMatcherGroupEventMap(flattenAntigravityHooks(parsed)),
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
 		});
@@ -31047,11 +31206,17 @@ var ContinueHooks = class extends SettingsJsonHooks {
 * entry that uses them instead of a shell field is not mistaken for one
 * without a command.
 *
+* An optional `matcher` regex is honored on the events in
+* {@link COPILOT_MATCHER_HOOK_EVENTS}. The VS Code per-OS override fields come
+* from the legacy Local hooks reference and are kept for existing files.
+*
 * @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/hooks
 * @see https://code.visualstudio.com/docs/agents/reference/hooks-reference
 */
 const CopilotHookEntrySchema = zod_mini.z.looseObject({
 	type: zod_mini.z.string(),
+	matcher: zod_mini.z.optional(zod_mini.z.string()),
 	bash: zod_mini.z.optional(zod_mini.z.string()),
 	powershell: zod_mini.z.optional(zod_mini.z.string()),
 	command: zod_mini.z.optional(zod_mini.z.string()),
@@ -31085,8 +31250,10 @@ function canonicalToCopilotHooks(config) {
 		...sharedConfigHooks,
 		...config.copilot?.hooks
 	};
+	const matcherEvents = new Set(COPILOT_MATCHER_HOOK_EVENTS);
 	const copilot = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
+		const matcherSupported = matcherEvents.has(eventName);
 		const copilotEventName = lookupOwn({
 			record: CANONICAL_TO_COPILOT_EVENT_NAMES,
 			key: eventName
@@ -31094,7 +31261,7 @@ function canonicalToCopilotHooks(config) {
 		const entries = [];
 		for (const def of definitions) {
 			const hookType = def.type ?? "command";
-			if (def.matcher) continue;
+			if (def.matcher && !matcherSupported) continue;
 			if (hookType !== "command") continue;
 			const command = def.command;
 			const timeout = def.timeout;
@@ -31102,6 +31269,7 @@ function canonicalToCopilotHooks(config) {
 			const rest = Object.fromEntries(Object.entries(def).filter(([k]) => !canonicalSchemaKeys.includes(k)));
 			entries.push({
 				type: hookType,
+				...def.matcher && { matcher: def.matcher },
 				...command !== void 0 && command !== null && { [commandField]: command },
 				...def.env !== void 0 && { env: def.env },
 				...timeout !== void 0 && timeout !== null && { timeoutSec: timeout },
@@ -31196,6 +31364,7 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			if (command === void 0 && hasOsOverride(passthrough)) logger?.warn(`Copilot hook on '${copilotEventName}' has only VS Code per-OS overrides (windows/linux/osx) and no portable command; it is preserved for copilot, but other targets will generate it without a command until a \`command\` is added.`);
 			defs.push({
 				type: "command",
+				...entry.matcher !== void 0 && entry.matcher !== "" && { matcher: entry.matcher },
 				...command !== void 0 && { command },
 				...shell !== void 0 && { shell },
 				...timeout !== void 0 && { timeout },
@@ -31339,21 +31508,13 @@ var CopilotHooks = class CopilotHooks extends ToolHooks {
 */
 /**
 * Canonical events whose Copilot CLI hook entries honor an optional `matcher`
-* field (a regex compiled as `^(?:PATTERN)$`, tested against `toolName`).
-*
-* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
-* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
-* `Edit|Write`) are now honored instead of silently dropped").
-* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* field (a regex compiled as `^(?:PATTERN)$`). The hooks reference filters each
+* on a different field: the tool name for `preToolUse` / `postToolUse` /
+* `permissionRequest`, `notification_type`, the `preCompact` trigger
+* (`manual` | `auto`) and the `subagentStart` agent name.
+* See {@link COPILOTCLI_MATCHER_HOOK_EVENTS}.
 */
-const COPILOTCLI_MATCHER_EVENTS = /* @__PURE__ */ new Set([
-	"preToolUse",
-	"postToolUse",
-	"notification",
-	"permissionRequest",
-	"preCompact",
-	"subagentStart"
-]);
+const COPILOTCLI_MATCHER_EVENTS = new Set(COPILOTCLI_MATCHER_HOOK_EVENTS);
 /** Human-readable list of the matcher-aware events, for the drop warning. */
 const COPILOTCLI_MATCHER_EVENTS_LABEL = [...COPILOTCLI_MATCHER_EVENTS].join("/");
 const CopilotCliHookEntrySchema = zod_mini.z.looseObject({
@@ -33489,7 +33650,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.6; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.22.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -37579,7 +37740,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: COPILOT_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: true,
+		matcherEvents: COPILOT_MATCHER_HOOK_EVENTS
 	}],
 	["copilotcli", {
 		class: CopilotcliHooks,
@@ -37594,7 +37756,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			"prompt",
 			"http"
 		],
-		supportsMatcher: false
+		supportsMatcher: true
 	}],
 	["kilo", {
 		class: KiloHooks,
@@ -39984,6 +40146,31 @@ const REASONIX_READ_TOOL_NAME = "read_file";
 * treated as rulesync-owned on generate so the dormant copy is replaced.
 */
 const REASONIX_LEGACY_READ_TOOL_NAME = "Read";
+async function isPathPresent(path) {
+	return await fileExists(path) || await isPresentButUnresolvable(path);
+}
+/**
+* Warns when a project-scope generate is about to create `./reasonix.toml`
+* next to an existing `.reasonix/reasonix.toml`.
+*
+* Since v2.46.0 Reasonix reads `.reasonix/reasonix.toml` as the project config
+* when `./reasonix.toml` is absent, and never merges the two: once the root
+* file exists it wins, so every setting in the nested file (permissions,
+* sandbox, disabled tools, MCP servers, ...) silently stops applying. rulesync
+* writes only the root file, so it cannot keep the nested one in effect; this
+* at least names the problem, once per run however many of the features that
+* write the file (mcp, permissions, ignore) are generated. Like Reasonix, anything at the root path
+* (including a broken symlink) counts as the root file being there.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/internal/contract/config/paths.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/CONFIG_PATHS.md
+*/
+async function warnIfReasonixNestedProjectConfigShadowed({ outputRoot, global, logger }) {
+	if (global) return;
+	if (await isPathPresent((0, node_path.join)(outputRoot, "reasonix.toml"))) return;
+	if (!await isPathPresent((0, node_path.join)(outputRoot, REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH))) return;
+	const nested = toPosixPath(REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH);
+	warnOnceWithFallback(logger, `Reasonix: ${nested} exists but ${REASONIX_PROJECT_MCP_FILE_NAME} does not. Generating creates ${REASONIX_PROJECT_MCP_FILE_NAME}, and Reasonix then reads it instead of ${nested} (the two are never merged), so every setting in ${nested} stops applying. Move those settings into ${REASONIX_PROJECT_MCP_FILE_NAME} or the rulesync sources.`);
+}
 //#endregion
 //#region src/features/ignore/reasonix-ignore.ts
 const permissionsTableOf = (document) => toReasonixTable(document.permissions);
@@ -40067,7 +40254,12 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 			fileContent: rulesyncPatterns.join("\n")
 		});
 	}
-	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const readDenies = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((pattern) => buildReadDenyEntry(pattern, REASONIX_READ_TOOL_NAME));
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -40645,7 +40837,8 @@ var IgnoreProcessor = class extends FeatureProcessor {
 			outputRoot: this.outputRoot,
 			rulesyncIgnore,
 			options: this.featureOptions,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		});
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
 			toolIgnore,
@@ -40995,13 +41188,31 @@ function renameServerField(servers, from, to) {
 		return [name, Object.fromEntries(Object.entries(config).map(([key, value]) => key === from ? [to, value] : [key, value]))];
 	}));
 }
+function isEmptyValue(value) {
+	if (Array.isArray(value)) return value.length === 0;
+	return isPlainObject$1(value) && Object.keys(value).length === 0;
+}
 /**
 * Antigravity uses `serverUrl` (not the canonical `url`) for HTTP/SSE MCP
 * servers. Convert the canonical shape into Antigravity's on the way out, and
-* back to canonical on the way in, so round-tripping is lossless.
+* back to canonical on the way in.
+*
+* Antigravity documents no `type` field: the transport follows from `command`
+* (stdio) or `serverUrl` (Streamable HTTP / SSE), and `agy plugin validate`
+* reports the canonical `type` as an unknown field, so it is not written. A
+* remote server that carries `command`, `args` or `env` was also observed to be
+* refused at startup (runtime behavior reported by `agy plugin validate` 1.4.4,
+* not documented), so an empty `args` / `env` left on a `serverUrl` server is
+* dropped.
+* https://antigravity.google/docs/mcp
 */
 function toAntigravityMcpServers(servers) {
-	return renameServerField(servers, "url", "serverUrl");
+	const renamed = renameServerField(servers, "url", "serverUrl");
+	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
+		if (!isPlainObject$1(config)) return [name, config];
+		const isRemote = typeof config.serverUrl === "string";
+		return [name, Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value))))];
+	}));
 }
 function toCanonicalMcpServers(servers) {
 	return renameServerField(servers, "serverUrl", "url");
@@ -45191,6 +45402,60 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 	return true;
 }
 /**
+* Translate a canonical `oauth` block into dcode's custom Slack OAuth app
+* settings, or `undefined` (after warning) when it has to be left out.
+*
+* Since deepagents-code 0.1.87, `_validate_slack_oauth_config` accepts `oauth`
+* only as `{ client_id, client_secret? }` of non-empty strings, and only on a
+* `slack.com` / `*.slack.com` server with `auth: "oauth"`; anything else makes
+* dcode skip the whole server. The canonical block usually carries Claude
+* Code's `{ clientId, callbackPort, ... }` shape, so `clientId` becomes
+* `client_id` (a native `client_id` wins), `client_secret` passes through, and
+* every other key is dropped.
+*
+* @see https://github.com/langchain-ai/deepagents/blob/deepagents-code%3D%3D0.1.87/libs/code/deepagents_code/mcp_config.py
+*/
+function toDeepagentsOauth({ name, oauth, converted, logger }) {
+	if (!isSlackOauthServer(converted)) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		return;
+	}
+	const source = isRecord$1(oauth) ? oauth : {};
+	const result = {};
+	for (const [key, value] of Object.entries(source)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const nativeKey = key === "clientId" ? "client_id" : key;
+		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			continue;
+		}
+		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
+		if (!isDeepagentsOauthValue(value)) {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			continue;
+		}
+		result[nativeKey] = value;
+	}
+	if (result.client_id === void 0) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		return;
+	}
+	return result;
+}
+function isDeepagentsOauthValue(value) {
+	return typeof value === "string" && value.trim() !== "" && !/[\x00-\x1f\x7f]/.test(value);
+}
+function isSlackOauthServer(server) {
+	if (server.auth !== "oauth" || typeof server.url !== "string") return false;
+	let host;
+	try {
+		host = new URL(server.url).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return host === "slack.com" || host.endsWith(".slack.com");
+}
+/**
 * Translate one canonical server into dcode's `.mcp.json` shape, or `null` to
 * skip it.
 *
@@ -45213,7 +45478,7 @@ function toDeepagentsServer({ name, server, logger }) {
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
 	});
-	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, ...rest } = server;
+	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, oauth, ...rest } = server;
 	const converted = { ...rest };
 	if (!applyDeepagentsCommand({
 		name,
@@ -45228,6 +45493,15 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (transport !== void 0) converted.transport = normalized;
 		else converted.type = normalized;
 	}
+	if (oauth !== void 0) {
+		const deepagentsOauth = toDeepagentsOauth({
+			name,
+			oauth,
+			converted,
+			logger
+		});
+		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
+	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
 		toolName: TOOL_NAME,
 		serverName: name,
@@ -45254,6 +45528,13 @@ function toRulesyncServer(server) {
 	const converted = { ...rest };
 	for (const key of ["type", "transport"]) if (converted[key] === "streamable_http" || converted[key] === "streamable-http") converted[key] = "http";
 	if (Array.isArray(allowedTools)) converted.enabledTools = allowedTools;
+	if (isRecord$1(converted.oauth) && Object.hasOwn(converted.oauth, "client_id")) {
+		const { client_id: clientId, ...oauthRest } = converted.oauth;
+		converted.oauth = Object.hasOwn(oauthRest, "clientId") ? oauthRest : {
+			clientId,
+			...oauthRest
+		};
+	}
 	return converted;
 }
 var DeepagentsMcp = class DeepagentsMcp extends ToolMcp {
@@ -46986,6 +47267,50 @@ function copyHermesOauth(source) {
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_COST_UNIT_MAX_LENGTH = 32;
+function describeHermesValue(value) {
+	return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
+}
+/**
+* Copies the per-server MCP cost keys Hermes v0.22.3 reads in
+* `tools/mcp_tool_costs.py`: `tool_costs` (declared per-tool costs keyed by
+* MCP tool name; each a number, a `[min, max]` range or `{credits, note}`),
+* `spend_limit` (per-chat budget for the server's costed tools; `0`/absent =
+* no limit) and `cost_unit` (label shown with costs; default `credits`).
+*
+* A costed call that would exceed `spend_limit` asks first even on a
+* `trust: full` server, so dropping the key on regenerate would silently
+* remove the guard. Values Hermes would reject when loading the server are
+* dropped with a warning instead of being written into a config Hermes then
+* refuses: `spend_limit` must be a finite non-negative number, `cost_unit` a
+* non-blank string of at most 32 characters, and `tool_costs` a mapping. The
+* mapping is rebuilt as an opaque object (so no reference is shared with the
+* source), with prototype-pollution keys removed at every depth since its
+* values may themselves be objects.
+*/
+function copyHermesCostFields({ source, target, logger }) {
+	let copied = false;
+	const { spend_limit: spendLimit, cost_unit: costUnit, tool_costs: toolCosts } = source;
+	if (spendLimit !== void 0) {
+		if (typeof spendLimit === "number" && Number.isFinite(spendLimit) && spendLimit >= 0) {
+			target.spend_limit = spendLimit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping spend_limit ${describeHermesValue(spendLimit)}; Hermes requires a non-negative number.`);
+	}
+	if (costUnit !== void 0) {
+		if (typeof costUnit === "string" && costUnit.trim() !== "" && costUnit.length <= HERMES_COST_UNIT_MAX_LENGTH) {
+			target.cost_unit = costUnit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping cost_unit ${describeHermesValue(costUnit)}; Hermes requires a non-empty string of at most ${HERMES_COST_UNIT_MAX_LENGTH} characters.`);
+	}
+	if (toolCosts !== void 0) {
+		if (isPlainObject$1(toolCosts)) {
+			target.tool_costs = omitPrototypePollutionKeysDeep(toolCosts);
+			copied = true;
+		} else logger?.warn("Hermes MCP: dropping tool_costs; Hermes requires a mapping of MCP tool names to costs.");
+	}
+	return copied;
+}
 const HERMES_OPAQUE_MAPPING_KEYS = [
 	"sampling",
 	"elicitation",
@@ -46997,13 +47322,18 @@ const HERMES_OPAQUE_MAPPING_KEYS = [
 * alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
 * path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
 * `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
-* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, `identity_header`, and
+* the cost keys (see {@link copyHermesCostFields}) —
 * verbatim from `source` to `target`. Field names are identical on both sides
 * (the canonical `McpServerSchema` is a `looseObject`), so this serves export
 * and import alike. See the Hermes mcp-config-reference.
 */
-function copyHermesAdvancedFields(source, target) {
-	let copied = false;
+function copyHermesAdvancedFields(source, target, logger) {
+	let copied = copyHermesCostFields({
+		source,
+		target,
+		logger
+	});
 	if (typeof source.auth === "string") {
 		target.auth = source.auth;
 		copied = true;
@@ -47112,7 +47442,7 @@ function applyHermesToolsBlock(hermesTools, server) {
 * as Hermes's own `transport: sse`, without which Hermes would connect to it
 * over Streamable HTTP.
 */
-function convertServerToHermes(config) {
+function convertServerToHermes(config, logger) {
 	const out = {};
 	const command = config.command;
 	const url = resolveHermesUrl(config);
@@ -47135,7 +47465,7 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
-	copyHermesAdvancedFields(config, out);
+	copyHermesAdvancedFields(config, out, logger);
 	const tools = buildHermesToolsBlock(config);
 	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
@@ -47143,11 +47473,11 @@ function convertServerToHermes(config) {
 /**
 * Converts rulesync canonical MCP servers into Hermes `mcp_servers:` entries.
 */
-function convertToHermesFormat(mcpServers) {
+function convertToHermesFormat(mcpServers, logger) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
-		result[name] = convertServerToHermes(config);
+		result[name] = convertServerToHermes(config, logger);
 	}
 	return result;
 }
@@ -47167,7 +47497,7 @@ function mergeHermesMcpServers(config, mcpServers) {
 * Mirrors {@link convertToHermesFormat}: `enabled: false` maps back to the
 * canonical `disabled: true`, and only recognized fields are carried over.
 */
-function convertFromHermesFormat(mcpServers) {
+function convertFromHermesFormat(mcpServers, logger) {
 	const result = {};
 	const hermesOverrides = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
@@ -47184,7 +47514,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (isRecord$1(config.tools)) applyHermesToolsBlock(config.tools, server);
 		result[name] = server;
 		const hermesServer = { ...server };
-		if (copyHermesAdvancedFields(config, hermesServer)) hermesOverrides[name] = hermesServer;
+		if (copyHermesAdvancedFields(config, hermesServer, logger)) hermesOverrides[name] = hermesServer;
 	}
 	return {
 		mcpServers: result,
@@ -47203,8 +47533,10 @@ function convertFromHermesFormat(mcpServers) {
 */
 var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
-	constructor(params) {
+	logger;
+	constructor({ logger, ...params }) {
 		super(params);
+		this.logger = logger;
 		this.config = this.fileContent !== void 0 ? parseSharedConfig({
 			format: "yaml",
 			fileContent: this.fileContent
@@ -47248,7 +47580,7 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static getExtraSharedWritePaths() {
 		return getHermesagentSharedConfigWritePaths();
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
@@ -47258,17 +47590,18 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			logger
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull((0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
 		const merged = mergeHermesMcpServers(parseSharedConfig({
 			format: "yaml",
 			fileContent
-		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers(), logger));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -47280,11 +47613,12 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 				patch: { mcp_servers: merged.mcp_servers }
 			}),
 			validate,
-			global
+			global,
+			logger
 		});
 	}
 	toRulesyncMcp() {
-		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {}, this.logger);
 		return this.toRulesyncMcpDefault({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
@@ -48168,14 +48502,15 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 	if (!config.parsed) return {};
 	return {
 		...typeof config.mcp.startup_timeout_ms === "number" && { startupTimeoutMs: config.mcp.startup_timeout_ms },
-		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms }
+		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms },
+		...typeof config.mcp.default_deferred === "boolean" && { defaultDeferred: config.mcp.default_deferred }
 	};
 }
 /**
 * Kimi's `[mcp]` section in the shared user config sets the default connect and
-* per-tool-call timeouts for *every* MCP server, including ones rulesync did not
-* write. Per-server values in `mcp.json` still take precedence; this only moves
-* the floor.
+* per-tool-call timeouts, and whether tools load on demand, for *every* MCP
+* server, including ones rulesync did not write. Per-server values in
+* `mcp.json` still take precedence; this only moves the default.
 *
 * Written as an auxiliary file so it goes through the normal write phase and
 * respects `--dry-run`, and merged through the shared-config gateway so the
@@ -48183,7 +48518,8 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 *
 * The gateway replaces an owned key wholesale, and `mcp` is a table, so the
 * section is recomputed from the existing file: authoring only
-* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms`. Same
+* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms` or
+* `default_deferred`. Same
 * approach the `.vibe/config.toml` `tools` writer takes.
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
@@ -48210,7 +48546,8 @@ var KimiCodeMcpConfigToml = class KimiCodeMcpConfigToml extends ToolFile {
 			patch: { mcp: {
 				...existingSection,
 				...defaults.startupTimeoutMs !== void 0 && { startup_timeout_ms: defaults.startupTimeoutMs },
-				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs }
+				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs },
+				...defaults.defaultDeferred !== void 0 && { default_deferred: defaults.defaultDeferred }
 			} },
 			filePath: relativeConfigPath
 		});
@@ -48308,18 +48645,20 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 		if (!isRecord$1(block)) return [];
 		const startupTimeoutMs = typeof block.startupTimeoutMs === "number" ? block.startupTimeoutMs : void 0;
 		const toolTimeoutMs = typeof block.toolTimeoutMs === "number" ? block.toolTimeoutMs : void 0;
-		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0) return [];
+		const defaultDeferred = typeof block.defaultDeferred === "boolean" ? block.defaultDeferred : void 0;
+		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0 && defaultDeferred === void 0) return [];
 		const existing = await readKimiCodeConfig({ outputRoot });
 		if (!existing.parsed) {
 			const paths = kimiCodeConfigRelativePath();
-			warnWithFallback(logger, `Skipping the Kimi Code MCP timeout defaults: ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
+			warnWithFallback(logger, `Skipping the Kimi Code MCP [mcp] defaults: ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
 			return [];
 		}
 		return [KimiCodeMcpConfigToml.fromDefaults({
 			outputRoot,
 			defaults: {
 				startupTimeoutMs,
-				toolTimeoutMs
+				toolTimeoutMs,
+				defaultDeferred
 			},
 			existing
 		})];
@@ -50895,6 +51234,11 @@ var ReasonixMcp = class ReasonixMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
@@ -52922,6 +53266,144 @@ function buildCommandString(server) {
 	if (typeof server.command !== "string" || server.command.trim() === "") return void 0;
 	return [server.command, ...args.map(quoteShellWord)].join(" ");
 }
+/** A name bash accepts on the left of a `NAME=value` assignment. */
+const SHELL_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A canonical `${VAR}` reference whose name bash can expand. */
+const ENV_VAR_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/**
+* Quote an env value for a `NAME=value` assignment. Literal text is
+* single-quoted, so nothing in it is expanded or run, while every canonical
+* `${VAR}` reference is emitted as `"${VAR}"` so bash still expands it from
+* the environment Xum starts the server with. The pieces are concatenated into
+* one shell word: `Bearer ${TOKEN}` becomes `'Bearer '"${TOKEN}"`.
+*/
+function quoteEnvValue(value) {
+	if (value === "") return "''";
+	const parts = [];
+	let last = 0;
+	for (const match of value.matchAll(ENV_VAR_REFERENCE)) {
+		if (match.index > last) parts.push(quoteShellWord(value.slice(last, match.index)));
+		parts.push(`"\${${match[1]}}"`);
+		last = match.index + match[0].length;
+	}
+	if (last < value.length) parts.push(quoteShellWord(value.slice(last)));
+	return parts.join("");
+}
+/**
+* Build the `NAME=value ` prefix that sets a stdio server's `env` for its
+* command only (Xum runs the command string with bash). Returns the prefix
+* plus the entries left out: names that cannot be bash assignment targets and
+* entries whose value is not a string.
+*/
+function buildEnvPrefix(env) {
+	const assignments = [];
+	const invalidNames = [];
+	const nonStringNames = [];
+	for (const [name, value] of Object.entries(env)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!SHELL_ENV_NAME.test(name)) {
+			invalidNames.push(name);
+			continue;
+		}
+		if (typeof value !== "string") {
+			nonStringNames.push(name);
+			continue;
+		}
+		assignments.push(`${name}=${quoteEnvValue(value)}`);
+	}
+	return {
+		prefix: assignments.map((assignment) => `${assignment} `).join(""),
+		invalidNames,
+		nonStringNames
+	};
+}
+/** Bash reserved words; a command starting with one cannot take an assignment prefix. */
+const BASH_RESERVED_WORDS = /* @__PURE__ */ new Set([
+	"!",
+	"[[",
+	"]]",
+	"{",
+	"}",
+	"case",
+	"coproc",
+	"do",
+	"done",
+	"elif",
+	"else",
+	"esac",
+	"fi",
+	"for",
+	"function",
+	"if",
+	"in",
+	"select",
+	"then",
+	"time",
+	"until",
+	"while"
+]);
+/**
+* Explain why a `NAME=value` prefix would not reach the server, or return
+* `undefined` when it would. Bash applies such assignments to the first simple
+* command only: with a list or pipeline (`cd x && srv`) the server would not
+* see them, and in front of a group, parenthesized list or reserved word (`( srv )`,
+* `{ srv; }`, `if ...`) they are a syntax error that keeps the server from
+* starting. Only the verbatim `command` string is checked for operators,
+* outside complete single-quoted words; argv elements are quoted by
+* {@link quoteShellWord}.
+*/
+function envPrefixBlocker(server, baseCommand) {
+	if (typeof server.command === "string") {
+		const unquoted = server.command.replace(/'[^']*'/g, "");
+		if (unquoted.includes("'") || /[;&|(){}\n]/.test(unquoted)) return "its command string contains shell operators, grouping or a newline, so bash would not pass NAME=value assignments in front of it to the server";
+	}
+	const [firstWord] = baseCommand.trimStart().split(/\s+/);
+	if (firstWord !== void 0 && BASH_RESERVED_WORDS.has(firstWord)) return `its command starts with the bash reserved word ${quoteValueForWarning(firstWord)}, which cannot follow NAME=value assignments`;
+}
+/**
+* One leading `NAME=value` assignment in exactly the shape {@link quoteEnvValue}
+* writes: bare shell-safe characters, single-quoted text (with the `'\''`
+* escape) and `"${VAR}"` references, followed by spaces or tabs (a newline
+* would end the command, so the assignment would not apply to what follows). Bare characters
+* are matched one at a time, so every alternative starts with a distinct
+* character and the pattern cannot backtrack exponentially.
+*/
+const LEADING_ENV_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=((?:[A-Za-z0-9_\-.,:/@%+=]|'[^']*'|\\'|"\$\{[A-Za-z_][A-Za-z0-9_]*\}")*)[ \t]+/;
+/** Decode a value written by {@link quoteEnvValue} back into its canonical form. */
+function unquoteEnvValue(quoted) {
+	return quoted.replace(/'([^']*)'|\\'|"(\$\{[A-Za-z_][A-Za-z0-9_]*\})"/g, (_m, single, ref) => typeof single === "string" ? single : typeof ref === "string" ? ref : "'");
+}
+/**
+* Split leading `NAME=value` assignments off a command string, but only when
+* every one of them is in the shape rulesync writes and a plain command
+* follows (see {@link envPrefixBlocker}); anything else (for example a `$(...)` substitution) keeps the whole string as
+* the command.
+*/
+function splitEnvPrefix(command) {
+	const env = {};
+	let rest = command.trimStart();
+	for (;;) {
+		const match = LEADING_ENV_ASSIGNMENT.exec(rest);
+		if (match === null) break;
+		const [whole, name, quoted] = match;
+		if (name === void 0 || quoted === void 0 || PROTOTYPE_POLLUTION_KEYS.has(name)) break;
+		env[name] = unquoteEnvValue(quoted);
+		rest = rest.slice(whole.length);
+	}
+	if (Object.keys(env).length === 0 || rest.trim() === "" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest) || envPrefixBlocker({ command: rest }, rest) !== void 0) return { rest: command };
+	return {
+		env,
+		rest
+	};
+}
+/** Read a command string back into `env` + `command` + `args`. */
+function parseCommandString(command) {
+	const { env, rest } = splitEnvPrefix(command);
+	return {
+		...env !== void 0 && { env },
+		...splitCommandString(rest)
+	};
+}
 /** Split a plain command string back into `command` + `args` when it is safe to. */
 function splitCommandString(command) {
 	const trimmed = command.trim();
@@ -52965,10 +53447,20 @@ function convertServerToXum({ name, server, logger }) {
 			...settings
 		};
 	}
-	const command = buildCommandString(server);
-	if (command === void 0) return skip("it has no command");
-	const dropped = [...isPlainObject$1(server.env) && Object.keys(server.env).length > 0 ? ["env"] : [], ...typeof server.cwd === "string" ? ["cwd"] : []];
-	if (dropped.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets ${dropped.join(" and ")}, which Xum's mcp.jsonc cannot express; the server is written without it (Xum starts stdio servers with your shell environment in the workspace directory).`);
+	const baseCommand = buildCommandString(server);
+	if (baseCommand === void 0) return skip("it has no command");
+	let command = baseCommand;
+	if (isPlainObject$1(server.env) && Object.keys(server.env).length > 0) {
+		const blocker = envPrefixBlocker(server, baseCommand);
+		if (blocker !== void 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env, but ${blocker}; the server is written without env.`);
+		else {
+			const { prefix, invalidNames, nonStringNames } = buildEnvPrefix(server.env);
+			command = `${prefix}${baseCommand}`;
+			if (invalidNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${invalidNames.map(quoteValueForWarning).join(", ")}, which cannot be a bash variable name; the server is written without it.`);
+			if (nonStringNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${nonStringNames.map(quoteValueForWarning).join(", ")} to a value that is not a string; the server is written without it.`);
+		}
+	}
+	if (typeof server.cwd === "string") warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets cwd, which Xum's mcp.jsonc cannot express; the server is written without it (Xum starts stdio servers in the workspace directory).`);
 	return Object.keys(settings).length > 0 ? {
 		command,
 		...settings
@@ -52988,7 +53480,7 @@ function convertFromXumFormat(servers) {
 	for (const [name, entry] of Object.entries(servers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
 		if (typeof entry === "string") {
-			result[name] = splitCommandString(entry);
+			result[name] = parseCommandString(entry);
 			continue;
 		}
 		if (!isPlainObject$1(entry)) continue;
@@ -52998,7 +53490,7 @@ function convertFromXumFormat(servers) {
 			server.url = entry.url;
 			const headers = copyStringHeaders(entry.headers);
 			if (headers !== void 0) server.headers = headers;
-		} else if (typeof entry.command === "string") Object.assign(server, splitCommandString(entry.command));
+		} else if (typeof entry.command === "string") Object.assign(server, parseCommandString(entry.command));
 		else continue;
 		if (entry.disabled === true) server.disabled = true;
 		if (isStringArray$1(entry.toolAllowlist)) server.enabledTools = entry.toolAllowlist;
@@ -53013,9 +53505,10 @@ function convertFromXumFormat(servers) {
 * (project; a server there wins over the user one of the same name). Both are
 * a JSONC document with a `servers` map:
 *
-* - a stdio server is a shell command string (the object form `{ command }`
-*   carries `disabled` / `toolAllowlist`); Xum's mcp.jsonc has no `env` or
-*   `cwd`, so those are dropped with a warning;
+* - a stdio server is a shell command string run with bash (the object form
+*   `{ command }` carries `disabled` / `toolAllowlist`); `env` is written as
+*   `NAME=value` assignments in front of the command, and `cwd`, which has no
+*   equivalent, is dropped with a warning;
 * - a remote server is `{ transport: "http" | "sse" | "auto", url, headers }`
 *   (the transport defaults to auto-detection).
 *
@@ -53147,7 +53640,7 @@ function asZcodeRemoteType(stated, url) {
 }
 /**
 * The keys each OAuth flow of ZCode's per-server `oauth` union accepts on a
-* remote server, and which of them are required. Read off the 3.14.3/3.15.3
+* remote server, and which of them are required. Read off the 3.14.3–3.16.2
 * runtime config schema, since ZCode's MCP page only says to "enable OAuth for
 * the service in its configuration". Both variants are strict, so any other
 * key would make ZCode skip the server.
@@ -53251,7 +53744,11 @@ function resolveZcodeTimeoutMs({ serverName, config, logger }) {
 }
 /**
 * The per-server keys ZCode reads on every transport: `timeoutMs`,
-* `protocolVersion` and the enable toggle (`enableKey`).
+* `protocolVersion`, `alwaysLoad` and the enable toggle (`enableKey`).
+*
+* `alwaysLoad` (added in 3.16.2 alongside tool search) keeps a server's tools
+* loaded up front instead of deferring them behind tool search. ZCode's schema
+* types it as a boolean, so any other value is dropped with a warning.
 */
 function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const common = {};
@@ -53264,6 +53761,9 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const { protocolVersion } = config;
 	if (ZCODE_PROTOCOL_VERSIONS.has(protocolVersion)) common.protocolVersion = protocolVersion;
 	else if (protocolVersion !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping protocolVersion ${JSON.stringify(protocolVersion)}, as ZCode accepts only ${[...ZCODE_PROTOCOL_VERSIONS].map((v) => JSON.stringify(v)).join(", ")}.`);
+	const { alwaysLoad } = config;
+	if (typeof alwaysLoad === "boolean") common.alwaysLoad = alwaysLoad;
+	else if (alwaysLoad !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping alwaysLoad ${JSON.stringify(alwaysLoad)}, as it must be a boolean.`);
 	if (config.disabled === true) common[enableKey] = false;
 	return common;
 }
@@ -53276,11 +53776,11 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 * absent.
 *
 * Every server also carries `timeoutMs` (from the canonical `timeout`, or an
-* explicit `timeoutMs`) and an allow-listed `protocolVersion`; stdio servers
-* carry `cwd`, and remote servers an `oauth` built from the namespaced
-* `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
+* explicit `timeoutMs`), an allow-listed `protocolVersion` and a boolean
+* `alwaysLoad`; stdio servers carry `cwd`, and remote servers an `oauth` built
+* from the namespaced `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
 * is read from the authored server through `rawServerOf`. ZCode's docs do not
-* name these keys, so they follow the 3.14.3/3.15.3 runtime's per-server
+* name these keys, so they follow the 3.14.3–3.16.2 runtime's per-server
 * schema, which is strict: an unknown key makes ZCode skip the server, which
 * is why the output stays a whitelist.
 *
@@ -58417,6 +58917,11 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
 		widens: isNotFalse
 	},
+	{
+		path: ["allowNestedUserNamespaces"],
+		reason: "lets sandboxed Linux commands create user namespaces, which gets around the sandbox's file protections",
+		widens: isNotFalse
+	},
 	{
 		path: ["allowUnsandboxedCommands"],
 		reason: "controls whether Claude may retry a blocked command outside the sandbox",
@@ -68866,7 +69371,7 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *   catch-all one at its own strictness, a pattern-specific one as `prompt`).
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
-* `write` or `yolo`); without it the key is left as it is in the file, and on
+* `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
 * import a recognized value is read back into the override.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
@@ -71138,6 +71643,8 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 const REASONIX_TOOL_LABEL = "Reasonix";
 /** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
 const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/** The `[permissions]` key the override's `askOnExternalOrigin` writes and reads. */
+const REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY = "ask_on_external_origin";
 /**
 * `[sandbox]` keys whose authored value loosens the enforcement layer beneath
 * the permission policy: they take Bash out of its OS jail, open that jail to
@@ -71340,6 +71847,95 @@ function applyPermissionsMode({ permissions, authored, global, relativeFilePath,
 		reason: "lets every writer call that no rule matches run without a prompt"
 	}];
 }
+/**
+* Writes the override's `askOnExternalOrigin` into `[permissions]`. Reasonix
+* honors the key only in the user config (`narrowPermissions` in
+* `project_scope.go`), so a project-scope generate skips it with a warning and
+* leaves whatever the file had. Turning it on only adds prompts, so that is
+* quiet; turning off a value the file had on is reported, since Auto and YOLO
+* then run calls that repeat text from a web page or tool result without asking.
+* As with `applyAllowDynamicBash`, only a literal `true` counts as quiet, so a
+* value a `--no-validate` run let through is never written in silence.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/GUIDE.md
+*/
+function applyAskOnExternalOrigin({ permissions, override, global, relativeFilePath, logger }) {
+	const authored = override?.askOnExternalOrigin;
+	if (authored === void 0) return [];
+	if (!global) {
+		logger?.warn(`Reasonix permissions: skipping reasonix.askOnExternalOrigin for the project-scoped ${relativeFilePath}; Reasonix honors [permissions] ask_on_external_origin only in the user config and ignores a project value, so generate it with --global instead.`);
+		return [];
+	}
+	const previous = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+	permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY] = authored;
+	if (authored === true || previous !== true && authored === false) return [];
+	return [{
+		label: `permissions.${REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY}`,
+		reason: "lets Auto and YOLO run a call that repeats text from a web page or tool result without asking first"
+	}];
+}
+/**
+* The `tools` patch entry — the `[tools]` table with the override's `disabled`
+* list laid over it, or nothing when the override does not author one — and the
+* trust rows it carries. Adding a name only removes a tool, and a project file
+* can only add to the user's list, so that stays quiet. The list is replaced
+* whole, though, so a name the file had turned off and the override leaves out
+* is turned back on, and that is reported, as are a `[tools]` or a `disabled`
+* the file holds in a shape that cannot be read. Only `disabled` is written:
+* the rest of `[tools]` (timeouts, search backends, ...) stays as it is.
+*/
+function applyToolsDisabled({ existing, override }) {
+	const disabled = override?.tools?.disabled;
+	if (disabled === void 0) return {
+		patch: {},
+		entries: []
+	};
+	const patch = { tools: {
+		...asReasonixRecord(existing),
+		disabled
+	} };
+	if (existing === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!isRecord$1(existing)) return {
+		patch,
+		entries: [{
+			label: "tools",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const before = existing.disabled;
+	if (before === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!Array.isArray(before)) return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: replacedUnreadableReason({
+				shape: "list",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const reEnabled = (0, es_toolkit.uniq)(before.filter((name) => !disabled.includes(name)));
+	if (reEnabled.length === 0) return {
+		patch,
+		entries: []
+	};
+	return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: `turns back on ${reEnabled.map((name) => quoteValueForWarning(name)).join(", ")}, which the file had turned off`
+		}]
+	};
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -71395,6 +71991,11 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const relativeFilePathForLog = toPosixPath((0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath));
@@ -71454,7 +72055,20 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			relativeFilePath: relativeFilePathForLog,
 			logger
 		}));
+		trustAffecting.push(...applyAskOnExternalOrigin({
+			permissions: mergedPermissions,
+			override,
+			global,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		}));
 		const patch = { permissions: mergedPermissions };
+		const toolsDisabled = applyToolsDisabled({
+			existing: parsed.tools,
+			override
+		});
+		Object.assign(patch, toolsDisabled.patch);
+		trustAffecting.push(...toolsDisabled.entries);
 		if (override?.sandbox !== void 0) {
 			const authoredSandbox = dropUserOnlySandboxKeys({
 				sandbox: override.sandbox,
@@ -71528,6 +72142,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
 		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (this.global && typeof permissions.mode === "string" && REASONIX_PERMISSION_MODES.has(permissions.mode)) reasonixOverride.mode = permissions.mode;
+		const askOnExternalOrigin = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+		if (this.global && typeof askOnExternalOrigin === "boolean") reasonixOverride.askOnExternalOrigin = askOnExternalOrigin;
+		const toolsDisabled = asReasonixRecord(this.toml.tools).disabled;
+		if (Array.isArray(toolsDisabled)) {
+			const names = toReasonixStringArray(toolsDisabled);
+			if (names.length < toolsDisabled.length) warnWithFallback(void 0, `Reasonix permissions: ${this.getRelativePathFromCwd()} [tools] disabled holds ${toolsDisabled.length - names.length} non-string entries; they are not imported into reasonix.tools.disabled, so the next generate drops them.`);
+			reasonixOverride.tools = { disabled: names };
+		}
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;
@@ -73109,7 +73731,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 		const authoredProviderOptions = isPlainObject$1(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
 		const runtimeModeRefusesProviderOptions = authoredProviderOptions !== void 0 && runtime.active;
 		if (runtimeModeRefusesProviderOptions) logger?.warn(`Takt permissions: not writing "${TAKT_PROVIDER_OPTIONS_KEY}" to ${filePath} because ${runtime.filePaths.join(" + ")} puts Takt in runtime provider mode (Takt 0.56.0+), where any legacy provider setting in config.yaml makes Takt fail with "Mixed provider configuration detected". Move those options to \`provider.profiles.<profile>.options\` in runtime.yaml, and remove them from the \`takt\` block of the rulesync source. A "${TAKT_PROVIDER_OPTIONS_KEY}" already in ${filePath} is left untouched — rulesync does not own that key.`);
-		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : authoredProviderOptions;
+		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : dropUntrustedProviderOptions({
+			providerOptions: authoredProviderOptions,
+			global,
+			filePath,
+			logger
+		});
 		const authoredPolicies = pickSecurityPolicies(override, {
 			filePath,
 			logger,
@@ -73613,6 +74240,68 @@ function taktModeToRulesyncConfig(mode) {
 		default: return { permission: { bash: { [CATCH_ALL_PATTERN$1]: "deny" } } };
 	}
 }
+const TAKT_BASE_URL_PROVIDERS = [
+	"codex",
+	"claude",
+	"deepseek_harness"
+];
+const TAKT_DEEPSEEK_HARNESS_KEY = "deepseek_harness";
+/** Mirrors Takt's `isLoopbackBaseUrl`: localhost, *.localhost, ::1 or 127.x.x.x. */
+function isLoopbackBaseUrl(value) {
+	let hostname;
+	try {
+		hostname = new URL(value).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "[::1]") return true;
+	const octets = hostname.split(".");
+	return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d+$/.test(octet) && Number(octet) <= 255);
+}
+/** The keys of one `provider_options.<provider>` entry Takt rejects in config.yaml. */
+function untrustedProviderOptionKeys({ provider, options, global }) {
+	const keys = [];
+	if (provider === TAKT_DEEPSEEK_HARNESS_KEY) {
+		if (options.reasoning_effort !== void 0) keys.push("reasoning_effort");
+		const { plugins } = options;
+		if (!global && plugins !== void 0 && (!Array.isArray(plugins) || plugins.length > 0)) keys.push("plugins");
+	}
+	const baseUrl = options.base_url;
+	if (!global && TAKT_BASE_URL_PROVIDERS.includes(provider) && baseUrl !== void 0 && (typeof baseUrl !== "string" || !isLoopbackBaseUrl(baseUrl))) keys.push("base_url");
+	return keys;
+}
+/**
+* Drop the `provider_options` entries Takt refuses to load from `config.yaml`
+* (it fails at startup with a `Configuration error`), warning for each:
+*   - `deepseek_harness.reasoning_effort` in either scope — Takt accepts it only
+*     in runtime profile options or `TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT`.
+*   - at project scope, a non-empty `deepseek_harness.plugins` (Takt 0.71.0+,
+*     global config only) and a non-loopback `{codex,claude,deepseek_harness}.base_url`.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/providerOptions.ts
+* https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+function dropUntrustedProviderOptions({ providerOptions, global, filePath, logger }) {
+	if (providerOptions === void 0) return;
+	const dropped = [];
+	const result = {};
+	for (const [provider, options] of Object.entries(providerOptions)) {
+		if (!isPlainObject$1(options)) {
+			result[provider] = options;
+			continue;
+		}
+		const untrusted = untrustedProviderOptionKeys({
+			provider,
+			options,
+			global
+		});
+		const kept = Object.fromEntries(Object.entries(options).filter(([key]) => !untrusted.includes(key)));
+		dropped.push(...untrusted.map((key) => `${TAKT_PROVIDER_OPTIONS_KEY}.${provider}.${key}`));
+		if (Object.keys(kept).length > 0 || Object.keys(options).length === 0) result[provider] = kept;
+	}
+	if (dropped.length === 0) return providerOptions;
+	logger?.warn(`Takt permissions: not writing ${dropped.map((key) => `"${key}"`).join(", ")} to ${filePath} because Takt refuses to load ${dropped.length === 1 ? "it" : "them"} from ${global ? "config.yaml" : "a project config.yaml"} and fails at startup with a "Configuration error". Set non-loopback base URLs and DeepSeek Harness plugins in the global ~/.takt/config.yaml (or the TAKT_PROVIDER_OPTIONS_* environment variables), and DeepSeek Harness reasoning_effort in a runtime.yaml profile's options or TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT, then remove them from the \`takt\` block of the rulesync source.`);
+	return Object.keys(result).length > 0 ? result : void 0;
+}
 /**
 * Lift Takt's security-policy keys out of a source object, keeping only the
 * shapes Takt itself accepts (a boolean, or a table of booleans). Used in both
@@ -85942,6 +86631,19 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 //#endregion
 //#region src/features/skills/xum-skill.ts
 /**
+* The Agent Skills standard keys the `agentsskills` section carries. On import
+* they go back there, exactly as for the `agentsskills` target, and every other
+* key besides `name` / `description` goes into the `xum` section.
+*/
+const AGENT_SKILLS_STANDARD_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"description",
+	"license",
+	"compatibility",
+	"metadata",
+	"allowed-tools"
+]);
+/**
 * Xum skills follow the Agent Skills layout (`<name>/SKILL.md` with the
 * required `name` and `description` frontmatter; the directory name is
 * lowercase letters, digits and single hyphens up to 64 characters, and
@@ -85949,12 +86651,82 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 * Xum's locations: `.xum/skills/` (project) and `~/.xum/skills/` (user).
 * Within one directory `.xum/skills` wins over `.agents/skills`.
 *
+* On top of the standard fields, Xum reads `disable-model-invocation` (and its
+* own `advertise: false` alias), `user-invocable`, `argument-hint`,
+* `when_to_use` / `when-to-use` and `paths` (globs that make the skill
+* path-scoped). Those come from the `xum` section of the rulesync skill and are
+* written verbatim; the two invocation gates fall back to the root-level
+* rulesync values.
+*
 * @see https://xum.cdr.dev/agents/agent-skills
 */
-var XumSkill = class extends AgentsSkillsSkill {
+var XumSkill = class XumSkill extends AgentsSkillsSkill {
 	static getSettablePaths(_options = {}) {
 		return { relativeDirPath: XUM_SKILLS_DIR_PATH };
 	}
+	toRulesyncSkill() {
+		const base = super.toRulesyncSkill();
+		const xumSection = Object.fromEntries(Object.entries(this.getFrontmatter()).filter(([key]) => !AGENT_SKILLS_STANDARD_KEYS.has(key)));
+		if (Object.keys(xumSection).length === 0) return base;
+		const rulesyncFrontmatter = {
+			...base.getFrontmatter(),
+			xum: xumSection
+		};
+		return new RulesyncSkill({
+			outputRoot: base.getOutputRoot(),
+			relativeDirPath: base.getRelativeDirPath(),
+			dirName: base.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: base.getBody(),
+			otherFiles: base.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = XumSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const xumSection = {};
+		const ignoredKeys = [];
+		for (const [key, value] of Object.entries(rulesyncFrontmatter.xum ?? {})) if (AGENT_SKILLS_STANDARD_KEYS.has(key)) ignoredKeys.push(key);
+		else xumSection[key] = value;
+		if (ignoredKeys.length > 0) warnWithFallback(logger, `${(0, node_path.join)(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)}: the xum section sets ${ignoredKeys.map(quoteValueForWarning).join(", ")}, which ${ignoredKeys.length === 1 ? "is" : "are"} ignored there; set name/description at the root and the Agent Skills standard fields at the root or in the agentsskills section.`);
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const frontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter)),
+			...xumSection,
+			...userInvocable !== void 0 && { "user-invocable": userInvocable },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation }
+		};
+		AgentsSkillsSkill.reportSpecViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			sourceAllowedTools: rulesyncFrontmatter.agentsskills?.["allowed-tools"],
+			logger
+		});
+		return new XumSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("xum");
@@ -92110,6 +92882,15 @@ const KiroCliSubagentJsonSchema = zod_mini.z.looseObject({
 	allowedTools: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.array(zod_mini.z.string()))),
 	includeMcpJson: zod_mini.z.optional(zod_mini.z.nullable(zod_mini.z.boolean()))
 });
+/**
+* The name Kiro gives an agent file: its path relative to the agents directory
+* without the extension, so a nested `team/planner.md` is `team/planner`.
+* https://kiro.dev/docs/custom-agents/
+*/
+function kiroAgentNameFromPath(relativeFilePath) {
+	const posixPath = toPosixPath(relativeFilePath);
+	return posixPath.slice(0, posixPath.length - (0, node_path.extname)(posixPath).length);
+}
 var KiroSubagent = class extends ToolSubagent {
 	body;
 	constructor({ body, ...rest }) {
@@ -92145,7 +92926,7 @@ var KiroSubagent = class extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: [toolTarget],
-				name: name ?? (0, node_path.basename)(this.getRelativeFilePath(), ".json"),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? void 0,
 				...Object.keys(kiroSection).length > 0 && { kiro: kiroSection }
 			},
@@ -92295,7 +93076,7 @@ var KiroIdeSubagent = class KiroIdeSubagent extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
-				name: name ?? this.getRelativeFilePath().replace(/\.md$/, ""),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? "",
 				...Object.keys(kiroIdeSection).length > 0 && { "kiro-ide": kiroIdeSection }
 			},
@@ -94913,7 +95694,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.json"
+			filePattern: "**/*.json",
+			supportsNestedPaths: true
 		}
 	}],
 	["kiro-ide", {
@@ -94922,7 +95704,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.md"
+			filePattern: "**/*.md",
+			supportsNestedPaths: true
 		}
 	}],
 	["lettacode", {
@@ -109164,6 +109947,12 @@ Object.defineProperty(exports, "PACKAGING_TOOL_TARGETS", {
 		return PACKAGING_TOOL_TARGETS;
 	}
 });
+Object.defineProperty(exports, "PathOutsideRootError", {
+	enumerable: true,
+	get: function() {
+		return PathOutsideRootError;
+	}
+});
 Object.defineProperty(exports, "QWENCODE_DIR", {
 	enumerable: true,
 	get: function() {
@@ -109464,6 +110253,12 @@ Object.defineProperty(exports, "assertDirectoryIfExists", {
 		return assertDirectoryIfExists;
 	}
 });
+Object.defineProperty(exports, "assertPathResolvesInsideRoot", {
+	enumerable: true,
+	get: function() {
+		return assertPathResolvesInsideRoot;
+	}
+});
 Object.defineProperty(exports, "assertTargetsFeaturesExclusive", {
 	enumerable: true,
 	get: function() {