rulesync 40.1.0 → 40.2.0

package/dist/{import-BmBQ8sWz.js → import-D7cJEvia.js}

@@ -23474,6 +23474,62 @@ function findOpencodeV2McpContainers(mcp) {
 	return [...envelope !== null && Object.keys(envelope).length > 0 ? ["mcp.servers"] : [], ...isOpencodeV2GlobalTimeout(mcp.timeout) && Object.keys(mcp.timeout).length > 0 ? ["mcp.timeout"] : []];
 }
 /**
+* Returns the non-empty V2 global `mcp.timeout` object of an OpenCode `mcp`
+* value, or `undefined` when there is none.
+*/
+function getOpencodeV2GlobalMcpTimeout(mcp) {
+	return isRecord$1(mcp) && findOpencodeV2McpContainers(mcp).includes("mcp.timeout") ? mcp.timeout : void 0;
+}
+/**
+* Returns the raw entry an OpenCode `mcp` value holds for a server: the one
+* under the V2 `mcp.servers` envelope, or else the flat V1 entry.
+*/
+function getOpencodeMcpServerEntry(mcp, name) {
+	if (!isRecord$1(mcp)) return;
+	const envelope = getOpencodeV2McpEnvelope(mcp);
+	if (envelope !== null && Object.hasOwn(envelope, name)) return envelope[name];
+	return Object.hasOwn(mcp, name) ? mcp[name] : void 0;
+}
+const OPENCODE_V1_TO_V2_OAUTH_KEYS = new Map([...OPENCODE_V2_OAUTH_KEYS].map(([v2, v1]) => [v1, v2]));
+/**
+* Raises one V1-shaped OpenCode MCP server (`local` or `remote`) to the V2
+* spelling — the inverse of {@link lowerOpencodeV2Server}:
+*
+* - `enabled` is dropped and `disabled: true` written only for a disabled server;
+* - a number `timeout` becomes `{ catalog, execution }`, and camelCase `oauth`
+*   keys become snake_case.
+*
+* Values Rulesync's canonical form cannot hold are taken from the entry the
+* file already has for the server (`existing`): its `timeout` object and its
+* `oauth` object are kept verbatim whenever lowering them gives back exactly
+* what the canonical server carries, so a V2 file survives import and
+* generate unchanged. When the canonical `timeout` differs, the existing
+* `startup` value is still kept.
+*/
+function raiseOpencodeServerToV2(server, existing) {
+	const { enabled, timeout, oauth, ...rest } = server;
+	const raised = { ...rest };
+	if (enabled === false) raised.disabled = true;
+	const existingTimeout = isRecord$1(existing) && isRecord$1(existing.timeout) ? existing.timeout : null;
+	if (existingTimeout !== null && lowerOpencodeV2Timeout(existingTimeout) === timeout) raised.timeout = existingTimeout;
+	else if (typeof timeout === "number") {
+		const startup = existingTimeout?.startup;
+		raised.timeout = {
+			...startup !== void 0 && { startup },
+			catalog: timeout,
+			execution: timeout
+		};
+	} else if (timeout !== void 0) raised.timeout = timeout;
+	const existingOauth = isRecord$1(existing) && isRecord$1(existing.oauth) ? existing.oauth : null;
+	if (existingOauth !== null && isRecord$1(oauth) && isDeepStrictEqual(lowerOpencodeV2OAuth(existingOauth, ""), oauth)) raised.oauth = existingOauth;
+	else if (isRecord$1(oauth)) {
+		const snakeOauth = {};
+		for (const [key, value] of Object.entries(oauth)) setOwnEntry(snakeOauth, OPENCODE_V1_TO_V2_OAUTH_KEYS.get(key) ?? key, value);
+		raised.oauth = snakeOauth;
+	} else if (oauth !== void 0) raised.oauth = oauth;
+	return raised;
+}
+/**
 * Lowers OpenCode V2 `mcp` spellings found in a V1 config to the flat V1 map,
 * the way OpenCode V1 itself does since v1.18.24 (`normalizeMcp`):
 *
@@ -33935,6 +33991,69 @@ var JunieHooks = class JunieHooks extends ToolHooks {
 	}
 };
 //#endregion
+//#region src/features/hooks/hook-block-reason.ts
+/**
+* Source lines of a `sanitizeBlockReason(raw)` helper, emitted into generated
+* hook plugins that hand a hook command's output to the agent as the reason a
+* call was blocked (the Pi / oh-my-pi extension and the OpenCode-style plugin).
+* It returns the sanitized, length-capped text, or `""` when nothing survives
+* so the caller can substitute its own fallback.
+*
+* The text is sanitized because a hook command's output can relay third-party
+* content (linter output, matched file lines) into a terminal or, in RPC mode,
+* into an external client. Escape sequences, C1 and other control characters,
+* and format characters such as bidirectional overrides and zero-width joiners
+* are stripped so the reason cannot repaint or reorder what the user is shown,
+* and carriage returns are folded into newlines so it cannot overwrite an
+* already printed line. The format-character pass is a superset of the bidi
+* controls listed in `CONTROL_CHARACTERS_PATTERN`
+* (`src/utils/control-characters.ts`): a blocked-hook reason is short
+* diagnostic text, so dropping every `Cf` character is safer than enumerating
+* the harmful ones and missing `U+061C`, `U+FEFF`, or a future addition.
+*
+* Sanitization runs before truncation so a reason that begins with a progress
+* banner is still reported by its content. The raw text is only sliced to a
+* generous backstop first: a hook command may emit a large amount of output,
+* and the slice bounds the work even if a later edit reintroduces a pattern
+* that is not linear. A slice that actually fired is reported as truncated, so
+* the text is never silently cut.
+*
+* Both slices cut on UTF-16 code units, so each drops a trailing lone high
+* surrogate: the reason may travel as JSON, and half a surrogate pair is not
+* text a strict consumer has to accept.
+*
+* `typed` emits TypeScript parameter and return annotations (for the Pi
+* extension, a `.ts` module); without it the lines are plain JavaScript.
+*/
+function buildBlockReasonSanitizerLines({ typed }) {
+	const str = typed ? ": string" : "";
+	return [
+		"const MAX_BLOCK_REASON_LENGTH = 2000;",
+		"const MAX_SCANNED_REASON_LENGTH = 128_000;",
+		"",
+		`function dropTrailingLoneSurrogate(text${str})${str} {`,
+		"  return text.replace(/[\\ud800-\\udbff]$/, \"\");",
+		"}",
+		"",
+		`function sanitizeBlockReason(raw${str})${str} {`,
+		"  const scannedTruncated = raw.length > MAX_SCANNED_REASON_LENGTH;",
+		"  const scanned = scannedTruncated",
+		"    ? dropTrailingLoneSurrogate(raw.slice(0, MAX_SCANNED_REASON_LENGTH))",
+		"    : raw;",
+		"  const sanitized = scanned",
+		"    .replace(/\\r\\n?/g, \"\\n\")",
+		"    .replace(/\\u001b\\[[0-9;?]*[\\u0020-\\u002f]*[\\u0040-\\u007e]/g, \"\")",
+		"    .replace(/\\u001b\\][^\\u0007\\u001b]{0,256}(?:\\u0007|\\u001b\\\\)/g, \"\")",
+		"    .replace(/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f-\\u009f]/g, \"\")",
+		"    .replace(/[\\p{Cf}\\p{Zl}\\p{Zp}]/gu, \"\")",
+		"    .trim();",
+		"  if (!sanitized) return \"\";",
+		"  if (sanitized.length <= MAX_BLOCK_REASON_LENGTH && !scannedTruncated) return sanitized;",
+		"  return `${dropTrailingLoneSurrogate(sanitized.slice(0, MAX_BLOCK_REASON_LENGTH))}...`;",
+		"}"
+	];
+}
+//#endregion
 //#region src/features/hooks/opencode-style-generator.ts
 /**
 * Tool events emitted as named `(input, ...)` hooks rather than through the
@@ -34005,6 +34124,87 @@ const SHELL_EVENT_TOOL_GATES = {
 		tool: "bash"
 	}
 };
+/**
+* Canonical events whose command receives a Claude Code-style JSON payload on
+* stdin and whose result can deny the call, mapped to the `hook_event_name`
+* the payload carries. Only `preToolUse` (`tool.execute.before`) takes part:
+* it is the one named hook where throwing aborts the call — OpenCode rejects
+* the tool call and returns the error message to the model (the `.env`
+* protection example in the plugins doc).
+*
+* The payload mirrors Claude Code's `PreToolUse` input: `hook_event_name`,
+* `session_id` (`input.sessionID`), `tool_use_id` (`input.callID`),
+* `tool_name` (the raw OpenCode tool name — `bash`, `edit`, `<server>_<tool>`
+* for MCP — the same subject a `matcher` is tested against), `tool_input`
+* (`output.args`) and `cwd` (the plugin context's `directory`, falling back to
+* `process.cwd()`). It is serialized lazily, on the first handler whose
+* matcher matches, so a tool call no hook applies to pays nothing for it.
+*
+* Bun Shell has no stdin option on a command and rejects redirections on a
+* subshell, so the payload is piped in by the shell's builtin `echo`
+* (`echo ${payload} | <command>`); Bun escapes the interpolated value, so the
+* payload never reaches the shell as syntax. The pipe feeds the first
+* pipeline of the command — a compound `a && b` or `a; b` gives the payload
+* to `a` only, so multi-step guards belong in a script.
+*
+* @see https://opencode.ai/docs/plugins/
+* @see https://bun.sh/docs/runtime/shell
+* @see https://code.claude.com/docs/en/hooks
+*/
+const STDIN_PAYLOAD_EVENTS = { preToolUse: "PreToolUse" };
+/**
+* Name of the helper the generated plugin defines when a `preToolUse` handler
+* is present. It interprets the command's result like Claude Code does for a
+* `PreToolUse` hook, throwing (which aborts the OpenCode tool call) when the
+* hook denies it:
+* - exit code 2 → deny, with the command's stderr as the reason;
+* - exit code 0 with JSON stdout whose `hookSpecificOutput.permissionDecision`
+*   is `"deny"` → deny, with `permissionDecisionReason` as the reason;
+* - exit code 0 otherwise → allow;
+* - any other non-zero exit → deny too, with stderr or the exit code.
+*
+* Every reason goes through the `sanitizeBlockReason` helper shared with the
+* Pi extension (`hook-block-reason.ts`): control and format characters are
+* stripped and the text is capped at 2000 characters before the model sees it.
+*
+* The other non-zero exit case is deliberate. Claude Code treats that as a
+*   non-blocking error, but before this payload contract existed the plugin
+*   ran the command through Bun Shell's default throwing mode, so every
+*   non-zero exit aborted the call. Keeping that preserves guards that block
+*   with `exit 1`, rather than silently failing them open.
+*/
+const PRE_TOOL_USE_RESULT_HELPER = "__rulesyncEnforcePreToolUseResult";
+const PRE_TOOL_USE_RESULT_HELPER_LINES = [
+	...buildBlockReasonSanitizerLines({ typed: false }),
+	"",
+	`const ${PRE_TOOL_USE_RESULT_HELPER} = (result) => {`,
+	"  const stderr = result.stderr.toString();",
+	"  if (result.exitCode === 0) {",
+	"    let parsed;",
+	"    try {",
+	"      parsed = JSON.parse(result.stdout.toString());",
+	"    } catch {",
+	"      return;",
+	"    }",
+	"    const specific = parsed && typeof parsed === \"object\" ? parsed.hookSpecificOutput : undefined;",
+	"    if (specific && typeof specific === \"object\" && specific.permissionDecision === \"deny\") {",
+	"      throw new Error(",
+	"        (typeof specific.permissionDecisionReason === \"string\" &&",
+	"          sanitizeBlockReason(specific.permissionDecisionReason)) ||",
+	"          \"Blocked by a preToolUse hook.\",",
+	"      );",
+	"    }",
+	"    return;",
+	"  }",
+	"  if (result.exitCode === 2) {",
+	"    throw new Error(sanitizeBlockReason(stderr) || \"Blocked by a preToolUse hook.\");",
+	"  }",
+	"  throw new Error(",
+	"    sanitizeBlockReason(stderr) ||",
+	"      \"preToolUse hook command failed with exit code \" + result.exitCode + \".\",",
+	"  );",
+	"};"
+];
 function escapeForTemplateLiteral(command) {
 	return command.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
 }
@@ -34019,6 +34219,17 @@ function validateAndSanitizeMatcher(matcher) {
 	}
 	return sanitized.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
 }
+/** The per-canonical-event gates and payload flag every handler of it carries. */
+function handlerExtrasFor(canonicalEvent) {
+	const shellGate = SHELL_EVENT_TOOL_GATES[canonicalEvent];
+	const propertyGate = GENERIC_EVENT_PROPERTY_GATES[canonicalEvent];
+	const stdinEvent = shellGate ? void 0 : STDIN_PAYLOAD_EVENTS[canonicalEvent];
+	return {
+		...shellGate ? { toolGate: shellGate.tool } : {},
+		...propertyGate ? { propertyGate } : {},
+		...stdinEvent ? { stdinEvent } : {}
+	};
+}
 /**
 * Group the effective hooks into named (tool.execute.*) and generic event
 * handler groups, keyed by tool event name. Mutates the supplied groups.
@@ -34026,7 +34237,7 @@ function validateAndSanitizeMatcher(matcher) {
 function collectOpencodeStyleHandlers({ effectiveHooks, eventMap, namedEventHandlers, genericEventHandlers }) {
 	for (const [canonicalEvent, definitions] of Object.entries(effectiveHooks)) {
 		const shellGate = SHELL_EVENT_TOOL_GATES[canonicalEvent];
-		const propertyGate = GENERIC_EVENT_PROPERTY_GATES[canonicalEvent];
+		const extras = handlerExtrasFor(canonicalEvent);
 		const toolEvent = shellGate?.toolEvent ?? eventMap[canonicalEvent];
 		if (!toolEvent) continue;
 		const matcherSupported = !shellGate && Object.hasOwn(NAMED_HOOK_MATCHER_SUBJECTS, toolEvent) && NAMED_HOOK_MATCHER_SUBJECTS[toolEvent] !== null;
@@ -34038,8 +34249,7 @@ function collectOpencodeStyleHandlers({ effectiveHooks, eventMap, namedEventHand
 			handlers.push({
 				command: def.command,
 				matcher: def.matcher ? def.matcher : void 0,
-				...shellGate ? { toolGate: shellGate.tool } : {},
-				...propertyGate ? { propertyGate } : {}
+				...extras
 			});
 		}
 		if (handlers.length > 0) {
@@ -34072,46 +34282,79 @@ function buildGenericEventBodyLines(genericEventHandlers) {
 	bodyLines.push("    },");
 	return bodyLines;
 }
+function stdinPayloadVariable(stdinEvent) {
+	return `__rulesync${stdinEvent}Input`;
+}
+/**
+* The statement that runs a handler's command. A handler with a stdin payload
+* pipes the payload in and hands the result to the deny-aware helper; every
+* other handler keeps Bun Shell's default mode, where a non-zero exit throws.
+*/
+function buildRunStatement(handler) {
+	const escapedCommand = escapeForTemplateLiteral(handler.command);
+	if (handler.stdinEvent) {
+		const payload = stdinPayloadVariable(handler.stdinEvent);
+		return `${PRE_TOOL_USE_RESULT_HELPER}(await $\`echo \${${payload}()} | ${escapedCommand}\`.nothrow().quiet());`;
+	}
+	return `await $\`${escapedCommand}\`;`;
+}
 /** Emit the named (`tool.execute.*`) handler blocks. */
 function buildNamedEventBodyLines(namedEventHandlers) {
 	const bodyLines = [];
 	for (const [eventName, handlers] of Object.entries(namedEventHandlers)) {
 		const matcherSubject = NAMED_HOOK_MATCHER_SUBJECTS[eventName] ?? null;
-		bodyLines.push(`    "${eventName}": async (input) => {`);
+		const stdinEvents = [...new Set(handlers.flatMap((handler) => handler.stdinEvent ? [handler.stdinEvent] : []))];
+		bodyLines.push(`    "${eventName}": async (${stdinEvents.length > 0 ? "input, output" : "input"}) => {`);
+		for (const stdinEvent of stdinEvents) {
+			const payload = stdinPayloadVariable(stdinEvent);
+			bodyLines.push(`      let ${payload}Cache;`);
+			bodyLines.push(`      const ${payload} = () =>`);
+			bodyLines.push(`        (${payload}Cache ??= JSON.stringify({`);
+			bodyLines.push(`          hook_event_name: "${stdinEvent}",`);
+			bodyLines.push("          session_id: input.sessionID,");
+			bodyLines.push("          tool_use_id: input.callID,");
+			bodyLines.push("          tool_name: input.tool,");
+			bodyLines.push("          tool_input: output?.args,");
+			bodyLines.push("          cwd: directory ?? process.cwd(),");
+			bodyLines.push("        }));");
+		}
 		for (const handler of handlers) {
-			const escapedCommand = escapeForTemplateLiteral(handler.command);
+			const runStatement = buildRunStatement(handler);
 			if (handler.toolGate) {
 				bodyLines.push(`      if (input.tool === "${handler.toolGate}") {`);
-				bodyLines.push(`        await $\`${escapedCommand}\`;`);
+				bodyLines.push(`        ${runStatement}`);
 				bodyLines.push("      }");
 			} else if (handler.matcher && matcherSubject !== null) {
 				const safeMatcher = validateAndSanitizeMatcher(handler.matcher);
 				bodyLines.push("      {");
 				bodyLines.push(`        const __re = new RegExp("${safeMatcher}");`);
 				bodyLines.push(`        if (__re.test(${matcherSubject})) {`);
-				bodyLines.push(`          await $\`${escapedCommand}\`;`);
+				bodyLines.push(`          ${runStatement}`);
 				bodyLines.push("        }");
 				bodyLines.push("      }");
-			} else bodyLines.push(`      await $\`${escapedCommand}\`;`);
+			} else bodyLines.push(`      ${runStatement}`);
 		}
 		bodyLines.push("    },");
 	}
 	return bodyLines;
 }
 /** Wrap the handler body lines in the requested export shape. */
-function wrapInExportShape({ bodyLines, exportStyle }) {
+function wrapInExportShape({ preambleLines, bodyLines, exportStyle }) {
+	const pluginContextPattern = preambleLines.length > 0 ? "{ $, directory }" : "{ $ }";
 	const lines = [];
 	if (exportStyle === "default") {
 		lines.push("export default {");
 		lines.push("  id: \"rulesync-hooks\",");
-		lines.push("  server: async ({ $ }) => {");
+		lines.push(`  server: async (${pluginContextPattern}) => {`);
+		for (const line of preambleLines) lines.push(line === "" ? "" : `    ${line}`);
 		lines.push("    return {");
 		for (const line of bodyLines) lines.push(line === "" ? "" : `  ${line}`);
 		lines.push("    };");
 		lines.push("  },");
 		lines.push("};");
 	} else {
-		lines.push("export const RulesyncHooksPlugin = async ({ $ }) => {");
+		lines.push(`export const RulesyncHooksPlugin = async (${pluginContextPattern}) => {`);
+		for (const line of preambleLines) lines.push(line === "" ? "" : `  ${line}`);
 		lines.push("  return {");
 		lines.push(...bodyLines);
 		lines.push("  };");
@@ -34136,8 +34379,10 @@ function generateOpencodeStylePluginCode(config, supportedEvents, toolConfigKey,
 		namedEventHandlers,
 		genericEventHandlers
 	});
+	const bodyLines = [...buildGenericEventBodyLines(genericEventHandlers), ...buildNamedEventBodyLines(namedEventHandlers)];
 	return wrapInExportShape({
-		bodyLines: [...buildGenericEventBodyLines(genericEventHandlers), ...buildNamedEventBodyLines(namedEventHandlers)],
+		preambleLines: Object.values(namedEventHandlers).some((handlers) => handlers.some((handler) => handler.stdinEvent !== void 0)) ? PRE_TOOL_USE_RESULT_HELPER_LINES : [],
+		bodyLines,
 		exportStyle
 	}).join("\n");
 }
@@ -35282,36 +35527,12 @@ function failureLinesByMode(dialect) {
 * `PI_SETTLE_BLOCKING_EVENT`): such a failure is rethrown for Pi to report
 * instead of continuing the agent.
 *
-* The chosen text is sanitized because a hook command's output can relay
-* third-party content (linter output, matched file lines) into a terminal or,
-* in RPC mode, into an external client. Escape sequences, C1 and other control
-* characters, and format characters such as bidirectional overrides and
-* zero-width joiners are stripped so the reason cannot repaint or reorder what
-* the user is shown, and carriage returns are folded into newlines so it cannot
-* overwrite an already printed line. The format-character pass is a superset of
-* the bidi controls listed in `CONTROL_CHARACTERS_PATTERN`
-* (`src/utils/control-characters.ts`): a blocked-hook reason is short
-* diagnostic text, so dropping every `Cf` character is safer than enumerating
-* the harmful ones and missing `U+061C`, `U+FEFF`, or a future addition.
-*
-* Sanitization runs before truncation so a reason that begins with a progress
-* banner is still reported by its content. The raw text is only sliced to a
-* generous backstop first: a hook command may emit up to `exec`'s full
-* `maxBuffer`, and the slice bounds the work even if a later edit reintroduces
-* a pattern that is not linear. A slice that actually fired is reported as
-* truncated, so the text is never silently cut.
-*
-* Both slices cut on UTF-16 code units, so each drops a trailing lone high
-* surrogate: the reason travels to an RPC client as JSON, and half a surrogate
-* pair is not text a strict consumer has to accept.
+* The chosen text goes through `sanitizeBlockReason`, shared with the
+* OpenCode-style plugin (see `hook-block-reason.ts`): control and format
+* characters are stripped and the result is capped at 2000 characters.
 */
 const BLOCK_REASON_HELPER_LINES = [
-	"const MAX_BLOCK_REASON_LENGTH = 2000;",
-	"const MAX_SCANNED_REASON_LENGTH = 128_000;",
-	"",
-	"function dropTrailingLoneSurrogate(text: string): string {",
-	"  return text.replace(/[\\ud800-\\udbff]$/, \"\");",
-	"}",
+	...buildBlockReasonSanitizerLines({ typed: true }),
 	"",
 	"function toBlockReason(error: unknown): string {",
 	"  const result = error as { stdout?: unknown; stderr?: unknown; code?: unknown } | null;",
@@ -35325,20 +35546,7 @@ const BLOCK_REASON_HELPER_LINES = [
 	"      : error instanceof Error",
 	"        ? error.message",
 	"        : String(error));",
-	"  const scannedTruncated = raw.length > MAX_SCANNED_REASON_LENGTH;",
-	"  const scanned = scannedTruncated",
-	"    ? dropTrailingLoneSurrogate(raw.slice(0, MAX_SCANNED_REASON_LENGTH))",
-	"    : raw;",
-	"  const sanitized = scanned",
-	"    .replace(/\\r\\n?/g, \"\\n\")",
-	"    .replace(/\\u001b\\[[0-9;?]*[\\u0020-\\u002f]*[\\u0040-\\u007e]/g, \"\")",
-	"    .replace(/\\u001b\\][^\\u0007\\u001b]{0,256}(?:\\u0007|\\u001b\\\\)/g, \"\")",
-	"    .replace(/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f-\\u009f]/g, \"\")",
-	"    .replace(/[\\p{Cf}\\p{Zl}\\p{Zp}]/gu, \"\")",
-	"    .trim();",
-	"  if (!sanitized) return \"Hook command failed.\";",
-	"  if (sanitized.length <= MAX_BLOCK_REASON_LENGTH && !scannedTruncated) return sanitized;",
-	"  return `${dropTrailingLoneSurrogate(sanitized.slice(0, MAX_BLOCK_REASON_LENGTH))}...`;",
+	"  return sanitizeBlockReason(raw) || \"Hook command failed.\";",
 	"}"
 ];
 /**
@@ -48957,12 +49165,18 @@ function warnAboutToggleDroppedKeys(serverName, serverConfig, logger) {
 * - enabledTools/disabledTools -> top-level tools map (with server name prefix)
 * - OpenCode-supported extras (timeout, oauth, protocol, codemode) -> passed through verbatim
 */
-function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, logger) {
+function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry, configShape, logger) {
 	const serverRecord = serverConfig;
 	const passthrough = {};
 	for (const key of OPENCODE_PASSTHROUGH_SERVER_FIELDS) if (serverRecord[key] !== void 0) passthrough[key] = serverRecord[key];
 	const enabled = serverConfig.disabled !== void 0 ? !serverConfig.disabled : true;
 	if (declaresNoTransport(serverConfig)) {
+		if (configShape === "v2") return warnAndSkipMcpServer({
+			toolName: "OpenCode",
+			serverName,
+			reason: "no transport, and the OpenCode V2 shape (\"configShape\": \"v2\") has no toggle-only entry",
+			logger
+		});
 		if (serverConfig.disabled === void 0) {
 			if (existingEntry !== void 0 && !isOpencodeTransportServer(existingEntry)) {
 				warnAboutToggleDroppedKeys(serverName, serverConfig, logger);
@@ -49010,11 +49224,11 @@ function convertServerToOpencodeFormat(serverName, serverConfig, existingEntry,
 		...serverConfig.cwd && { cwd: serverConfig.cwd }
 	};
 }
-function convertToOpencodeFormat(mcpServers, existingMcp, logger) {
+function convertToOpencodeFormat(mcpServers, existingMcp, configShape, logger) {
 	const tools = {};
 	return {
 		mcp: Object.fromEntries(Object.entries(mcpServers).map(([serverName, serverConfig]) => {
-			const converted = convertServerToOpencodeFormat(serverName, serverConfig, existingMcp[serverName], logger);
+			const converted = convertServerToOpencodeFormat(serverName, serverConfig, existingMcp[serverName], configShape, logger);
 			if (serverConfig.enabledTools) for (const tool of serverConfig.enabledTools) tools[`${serverName}_${tool}`] = true;
 			if (serverConfig.disabledTools) for (const tool of serverConfig.disabledTools) tools[`${serverName}_${tool}`] = false;
 			return converted === null ? null : [serverName, converted];
@@ -49022,6 +49236,7 @@ function convertToOpencodeFormat(mcpServers, existingMcp, logger) {
 		tools
 	};
 }
+const OpencodeMcpFeatureOptionsSchema = z.looseObject({ configShape: z.optional(z.enum(["v1", "v2"])) });
 var OpencodeMcp = class extends ToolMcp {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
 	static layout = OPENCODE_LAYOUT;
@@ -49060,6 +49275,19 @@ var OpencodeMcp = class extends ToolMcp {
 		return this.json;
 	}
 	/**
+	* Reads the `configShape` option of the target's `mcp` feature options
+	* (`targets.opencode.mcp.configShape`). Only a layout that reads the V2
+	* spellings back can be given the V2 shape.
+	*/
+	static resolveConfigShape(options) {
+		if (!options) return "v1";
+		const parsed = OpencodeMcpFeatureOptionsSchema.safeParse(options);
+		if (!parsed.success) throw new Error(`Invalid options for the ${this.layout.toolTarget} mcp feature: \`configShape\` must be either "v1" or "v2".`);
+		const configShape = parsed.data.configShape ?? "v1";
+		if (configShape === "v2" && !this.layout.readsV2ConfigSpellings) throw new Error(`Invalid options for the ${this.layout.toolTarget} mcp feature: \`configShape: "v2"\` is supported only for OpenCode.`);
+		return configShape;
+	}
+	/**
 	* opencode.json may contain other settings, so it should not be deleted.
 	*/
 	isDeletable() {
@@ -49103,7 +49331,8 @@ var OpencodeMcp = class extends ToolMcp {
 			logger
 		});
 	}
-	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger }) {
+	static async fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, global = false, logger, featureOptions }) {
+		const configShape = this.resolveConfigShape(featureOptions);
 		const basePaths = this.getSettablePaths({ global });
 		const jsonDir = join(outputRoot, basePaths.relativeDirPath);
 		let fileContent = null;
@@ -49121,16 +49350,21 @@ var OpencodeMcp = class extends ToolMcp {
 		});
 		const existingJson = parse$1(fileContent || "{}");
 		const existingMcp = OpencodeConfigSchema.safeParse(this.lowerConfig(existingJson));
-		if (this.layout.readsV2ConfigSpellings && isRecord$1(existingJson)) {
-			const containers = findOpencodeV2McpContainers(existingJson.mcp);
+		const existingRawMcp = isRecord$1(existingJson) ? existingJson.mcp : void 0;
+		if (configShape === "v1" && this.layout.readsV2ConfigSpellings) {
+			const containers = findOpencodeV2McpContainers(existingRawMcp);
 			if (containers.length > 0) logger?.warn(`OpenCode MCP: the whole "mcp" key is rewritten in the flat V1 shape, so ${containers.map(quoteValueForWarning).join(" and ")} ${containers.length === 1 ? "is" : "are"} not kept.`);
 		}
-		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(transformedServers, (existingMcp.success ? existingMcp.data.mcp : void 0) ?? {}, logger);
-		const generatedMcp = undefinedWhenEmpty(convertedMcp);
+		const { mcp: convertedMcp, tools: mcpTools } = convertToOpencodeFormat(transformedServers, (existingMcp.success ? existingMcp.data.mcp : void 0) ?? {}, configShape, logger);
+		const generatedServers = undefinedWhenEmpty(convertedMcp);
+		const generatedMcp = configShape === "v2" ? this.toV2Mcp({
+			servers: convertedMcp,
+			existingRawMcp
+		}) : generatedServers;
 		const generatedTools = Object.keys(mcpTools).length > 0 ? mcpTools : void 0;
 		warnOpencodeDotDirOverrides({
 			generated: {
-				mcp: generatedMcp,
+				mcp: generatedServers,
 				tools: generatedTools
 			},
 			overlays: (await readOpencodeDotDirConfigLayers({
@@ -49166,6 +49400,28 @@ var OpencodeMcp = class extends ToolMcp {
 		});
 	}
 	/**
+	* Builds the V2 `mcp` value: each server raised to the V2 spelling under the
+	* `mcp.servers` envelope, keeping what the existing file has that Rulesync
+	* cannot express (see {@link raiseOpencodeServerToV2}), plus the existing
+	* global `mcp.timeout`, which has no canonical counterpart.
+	*/
+	static toV2Mcp({ servers, existingRawMcp }) {
+		const v2Servers = {};
+		for (const [name, server] of Object.entries(servers)) Object.defineProperty(v2Servers, name, {
+			value: raiseOpencodeServerToV2(server, getOpencodeMcpServerEntry(existingRawMcp, name)),
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+		const globalTimeout = getOpencodeV2GlobalMcpTimeout(existingRawMcp);
+		const hasServers = Object.keys(v2Servers).length > 0;
+		if (!hasServers && globalTimeout === void 0) return;
+		return {
+			...globalTimeout !== void 0 && { timeout: globalTimeout },
+			...hasServers && { servers: v2Servers }
+		};
+	}
+	/**
 	* Register additional instruction file paths into the shared opencode config
 	* (`opencode.json` / `opencode.jsonc`) under the `instructions` key.
 	*
@@ -54885,7 +55141,8 @@ var McpProcessor = class extends FeatureProcessor {
 	toolTarget;
 	global;
 	getFactory;
-	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$3, dryRun = false, logger }) {
+	featureOptions;
+	constructor({ outputRoot = process.cwd(), inputRoots, toolTarget, global = false, getFactory = defaultGetFactory$3, dryRun = false, logger, featureOptions }) {
 		super({
 			outputRoot,
 			inputRoots,
@@ -54897,6 +55154,7 @@ var McpProcessor = class extends FeatureProcessor {
 		this.toolTarget = result.data;
 		this.global = global;
 		this.getFactory = getFactory;
+		this.featureOptions = featureOptions;
 	}
 	/**
 	* Implementation of abstract method from FeatureProcessor
@@ -54978,7 +55236,8 @@ var McpProcessor = class extends FeatureProcessor {
 				outputRoot: this.outputRoot,
 				rulesyncMcp: filteredRulesyncMcp,
 				global: this.global,
-				logger: this.logger
+				logger: this.logger,
+				featureOptions: this.featureOptions
 			});
 		}));
 		const auxiliaryFiles = await factory.class.getAuxiliaryFiles?.({
@@ -57759,12 +58018,14 @@ var CodewhaleSkill = class CodewhaleSkill extends ToolSkill {
 const CodexCliSkillFrontmatterSchema = z.looseObject({
 	name: z.string(),
 	description: z.string(),
-	metadata: z.optional(z.looseObject({ "short-description": z.optional(z.string()) }))
+	metadata: z.optional(z.looseObject({ "short-description": z.optional(z.string()) })),
+	"disable-model-invocation": z.optional(z.boolean())
 });
 /**
 * Relative path (within a skill directory) of the Codex `agents/openai.yaml` sidecar.
 * Codex CLI reads UI metadata, invocation policy, and tool dependencies from this file;
-* `SKILL.md` frontmatter only carries `name` and `description`.
+* from `SKILL.md` frontmatter it reads only `name`, `description` and
+* `metadata.short-description`, ignoring any other key.
 * @see https://developers.openai.com/codex/skills.md
 */
 const CODEX_OPENAI_YAML_RELATIVE_PATH = CODEXCLI_OPENAI_YAML_RELATIVE_PATH;
@@ -57854,6 +58115,40 @@ function openaiYamlToCodexcliSection(parsed) {
 	return Object.keys(section).length > 0 ? section : void 0;
 }
 /**
+* Build the `SKILL.md` `metadata` map: the root-level rulesync `metadata` with
+* the legacy `codexcli.short-description` merged in. The tool-specific value wins
+* over a root `metadata.short-description`, as a target section overrides the
+* root default everywhere else. Values are stringified because the Agent Skills
+* spec types `metadata` as a string-to-string map, and `.agents/skills/` is read
+* by other spec clients too; Codex itself deserializes `short-description` as a
+* string.
+* @see https://agentskills.io/specification
+*/
+function buildSkillMetadata({ rootMetadata, shortDescription }) {
+	const merged = {
+		...rootMetadata,
+		...shortDescription !== void 0 && { "short-description": shortDescription }
+	};
+	return Object.keys(merged).length > 0 ? toStringMetadata(merged) : void 0;
+}
+/**
+* Drop `policy.allow_implicit_invocation: false` from an imported sidecar section
+* when the `SKILL.md` frontmatter already carries `disable-model-invocation: true`,
+* since the root flag regenerates exactly that value. Keeping both would store the
+* same setting twice in `.rulesync/skills/`.
+*/
+function dropPolicyImpliedByRootFlag(section, disableModelInvocation) {
+	const policy = section?.policy;
+	if (!section || disableModelInvocation !== true || policy === null || typeof policy !== "object" || Array.isArray(policy) || policy.allow_implicit_invocation !== false) return section;
+	const { allow_implicit_invocation: _implied, ...restPolicy } = policy;
+	const { policy: _policy, ...restSection } = section;
+	const result = {
+		...restSection,
+		...Object.keys(restPolicy).length > 0 && { policy: restPolicy }
+	};
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+/**
 * Represents a Codex CLI skill directory.
 * Codex CLI supports skills in both project mode (under $CWD/.agents/skills)
 * and global mode (under ~/.agents/skills — Rulesync resolves the home
@@ -57904,16 +58199,20 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 	}
 	toRulesyncSkill() {
 		const frontmatter = this.getFrontmatter();
+		const disableModelInvocation = frontmatter["disable-model-invocation"];
 		const { parsed, rest } = extractOpenaiYamlFile(this.getOtherFiles());
-		const openaiSection = openaiYamlToCodexcliSection(parsed);
+		const openaiSection = dropPolicyImpliedByRootFlag(openaiYamlToCodexcliSection(parsed), disableModelInvocation);
+		const { "short-description": shortDescription, ...rootMetadata } = frontmatter.metadata ?? {};
 		const codexcliSection = {
-			...frontmatter.metadata?.["short-description"] && { "short-description": frontmatter.metadata["short-description"] },
+			...shortDescription !== void 0 && { "short-description": shortDescription },
 			...openaiSection
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
 			description: frontmatter.description,
 			targets: ["*"],
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation },
+			...Object.keys(rootMetadata).length > 0 && { metadata: rootMetadata },
 			...Object.keys(codexcliSection).length > 0 && { codexcli: codexcliSection }
 		};
 		return new RulesyncSkill({
@@ -57930,10 +58229,16 @@ var CodexCliSkill = class CodexCliSkill extends ToolSkill {
 	static fromRulesyncSkill({ outputRoot = process.cwd(), rulesyncSkill, validate = true, global = false }) {
 		const settablePaths = CodexCliSkill.getSettablePaths({ global });
 		const rulesyncFrontmatter = rulesyncSkill.getFrontmatter();
+		const metadata = buildSkillMetadata({
+			rootMetadata: rulesyncFrontmatter.metadata,
+			shortDescription: rulesyncFrontmatter.codexcli?.["short-description"]
+		});
+		const disableModelInvocation = rulesyncFrontmatter["disable-model-invocation"];
 		const codexFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...rulesyncFrontmatter.codexcli?.["short-description"] && { metadata: { "short-description": rulesyncFrontmatter.codexcli["short-description"] } }
+			...disableModelInvocation !== void 0 && { "disable-model-invocation": disableModelInvocation },
+			...metadata !== void 0 && { metadata }
 		};
 		const target = toPosixPath(CODEX_OPENAI_YAML_RELATIVE_PATH);
 		const baseOtherFiles = rulesyncSkill.getOtherFiles().filter((file) => toPosixPath(file.relativeFilePathToDirPath) !== target);
@@ -67421,6 +67726,16 @@ var CopilotSubagent = class CopilotSubagent extends ToolSubagent {
 *    (`preferred` lets a `subagents` settings override or the `/subagents`
 *    picker replace the model; `required` locks dispatch to the authored
 *    list). CLI v1.0.81+; the shared reference page still lists `model` only.
+*  - `model` may also be a list of models in preference order. The Copilot
+*    CLI changelog for v1.0.83 (2026-09-04) says "Custom agents can list
+*    several models in `model`, tried in order until one is available to
+*    you"; the CLI command reference and the shared configuration reference
+*    still document `model` as a string, so older CLI versions may not read
+*    the list form (a string is the safe form there). The VS Code Copilot
+*    harness documents the same array spelling. Preserve a list as authored
+*    instead of rewriting it to the separate `models` field.
+*    https://github.com/github/copilot-cli/blob/main/changelog.md#1083---2026-09-04
+*    https://github.com/microsoft/vscode-docs/blob/main/docs/agents/reference/custom-agent-file-reference.md
 *
 * `looseObject` is used so that future additional fields are passed through
 * unchanged (consistent with the rest of rulesync's frontmatter schemas).
@@ -67430,7 +67745,7 @@ const CopilotCliSubagentFrontmatterSchema = z.looseObject({
 	name: z.optional(z.string()),
 	target: z.optional(z.string()),
 	tools: z.optional(z.union([z.string(), z.array(z.string())])),
-	model: z.optional(z.string()),
+	model: z.optional(z.union([z.string(), z.array(z.string())])),
 	models: z.optional(z.array(z.string())),
 	modelPolicy: z.optional(z.enum(["preferred", "required"])),
 	"disable-model-invocation": z.optional(z.boolean()),
@@ -107219,7 +107534,8 @@ function buildMcpStrategy(ctx) {
 			toolTarget,
 			global,
 			dryRun,
-			logger
+			logger,
+			featureOptions: config.getFeatureOptions(toolTarget, "mcp")
 		}),
 		loadSource: (p) => p.loadToolFiles(),
 		toRulesync: (p, files) => p.convertToolFilesToRulesyncFiles(files),
@@ -108949,7 +109265,8 @@ async function generateMcpCore(params) {
 			toolTarget,
 			global: config.getGlobal(),
 			dryRun: config.isPreviewMode(),
-			logger
+			logger,
+			featureOptions: config.getFeatureOptions(toolTarget, "mcp")
 		});
 		const result = await processFeatureWithRulesyncFiles({
 			config,
@@ -109675,4 +109992,4 @@ async function importChecksCore(params) {
 //#endregion
 export { RulesyncIgnore as $, stripHiddenCharacters as $n, readFileContent as $t, caseFoldIdentity as A, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as An, ErrorCodes as At, QWENCODE_DIR as B, RULESYNC_RULES_RELATIVE_DIR_PATH as Bn, ensureDir as Bt, COMMANDCODE_DIR as C, MAX_FILE_SIZE as Cn, WarningCollectingLogger as Ct, ChecksProcessor as D, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Dn, resetRunWarningState as Dt, CODEBUDDY_LOCAL_RULE_FILE_NAME as E, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as En, withFallbackLoggerTarget as Et, CLAUDECODE_DIR as F, RULESYNC_MCP_SCHEMA_URL as Fn, assertTreeContainsNoSymlinks as Ft, RulesyncSubagent as G, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Gn, isFileNotFoundError as Gt, AUGMENTCODE_DIR as H, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Hn, findFilesByGlobs as Ht, CLAUDECODE_LOCAL_RULE_FILE_NAME as I, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as In, assertWritablePathInsideRoot as It, RulesyncSkillFrontmatterSchema as J, hasDeceptiveHiddenCharacters as Jn, listDirectoryEntryNames as Jt, RulesyncSubagentFrontmatterSchema as K, formatError as Kn, isFileSystemError as Kt, CLAUDECODE_MEMORIES_DIR_NAME as L, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Ln, checkPathTraversal as Lt, CODEXCLI_BASH_RULES_FILE_NAME as M, RULESYNC_IGNORE_RELATIVE_FILE_PATH as Mn, applyFileMode as Mt, CODEXCLI_DIR as N, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Nn, assertDirectoryIfExists as Nt, FACTORYDROID_DIR as O, RULESYNC_CONFIG_SCHEMA_URL as On, withWarnOnceScope as Ot, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as P, RULESYNC_MCP_RELATIVE_FILE_PATH as Pn, assertPathResolvesInsideRoot as Pt, RulesyncMcp as Q, stripControlCharactersKeepingLineFeeds as Qn, posixRelativePathEscapesRoot as Qt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as R, RULESYNC_PERMISSIONS_SCHEMA_URL as Rn, createTempDirectory as Rt, LETTACODE_SETTINGS_LOCAL_FILE_NAME as S, FEATURE_SOURCE_TREE_ENTRIES as Sn, JsonLogger as St, CODEBUDDY_DIR as T, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Tn, warnOnConflictingFlags as Tt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as U, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Un, getFileSizeAndExecutableBit as Ut, QWENCODE_LOCAL_RULE_FILE_NAME as V, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Vn, fileExists as Vt, getLocalSkillDirNames as W, RULESYNC_USER_CONFIG_DIR_NAME as Wn, getHomeDirectory as Wt, RulesyncRuleFrontmatterSchema as X, quoteForLog as Xn, listSubdirectoryNames as Xt, RulesyncRule as Y, hasEnclosingMarkOutsideKeycap as Yn, listFilePathsRecursively as Yt, RulesyncPermissions as Z, stripControlCharacters as Zn, pathEscapesRoot as Zt, HooksProcessor as _, ToolTargetSchema as _n, GITIGNORE_DESTINATION_KEY as _t, convertFromTool as a, removeTempDirectory as an, RulesyncCommandFrontmatterSchema as at, REASONIX_LOCAL_RULE_FILE_NAME as b, DEPRECATED_FEATURE_REPLACEMENTS as bn, findControlCharacter as bt, parseCommaSeparatedList as c, runWithDirectoryRollback as cn, stringifyFrontmatter as ct, shortenToWidth as d, writeFileBuffer as dn, SKILL_FILE_NAME as dt, readFileContentOrNull as en, RulesyncHooks as et, RulesProcessor as f, writeFileContent as fn, ConfigResolver as ft, IgnoreProcessor as g, PACKAGING_TOOL_TARGETS as gn, ConfigFileSchema as gt, McpProcessor as h, ALL_TOOL_TARGETS_WITH_WILDCARD as hn, CONFLICTING_TARGET_PAIRS as ht, inspectInputRoots as i, removeFileStrict as in, RulesyncCommand as it, groupSpellingsByCaseFoldedIdentity as j, RULESYNC_HOOKS_RELATIVE_FILE_PATH as jn, PathOutsideRootError as jt, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as k, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as kn, CLIError as kt, ELLIPSIS_WIDTH as l, splitPathSegments as ln, loadYaml as lt, SkillsProcessor as m, ALL_TOOL_TARGETS as mn, resolveEffectiveInputRoots as mt, formatSourceLoadFailure as n, removeDirectoryStrict as nn, resolveRulesyncSourceWritePath as nt, isPackagingToolTarget as o, resolvePath as on, RulesyncCheck as ot, SubagentsProcessor as p, mapWithConcurrency as pn, mergeInputRootConfigs as pt, RulesyncSkill as q, truncateText as qn, isSymlink as qt, generate as r, removeFile as rn, parseJsonc as rt, getProcessorRegistryEntry as s, resolvedRelativePath as sn, RulesyncCheckFrontmatterSchema as st, importFromTool as t, removeDirectory as tn, getRulesyncSourceCandidates as tt, displayWidthOf as u, toPosixPath as un, SHARED_USER_MANAGED_CONFIG_PATHS as ut, CRUSH_LOCAL_RULE_FILE_NAME as v, ALL_FEATURES as vn, SourceEntrySchema as vt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as w, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as wn, fallbackLogger as wt, LETTACODE_DIR as x, CURATED_RULES_FEATURE_SUBDIR as xn, ConsoleLogger as xt, CommandsProcessor as y, ALL_FEATURES_WITH_WILDCARD as yn, assertTargetsFeaturesExclusive as yt, CLAUDECODE_SKILLS_DIR_PATH as z, RULESYNC_RELATIVE_DIR_PATH as zn, directoryExists as zt };
 
-//# sourceMappingURL=import-BmBQ8sWz.js.map
+//# sourceMappingURL=import-D7cJEvia.js.map