rulesync 39.0.0 → 40.0.0

package/dist/{import-CfVOkld5.js → import-Chn7Nqnm.js}

@@ -1048,6 +1048,57 @@ async function assertWritablePathInsideRoot(params) {
 		existingPath = parentPath;
 	}
 }
+/**
+* Thrown by {@link assertPathResolvesInsideRoot} when a symbolic link leads
+* the target outside the root, or the target is reached through a dangling
+* link. Any other error it throws comes from the filesystem itself.
+*/
+var PathOutsideRootError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "PathOutsideRootError";
+	}
+};
+/**
+* Refuse a write or removal target whose real location is outside `rootPath`.
+*
+* Unlike {@link assertWritablePathInsideRoot}, a symbolic link on the way is
+* allowed as long as it resolves inside the root: projects deliberately link a
+* skill directory to a shared one next to it. What this stops is a link that
+* leads elsewhere — a cloned repository committing `.rulesync/skills/x ->
+* ~/.ssh`, say — which a textual check such as {@link checkPathTraversal}
+* cannot see. The deepest existing ancestor of `targetPath` is resolved, and
+* an existing target that is itself a link is resolved too.
+*/
+async function assertPathResolvesInsideRoot(params) {
+	const { rootPath, targetPath } = params;
+	let realRoot;
+	try {
+		realRoot = await realpath(rootPath);
+	} catch (error) {
+		if (isFileNotFoundError(error)) {
+			if (await isSymlink(rootPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${rootPath}.`, { cause: error });
+			return;
+		}
+		throw error;
+	}
+	let existingPath = resolve(targetPath);
+	while (true) {
+		let realExisting;
+		try {
+			realExisting = await realpath(existingPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+			if (await isSymlink(existingPath)) throw new PathOutsideRootError(`Refusing to write through a dangling symbolic link: ${targetPath}.`, { cause: error });
+			const parentPath = dirname(existingPath);
+			if (parentPath === existingPath) throw error;
+			existingPath = parentPath;
+			continue;
+		}
+		if (pathEscapesRoot(relative(realRoot, realExisting))) throw new PathOutsideRootError(`Path resolves outside ${rootPath} through a symbolic link: ${targetPath}.`);
+		return;
+	}
+}
 async function assertTreeContainsNoSymlinks(dirPath) {
 	for (const entry of await readdir(dirPath, { withFileTypes: true })) {
 		const entryPath = join(dirPath, entry.name);
@@ -5112,6 +5163,40 @@ const COPILOT_HOOK_EVENTS = [
 	"userPromptExpansion"
 ];
 /**
+* The {@link COPILOT_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex. The hooks reference documents matcher filtering on
+* `preToolUse` / `postToolUse` / `permissionRequest` (tool name), `preCompact`
+* (trigger) and `subagentStart` (agent name), plus `notification`; the last
+* two are not authorable for `copilot`, so they are not listed here. VS Code's
+* migration guide confirms the Copilot harness "applies documented matcher
+* rules" (only the legacy Local harness ignores them).
+*
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/migrate-customizations
+*/
+const COPILOT_MATCHER_HOOK_EVENTS = [
+	"preToolUse",
+	"postToolUse",
+	"preCompact",
+	"subagentStart"
+];
+/**
+* The {@link COPILOTCLI_HOOK_EVENTS} whose hook entries honor an optional
+* `matcher` regex: the shared {@link COPILOT_MATCHER_HOOK_EVENTS} plus the two
+* CLI-only events, `permissionRequest` (tool name) and `notification`
+* (notification type).
+*
+* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
+* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
+* `Edit|Write`) are now honored instead of silently dropped").
+* @see https://docs.github.com/en/copilot/reference/hooks-reference
+*/
+const COPILOTCLI_MATCHER_HOOK_EVENTS = [
+	...COPILOT_MATCHER_HOOK_EVENTS,
+	"permissionRequest",
+	"notification"
+];
+/**
 * Hook events supported by the GitHub Copilot CLI (`copilotcli-hooks.ts`).
 *
 * The CLI documents a wider event surface than the shared cloud-agent set, so
@@ -5265,12 +5350,15 @@ const KIRO_IDE_HOOK_EVENTS = [
 /**
 * Hook events supported by Google Antigravity (both the IDE and the CLI).
 *
-* Antigravity exposes a Claude-style hooks surface covering the five
-* tool/model/turn lifecycle events it documents: `PreToolUse`, `PostToolUse`,
-* `PreInvocation`, `PostInvocation`, and `Stop`. The model-invocation events
-* (`PreInvocation`/`PostInvocation`) and `Stop` are matcher-less handler lists.
+* Antigravity exposes a Claude-style hooks surface covering the six
+* session/tool/model/turn lifecycle events it documents: `SessionStart`,
+* `PreToolUse`, `PostToolUse`, `PreInvocation`, `PostInvocation`, and `Stop`.
+* `SessionStart`, the model-invocation events (`PreInvocation`/`PostInvocation`)
+* and `Stop` are matcher-less handler lists.
+* https://antigravity.google/docs/hooks
 */
 const ANTIGRAVITY_HOOK_EVENTS = [
+	"sessionStart",
 	"preToolUse",
 	"postToolUse",
 	"preModelInvocation",
@@ -6043,8 +6131,8 @@ const CONTINUE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANO
 /**
 * Hook events supported by Hermes Agent's native Shell Hooks system.
 *
-* Hermes validates hook events against a fixed `VALID_HOOKS` set — 44 entries as
-* of v0.21.6 (tag `v0.21.6`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
+* Hermes validates hook events against a fixed `VALID_HOOKS` set — 46 entries as
+* of v0.22.3 (tag `v0.22.3`); see {@link HERMESAGENT_NATIVE_HOOK_EVENTS} for the
 * full list. Only the events with a clean 1:1 canonical equivalent are mapped
 * here. All other native events round-trip through `hermesagent.hooks`.
 * @see https://github.com/NousResearch/hermes-agent/blob/main/website/docs/user-guide/features/hooks.md
@@ -6068,15 +6156,16 @@ const HERMESAGENT_HOOK_EVENTS = [
 * observers, `gateway_platform_event` and `transform_api_error_classification`.
 * Shell hooks are gated on the same set.
 *
-* Verified against the tag `v0.21.6`: `VALID_HOOKS` holds 44 entries, grown
+* Verified against the tag `v0.22.3`: `VALID_HOOKS` holds 46 entries, grown
 * from 23 at `v2026.8.3` (v0.20.0) and 37 at `v2026.8.16` (v0.20.2) — v0.21
 * added `agent_loop_stopped` and `on_room_member_activity`, v0.21.5 added
-* `pre_auxiliary_call` and `post_auxiliary_call`, and v0.21.6 added
+* `pre_auxiliary_call` and `post_auxiliary_call`, v0.21.6 added
 * `post_gateway_admission`, `on_human_input_request` and
-* `on_human_input_resolved`. This list holds 43 of them — see
+* `on_human_input_resolved`, and v0.22.3 added `on_session_delete` and
+* `post_compaction`. This list holds 45 of them — see
 * {@link HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS} for the exclusion.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py
 */
 const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"pre_tool_call",
@@ -6100,6 +6189,7 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_session_end",
 	"on_session_finalize",
 	"on_session_reset",
+	"on_session_delete",
 	"on_skill_lifecycle",
 	"subagent_start",
 	"subagent_stop",
@@ -6121,7 +6211,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 	"on_kanban_task_updated",
 	"on_kanban_dispatch_tick",
 	"gateway_platform_event",
-	"pre_command"
+	"pre_command",
+	"post_compaction"
 ];
 /**
 * `VALID_HOOKS` entries a SHELL hook may not register for. `VALID_HOOKS` doubles
@@ -6133,8 +6224,8 @@ const HERMESAGENT_NATIVE_HOOK_EVENTS = [
 * rulesync only ever writes shell hooks, so these are excluded from
 * {@link HERMESAGENT_NATIVE_HOOK_EVENTS} and warned about with their own message.
 *
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
-* @see https://github.com/NousResearch/hermes-agent/blob/v0.21.6/agent/shell_hooks.py — `_parse_hooks_block`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/hermes_cli/plugins.py — `SHELL_UNSUPPORTED_HOOKS`
+* @see https://github.com/NousResearch/hermes-agent/blob/v0.22.3/agent/shell_hooks.py — `_parse_hooks_block`
 */
 const HERMESAGENT_SHELL_UNSUPPORTED_HOOK_EVENTS = ["transform_api_error_classification"];
 /**
@@ -6316,10 +6407,11 @@ const CANONICAL_TO_AUGMENTCODE_EVENT_NAMES = {
 const AUGMENTCODE_TO_CANONICAL_EVENT_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENTCODE_EVENT_NAMES).map(([k, v]) => [v, k]));
 /**
 * Map canonical camelCase event names to Antigravity PascalCase.
-* Antigravity uses the same PascalCase names as Claude for its tool/turn events,
+* Antigravity uses the same PascalCase names as Claude for its session/tool/turn events,
 * plus `PreInvocation`/`PostInvocation` for the model-invocation lifecycle.
 */
 const CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES = {
+	sessionStart: "SessionStart",
 	preToolUse: "PreToolUse",
 	postToolUse: "PostToolUse",
 	preModelInvocation: "PreInvocation",
@@ -7338,14 +7430,19 @@ const toolScopedMcpSchema = z.looseObject({ mcpServers: z.optional(z.record(z.st
 /**
 * Kimi Code's tool-scoped block also carries the `[mcp]` defaults from its
 * shared user config: connect and per-tool-call timeouts that apply to *every*
-* MCP server, including ones rulesync did not write. Per-server
-* `startupTimeoutMs` / `toolTimeoutMs` in `mcpServers` still win.
+* MCP server, including ones rulesync did not write, and (Kimi Code 2.3.0)
+* `defaultDeferred`, which loads every server's tools on demand unless the
+* server opts out. Per-server `startupTimeoutMs` / `toolTimeoutMs` / `deferred`
+* in `mcpServers` still win. `defaultDeferred` only takes effect when Kimi's
+* experimental `tool-select` flag is on, and is captured when a server connects
+* (MoonshotAI/kimi-code#4210).
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
 */
 const kimiCodeScopedMcpSchema = z.extend(toolScopedMcpSchema, {
 	startupTimeoutMs: z.optional(z.number()),
-	toolTimeoutMs: z.optional(z.number())
+	toolTimeoutMs: z.optional(z.number()),
+	defaultDeferred: z.optional(z.boolean())
 });
 /**
 * Qwen Code's tool-scoped block also carries the server-level allow/deny lists
@@ -8114,13 +8211,16 @@ const CopilotPermissionsOverrideSchema = z.looseObject({
 });
 /**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
-* before prompting. `always-ask` auto-approves only read-only tools, `write`
-* also workspace writes, and `yolo` (oh-my-pi's default) every tier.
+* before prompting. `always-ask` auto-approves only read-only tools,
+* `always-ask-cached` (Ask and remember) also prompts before file reads and
+* lets a prompt remember the granted file or folder, `write` also
+* auto-approves workspace writes, and `yolo` (oh-my-pi's default) every tier.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
 */
 const OMP_APPROVAL_MODES = [
 	"always-ask",
+	"always-ask-cached",
 	"write",
 	"yolo"
 ];
@@ -8141,10 +8241,13 @@ const KimiCodePermissionsOverrideSchema = z.looseObject({
 	])),
 	/**
 	* Kimi's `[permission] dangerous_command_guard` switch (Kimi Code 0.40.0,
-	* default `true`). `false` turns off the built-in dangerous-command policy
-	* (no confirmation for `rm -rf`, `shutdown` and the like).
+	* default `true`). Since Kimi Code 2.3.0, `false` turns off every built-in
+	* guard confirmation policy: dangerous commands (`rm -rf`, `shutdown` and the
+	* like), sensitive-file access (`.env`, `id_rsa`, ...) and git control-path
+	* access. Before 2.3.0 it only covered dangerous commands.
 	*
 	* @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#permission
+	* @see https://github.com/MoonshotAI/kimi-code/pull/4250
 	*/
 	dangerousCommandGuard: z.optional(z.boolean()),
 	rules: z.optional(z.array(z.looseObject({
@@ -8504,6 +8607,8 @@ const TabninePermissionsOverrideSchema = z.looseObject({
 * { "allowDynamicBash": true, "rawAllow": ["Bash=pnpm test"] }
 * @example
 * { "mode": "deny" }
+* @example
+* { "tools": { "disabled": ["web_fetch"] }, "askOnExternalOrigin": true }
 */
 const ReasonixPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
@@ -8517,7 +8622,9 @@ const ReasonixPermissionsOverrideSchema = z.looseObject({
 		"ask",
 		"allow",
 		"deny"
-	]))
+	])),
+	askOnExternalOrigin: z.optional(z.boolean()),
+	tools: z.optional(z.strictObject({ disabled: z.optional(z.array(z.string())) }))
 });
 /**
 * Tool-scoped override block for Qoder. `outputStyle` is written to the
@@ -11331,6 +11438,15 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
 		metadata: z.optional(z.looseObject({}))
 	})),
+	xum: z.optional(z.looseObject({
+		"disable-model-invocation": z.optional(z.boolean()),
+		advertise: z.optional(z.boolean()),
+		"user-invocable": z.optional(z.boolean()),
+		"argument-hint": z.optional(z.string()),
+		when_to_use: z.optional(z.string()),
+		"when-to-use": z.optional(z.string()),
+		paths: z.optional(z.union([z.string(), z.array(z.string())]))
+	})),
 	zcode: z.optional(z.looseObject({
 		when_to_use: z.optional(z.string()),
 		license: z.optional(z.string()),
@@ -11609,7 +11725,7 @@ async function getLocalSkillDirNames(sourceTree) {
 * The rulesync skill frontmatter exposes a root-level `disable-model-invocation`
 * default that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, zed, pi, omp, qwencode, vibe, grokcli, factorydroid, dsh, reasonix,
-* commandcode, lettacode, opencode, mimocode). Each tool's own section may override that
+* commandcode, lettacode, opencode, mimocode, xum). Each tool's own section may override that
 * default with a per-target value. A defined section value (including `false`)
 * always wins over the root default.
 *
@@ -11629,7 +11745,7 @@ function resolveDisableModelInvocation({ rootFrontmatter, section }) {
 * The rulesync skill frontmatter exposes a root-level `user-invocable` default
 * that applies to every tool supporting the flag (claudecode, codebuddy, copilot,
 * copilotcli, crush, cursor, qwencode, vibe, grokcli, factorydroid, dsh, reasonix, commandcode,
-* lettacode). Each tool's own section may override that default with a
+* lettacode, xum). Each tool's own section may override that default with a
 * per-target value. A defined section value (including `false`) always wins
 * over the root default.
 *
@@ -13944,7 +14060,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -13965,7 +14082,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 				ownedKeys: [
 					"permissions",
 					"sandbox",
-					"agent"
+					"agent",
+					"tools"
 				]
 			}
 		}
@@ -24090,6 +24208,7 @@ var QwencodeCommand = class QwencodeCommand extends ToolCommand {
 const REASONIX_PROJECT_MCP_FILE_NAME = "reasonix.toml";
 const REASONIX_GLOBAL_DIR = ".reasonix";
 const REASONIX_GLOBAL_MCP_FILE_NAME = "config.toml";
+const REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH = join(".reasonix", REASONIX_PROJECT_MCP_FILE_NAME);
 const REASONIX_PROJECT_PERMISSIONS_FILE_NAME = REASONIX_PROJECT_MCP_FILE_NAME;
 const REASONIX_GLOBAL_PERMISSIONS_FILE_NAME = REASONIX_GLOBAL_MCP_FILE_NAME;
 const REASONIX_DIR = REASONIX_GLOBAL_DIR;
@@ -28437,25 +28556,65 @@ function toolHooksToCanonical({ hooks, converterConfig, logger }) {
 //#endregion
 //#region src/features/hooks/antigravity-hooks.ts
 /**
-* Antigravity uses a Claude-Code-like `hooks.json` (matcher shape). The
-* `PreToolUse`/`PostToolUse` events use the matcher-based array shape, while
-* `PreInvocation`/`PostInvocation`/`Stop` are matcher-less handler lists.
-* `projectDirVar` is empty because Antigravity does not document a
-* project-directory variable for commands.
+* Canonical events whose Antigravity counterparts (`SessionStart`,
+* `PreInvocation`, `PostInvocation`, `Stop`) take no matcher.
+*/
+const ANTIGRAVITY_NO_MATCHER_EVENTS = /* @__PURE__ */ new Set([
+	"sessionStart",
+	"preModelInvocation",
+	"postModelInvocation",
+	"stop"
+]);
+/**
+* Antigravity event names whose value is a flat list of handlers
+* (`"Stop": [ { "type": "command", "command": "..." } ]`) rather than a list
+* of `{ "matcher", "hooks": [...] }` groups. Antigravity's loader rejects a
+* wrapped group under these events ("command hook must specify 'command'")
+* and then skips the whole `hooks.json`.
+* https://antigravity.google/docs/hooks
+*/
+const ANTIGRAVITY_FLAT_HANDLER_EVENTS = new Set([...ANTIGRAVITY_NO_MATCHER_EVENTS].map((event) => lookupOwn({
+	record: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
+	key: event
+}) ?? event));
+/**
+* Antigravity uses a Claude-Code-like `hooks.json`. The `PreToolUse` /
+* `PostToolUse` events use the matcher-based group shape, while `SessionStart`,
+* `PreInvocation`, `PostInvocation` and `Stop` are flat handler lists (see
+* {@link toAntigravityEventMap}). `projectDirVar` is empty because Antigravity
+* does not document a project-directory variable for commands.
 */
 const ANTIGRAVITY_CONVERTER_CONFIG = {
 	supportedEvents: ANTIGRAVITY_HOOK_EVENTS,
 	canonicalToToolEventNames: CANONICAL_TO_ANTIGRAVITY_EVENT_NAMES,
 	toolToCanonicalEventNames: ANTIGRAVITY_TO_CANONICAL_EVENT_NAMES,
 	projectDirVar: "",
-	noMatcherEvents: /* @__PURE__ */ new Set([
-		"preModelInvocation",
-		"postModelInvocation",
-		"stop"
-	]),
+	noMatcherEvents: ANTIGRAVITY_NO_MATCHER_EVENTS,
 	supportedHookTypes: /* @__PURE__ */ new Set(["command"])
 };
 /**
+* Turn the shared converter's matcher-group output into Antigravity's shape:
+* the matcher-less events get their handlers directly under the event key.
+*/
+function toAntigravityEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event)) return [event, entries];
+		return [event, entries.flatMap((entry) => isPlainObject$1(entry) && Array.isArray(entry.hooks) ? entry.hooks : [])];
+	}));
+}
+/**
+* Reverse of {@link toAntigravityEventMap} for import: wrap each flat handler
+* of a matcher-less event in a `{ hooks: [...] }` group so the shared converter
+* can read it. An entry that is already a group (`{ hooks: [...] }`, as older
+* rulesync versions wrote) is kept as is.
+*/
+function toMatcherGroupEventMap(eventMap) {
+	return Object.fromEntries(Object.entries(eventMap).map(([event, entries]) => {
+		if (!ANTIGRAVITY_FLAT_HANDLER_EVENTS.has(event) || !Array.isArray(entries)) return [event, entries];
+		return [event, entries.map((entry) => isPlainObject$1(entry) && !("hooks" in entry) ? { hooks: [entry] } : entry)];
+	}));
+}
+/**
 * Antigravity's `hooks.json` is keyed by a named hook whose value holds the
 * per-event map (plus an optional `enabled` flag). rulesync writes a single
 * generated hook under this stable name.
@@ -28492,8 +28651,8 @@ function flattenAntigravityHooks(parsed) {
 * Hooks generator for Google Antigravity (both the IDE and the CLI).
 *
 * Antigravity writes a dedicated `hooks.json` keyed by a named hook whose
-* value holds the Claude-Code-style event → matcher-entry map
-* (`{ "<name>": { "<Event>": [...] } }`). Project and global modes share the
+* value holds the event map (`{ "<name>": { "<Event>": [...] } }`): matcher
+* groups for the tool events, flat handler lists for the others. Project and global modes share the
 * same shape; only the location differs (`.agents/hooks.json` vs
 * `~/.gemini/config/hooks.json`).
 *
@@ -28537,12 +28696,12 @@ var AntigravityHooks = class extends ToolHooks {
 	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
-		const eventMap = canonicalToToolHooks({
+		const eventMap = toAntigravityEventMap(canonicalToToolHooks({
 			config,
 			toolOverrideHooks: config[this.getOverrideKey()]?.hooks,
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
-		});
+		}));
 		const antigravityHooks = Object.keys(eventMap).length > 0 ? { [ANTIGRAVITY_HOOK_NAME]: eventMap } : {};
 		const fileContent = JSON.stringify(antigravityHooks, null, 2);
 		return new this({
@@ -28561,7 +28720,7 @@ var AntigravityHooks = class extends ToolHooks {
 			throw new Error(`Failed to parse Antigravity hooks content in ${join(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const hooks = toolHooksToCanonical({
-			hooks: flattenAntigravityHooks(parsed),
+			hooks: toMatcherGroupEventMap(flattenAntigravityHooks(parsed)),
 			converterConfig: ANTIGRAVITY_CONVERTER_CONFIG,
 			logger
 		});
@@ -31025,11 +31184,17 @@ var ContinueHooks = class extends SettingsJsonHooks {
 * entry that uses them instead of a shell field is not mistaken for one
 * without a command.
 *
+* An optional `matcher` regex is honored on the events in
+* {@link COPILOT_MATCHER_HOOK_EVENTS}. The VS Code per-OS override fields come
+* from the legacy Local hooks reference and are kept for existing files.
+*
 * @see https://docs.github.com/en/copilot/reference/hooks-reference
+* @see https://code.visualstudio.com/docs/agent-customization/hooks
 * @see https://code.visualstudio.com/docs/agents/reference/hooks-reference
 */
 const CopilotHookEntrySchema = z.looseObject({
 	type: z.string(),
+	matcher: z.optional(z.string()),
 	bash: z.optional(z.string()),
 	powershell: z.optional(z.string()),
 	command: z.optional(z.string()),
@@ -31063,8 +31228,10 @@ function canonicalToCopilotHooks(config) {
 		...sharedConfigHooks,
 		...config.copilot?.hooks
 	};
+	const matcherEvents = new Set(COPILOT_MATCHER_HOOK_EVENTS);
 	const copilot = {};
 	for (const [eventName, definitions] of Object.entries(effectiveHooks)) {
+		const matcherSupported = matcherEvents.has(eventName);
 		const copilotEventName = lookupOwn({
 			record: CANONICAL_TO_COPILOT_EVENT_NAMES,
 			key: eventName
@@ -31072,7 +31239,7 @@ function canonicalToCopilotHooks(config) {
 		const entries = [];
 		for (const def of definitions) {
 			const hookType = def.type ?? "command";
-			if (def.matcher) continue;
+			if (def.matcher && !matcherSupported) continue;
 			if (hookType !== "command") continue;
 			const command = def.command;
 			const timeout = def.timeout;
@@ -31080,6 +31247,7 @@ function canonicalToCopilotHooks(config) {
 			const rest = Object.fromEntries(Object.entries(def).filter(([k]) => !canonicalSchemaKeys.includes(k)));
 			entries.push({
 				type: hookType,
+				...def.matcher && { matcher: def.matcher },
 				...command !== void 0 && command !== null && { [commandField]: command },
 				...def.env !== void 0 && { env: def.env },
 				...timeout !== void 0 && timeout !== null && { timeoutSec: timeout },
@@ -31174,6 +31342,7 @@ function copilotHooksToCanonical(copilotHooks, logger) {
 			if (command === void 0 && hasOsOverride(passthrough)) logger?.warn(`Copilot hook on '${copilotEventName}' has only VS Code per-OS overrides (windows/linux/osx) and no portable command; it is preserved for copilot, but other targets will generate it without a command until a \`command\` is added.`);
 			defs.push({
 				type: "command",
+				...entry.matcher !== void 0 && entry.matcher !== "" && { matcher: entry.matcher },
 				...command !== void 0 && { command },
 				...shell !== void 0 && { shell },
 				...timeout !== void 0 && { timeout },
@@ -31317,21 +31486,13 @@ var CopilotHooks = class CopilotHooks extends ToolHooks {
 */
 /**
 * Canonical events whose Copilot CLI hook entries honor an optional `matcher`
-* field (a regex compiled as `^(?:PATTERN)$`, tested against `toolName`).
-*
-* Confirmed by the upstream changelog: v1.0.36 (2026-04-24, `preToolUse.matcher`
-* honored) and v1.0.63 (2026-06-15, "PostToolUse hook matchers (e.g.
-* `Edit|Write`) are now honored instead of silently dropped").
-* @see https://docs.github.com/en/copilot/reference/hooks-reference
+* field (a regex compiled as `^(?:PATTERN)$`). The hooks reference filters each
+* on a different field: the tool name for `preToolUse` / `postToolUse` /
+* `permissionRequest`, `notification_type`, the `preCompact` trigger
+* (`manual` | `auto`) and the `subagentStart` agent name.
+* See {@link COPILOTCLI_MATCHER_HOOK_EVENTS}.
 */
-const COPILOTCLI_MATCHER_EVENTS = /* @__PURE__ */ new Set([
-	"preToolUse",
-	"postToolUse",
-	"notification",
-	"permissionRequest",
-	"preCompact",
-	"subagentStart"
-]);
+const COPILOTCLI_MATCHER_EVENTS = new Set(COPILOTCLI_MATCHER_HOOK_EVENTS);
 /** Human-readable list of the matcher-aware events, for the drop warning. */
 const COPILOTCLI_MATCHER_EVENTS_LABEL = [...COPILOTCLI_MATCHER_EVENTS].join("/");
 const CopilotCliHookEntrySchema = z.looseObject({
@@ -33467,7 +33628,7 @@ function canonicalToHermesHooks({ config, toolOverrideHooks, logger }) {
 	for (const [nativeEvent, definitions] of Object.entries(toolOverrideHooks ?? {})) {
 		if (HERMESAGENT_CANONICAL_EVENTS.has(nativeEvent)) continue;
 		if (HERMESAGENT_SHELL_UNSUPPORTED_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is Python-plugin-only; Hermes Agent refuses it for shell hooks, so the generated entry will never run.`);
-		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.21.6; preserving it for forward compatibility.`);
+		else if (!HERMESAGENT_NATIVE_EVENTS.has(nativeEvent)) logger?.warn(`Hermes hook event "${nativeEvent}" is not documented by Hermes Agent v0.22.3; preserving it for forward compatibility.`);
 		setHermesHookEntries({
 			result,
 			event: nativeEvent,
@@ -37557,7 +37718,8 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 		},
 		supportedEvents: COPILOT_HOOK_EVENTS,
 		supportedHookTypes: ["command"],
-		supportsMatcher: false
+		supportsMatcher: true,
+		matcherEvents: COPILOT_MATCHER_HOOK_EVENTS
 	}],
 	["copilotcli", {
 		class: CopilotcliHooks,
@@ -37572,7 +37734,7 @@ const toolHooksFactories = /* @__PURE__ */ new Map([
 			"prompt",
 			"http"
 		],
-		supportsMatcher: false
+		supportsMatcher: true
 	}],
 	["kilo", {
 		class: KiloHooks,
@@ -39962,6 +40124,31 @@ const REASONIX_READ_TOOL_NAME = "read_file";
 * treated as rulesync-owned on generate so the dormant copy is replaced.
 */
 const REASONIX_LEGACY_READ_TOOL_NAME = "Read";
+async function isPathPresent(path) {
+	return await fileExists(path) || await isPresentButUnresolvable(path);
+}
+/**
+* Warns when a project-scope generate is about to create `./reasonix.toml`
+* next to an existing `.reasonix/reasonix.toml`.
+*
+* Since v2.46.0 Reasonix reads `.reasonix/reasonix.toml` as the project config
+* when `./reasonix.toml` is absent, and never merges the two: once the root
+* file exists it wins, so every setting in the nested file (permissions,
+* sandbox, disabled tools, MCP servers, ...) silently stops applying. rulesync
+* writes only the root file, so it cannot keep the nested one in effect; this
+* at least names the problem, once per run however many of the features that
+* write the file (mcp, permissions, ignore) are generated. Like Reasonix, anything at the root path
+* (including a broken symlink) counts as the root file being there.
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/internal/contract/config/paths.go
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/CONFIG_PATHS.md
+*/
+async function warnIfReasonixNestedProjectConfigShadowed({ outputRoot, global, logger }) {
+	if (global) return;
+	if (await isPathPresent(join(outputRoot, "reasonix.toml"))) return;
+	if (!await isPathPresent(join(outputRoot, REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH))) return;
+	const nested = toPosixPath(REASONIX_NESTED_PROJECT_CONFIG_RELATIVE_FILE_PATH);
+	warnOnceWithFallback(logger, `Reasonix: ${nested} exists but ${REASONIX_PROJECT_MCP_FILE_NAME} does not. Generating creates ${REASONIX_PROJECT_MCP_FILE_NAME}, and Reasonix then reads it instead of ${nested} (the two are never merged), so every setting in ${nested} stops applying. Move those settings into ${REASONIX_PROJECT_MCP_FILE_NAME} or the rulesync sources.`);
+}
 //#endregion
 //#region src/features/ignore/reasonix-ignore.ts
 const permissionsTableOf = (document) => toReasonixTable(document.permissions);
@@ -40045,7 +40232,12 @@ var ReasonixIgnore = class ReasonixIgnore extends ToolIgnore {
 			fileContent: rulesyncPatterns.join("\n")
 		});
 	}
-	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false }) {
+	static async fromRulesyncIgnore({ outputRoot = process.cwd(), rulesyncIgnore, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const readDenies = rulesyncIgnore.getFileContent().split(/\r?\n|\r/).map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#")).map((pattern) => buildReadDenyEntry(pattern, REASONIX_READ_TOOL_NAME));
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
@@ -40623,7 +40815,8 @@ var IgnoreProcessor = class extends FeatureProcessor {
 			outputRoot: this.outputRoot,
 			rulesyncIgnore,
 			options: this.featureOptions,
-			global: this.global
+			global: this.global,
+			logger: this.logger
 		});
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
 			toolIgnore,
@@ -40973,13 +41166,31 @@ function renameServerField(servers, from, to) {
 		return [name, Object.fromEntries(Object.entries(config).map(([key, value]) => key === from ? [to, value] : [key, value]))];
 	}));
 }
+function isEmptyValue(value) {
+	if (Array.isArray(value)) return value.length === 0;
+	return isPlainObject$1(value) && Object.keys(value).length === 0;
+}
 /**
 * Antigravity uses `serverUrl` (not the canonical `url`) for HTTP/SSE MCP
 * servers. Convert the canonical shape into Antigravity's on the way out, and
-* back to canonical on the way in, so round-tripping is lossless.
+* back to canonical on the way in.
+*
+* Antigravity documents no `type` field: the transport follows from `command`
+* (stdio) or `serverUrl` (Streamable HTTP / SSE), and `agy plugin validate`
+* reports the canonical `type` as an unknown field, so it is not written. A
+* remote server that carries `command`, `args` or `env` was also observed to be
+* refused at startup (runtime behavior reported by `agy plugin validate` 1.4.4,
+* not documented), so an empty `args` / `env` left on a `serverUrl` server is
+* dropped.
+* https://antigravity.google/docs/mcp
 */
 function toAntigravityMcpServers(servers) {
-	return renameServerField(servers, "url", "serverUrl");
+	const renamed = renameServerField(servers, "url", "serverUrl");
+	return Object.fromEntries(Object.entries(renamed).map(([name, config]) => {
+		if (!isPlainObject$1(config)) return [name, config];
+		const isRemote = typeof config.serverUrl === "string";
+		return [name, Object.fromEntries(Object.entries(config).filter(([key, value]) => key !== "type" && !(isRemote && (key === "args" || key === "env") && isEmptyValue(value))))];
+	}));
 }
 function toCanonicalMcpServers(servers) {
 	return renameServerField(servers, "serverUrl", "url");
@@ -45169,6 +45380,60 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 	return true;
 }
 /**
+* Translate a canonical `oauth` block into dcode's custom Slack OAuth app
+* settings, or `undefined` (after warning) when it has to be left out.
+*
+* Since deepagents-code 0.1.87, `_validate_slack_oauth_config` accepts `oauth`
+* only as `{ client_id, client_secret? }` of non-empty strings, and only on a
+* `slack.com` / `*.slack.com` server with `auth: "oauth"`; anything else makes
+* dcode skip the whole server. The canonical block usually carries Claude
+* Code's `{ clientId, callbackPort, ... }` shape, so `clientId` becomes
+* `client_id` (a native `client_id` wins), `client_secret` passes through, and
+* every other key is dropped.
+*
+* @see https://github.com/langchain-ai/deepagents/blob/deepagents-code%3D%3D0.1.87/libs/code/deepagents_code/mcp_config.py
+*/
+function toDeepagentsOauth({ name, oauth, converted, logger }) {
+	if (!isSlackOauthServer(converted)) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		return;
+	}
+	const source = isRecord$1(oauth) ? oauth : {};
+	const result = {};
+	for (const [key, value] of Object.entries(source)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
+		const nativeKey = key === "clientId" ? "client_id" : key;
+		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			continue;
+		}
+		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
+		if (!isDeepagentsOauthValue(value)) {
+			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			continue;
+		}
+		result[nativeKey] = value;
+	}
+	if (result.client_id === void 0) {
+		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		return;
+	}
+	return result;
+}
+function isDeepagentsOauthValue(value) {
+	return typeof value === "string" && value.trim() !== "" && !/[\x00-\x1f\x7f]/.test(value);
+}
+function isSlackOauthServer(server) {
+	if (server.auth !== "oauth" || typeof server.url !== "string") return false;
+	let host;
+	try {
+		host = new URL(server.url).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	return host === "slack.com" || host.endsWith(".slack.com");
+}
+/**
 * Translate one canonical server into dcode's `.mcp.json` shape, or `null` to
 * skip it.
 *
@@ -45191,7 +45456,7 @@ function toDeepagentsServer({ name, server, logger }) {
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
 	});
-	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, ...rest } = server;
+	const { enabledTools, disabledTools, type: _type, transport, disabled: _disabled, httpUrl, oauth, ...rest } = server;
 	const converted = { ...rest };
 	if (!applyDeepagentsCommand({
 		name,
@@ -45206,6 +45471,15 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (transport !== void 0) converted.transport = normalized;
 		else converted.type = normalized;
 	}
+	if (oauth !== void 0) {
+		const deepagentsOauth = toDeepagentsOauth({
+			name,
+			oauth,
+			converted,
+			logger
+		});
+		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
+	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
 		toolName: TOOL_NAME,
 		serverName: name,
@@ -45232,6 +45506,13 @@ function toRulesyncServer(server) {
 	const converted = { ...rest };
 	for (const key of ["type", "transport"]) if (converted[key] === "streamable_http" || converted[key] === "streamable-http") converted[key] = "http";
 	if (Array.isArray(allowedTools)) converted.enabledTools = allowedTools;
+	if (isRecord$1(converted.oauth) && Object.hasOwn(converted.oauth, "client_id")) {
+		const { client_id: clientId, ...oauthRest } = converted.oauth;
+		converted.oauth = Object.hasOwn(oauthRest, "clientId") ? oauthRest : {
+			clientId,
+			...oauthRest
+		};
+	}
 	return converted;
 }
 var DeepagentsMcp = class DeepagentsMcp extends ToolMcp {
@@ -46964,6 +47245,50 @@ function copyHermesOauth(source) {
 	if (typeof source.cimd === "boolean") oauth.cimd = source.cimd;
 	return Object.keys(oauth).length > 0 ? oauth : void 0;
 }
+const HERMES_COST_UNIT_MAX_LENGTH = 32;
+function describeHermesValue(value) {
+	return typeof value === "number" ? String(value) : JSON.stringify(value) ?? String(value);
+}
+/**
+* Copies the per-server MCP cost keys Hermes v0.22.3 reads in
+* `tools/mcp_tool_costs.py`: `tool_costs` (declared per-tool costs keyed by
+* MCP tool name; each a number, a `[min, max]` range or `{credits, note}`),
+* `spend_limit` (per-chat budget for the server's costed tools; `0`/absent =
+* no limit) and `cost_unit` (label shown with costs; default `credits`).
+*
+* A costed call that would exceed `spend_limit` asks first even on a
+* `trust: full` server, so dropping the key on regenerate would silently
+* remove the guard. Values Hermes would reject when loading the server are
+* dropped with a warning instead of being written into a config Hermes then
+* refuses: `spend_limit` must be a finite non-negative number, `cost_unit` a
+* non-blank string of at most 32 characters, and `tool_costs` a mapping. The
+* mapping is rebuilt as an opaque object (so no reference is shared with the
+* source), with prototype-pollution keys removed at every depth since its
+* values may themselves be objects.
+*/
+function copyHermesCostFields({ source, target, logger }) {
+	let copied = false;
+	const { spend_limit: spendLimit, cost_unit: costUnit, tool_costs: toolCosts } = source;
+	if (spendLimit !== void 0) {
+		if (typeof spendLimit === "number" && Number.isFinite(spendLimit) && spendLimit >= 0) {
+			target.spend_limit = spendLimit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping spend_limit ${describeHermesValue(spendLimit)}; Hermes requires a non-negative number.`);
+	}
+	if (costUnit !== void 0) {
+		if (typeof costUnit === "string" && costUnit.trim() !== "" && costUnit.length <= HERMES_COST_UNIT_MAX_LENGTH) {
+			target.cost_unit = costUnit;
+			copied = true;
+		} else logger?.warn(`Hermes MCP: dropping cost_unit ${describeHermesValue(costUnit)}; Hermes requires a non-empty string of at most ${HERMES_COST_UNIT_MAX_LENGTH} characters.`);
+	}
+	if (toolCosts !== void 0) {
+		if (isPlainObject$1(toolCosts)) {
+			target.tool_costs = omitPrototypePollutionKeysDeep(toolCosts);
+			copied = true;
+		} else logger?.warn("Hermes MCP: dropping tool_costs; Hermes requires a mapping of MCP tool names to costs.");
+	}
+	return copied;
+}
 const HERMES_OPAQUE_MAPPING_KEYS = [
 	"sampling",
 	"elicitation",
@@ -46975,13 +47300,18 @@ const HERMES_OPAQUE_MAPPING_KEYS = [
 * alias — `auth` (`oauth` for OAuth 2.1/PKCE), mTLS `client_cert` (string PEM
 * path, or `[cert, key]`/`[cert, key, password]` list) and `client_key`,
 * `connect_timeout` (seconds), `supports_parallel_tool_calls`, `protocol`,
-* `lazy`, `keepalive_interval`, `elicitation`, `trust`, and `identity_header` —
+* `lazy`, `keepalive_interval`, `elicitation`, `trust`, `identity_header`, and
+* the cost keys (see {@link copyHermesCostFields}) —
 * verbatim from `source` to `target`. Field names are identical on both sides
 * (the canonical `McpServerSchema` is a `looseObject`), so this serves export
 * and import alike. See the Hermes mcp-config-reference.
 */
-function copyHermesAdvancedFields(source, target) {
-	let copied = false;
+function copyHermesAdvancedFields(source, target, logger) {
+	let copied = copyHermesCostFields({
+		source,
+		target,
+		logger
+	});
 	if (typeof source.auth === "string") {
 		target.auth = source.auth;
 		copied = true;
@@ -47090,7 +47420,7 @@ function applyHermesToolsBlock(hermesTools, server) {
 * as Hermes's own `transport: sse`, without which Hermes would connect to it
 * over Streamable HTTP.
 */
-function convertServerToHermes(config) {
+function convertServerToHermes(config, logger) {
 	const out = {};
 	const command = config.command;
 	const url = resolveHermesUrl(config);
@@ -47113,7 +47443,7 @@ function convertServerToHermes(config) {
 	if (config.disabled === true) out.enabled = false;
 	const timeout = resolveHermesTimeout(config);
 	if (timeout !== void 0) out.timeout = timeout;
-	copyHermesAdvancedFields(config, out);
+	copyHermesAdvancedFields(config, out, logger);
 	const tools = buildHermesToolsBlock(config);
 	if (Object.keys(tools).length > 0) out.tools = tools;
 	return out;
@@ -47121,11 +47451,11 @@ function convertServerToHermes(config) {
 /**
 * Converts rulesync canonical MCP servers into Hermes `mcp_servers:` entries.
 */
-function convertToHermesFormat(mcpServers) {
+function convertToHermesFormat(mcpServers, logger) {
 	const result = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name) || !isRecord$1(config)) continue;
-		result[name] = convertServerToHermes(config);
+		result[name] = convertServerToHermes(config, logger);
 	}
 	return result;
 }
@@ -47145,7 +47475,7 @@ function mergeHermesMcpServers(config, mcpServers) {
 * Mirrors {@link convertToHermesFormat}: `enabled: false` maps back to the
 * canonical `disabled: true`, and only recognized fields are carried over.
 */
-function convertFromHermesFormat(mcpServers) {
+function convertFromHermesFormat(mcpServers, logger) {
 	const result = {};
 	const hermesOverrides = {};
 	for (const [name, config] of Object.entries(mcpServers)) {
@@ -47162,7 +47492,7 @@ function convertFromHermesFormat(mcpServers) {
 		if (isRecord$1(config.tools)) applyHermesToolsBlock(config.tools, server);
 		result[name] = server;
 		const hermesServer = { ...server };
-		if (copyHermesAdvancedFields(config, hermesServer)) hermesOverrides[name] = hermesServer;
+		if (copyHermesAdvancedFields(config, hermesServer, logger)) hermesOverrides[name] = hermesServer;
 	}
 	return {
 		mcpServers: result,
@@ -47181,8 +47511,10 @@ function convertFromHermesFormat(mcpServers) {
 */
 var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	config;
-	constructor(params) {
+	logger;
+	constructor({ logger, ...params }) {
 		super(params);
+		this.logger = logger;
 		this.config = this.fileContent !== void 0 ? parseSharedConfig({
 			format: "yaml",
 			fileContent: this.fileContent
@@ -47226,7 +47558,7 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 	static getExtraSharedWritePaths() {
 		return getHermesagentSharedConfigWritePaths();
 	}
-	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false }) {
+	static async fromFile({ outputRoot = process.cwd(), validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
@@ -47236,17 +47568,18 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 			relativeFilePath: paths.relativeFilePath,
 			fileContent,
 			validate,
-			global
+			global,
+			logger
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
 		if (!global) throw new Error(HERMESAGENT_GLOBAL_ONLY_MESSAGE);
 		const paths = this.getSettablePaths({ global });
 		const fileContent = await readFileContentOrNull(join(outputRoot, paths.relativeDirPath, paths.relativeFilePath)) ?? "";
 		const merged = mergeHermesMcpServers(parseSharedConfig({
 			format: "yaml",
 			fileContent
-		}), convertToHermesFormat(rulesyncMcp.getMcpServers()));
+		}), convertToHermesFormat(rulesyncMcp.getMcpServers(), logger));
 		return new HermesagentMcp({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -47258,11 +47591,12 @@ var HermesagentMcp = class HermesagentMcp extends ToolMcp {
 				patch: { mcp_servers: merged.mcp_servers }
 			}),
 			validate,
-			global
+			global,
+			logger
 		});
 	}
 	toRulesyncMcp() {
-		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {});
+		const { mcpServers: servers, hermesOverrides } = convertFromHermesFormat(isRecord$1(this.config.mcp_servers) ? this.config.mcp_servers : {}, this.logger);
 		return this.toRulesyncMcpDefault({
 			outputRoot: getHermesagentRulesyncOutputRoot({
 				nativeOutputRoot: this.outputRoot,
@@ -48146,14 +48480,15 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 	if (!config.parsed) return {};
 	return {
 		...typeof config.mcp.startup_timeout_ms === "number" && { startupTimeoutMs: config.mcp.startup_timeout_ms },
-		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms }
+		...typeof config.mcp.tool_timeout_ms === "number" && { toolTimeoutMs: config.mcp.tool_timeout_ms },
+		...typeof config.mcp.default_deferred === "boolean" && { defaultDeferred: config.mcp.default_deferred }
 	};
 }
 /**
 * Kimi's `[mcp]` section in the shared user config sets the default connect and
-* per-tool-call timeouts for *every* MCP server, including ones rulesync did not
-* write. Per-server values in `mcp.json` still take precedence; this only moves
-* the floor.
+* per-tool-call timeouts, and whether tools load on demand, for *every* MCP
+* server, including ones rulesync did not write. Per-server values in
+* `mcp.json` still take precedence; this only moves the default.
 *
 * Written as an auxiliary file so it goes through the normal write phase and
 * respects `--dry-run`, and merged through the shared-config gateway so the
@@ -48161,7 +48496,8 @@ async function readKimiCodeMcpDefaults({ outputRoot }) {
 *
 * The gateway replaces an owned key wholesale, and `mcp` is a table, so the
 * section is recomputed from the existing file: authoring only
-* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms`. Same
+* `startupTimeoutMs` must not delete a hand-written `tool_timeout_ms` or
+* `default_deferred`. Same
 * approach the `.vibe/config.toml` `tools` writer takes.
 *
 * @see https://moonshotai.github.io/kimi-code/en/configuration/config-files.html#mcp
@@ -48188,7 +48524,8 @@ var KimiCodeMcpConfigToml = class KimiCodeMcpConfigToml extends ToolFile {
 			patch: { mcp: {
 				...existingSection,
 				...defaults.startupTimeoutMs !== void 0 && { startup_timeout_ms: defaults.startupTimeoutMs },
-				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs }
+				...defaults.toolTimeoutMs !== void 0 && { tool_timeout_ms: defaults.toolTimeoutMs },
+				...defaults.defaultDeferred !== void 0 && { default_deferred: defaults.defaultDeferred }
 			} },
 			filePath: relativeConfigPath
 		});
@@ -48286,18 +48623,20 @@ var KimiCodeMcp = class KimiCodeMcp extends ToolMcp {
 		if (!isRecord$1(block)) return [];
 		const startupTimeoutMs = typeof block.startupTimeoutMs === "number" ? block.startupTimeoutMs : void 0;
 		const toolTimeoutMs = typeof block.toolTimeoutMs === "number" ? block.toolTimeoutMs : void 0;
-		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0) return [];
+		const defaultDeferred = typeof block.defaultDeferred === "boolean" ? block.defaultDeferred : void 0;
+		if (startupTimeoutMs === void 0 && toolTimeoutMs === void 0 && defaultDeferred === void 0) return [];
 		const existing = await readKimiCodeConfig({ outputRoot });
 		if (!existing.parsed) {
 			const paths = kimiCodeConfigRelativePath();
-			warnWithFallback(logger, `Skipping the Kimi Code MCP timeout defaults: ${join(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
+			warnWithFallback(logger, `Skipping the Kimi Code MCP [mcp] defaults: ${join(paths.relativeDirPath, paths.relativeFilePath)} is not valid TOML.`);
 			return [];
 		}
 		return [KimiCodeMcpConfigToml.fromDefaults({
 			outputRoot,
 			defaults: {
 				startupTimeoutMs,
-				toolTimeoutMs
+				toolTimeoutMs,
+				defaultDeferred
 			},
 			existing
 		})];
@@ -50873,6 +51212,11 @@ var ReasonixMcp = class ReasonixMcp extends ToolMcp {
 		});
 	}
 	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "";
@@ -52900,6 +53244,144 @@ function buildCommandString(server) {
 	if (typeof server.command !== "string" || server.command.trim() === "") return void 0;
 	return [server.command, ...args.map(quoteShellWord)].join(" ");
 }
+/** A name bash accepts on the left of a `NAME=value` assignment. */
+const SHELL_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A canonical `${VAR}` reference whose name bash can expand. */
+const ENV_VAR_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/**
+* Quote an env value for a `NAME=value` assignment. Literal text is
+* single-quoted, so nothing in it is expanded or run, while every canonical
+* `${VAR}` reference is emitted as `"${VAR}"` so bash still expands it from
+* the environment Xum starts the server with. The pieces are concatenated into
+* one shell word: `Bearer ${TOKEN}` becomes `'Bearer '"${TOKEN}"`.
+*/
+function quoteEnvValue(value) {
+	if (value === "") return "''";
+	const parts = [];
+	let last = 0;
+	for (const match of value.matchAll(ENV_VAR_REFERENCE)) {
+		if (match.index > last) parts.push(quoteShellWord(value.slice(last, match.index)));
+		parts.push(`"\${${match[1]}}"`);
+		last = match.index + match[0].length;
+	}
+	if (last < value.length) parts.push(quoteShellWord(value.slice(last)));
+	return parts.join("");
+}
+/**
+* Build the `NAME=value ` prefix that sets a stdio server's `env` for its
+* command only (Xum runs the command string with bash). Returns the prefix
+* plus the entries left out: names that cannot be bash assignment targets and
+* entries whose value is not a string.
+*/
+function buildEnvPrefix(env) {
+	const assignments = [];
+	const invalidNames = [];
+	const nonStringNames = [];
+	for (const [name, value] of Object.entries(env)) {
+		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
+		if (!SHELL_ENV_NAME.test(name)) {
+			invalidNames.push(name);
+			continue;
+		}
+		if (typeof value !== "string") {
+			nonStringNames.push(name);
+			continue;
+		}
+		assignments.push(`${name}=${quoteEnvValue(value)}`);
+	}
+	return {
+		prefix: assignments.map((assignment) => `${assignment} `).join(""),
+		invalidNames,
+		nonStringNames
+	};
+}
+/** Bash reserved words; a command starting with one cannot take an assignment prefix. */
+const BASH_RESERVED_WORDS = /* @__PURE__ */ new Set([
+	"!",
+	"[[",
+	"]]",
+	"{",
+	"}",
+	"case",
+	"coproc",
+	"do",
+	"done",
+	"elif",
+	"else",
+	"esac",
+	"fi",
+	"for",
+	"function",
+	"if",
+	"in",
+	"select",
+	"then",
+	"time",
+	"until",
+	"while"
+]);
+/**
+* Explain why a `NAME=value` prefix would not reach the server, or return
+* `undefined` when it would. Bash applies such assignments to the first simple
+* command only: with a list or pipeline (`cd x && srv`) the server would not
+* see them, and in front of a group, parenthesized list or reserved word (`( srv )`,
+* `{ srv; }`, `if ...`) they are a syntax error that keeps the server from
+* starting. Only the verbatim `command` string is checked for operators,
+* outside complete single-quoted words; argv elements are quoted by
+* {@link quoteShellWord}.
+*/
+function envPrefixBlocker(server, baseCommand) {
+	if (typeof server.command === "string") {
+		const unquoted = server.command.replace(/'[^']*'/g, "");
+		if (unquoted.includes("'") || /[;&|(){}\n]/.test(unquoted)) return "its command string contains shell operators, grouping or a newline, so bash would not pass NAME=value assignments in front of it to the server";
+	}
+	const [firstWord] = baseCommand.trimStart().split(/\s+/);
+	if (firstWord !== void 0 && BASH_RESERVED_WORDS.has(firstWord)) return `its command starts with the bash reserved word ${quoteValueForWarning(firstWord)}, which cannot follow NAME=value assignments`;
+}
+/**
+* One leading `NAME=value` assignment in exactly the shape {@link quoteEnvValue}
+* writes: bare shell-safe characters, single-quoted text (with the `'\''`
+* escape) and `"${VAR}"` references, followed by spaces or tabs (a newline
+* would end the command, so the assignment would not apply to what follows). Bare characters
+* are matched one at a time, so every alternative starts with a distinct
+* character and the pattern cannot backtrack exponentially.
+*/
+const LEADING_ENV_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=((?:[A-Za-z0-9_\-.,:/@%+=]|'[^']*'|\\'|"\$\{[A-Za-z_][A-Za-z0-9_]*\}")*)[ \t]+/;
+/** Decode a value written by {@link quoteEnvValue} back into its canonical form. */
+function unquoteEnvValue(quoted) {
+	return quoted.replace(/'([^']*)'|\\'|"(\$\{[A-Za-z_][A-Za-z0-9_]*\})"/g, (_m, single, ref) => typeof single === "string" ? single : typeof ref === "string" ? ref : "'");
+}
+/**
+* Split leading `NAME=value` assignments off a command string, but only when
+* every one of them is in the shape rulesync writes and a plain command
+* follows (see {@link envPrefixBlocker}); anything else (for example a `$(...)` substitution) keeps the whole string as
+* the command.
+*/
+function splitEnvPrefix(command) {
+	const env = {};
+	let rest = command.trimStart();
+	for (;;) {
+		const match = LEADING_ENV_ASSIGNMENT.exec(rest);
+		if (match === null) break;
+		const [whole, name, quoted] = match;
+		if (name === void 0 || quoted === void 0 || PROTOTYPE_POLLUTION_KEYS.has(name)) break;
+		env[name] = unquoteEnvValue(quoted);
+		rest = rest.slice(whole.length);
+	}
+	if (Object.keys(env).length === 0 || rest.trim() === "" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest) || envPrefixBlocker({ command: rest }, rest) !== void 0) return { rest: command };
+	return {
+		env,
+		rest
+	};
+}
+/** Read a command string back into `env` + `command` + `args`. */
+function parseCommandString(command) {
+	const { env, rest } = splitEnvPrefix(command);
+	return {
+		...env !== void 0 && { env },
+		...splitCommandString(rest)
+	};
+}
 /** Split a plain command string back into `command` + `args` when it is safe to. */
 function splitCommandString(command) {
 	const trimmed = command.trim();
@@ -52943,10 +53425,20 @@ function convertServerToXum({ name, server, logger }) {
 			...settings
 		};
 	}
-	const command = buildCommandString(server);
-	if (command === void 0) return skip("it has no command");
-	const dropped = [...isPlainObject$1(server.env) && Object.keys(server.env).length > 0 ? ["env"] : [], ...typeof server.cwd === "string" ? ["cwd"] : []];
-	if (dropped.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets ${dropped.join(" and ")}, which Xum's mcp.jsonc cannot express; the server is written without it (Xum starts stdio servers with your shell environment in the workspace directory).`);
+	const baseCommand = buildCommandString(server);
+	if (baseCommand === void 0) return skip("it has no command");
+	let command = baseCommand;
+	if (isPlainObject$1(server.env) && Object.keys(server.env).length > 0) {
+		const blocker = envPrefixBlocker(server, baseCommand);
+		if (blocker !== void 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env, but ${blocker}; the server is written without env.`);
+		else {
+			const { prefix, invalidNames, nonStringNames } = buildEnvPrefix(server.env);
+			command = `${prefix}${baseCommand}`;
+			if (invalidNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${invalidNames.map(quoteValueForWarning).join(", ")}, which cannot be a bash variable name; the server is written without it.`);
+			if (nonStringNames.length > 0) warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets env ${nonStringNames.map(quoteValueForWarning).join(", ")} to a value that is not a string; the server is written without it.`);
+		}
+	}
+	if (typeof server.cwd === "string") warnWithFallback(logger, `Xum MCP: ${quoteValueForWarning(name)} sets cwd, which Xum's mcp.jsonc cannot express; the server is written without it (Xum starts stdio servers in the workspace directory).`);
 	return Object.keys(settings).length > 0 ? {
 		command,
 		...settings
@@ -52966,7 +53458,7 @@ function convertFromXumFormat(servers) {
 	for (const [name, entry] of Object.entries(servers)) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(name)) continue;
 		if (typeof entry === "string") {
-			result[name] = splitCommandString(entry);
+			result[name] = parseCommandString(entry);
 			continue;
 		}
 		if (!isPlainObject$1(entry)) continue;
@@ -52976,7 +53468,7 @@ function convertFromXumFormat(servers) {
 			server.url = entry.url;
 			const headers = copyStringHeaders(entry.headers);
 			if (headers !== void 0) server.headers = headers;
-		} else if (typeof entry.command === "string") Object.assign(server, splitCommandString(entry.command));
+		} else if (typeof entry.command === "string") Object.assign(server, parseCommandString(entry.command));
 		else continue;
 		if (entry.disabled === true) server.disabled = true;
 		if (isStringArray$1(entry.toolAllowlist)) server.enabledTools = entry.toolAllowlist;
@@ -52991,9 +53483,10 @@ function convertFromXumFormat(servers) {
 * (project; a server there wins over the user one of the same name). Both are
 * a JSONC document with a `servers` map:
 *
-* - a stdio server is a shell command string (the object form `{ command }`
-*   carries `disabled` / `toolAllowlist`); Xum's mcp.jsonc has no `env` or
-*   `cwd`, so those are dropped with a warning;
+* - a stdio server is a shell command string run with bash (the object form
+*   `{ command }` carries `disabled` / `toolAllowlist`); `env` is written as
+*   `NAME=value` assignments in front of the command, and `cwd`, which has no
+*   equivalent, is dropped with a warning;
 * - a remote server is `{ transport: "http" | "sse" | "auto", url, headers }`
 *   (the transport defaults to auto-detection).
 *
@@ -53125,7 +53618,7 @@ function asZcodeRemoteType(stated, url) {
 }
 /**
 * The keys each OAuth flow of ZCode's per-server `oauth` union accepts on a
-* remote server, and which of them are required. Read off the 3.14.3/3.15.3
+* remote server, and which of them are required. Read off the 3.14.3–3.16.2
 * runtime config schema, since ZCode's MCP page only says to "enable OAuth for
 * the service in its configuration". Both variants are strict, so any other
 * key would make ZCode skip the server.
@@ -53229,7 +53722,11 @@ function resolveZcodeTimeoutMs({ serverName, config, logger }) {
 }
 /**
 * The per-server keys ZCode reads on every transport: `timeoutMs`,
-* `protocolVersion` and the enable toggle (`enableKey`).
+* `protocolVersion`, `alwaysLoad` and the enable toggle (`enableKey`).
+*
+* `alwaysLoad` (added in 3.16.2 alongside tool search) keeps a server's tools
+* loaded up front instead of deferring them behind tool search. ZCode's schema
+* types it as a boolean, so any other value is dropped with a warning.
 */
 function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const common = {};
@@ -53242,6 +53739,9 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 	const { protocolVersion } = config;
 	if (ZCODE_PROTOCOL_VERSIONS.has(protocolVersion)) common.protocolVersion = protocolVersion;
 	else if (protocolVersion !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping protocolVersion ${JSON.stringify(protocolVersion)}, as ZCode accepts only ${[...ZCODE_PROTOCOL_VERSIONS].map((v) => JSON.stringify(v)).join(", ")}.`);
+	const { alwaysLoad } = config;
+	if (typeof alwaysLoad === "boolean") common.alwaysLoad = alwaysLoad;
+	else if (alwaysLoad !== void 0) logger?.warn(`ZCode MCP server "${serverName}": dropping alwaysLoad ${JSON.stringify(alwaysLoad)}, as it must be a boolean.`);
 	if (config.disabled === true) common[enableKey] = false;
 	return common;
 }
@@ -53254,11 +53754,11 @@ function toZcodeCommonKeys({ serverName, config, enableKey, logger }) {
 * absent.
 *
 * Every server also carries `timeoutMs` (from the canonical `timeout`, or an
-* explicit `timeoutMs`) and an allow-listed `protocolVersion`; stdio servers
-* carry `cwd`, and remote servers an `oauth` built from the namespaced
-* `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
+* explicit `timeoutMs`), an allow-listed `protocolVersion` and a boolean
+* `alwaysLoad`; stdio servers carry `cwd`, and remote servers an `oauth` built
+* from the namespaced `zcodeOauth`. That key is stripped by `RulesyncMcp.getMcpServers()`, so it
 * is read from the authored server through `rawServerOf`. ZCode's docs do not
-* name these keys, so they follow the 3.14.3/3.15.3 runtime's per-server
+* name these keys, so they follow the 3.14.3–3.16.2 runtime's per-server
 * schema, which is strict: an unknown key makes ZCode skip the server, which
 * is why the output stays a whitelist.
 *
@@ -58395,6 +58895,11 @@ const CLAUDECODE_TRUST_AFFECTING_SANDBOX_PATHS = [
 		reason: "lets sandboxed commands send Apple Events, which removes code-execution isolation",
 		widens: isNotFalse
 	},
+	{
+		path: ["allowNestedUserNamespaces"],
+		reason: "lets sandboxed Linux commands create user namespaces, which gets around the sandbox's file protections",
+		widens: isNotFalse
+	},
 	{
 		path: ["allowUnsandboxedCommands"],
 		reason: "controls whether Claude may retry a blocked command outside the sandbox",
@@ -68844,7 +69349,7 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *   catch-all one at its own strictness, a pattern-specific one as `prompt`).
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
-* `write` or `yolo`); without it the key is left as it is in the file, and on
+* `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
 * import a recognized value is read back into the override.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
@@ -71116,6 +71621,8 @@ function buildReasonixPermissionEntry(toolName, pattern) {
 const REASONIX_TOOL_LABEL = "Reasonix";
 /** The `[permissions]` key the override's `allowDynamicBash` writes and reads. */
 const REASONIX_ALLOW_DYNAMIC_BASH_KEY = "allow_dynamic_bash";
+/** The `[permissions]` key the override's `askOnExternalOrigin` writes and reads. */
+const REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY = "ask_on_external_origin";
 /**
 * `[sandbox]` keys whose authored value loosens the enforcement layer beneath
 * the permission policy: they take Bash out of its OS jail, open that jail to
@@ -71318,6 +71825,95 @@ function applyPermissionsMode({ permissions, authored, global, relativeFilePath,
 		reason: "lets every writer call that no rule matches run without a prompt"
 	}];
 }
+/**
+* Writes the override's `askOnExternalOrigin` into `[permissions]`. Reasonix
+* honors the key only in the user config (`narrowPermissions` in
+* `project_scope.go`), so a project-scope generate skips it with a warning and
+* leaves whatever the file had. Turning it on only adds prompts, so that is
+* quiet; turning off a value the file had on is reported, since Auto and YOLO
+* then run calls that repeat text from a web page or tool result without asking.
+* As with `applyAllowDynamicBash`, only a literal `true` counts as quiet, so a
+* value a `--no-validate` run let through is never written in silence.
+*
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.47.1/docs/GUIDE.md
+*/
+function applyAskOnExternalOrigin({ permissions, override, global, relativeFilePath, logger }) {
+	const authored = override?.askOnExternalOrigin;
+	if (authored === void 0) return [];
+	if (!global) {
+		logger?.warn(`Reasonix permissions: skipping reasonix.askOnExternalOrigin for the project-scoped ${relativeFilePath}; Reasonix honors [permissions] ask_on_external_origin only in the user config and ignores a project value, so generate it with --global instead.`);
+		return [];
+	}
+	const previous = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+	permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY] = authored;
+	if (authored === true || previous !== true && authored === false) return [];
+	return [{
+		label: `permissions.${REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY}`,
+		reason: "lets Auto and YOLO run a call that repeats text from a web page or tool result without asking first"
+	}];
+}
+/**
+* The `tools` patch entry — the `[tools]` table with the override's `disabled`
+* list laid over it, or nothing when the override does not author one — and the
+* trust rows it carries. Adding a name only removes a tool, and a project file
+* can only add to the user's list, so that stays quiet. The list is replaced
+* whole, though, so a name the file had turned off and the override leaves out
+* is turned back on, and that is reported, as are a `[tools]` or a `disabled`
+* the file holds in a shape that cannot be read. Only `disabled` is written:
+* the rest of `[tools]` (timeouts, search backends, ...) stays as it is.
+*/
+function applyToolsDisabled({ existing, override }) {
+	const disabled = override?.tools?.disabled;
+	if (disabled === void 0) return {
+		patch: {},
+		entries: []
+	};
+	const patch = { tools: {
+		...asReasonixRecord(existing),
+		disabled
+	} };
+	if (existing === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!isRecord$1(existing)) return {
+		patch,
+		entries: [{
+			label: "tools",
+			reason: replacedUnreadableReason({
+				shape: "object",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const before = existing.disabled;
+	if (before === void 0) return {
+		patch,
+		entries: []
+	};
+	if (!Array.isArray(before)) return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: replacedUnreadableReason({
+				shape: "list",
+				toolLabel: REASONIX_TOOL_LABEL
+			})
+		}]
+	};
+	const reEnabled = uniq(before.filter((name) => !disabled.includes(name)));
+	if (reEnabled.length === 0) return {
+		patch,
+		entries: []
+	};
+	return {
+		patch,
+		entries: [{
+			label: "tools.disabled",
+			reason: `turns back on ${reEnabled.map((name) => quoteValueForWarning(name)).join(", ")}, which the file had turned off`
+		}]
+	};
+}
 function parseReasonixConfig(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -71373,6 +71969,11 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		});
 	}
 	static async fromRulesyncPermissions({ outputRoot = process.cwd(), rulesyncPermissions, validate = true, logger, global = false }) {
+		await warnIfReasonixNestedProjectConfigShadowed({
+			outputRoot,
+			global,
+			logger
+		});
 		const paths = this.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const relativeFilePathForLog = toPosixPath(join(paths.relativeDirPath, paths.relativeFilePath));
@@ -71432,7 +72033,20 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 			relativeFilePath: relativeFilePathForLog,
 			logger
 		}));
+		trustAffecting.push(...applyAskOnExternalOrigin({
+			permissions: mergedPermissions,
+			override,
+			global,
+			relativeFilePath: relativeFilePathForLog,
+			logger
+		}));
 		const patch = { permissions: mergedPermissions };
+		const toolsDisabled = applyToolsDisabled({
+			existing: parsed.tools,
+			override
+		});
+		Object.assign(patch, toolsDisabled.patch);
+		trustAffecting.push(...toolsDisabled.entries);
 		if (override?.sandbox !== void 0) {
 			const authoredSandbox = dropUserOnlySandboxKeys({
 				sandbox: override.sandbox,
@@ -71506,6 +72120,14 @@ var ReasonixPermissions = class ReasonixPermissions extends ToolPermissions {
 		const allowDynamicBash = permissions[REASONIX_ALLOW_DYNAMIC_BASH_KEY];
 		if (typeof allowDynamicBash === "boolean") reasonixOverride.allowDynamicBash = allowDynamicBash;
 		if (this.global && typeof permissions.mode === "string" && REASONIX_PERMISSION_MODES.has(permissions.mode)) reasonixOverride.mode = permissions.mode;
+		const askOnExternalOrigin = permissions[REASONIX_ASK_ON_EXTERNAL_ORIGIN_KEY];
+		if (this.global && typeof askOnExternalOrigin === "boolean") reasonixOverride.askOnExternalOrigin = askOnExternalOrigin;
+		const toolsDisabled = asReasonixRecord(this.toml.tools).disabled;
+		if (Array.isArray(toolsDisabled)) {
+			const names = toReasonixStringArray(toolsDisabled);
+			if (names.length < toolsDisabled.length) warnWithFallback(void 0, `Reasonix permissions: ${this.getRelativePathFromCwd()} [tools] disabled holds ${toolsDisabled.length - names.length} non-string entries; they are not imported into reasonix.tools.disabled, so the next generate drops them.`);
+			reasonixOverride.tools = { disabled: names };
+		}
 		if (Object.keys(sandbox).length > 0) reasonixOverride.sandbox = sandbox;
 		if (Object.keys(agentPlanMode).length > 0) reasonixOverride.agent = agentPlanMode;
 		if (allowSplit.exact.length > 0) reasonixOverride.rawAllow = allowSplit.exact;
@@ -73087,7 +73709,12 @@ var TaktPermissions = class TaktPermissions extends ToolPermissions {
 		const authoredProviderOptions = isPlainObject$1(override?.[TAKT_PROVIDER_OPTIONS_KEY]) ? override[TAKT_PROVIDER_OPTIONS_KEY] : void 0;
 		const runtimeModeRefusesProviderOptions = authoredProviderOptions !== void 0 && runtime.active;
 		if (runtimeModeRefusesProviderOptions) logger?.warn(`Takt permissions: not writing "${TAKT_PROVIDER_OPTIONS_KEY}" to ${filePath} because ${runtime.filePaths.join(" + ")} puts Takt in runtime provider mode (Takt 0.56.0+), where any legacy provider setting in config.yaml makes Takt fail with "Mixed provider configuration detected". Move those options to \`provider.profiles.<profile>.options\` in runtime.yaml, and remove them from the \`takt\` block of the rulesync source. A "${TAKT_PROVIDER_OPTIONS_KEY}" already in ${filePath} is left untouched — rulesync does not own that key.`);
-		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : authoredProviderOptions;
+		const overrideProviderOptions = runtimeModeRefusesProviderOptions ? void 0 : dropUntrustedProviderOptions({
+			providerOptions: authoredProviderOptions,
+			global,
+			filePath,
+			logger
+		});
 		const authoredPolicies = pickSecurityPolicies(override, {
 			filePath,
 			logger,
@@ -73591,6 +74218,68 @@ function taktModeToRulesyncConfig(mode) {
 		default: return { permission: { bash: { [CATCH_ALL_PATTERN$1]: "deny" } } };
 	}
 }
+const TAKT_BASE_URL_PROVIDERS = [
+	"codex",
+	"claude",
+	"deepseek_harness"
+];
+const TAKT_DEEPSEEK_HARNESS_KEY = "deepseek_harness";
+/** Mirrors Takt's `isLoopbackBaseUrl`: localhost, *.localhost, ::1 or 127.x.x.x. */
+function isLoopbackBaseUrl(value) {
+	let hostname;
+	try {
+		hostname = new URL(value).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname === "[::1]") return true;
+	const octets = hostname.split(".");
+	return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d+$/.test(octet) && Number(octet) <= 255);
+}
+/** The keys of one `provider_options.<provider>` entry Takt rejects in config.yaml. */
+function untrustedProviderOptionKeys({ provider, options, global }) {
+	const keys = [];
+	if (provider === TAKT_DEEPSEEK_HARNESS_KEY) {
+		if (options.reasoning_effort !== void 0) keys.push("reasoning_effort");
+		const { plugins } = options;
+		if (!global && plugins !== void 0 && (!Array.isArray(plugins) || plugins.length > 0)) keys.push("plugins");
+	}
+	const baseUrl = options.base_url;
+	if (!global && TAKT_BASE_URL_PROVIDERS.includes(provider) && baseUrl !== void 0 && (typeof baseUrl !== "string" || !isLoopbackBaseUrl(baseUrl))) keys.push("base_url");
+	return keys;
+}
+/**
+* Drop the `provider_options` entries Takt refuses to load from `config.yaml`
+* (it fails at startup with a `Configuration error`), warning for each:
+*   - `deepseek_harness.reasoning_effort` in either scope — Takt accepts it only
+*     in runtime profile options or `TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT`.
+*   - at project scope, a non-empty `deepseek_harness.plugins` (Takt 0.71.0+,
+*     global config only) and a non-loopback `{codex,claude,deepseek_harness}.base_url`.
+* https://github.com/nrslib/takt/blob/main/src/infra/config/providerOptions.ts
+* https://github.com/nrslib/takt/blob/main/docs/configuration.md
+*/
+function dropUntrustedProviderOptions({ providerOptions, global, filePath, logger }) {
+	if (providerOptions === void 0) return;
+	const dropped = [];
+	const result = {};
+	for (const [provider, options] of Object.entries(providerOptions)) {
+		if (!isPlainObject$1(options)) {
+			result[provider] = options;
+			continue;
+		}
+		const untrusted = untrustedProviderOptionKeys({
+			provider,
+			options,
+			global
+		});
+		const kept = Object.fromEntries(Object.entries(options).filter(([key]) => !untrusted.includes(key)));
+		dropped.push(...untrusted.map((key) => `${TAKT_PROVIDER_OPTIONS_KEY}.${provider}.${key}`));
+		if (Object.keys(kept).length > 0 || Object.keys(options).length === 0) result[provider] = kept;
+	}
+	if (dropped.length === 0) return providerOptions;
+	logger?.warn(`Takt permissions: not writing ${dropped.map((key) => `"${key}"`).join(", ")} to ${filePath} because Takt refuses to load ${dropped.length === 1 ? "it" : "them"} from ${global ? "config.yaml" : "a project config.yaml"} and fails at startup with a "Configuration error". Set non-loopback base URLs and DeepSeek Harness plugins in the global ~/.takt/config.yaml (or the TAKT_PROVIDER_OPTIONS_* environment variables), and DeepSeek Harness reasoning_effort in a runtime.yaml profile's options or TAKT_PROVIDER_OPTIONS_DEEPSEEK_HARNESS_REASONING_EFFORT, then remove them from the \`takt\` block of the rulesync source.`);
+	return Object.keys(result).length > 0 ? result : void 0;
+}
 /**
 * Lift Takt's security-policy keys out of a source object, keeping only the
 * shapes Takt itself accepts (a boolean, or a table of booleans). Used in both
@@ -85920,6 +86609,19 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 //#endregion
 //#region src/features/skills/xum-skill.ts
 /**
+* The Agent Skills standard keys the `agentsskills` section carries. On import
+* they go back there, exactly as for the `agentsskills` target, and every other
+* key besides `name` / `description` goes into the `xum` section.
+*/
+const AGENT_SKILLS_STANDARD_KEYS = /* @__PURE__ */ new Set([
+	"name",
+	"description",
+	"license",
+	"compatibility",
+	"metadata",
+	"allowed-tools"
+]);
+/**
 * Xum skills follow the Agent Skills layout (`<name>/SKILL.md` with the
 * required `name` and `description` frontmatter; the directory name is
 * lowercase letters, digits and single hyphens up to 64 characters, and
@@ -85927,12 +86629,82 @@ var WarpSkill = class WarpSkill extends ToolSkill {
 * Xum's locations: `.xum/skills/` (project) and `~/.xum/skills/` (user).
 * Within one directory `.xum/skills` wins over `.agents/skills`.
 *
+* On top of the standard fields, Xum reads `disable-model-invocation` (and its
+* own `advertise: false` alias), `user-invocable`, `argument-hint`,
+* `when_to_use` / `when-to-use` and `paths` (globs that make the skill
+* path-scoped). Those come from the `xum` section of the rulesync skill and are
+* written verbatim; the two invocation gates fall back to the root-level
+* rulesync values.
+*
 * @see https://xum.cdr.dev/agents/agent-skills
 */
-var XumSkill = class extends AgentsSkillsSkill {
+var XumSkill = class XumSkill extends AgentsSkillsSkill {
 	static getSettablePaths(_options = {}) {
 		return { relativeDirPath: XUM_SKILLS_DIR_PATH };
 	}
+	toRulesyncSkill() {
+		const base = super.toRulesyncSkill();
+		const xumSection = Object.fromEntries(Object.entries(this.getFrontmatter()).filter(([key]) => !AGENT_SKILLS_STANDARD_KEYS.has(key)));
+		if (Object.keys(xumSection).length === 0) return base;
+		const rulesyncFrontmatter = {
+			...base.getFrontmatter(),
+			xum: xumSection
+		};
+		return new RulesyncSkill({
+			outputRoot: base.getOutputRoot(),
+			relativeDirPath: base.getRelativeDirPath(),
+			dirName: base.getDirName(),
+			frontmatter: rulesyncFrontmatter,
+			body: base.getBody(),
+			otherFiles: base.getOtherFiles(),
+			validate: true,
+			global: this.global
+		});
+	}
+	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false, logger }) {
+		const settablePaths = XumSkill.getSettablePaths({ global });
+		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const dirName = rulesyncSkill.getDirName();
+		const xumSection = {};
+		const ignoredKeys = [];
+		for (const [key, value] of Object.entries(rulesyncFrontmatter.xum ?? {})) if (AGENT_SKILLS_STANDARD_KEYS.has(key)) ignoredKeys.push(key);
+		else xumSection[key] = value;
+		if (ignoredKeys.length > 0) warnWithFallback(logger, `${join(outputRoot, settablePaths.relativeDirPath, dirName, SKILL_FILE_NAME)}: the xum section sets ${ignoredKeys.map(quoteValueForWarning).join(", ")}, which ${ignoredKeys.length === 1 ? "is" : "are"} ignored there; set name/description at the root and the Agent Skills standard fields at the root or in the agentsskills section.`);
+		const userInvocable = resolveUserInvocable({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const disableModelInvocation = resolveDisableModelInvocation({
+			rootFrontmatter: rulesyncFrontmatter,
+			section: xumSection
+		});
+		const frontmatter = {
+			name: rulesyncFrontmatter.name,
+			description: rulesyncFrontmatter.description,
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter)),
+			...xumSection,
+			...userInvocable !== void 0 && { "user-invocable": userInvocable },
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation }
+		};
+		AgentsSkillsSkill.reportSpecViolations({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			sourceAllowedTools: rulesyncFrontmatter.agentsskills?.["allowed-tools"],
+			logger
+		});
+		return new XumSkill({
+			outputRoot,
+			relativeDirPath: settablePaths.relativeDirPath,
+			dirName,
+			frontmatter,
+			body: rulesyncSkill.getBody(),
+			otherFiles: rulesyncSkill.getOtherFiles(),
+			validate,
+			global
+		});
+	}
 	static isTargetedByRulesyncSkill(rulesyncSkill) {
 		const targets = rulesyncSkill.getFrontmatter().targets;
 		return targets.includes("*") || targets.includes("xum");
@@ -92088,6 +92860,15 @@ const KiroCliSubagentJsonSchema = z.looseObject({
 	allowedTools: z.optional(z.nullable(z.array(z.string()))),
 	includeMcpJson: z.optional(z.nullable(z.boolean()))
 });
+/**
+* The name Kiro gives an agent file: its path relative to the agents directory
+* without the extension, so a nested `team/planner.md` is `team/planner`.
+* https://kiro.dev/docs/custom-agents/
+*/
+function kiroAgentNameFromPath(relativeFilePath) {
+	const posixPath = toPosixPath(relativeFilePath);
+	return posixPath.slice(0, posixPath.length - extname(posixPath).length);
+}
 var KiroSubagent = class extends ToolSubagent {
 	body;
 	constructor({ body, ...rest }) {
@@ -92123,7 +92904,7 @@ var KiroSubagent = class extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: [toolTarget],
-				name: name ?? basename(this.getRelativeFilePath(), ".json"),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? void 0,
 				...Object.keys(kiroSection).length > 0 && { kiro: kiroSection }
 			},
@@ -92273,7 +93054,7 @@ var KiroIdeSubagent = class KiroIdeSubagent extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
-				name: name ?? this.getRelativeFilePath().replace(/\.md$/, ""),
+				name: name ?? kiroAgentNameFromPath(this.getRelativeFilePath()),
 				description: description ?? "",
 				...Object.keys(kiroIdeSection).length > 0 && { "kiro-ide": kiroIdeSection }
 			},
@@ -94891,7 +95672,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.json"
+			filePattern: "**/*.json",
+			supportsNestedPaths: true
 		}
 	}],
 	["kiro-ide", {
@@ -94900,7 +95682,8 @@ const toolSubagentFactories = /* @__PURE__ */ new Map([
 			supportsProject: true,
 			supportsSimulated: false,
 			supportsGlobal: true,
-			filePattern: "*.md"
+			filePattern: "**/*.md",
+			supportsNestedPaths: true
 		}
 	}],
 	["lettacode", {
@@ -108890,6 +109673,6 @@ async function importChecksCore(params) {
 	return writtenCount;
 }
 //#endregion
-export { RulesyncHooks as $, removeDirectoryStrict as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as An, applyFileMode as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, parseCommaSeparatedList as Bn, getFileSizeAndExecutableBit as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_IGNORE_RELATIVE_FILE_PATH as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Fn, createTempDirectory as Ft, RulesyncSubagentFrontmatterSchema as G, truncateText as Gn, listDirectoryEntryNames as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, ALL_FEATURES_WITH_WILDCARD as Hn, isFileNotFoundError as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as In, directoryExists as It, RulesyncRule as J, quoteForLog as Jn, pathEscapesRoot as Jt, RulesyncSkill as K, hasDeceptiveHiddenCharacters as Kn, listFilePathsRecursively as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Ln, ensureDir as Lt, CODEXCLI_DIR as M, RULESYNC_PERMISSIONS_SCHEMA_URL as Mn, assertTreeContainsNoSymlinks as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_RELATIVE_DIR_PATH as Nn, assertWritablePathInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_MCP_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_RULES_RELATIVE_DIR_PATH as Pn, checkPathTraversal as Pt, RulesyncIgnore as Q, removeDirectory as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, RULESYNC_USER_CONFIG_DIR_NAME as Rn, fileExists as Rt, COMMANDCODE_DIR as S, RULESYNC_CONFIG_SCHEMA_URL as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, DEPRECATED_FEATURE_REPLACEMENTS as Un, isFileSystemError as Ut, AUGMENTCODE_DIR as V, ALL_FEATURES as Vn, getHomeDirectory as Vt, RulesyncSubagent as W, formatError as Wn, isSymlink as Wt, RulesyncPermissions as X, stripControlCharactersKeepingLineFeeds as Xn, readFileContent as Xt, RulesyncRuleFrontmatterSchema as Y, stripControlCharacters as Yn, posixRelativePathEscapesRoot as Yt, RulesyncMcp as Z, stripHiddenCharacters as Zn, readFileContentOrNull as Zt, CRUSH_LOCAL_RULE_FILE_NAME as _, MAX_FILE_SIZE as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, runWithDirectoryRollback as an, RulesyncCheck as at, LETTACODE_DIR as b, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, writeFileBuffer as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, ALL_TOOL_TARGETS as dn, ConfigResolver as dt, removeFile as en, getRulesyncSourceCandidates as et, displayWidthOf as f, ALL_TOOL_TARGETS_WITH_WILDCARD as fn, mergeInputRootConfigs as ft, HooksProcessor as g, FEATURE_SOURCE_TREE_ENTRIES as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, CURATED_RULES_FEATURE_SUBDIR as hn, ConfigFileSchema as ht, inspectInputRoots as i, resolvedRelativePath as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as jn, assertDirectoryIfExists as jt, caseFoldIdentity as k, RULESYNC_MCP_SCHEMA_URL as kn, ErrorCodes as kt, SubagentsProcessor as l, writeFileContent as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, ToolTargetSchema as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, removeTempDirectory as nn, parseJsonc as nt, convertFromTool as o, splitPathSegments as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, PACKAGING_TOOL_TARGETS as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, hasEnclosingMarkOutsideKeycap as qn, listSubdirectoryNames as qt, generate as r, resolvePath as rn, RulesyncCommand as rt, isPackagingToolTarget as s, toPosixPath as sn, stringifyFrontmatter as st, importFromTool as t, removeFileStrict as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, mapWithConcurrency as un, SKILL_FILE_NAME as ut, CommandsProcessor as v, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as wn, warnOnConflictingFlags as wt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as x, RULESYNC_CONFIG_RELATIVE_FILE_PATH as xn, JsonLogger as xt, REASONIX_LOCAL_RULE_FILE_NAME as y, RULESYNC_CHECKS_RELATIVE_DIR_PATH as yn, findControlCharacter as yt, QWENCODE_DIR as z, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as zn, findFilesByGlobs as zt };
+export { RulesyncHooks as $, stripHiddenCharacters as $n, readFileContentOrNull as $t, groupSpellingsByCaseFoldedIdentity as A, RULESYNC_MCP_RELATIVE_FILE_PATH as An, PathOutsideRootError as At, QWENCODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_USER_CONFIG_DIR_NAME as Bn, fileExists as Bt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as C, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Cn, fallbackLogger as Ct, FACTORYDROID_DIR as D, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Dn, withWarnOnceScope as Dt, ChecksProcessor as E, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as En, resetRunWarningState as Et, CLAUDECODE_LOCAL_RULE_FILE_NAME as F, RULESYNC_RELATIVE_DIR_PATH as Fn, assertWritablePathInsideRoot as Ft, RulesyncSubagentFrontmatterSchema as G, DEPRECATED_FEATURE_REPLACEMENTS as Gn, isFileSystemError as Gt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as H, parseCommaSeparatedList as Hn, getFileSizeAndExecutableBit as Ht, CLAUDECODE_MEMORIES_DIR_NAME as I, RULESYNC_RULES_RELATIVE_DIR_PATH as In, checkPathTraversal as It, RulesyncRule as J, hasDeceptiveHiddenCharacters as Jn, listFilePathsRecursively as Jt, RulesyncSkill as K, formatError as Kn, isSymlink as Kt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as L, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Ln, createTempDirectory as Lt, CODEXCLI_DIR as M, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Mn, assertDirectoryIfExists as Mt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as N, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Nn, assertPathResolvesInsideRoot as Nt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as O, RULESYNC_IGNORE_RELATIVE_FILE_PATH as On, CLIError as Ot, CLAUDECODE_DIR as P, RULESYNC_PERMISSIONS_SCHEMA_URL as Pn, assertTreeContainsNoSymlinks as Pt, RulesyncIgnore as Q, stripControlCharactersKeepingLineFeeds as Qn, readFileContent as Qt, CLAUDECODE_SKILLS_DIR_PATH as R, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Rn, directoryExists as Rt, COMMANDCODE_DIR as S, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Sn, WarningCollectingLogger as St, CODEBUDDY_LOCAL_RULE_FILE_NAME as T, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as Tn, withFallbackLoggerTarget as Tt, getLocalSkillDirNames as U, ALL_FEATURES as Un, getHomeDirectory as Ut, AUGMENTCODE_DIR as V, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Vn, findFilesByGlobs as Vt, RulesyncSubagent as W, ALL_FEATURES_WITH_WILDCARD as Wn, isFileNotFoundError as Wt, RulesyncPermissions as X, quoteForLog as Xn, pathEscapesRoot as Xt, RulesyncRuleFrontmatterSchema as Y, hasEnclosingMarkOutsideKeycap as Yn, listSubdirectoryNames as Yt, RulesyncMcp as Z, stripControlCharacters as Zn, posixRelativePathEscapesRoot as Zt, CRUSH_LOCAL_RULE_FILE_NAME as _, CURATED_RULES_FEATURE_SUBDIR as _n, SourceEntrySchema as _t, getProcessorRegistryEntry as a, resolvePath as an, RulesyncCheck as at, LETTACODE_DIR as b, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as bn, ConsoleLogger as bt, RulesProcessor as c, splitPathSegments as cn, loadYaml as ct, ELLIPSIS_WIDTH as d, writeFileContent as dn, ConfigResolver as dt, removeDirectory as en, getRulesyncSourceCandidates as et, displayWidthOf as f, mapWithConcurrency as fn, mergeInputRootConfigs as ft, HooksProcessor as g, ToolTargetSchema as gn, GITIGNORE_DESTINATION_KEY as gt, IgnoreProcessor as h, PACKAGING_TOOL_TARGETS as hn, ConfigFileSchema as ht, inspectInputRoots as i, removeTempDirectory as in, RulesyncCommandFrontmatterSchema as it, CODEXCLI_BASH_RULES_FILE_NAME as j, RULESYNC_MCP_SCHEMA_URL as jn, applyFileMode as jt, caseFoldIdentity as k, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as kn, ErrorCodes as kt, SubagentsProcessor as l, toPosixPath as ln, SHARED_USER_MANAGED_CONFIG_PATHS as lt, McpProcessor as m, ALL_TOOL_TARGETS_WITH_WILDCARD as mn, CONFLICTING_TARGET_PAIRS as mt, formatSourceLoadFailure as n, removeFile as nn, parseJsonc as nt, convertFromTool as o, resolvedRelativePath as on, RulesyncCheckFrontmatterSchema as ot, shortenToWidth as p, ALL_TOOL_TARGETS as pn, resolveEffectiveInputRoots as pt, RulesyncSkillFrontmatterSchema as q, truncateText as qn, listDirectoryEntryNames as qt, generate as r, removeFileStrict as rn, RulesyncCommand as rt, isPackagingToolTarget as s, runWithDirectoryRollback as sn, stringifyFrontmatter as st, importFromTool as t, removeDirectoryStrict as tn, resolveRulesyncSourceWritePath as tt, SkillsProcessor as u, writeFileBuffer as un, SKILL_FILE_NAME as ut, CommandsProcessor as v, FEATURE_SOURCE_TREE_ENTRIES as vn, assertTargetsFeaturesExclusive as vt, CODEBUDDY_DIR as w, RULESYNC_CONFIG_SCHEMA_URL as wn, warnOnConflictingFlags as wt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as x, RULESYNC_CHECKS_RELATIVE_DIR_PATH as xn, JsonLogger as xt, REASONIX_LOCAL_RULE_FILE_NAME as y, MAX_FILE_SIZE as yn, findControlCharacter as yt, QWENCODE_DIR as z, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as zn, ensureDir as zt };
 
-//# sourceMappingURL=import-CfVOkld5.js.map
+//# sourceMappingURL=import-Chn7Nqnm.js.map