rulesync 43.1.1 → 43.2.0

package/dist/{import-BiQjbRR6.cjs → import-DAT3ge4z.cjs}

@@ -5544,24 +5544,27 @@ const AUGMENTCODE_HOOK_EVENTS = [
 * Hook events supported by Mistral Vibe (mistral-vibe).
 *
 * Vibe exposes three hook events in `.vibe/hooks.toml`: `pre_tool` ←
-* `preToolUse`, `post_tool` ← `postToolUse`, and `post_agent` ← `stop` (fires
-* after every assistant turn that ends without pending tool calls — the closest
-* canonical equivalent to a "turn end"/"stop" event, matching how
-* codexcli/copilot map their stop events). Only the tool events
-* (`pre_tool`/`post_tool`) carry the `match` tool-name matcher (fnmatch glob or
-* `re:` regex) and the `strict` flag; `post_agent` carries neither. Only
-* `type: "command"` hooks are relevant.
+* `preToolUse`, `post_tool` ← `postToolUse`, and `post_agent` ← `stop` /
+* `subagentStop`. `post_agent` fires after every assistant turn that ends
+* without pending tool calls, for the main agent and (since v3.0.2) for every
+* subagent. v3.0.3 lets a `post_agent` hook take a `match` on the agent that
+* finished its turn: the reserved alias `main` selects the main agent, so
+* canonical `stop` becomes `post_agent` with `match = "main"`, and a canonical
+* `subagentStop` with a matcher becomes `post_agent` with that agent name as
+* `match`. Only the tool events (`pre_tool`/`post_tool`) carry the `strict`
+* flag. Only `type: "command"` hooks are relevant.
 *
 * v2.21.0 graduated hooks from experimental and renamed all three types
 * (`before_tool` → `pre_tool`, `after_tool` → `post_tool`, `post_agent_turn` →
 * `post_agent`). `HookType` is a strict enum, so an entry using an old name is
 * rejected outright and reported as a `HookConfigIssue`.
-* @see https://github.com/mistralai/mistral-vibe/blob/main/README.md
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
 */
 const VIBE_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
-	"stop"
+	"stop",
+	"subagentStop"
 ];
 /**
 * Hook events supported by Codewhale.
@@ -7029,9 +7032,10 @@ const JUNIE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_JUNIE_EVENT
 /**
 * Map canonical camelCase event names to Mistral Vibe snake_case.
 *
-* Vibe documents three hook events. The canonical `stop` event maps to Vibe's
-* `post_agent` (fires after every assistant turn ending without pending tool
-* calls) — the closest documented "turn end"/"stop" equivalent.
+* Vibe documents three hook events. The canonical `stop` and `subagentStop`
+* events both map to Vibe's `post_agent` (fires after every assistant turn
+* ending without pending tool calls); the adapter tells them apart with the
+* hook's `match` on the agent name (`main` for the main agent).
 *
 * These are the v2.21.0 names; the pre-2.21.0 spellings (`before_tool`,
 * `after_tool`, `post_agent_turn`) are rejected by Vibe's strict `HookType`
@@ -7041,7 +7045,8 @@ const JUNIE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_JUNIE_EVENT
 const CANONICAL_TO_VIBE_EVENT_NAMES = {
 	preToolUse: "pre_tool",
 	postToolUse: "post_tool",
-	stop: "post_agent"
+	stop: "post_agent",
+	subagentStop: "post_agent"
 };
 /**
 * Map Mistral Vibe snake_case event names to canonical camelCase.
@@ -7054,6 +7059,7 @@ const CANONICAL_TO_VIBE_EVENT_NAMES = {
 */
 const VIBE_TO_CANONICAL_EVENT_NAMES = {
 	...invertEventNames(CANONICAL_TO_VIBE_EVENT_NAMES),
+	post_agent: "stop",
 	before_tool: "preToolUse",
 	after_tool: "postToolUse",
 	post_agent_turn: "stop"
@@ -8404,6 +8410,32 @@ const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
 	sandbox: zod_mini.z.optional(CopilotSandboxSchema)
 });
 /**
+* The permission mode the GitHub Copilot CLI starts new interactive sessions
+* in (`defaultPermissionMode` of `~/.copilot/settings.json`): `manual` prompts
+* for every request not already allowed, `assisted` lets a model review
+* eligible requests (Assisted Permissions, non-experimental since v1.0.104),
+* and `allow-all` is equivalent to `--allow-all`. These are the CLI's own
+* values and differ from the VS Code `copilot` target's
+* {@link COPILOT_DEFAULT_PERMISSION_MODES}.
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+*/
+const COPILOTCLI_DEFAULT_PERMISSION_MODES = [
+	"manual",
+	"assisted",
+	"allow-all"
+];
+/**
+* Tool-scoped override block for the GitHub Copilot CLI.
+* `defaultPermissionMode` writes the user-scope `defaultPermissionMode` key of
+* `~/.copilot/settings.json`; it has no canonical category, and the repository
+* settings file does not accept it.
+*/
+const CopilotcliPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum(COPILOTCLI_DEFAULT_PERMISSION_MODES))
+});
+/**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
 * before prompting. `always-ask` auto-approves only read-only tools,
 * `always-ask-cached` (Ask and remember) also prompts before file reads and
@@ -8420,11 +8452,14 @@ const OMP_APPROVAL_MODES = [
 ];
 /**
 * Tool-scoped override block for oh-my-pi (`omp`). `approvalMode` writes the
-* `tools.approvalMode` key of `config.yml`, which has no canonical category.
+* `tools.approvalMode` key of `config.yml`, and `restrictedFolders` the
+* `tools.restrictedFolders` list (folders where every action prompts in every
+* approval mode, `yolo` included); neither has a canonical category.
 */
 const OmpPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	approvalMode: zod_mini.z.optional(zod_mini.z.enum(OMP_APPROVAL_MODES))
+	approvalMode: zod_mini.z.optional(zod_mini.z.enum(OMP_APPROVAL_MODES)),
+	restrictedFolders: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 const KimiCodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -8876,6 +8911,48 @@ const QoderPermissionsOverrideSchema = zod_mini.z.looseObject({
 	agentsMdExcludes: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 /**
+* Tool-scoped override block for CodeBuddy Code. The shared `permission` block
+* continues to drive `permissions.allow`/`ask`/`deny` of
+* `.codebuddy/settings.json` (project) / `~/.codebuddy/settings.json` (global).
+*
+* The other documented settings with no canonical category are authored here
+* and merged into the same file, key by key, over what the file already
+* holds:
+*
+* - `autoReview` (`policy` replaces the built-in security policy of the `auto`
+*   permission mode, `extraPolicy` is appended to it) and the legacy
+*   `autoMode` rules (`environment` / `allow` / `soft_deny` / `hard_deny`).
+*   CodeBuddy reads both from the user and project-local settings only, never
+*   from the shared project file, so they are written by `--global` generate
+*   alone.
+* - `memory.parentDiscovery`: whether project instruction files
+*   (`CODEBUDDY.md` / `AGENTS.md`) are also discovered in parent directories.
+*
+* Only the keys listed here are written; any other key of these groups is
+* skipped with a warning. Removing a key from the override leaves the
+* previously written value in place.
+*
+* @see https://www.codebuddy.ai/docs/cli/settings
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @example
+* { "autoReview": { "extraPolicy": "Allow dev namespace releases" },
+*   "memory": { "parentDiscovery": false } }
+*/
+const CodebuddyPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	autoReview: zod_mini.z.optional(zod_mini.z.looseObject({
+		policy: zod_mini.z.optional(zod_mini.z.string()),
+		extraPolicy: zod_mini.z.optional(zod_mini.z.string())
+	})),
+	autoMode: zod_mini.z.optional(zod_mini.z.looseObject({
+		environment: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		allow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		soft_deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		hard_deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	})),
+	memory: zod_mini.z.optional(zod_mini.z.looseObject({ parentDiscovery: zod_mini.z.optional(zod_mini.z.boolean()) }))
+});
+/**
 * One native Factory Droid permission rule. `match.prefix` positions are either
 * a single token or a non-empty list of alternative tokens.
 *
@@ -9758,13 +9835,13 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	zed: zod_mini.z.optional(ZedPermissionsOverrideSchema),
 	devin: zod_mini.z.optional(DevinPermissionsOverrideSchema),
 	qoder: zod_mini.z.optional(QoderPermissionsOverrideSchema),
+	copilotcli: zod_mini.z.optional(CopilotcliPermissionsOverrideSchema),
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	continue: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CopilotPermissionsOverrideSchema),
-	codebuddy: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	codebuddy: zod_mini.z.optional(CodebuddyPermissionsOverrideSchema),
 	commandcode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	lettacode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
-	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	crush: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	omp: zod_mini.z.optional(OmpPermissionsOverrideSchema),
@@ -10251,6 +10328,10 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 		enabled: zod_mini.z.optional(zod_mini.z.boolean()),
 		description: zod_mini.z.optional(zod_mini.z.string())
 	})),
+	cline: zod_mini.z.optional(zod_mini.z.looseObject({
+		disabled: zod_mini.z.optional(zod_mini.z.boolean()),
+		enabled: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({
 		alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
 		description: zod_mini.z.optional(zod_mini.z.string()),
@@ -13730,7 +13811,11 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["allowedUrls", "deniedUrls"]
+				ownedKeys: [
+					"allowedUrls",
+					"deniedUrls",
+					"defaultPermissionMode"
+				]
 			}
 		}
 	},
@@ -13909,7 +13994,12 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions"]
+				ownedKeys: [
+					"permissions",
+					"autoReview",
+					"autoMode",
+					"memory"
+				]
 			}
 		}
 	},
@@ -14219,7 +14309,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 					"tools",
 					"enabled_tools",
 					"disabled_tools",
-					"enable_subagents"
+					"enable_subagents",
+					"outside_workdir"
 				]
 			}
 		}
@@ -15889,17 +15980,24 @@ function toolSkillSearchRoots(paths) {
 	return [paths.relativeDirPath, ...paths.alternativeSkillRoots ?? []];
 }
 /**
-* The Agent Skills interoperability roots: project `.agents/skills/`, global
-* `~/.agents/skills/` (same relative path, home output root), and Amp's global
-* equivalent `~/.config/agents/skills/`. Foreign-authored — potentially
-* non-conformant — skills are the most likely to live here, so every tool that
-* scans one of these roots imports it leniently (skip-and-warn per skill), per
-* the Agent Skills client-implementation guide, while keeping fail-fast
-* behavior for its own native root. Amp's read-only global discovery root
-* `~/.config/amp/skills/` follows the same skip-and-warn rule.
-* https://agentskills.io/client-implementation/adding-skills-support
+* Skill roots that every tool scanning them imports leniently (skip-and-warn
+* per skill) instead of failing fast, regardless of the tool's own
+* `lenientImport` flag.
+*
+* - The Agent Skills interoperability roots: project `.agents/skills/`, global
+*   `~/.agents/skills/` (same relative path, home output root), and Amp's
+*   global equivalent `~/.config/agents/skills/`. Foreign-authored —
+*   potentially non-conformant — skills are the most likely to live here, so
+*   they are imported leniently per the Agent Skills client-implementation
+*   guide, while each tool keeps fail-fast behavior for its own native root.
+*   https://agentskills.io/client-implementation/adding-skills-support
+* - Amp's read-only global discovery root `~/.config/amp/skills/`, which is not
+*   an interop root but follows the same skip-and-warn rule.
+*
+* Other import-only roots (e.g. GitLab Duo's legacy skills root, Kimi Code's
+* shared root) are not listed here and stay fail-fast.
 */
-const AGENT_SKILLS_INTEROP_ROOTS = /* @__PURE__ */ new Set([
+const LENIENT_IMPORT_SKILL_ROOTS = /* @__PURE__ */ new Set([
 	toPosixPath(AGENTSMD_SKILLS_DIR_PATH),
 	toPosixPath(AMP_SKILLS_GLOBAL_DIR),
 	toPosixPath(AMP_SKILLS_NATIVE_GLOBAL_DIR)
@@ -15924,8 +16022,8 @@ function warnOnEmptyLoadedDescription({ skillFilePath, description }) {
 	if (typeof description !== "string" || description.length > 0) return;
 	warnOnceWithFallback(void 0, `${stripControlCharacters(toPosixPath(skillFilePath))}: ${EMPTY_SKILL_DESCRIPTION_VIOLATION}. Rulesync imports it anyway so the content is not lost; fill it in before relying on this skill.`);
 }
-function isAgentSkillsInteropRoot(relativeDirPath) {
-	return AGENT_SKILLS_INTEROP_ROOTS.has(toPosixPath(relativeDirPath));
+function isLenientImportSkillRoot(relativeDirPath) {
+	return LENIENT_IMPORT_SKILL_ROOTS.has(toPosixPath(relativeDirPath));
 }
 /** Ordered import roots: managed roots first, followed by read-only discovery roots. */
 function toolSkillImportRoots(paths) {
@@ -30565,7 +30663,10 @@ var QwencodeSkill = class QwencodeSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: QWENCODE_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: QWENCODE_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return QwencodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -33155,7 +33256,7 @@ var SkillsProcessor = class extends DirFeatureProcessor {
 		for (const root of roots) {
 			const rootOutputRoot = typeof root === "string" ? this.outputRoot : root.outputRoot;
 			const relativeDirPath = typeof root === "string" ? root : root.relativeDirPath;
-			const isLenientRoot = configuredRootPaths.has(relativeDirPath) || factory.meta.lenientImport === true || isAgentSkillsInteropRoot(relativeDirPath);
+			const isLenientRoot = configuredRootPaths.has(relativeDirPath) || factory.meta.lenientImport === true || isLenientImportSkillRoot(relativeDirPath);
 			const skillsDirPath = (0, node_path.join)(rootOutputRoot, relativeDirPath);
 			if (!await directoryExists(skillsDirPath)) continue;
 			const ownedDirNames = [];
@@ -39586,6 +39687,16 @@ var VibePluginSubagent = class VibePluginSubagent extends ToolSubagent {
 */
 const VIBE_PROMPTS_DIR_PATH = (0, node_path.join)(".vibe", "prompts");
 /**
+* The agent name Vibe reserves for `post_agent` hook matching (v3.0.3+).
+* `AgentProfile.from_toml` refuses a file whose stem matches it case-insensitively, so an
+* agent written as `main.toml` would never load.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/vibe/core/agents/models.py
+*/
+const VIBE_RESERVED_AGENT_NAME = "main";
+function isReservedVibeAgentFileName(relativeFilePath) {
+	return (0, node_path.basename)(relativeFilePath).replace(/\.(md|toml)$/, "").toLowerCase() === VIBE_RESERVED_AGENT_NAME;
+}
+/**
 * Vibe resolves a `system_prompt_id` by file name, and
 * `VibeConfigSchema._check_system_prompt` evaluates it during validation — an
 * unresolvable id raises and the agent is dropped at discovery. The id must
@@ -39700,9 +39811,17 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	* evaluates the property during validation, so an unresolvable
 	* `system_prompt_id` raises and `AgentRegistry._try_load` drops the agent
 	* with a warning.
+	*
+	* A subagent named `main` is skipped with a warning: Vibe reserves that name
+	* for hook matching and does not load an agent file called `main.toml`.
 	*/
-	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false }) {
+	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false, logger }) {
 		return rulesyncSubagents.flatMap((rulesyncSubagent) => {
+			const sourcePath = rulesyncSubagent.getRelativeFilePath();
+			if (isReservedVibeAgentFileName(sourcePath)) {
+				logger?.warn(`Skipping Vibe subagent ${sourcePath}: Vibe reserves the agent name '${VIBE_RESERVED_AGENT_NAME}' for hook matching and does not load an agent file named '${VIBE_RESERVED_AGENT_NAME}'. Rename the subagent file.`);
+				return [];
+			}
 			const agentFile = VibeSubagent.fromRulesyncSubagent({
 				outputRoot,
 				relativeDirPath: VibeSubagent.getSettablePaths({ global }).relativeDirPath,
@@ -44989,17 +45108,49 @@ var ClaudecodeRule = class ClaudecodeRule extends ToolRule {
 * - `alwaysApply: true`: force the rule to always load (equivalent to a file
 *   with no frontmatter at all).
 * - `description`: label surfaced in the rule toggle UI.
+* - `disabled: true` (or `enabled: false`): the rule is switched off. Since
+*   Cline v4.1.26 (cline/cline#14605) the rule toggle writes this flag into the
+*   rule file itself instead of keeping it only in extension state.
 *
 * Rules without frontmatter are always active. Uses `z.looseObject()` so
-* forward-compatible fields added upstream are preserved on round-trip.
+* forward-compatible fields added upstream are preserved on round-trip: every
+* key other than `paths` / `alwaysApply` / `description` is carried in the
+* rulesync `cline:` section.
 *
 * @see https://docs.cline.bot/customization/cline-rules
+* @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/extensions/config/user-instruction-config-loader.ts
 */
 const ClineRuleFrontmatterSchema = zod_mini.z.looseObject({
 	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.array(zod_mini.z.string()), zod_mini.z.string()])),
 	alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
 	description: zod_mini.z.optional(zod_mini.z.string())
 });
+const CLINE_RULE_FIELD_TYPES = {
+	disabled: "boolean",
+	enabled: "boolean"
+};
+const CANONICAL_CLINE_RULE_KEYS = [
+	"paths",
+	"alwaysApply",
+	"description"
+];
+/** Returns a copy of `record` without the canonical `paths` / `alwaysApply` / `description` keys. */
+function omitCanonicalClineRuleKeys(record) {
+	return Object.fromEntries(Object.entries(record ?? {}).filter(([key]) => !CANONICAL_CLINE_RULE_KEYS.includes(key)));
+}
+/**
+* Splits a Cline rule frontmatter into the keys that have canonical rulesync
+* homes (`paths` / `alwaysApply` / `description`) and the rest, which are
+* lifted into the rulesync `cline:` section.
+*/
+function extractClineSection({ frontmatter, relativeFilePath }) {
+	return Object.fromEntries(Object.entries(omitCanonicalClineRuleKeys(frontmatter)).filter(([key, value]) => {
+		const expected = Object.hasOwn(CLINE_RULE_FIELD_TYPES, key) ? CLINE_RULE_FIELD_TYPES[key] : void 0;
+		if (expected === void 0 || value === void 0 || typeof value === expected) return true;
+		warnWithFallback(void 0, `Cline rules: dropping ${key} from ${relativeFilePath}: Cline rejects the whole rule unless it is a ${expected}.`);
+		return false;
+	}));
+}
 function isNonRootParams$1(params) {
 	return "frontmatter" in params && "body" in params;
 }
@@ -45074,6 +45225,10 @@ var ClineRule = class ClineRule extends ToolRule {
 	toRulesyncRule() {
 		if (this.isRoot()) return this.toRulesyncRuleDefault();
 		const globs = this.frontmatter?.alwaysApply === true ? ["**/*"] : normalizePaths$1(this.frontmatter?.paths);
+		const cline = extractClineSection({
+			frontmatter: this.frontmatter,
+			relativeFilePath: this.getRelativeFilePath()
+		});
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
@@ -45082,7 +45237,8 @@ var ClineRule = class ClineRule extends ToolRule {
 				root: false,
 				targets: ["*"],
 				description: this.frontmatter?.description,
-				globs
+				globs,
+				...Object.keys(cline).length > 0 && { cline }
 			},
 			body: this.body ?? this.getFileContent()
 		});
@@ -45127,16 +45283,22 @@ var ClineRule = class ClineRule extends ToolRule {
 	* universal match-everything globs mean "always", so they map to
 	* `alwaysApply: true` instead of a `paths` list; specific globs become
 	* conditional `paths`; an empty globs list leaves the rule always-active with
-	* no `paths`/`alwaysApply`.
+	* no `paths`/`alwaysApply`. Every key of the rulesync `cline:` section
+	* (e.g. `disabled: true`) is written into the frontmatter too; the canonical
+	* `paths` / `alwaysApply` / `description` win over same-named keys there.
 	*/
 	static buildNonRootRule({ outputRoot, rulesyncRule, validate, relativeDirPath }) {
 		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
 		const globs = normalizePaths$1(rulesyncFrontmatter.globs);
 		const isUniversal = globs.length > 0 && globs.every((glob) => glob === "**/*" || glob === "*");
+		const rawClineSection = rulesyncFrontmatter.cline ?? {};
+		for (const key of CANONICAL_CLINE_RULE_KEYS) if (Object.hasOwn(rawClineSection, key)) warnWithFallback(void 0, `Cline rules: ignoring cline.${key} in ${rulesyncRule.getRelativeFilePath()}: set the canonical ${key === "description" ? "description" : "globs"} instead.`);
+		const clineSection = omitCanonicalClineRuleKeys(rawClineSection);
 		const frontmatter = {
 			paths: globs.length > 0 && !isUniversal ? globs : void 0,
 			alwaysApply: isUniversal ? true : void 0,
-			description: rulesyncFrontmatter.description || void 0
+			description: rulesyncFrontmatter.description || void 0,
+			...clineSection
 		};
 		return new ClineRule({
 			outputRoot,
@@ -55823,6 +55985,14 @@ function applyCommandPrefix({ def, converterConfig }) {
 	if (isExecForm) return `${bracePlaceholder(converterConfig.projectDirVar)}/${stripSurroundingQuotes(relativeCommand)}`;
 	return anchorInline(`"${converterConfig.projectDirVar}"/${relativeCommand}`);
 }
+/** Whether a field restricted to some events applies on this one. */
+function isEventApplicable({ events, eventName }) {
+	return events === void 0 || events.has(eventName);
+}
+/** Quote and comma-join a set of names (events, hook types) for a warning. */
+function describeEvents(names) {
+	return [...names].map((name) => `"${name}"`).join(", ");
+}
 /**
 * Whether a field registered for `command` hooks only applies to this hook.
 * Applied on both export and import: a value imported into a canonical field
@@ -55844,7 +56014,7 @@ function isFieldApplicable({ commandOnly, hookType }) {
 * silence — the mirror of the import side.
 */
 function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn }) {
-	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength } of fields) {
+	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag, events } of fields) {
 		const value = def[canonical];
 		if (value === void 0) continue;
 		if (!isFieldApplicable({
@@ -55854,6 +56024,13 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not generated.`);
 			continue;
 		}
+		if (events !== void 0 && !isEventApplicable({
+			events,
+			eventName
+		})) {
+			if (value !== false) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${describeEvents(events)} only, so it is not generated.`);
+			continue;
+		}
 		if (!isValid({
 			value,
 			canonical
@@ -55861,14 +56038,18 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": ${quoteValueForWarning(value)} is not a value this tool can express as "${tool}".`);
 			continue;
 		}
+		if (onlyWithFlag !== void 0 && def[onlyWithFlag] !== true) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" has no effect without "${onlyWithFlag}": true; this tool reads "${tool}" only on "${onlyWithFlag}" hooks.`);
 		if (maxLength !== void 0 && typeof value === "string") {
 			const length = collapseWhitespaceForLength ? value.replace(/\s+/g, " ").trim().length : value.length;
-			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
+			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long${collapseWhitespaceForLength ? " after collapsing whitespace" : ""}; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
 		}
 	}
-	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
+	return Object.fromEntries(fields.filter(({ canonical, commandOnly, events }) => isFieldApplicable({
 		commandOnly,
 		hookType
+	}) && isEventApplicable({
+		events,
+		eventName
 	}) && isValid({
 		value: def[canonical],
 		canonical
@@ -55881,16 +56062,24 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 * kind has a rule an authored file can plausibly violate — turns a rejected
 * value into a warning instead of a silent drop.
 */
-function importPassthroughFields({ h, hookType, fields, isValid, describeInvalid, warn }) {
-	const applicable = fields.filter(({ commandOnly }) => isFieldApplicable({
+function importPassthroughFields({ h, hookType, eventName, fields, isValid, describeInvalid, warn }) {
+	const typeApplicable = fields.filter(({ commandOnly }) => isFieldApplicable({
 		commandOnly,
 		hookType
 	}));
+	const applicable = typeApplicable.filter(({ events }) => isEventApplicable({
+		events,
+		eventName
+	}));
 	const skipped = fields.filter(({ commandOnly }) => !isFieldApplicable({
 		commandOnly,
 		hookType
 	}));
 	for (const { tool } of skipped) if (h[tool] !== void 0) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook: this tool documents it on "command" hooks only, so it is not imported.`);
+	for (const { tool, events } of typeApplicable) if (events !== void 0 && !isEventApplicable({
+		events,
+		eventName
+	}) && h[tool] !== void 0 && h[tool] !== false) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook on "${eventName}": this tool honours it on ${describeEvents(events)} only, so it is not imported.`);
 	for (const { tool, canonical } of applicable) if (describeInvalid !== void 0 && h[tool] !== void 0 && !isValid({
 		value: h[tool],
 		canonical
@@ -56058,11 +56247,11 @@ function isKeywordFieldApplicable({ spec, hookType, eventName, flags, direction,
 		return false;
 	}
 	if (hookTypes !== void 0 && !hookTypes.has(hookType)) {
-		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${[...hookTypes].map((type) => `"${type}"`).join(", ")} hooks only, so it is not ${direction}.`);
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${describeEvents(hookTypes)} hooks only, so it is not ${direction}.`);
 		return false;
 	}
 	if (events !== void 0 && !events.has(eventName)) {
-		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${describeEvents(events)} only, so it is not ${direction}.`);
 		return false;
 	}
 	if (ignoredEvents?.has(eventName)) {
@@ -56508,6 +56697,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.booleanPassthroughFields ?? [],
 			isValid: isBooleanValue,
 			warn
@@ -56522,6 +56712,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.numberPassthroughFields ?? [],
 			isValid: isImportableNumber,
 			describeInvalid: describeInvalidScalar,
@@ -56530,6 +56721,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.stringPassthroughFields ?? [],
 			isValid: isImportableString,
 			describeInvalid: describeInvalidScalar,
@@ -56538,6 +56730,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.arrayPassthroughFields ?? [],
 			isValid: isImportableArray,
 			describeInvalid: describeInvalidArray,
@@ -56546,6 +56739,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.recordPassthroughFields ?? [],
 			isValid: isEmittableRecord,
 			describeInvalid: describeInvalidRecord,
@@ -56554,6 +56748,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.objectPassthroughFields ?? [],
 			isValid: isImportableObject,
 			describeInvalid: describeInvalidObject,
@@ -61386,6 +61581,11 @@ const GROKCLI_CONVERTER_CONFIG = {
 		tool: "env",
 		commandOnly: true
 	}],
+	booleanPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "failClosed",
+		events: /* @__PURE__ */ new Set(["preToolUse", "beforeSubmitPrompt"])
+	}],
 	arrayPassthroughFields: [{
 		canonical: "args",
 		tool: "args",
@@ -63035,6 +63235,15 @@ const LETTACODE_CONVERTER_CONFIG = {
 	timeoutUnit: "milliseconds"
 };
 /**
+* Letta Code documents settings-file hooks as deprecated in favor of Mods
+* (https://docs.letta.com/reference/deprecated/hooks) but still ships the
+* loader, so rulesync keeps emitting them and tells the user once per run.
+* Mods are not modeled: they are JS/TS code modules loaded only from
+* `~/.letta/mods/` or an agent's memory directory, with no declarative or
+* project-local form a canonical hook could be translated into.
+*/
+const LETTACODE_HOOKS_DEPRECATION_WARNING = "Letta Code documents settings.json hooks as deprecated in favor of Mods and may remove them in a future release; rulesync still writes them while Letta Code loads them. See https://docs.letta.com/reference/deprecated/hooks";
+/**
 * Letta Code keeps a boolean `disabled` switch beside the event arrays inside
 * `hooks`. rulesync owns the whole `hooks` key, so the switch is read back from
 * the existing file and carried into the generated one instead of being lost.
@@ -63093,6 +63302,11 @@ function parseLettacodeSettings$1(fileContent, filePath) {
 * and UI preferences, ...), so generation merges the `hooks` key into the
 * existing file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
 *
+* Letta Code marks this surface deprecated in favor of Mods (see
+* `LETTACODE_HOOKS_DEPRECATION_WARNING`); generation warns once per run when it
+* writes any hook.
+*
+* @see https://docs.letta.com/reference/deprecated/hooks
 * @see https://github.com/letta-ai/letta-code/blob/main/src/hooks/types.ts
 * @see https://github.com/letta-ai/letta-code/blob/main/src/hooks/loader.ts
 */
@@ -63137,6 +63351,7 @@ var LettacodeHooks = class LettacodeHooks extends ToolHooks {
 			converterConfig: LETTACODE_CONVERTER_CONFIG,
 			logger
 		});
+		if (Object.keys(hooks).length > 0) warnOnceWithFallback(logger, LETTACODE_HOOKS_DEPRECATION_WARNING);
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
@@ -64264,14 +64479,16 @@ const QODER_SPEC = {
 			{
 				canonical: "rewakeMessage",
 				tool: "rewakeMessage",
-				commandOnly: true
+				commandOnly: true,
+				onlyWithFlag: "asyncRewake"
 			},
 			{
 				canonical: "rewakeSummary",
 				tool: "rewakeSummary",
 				commandOnly: true,
 				maxLength: 300,
-				collapseWhitespaceForLength: true
+				collapseWhitespaceForLength: true,
+				onlyWithFlag: "asyncRewake"
 			}
 		],
 		booleanPassthroughFields: [
@@ -65132,11 +65349,38 @@ const VIBE_DIR = ".vibe";
 const VIBE_HOOKS_FILE_NAME = "hooks.toml";
 /**
 * Vibe scopes the tool-name `match` glob and the `strict` flag to tool hooks
-* (`pre_tool` / `post_tool`) only; `post_agent` fires after every
-* assistant turn and carries no matcher.
-* @see https://github.com/mistralai/mistral-vibe/blob/main/README.md
+* (`pre_tool` / `post_tool`). `post_agent` takes a `match` too since v3.0.3,
+* but on the name of the agent that finished its turn, not a tool name (see
+* {@link VIBE_MAIN_AGENT_MATCH}).
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
 */
 const VIBE_TOOL_EVENTS = /* @__PURE__ */ new Set(["pre_tool", "post_tool"]);
+/** The Vibe event both canonical `stop` and `subagentStop` become. */
+const VIBE_POST_AGENT_EVENT = "post_agent";
+/**
+* The reserved agent alias a `post_agent` hook's `match` uses to run only
+* after the main agent. Without a `match`, `post_agent` runs after every
+* agent, subagents included (v3.0.2+), whereas canonical `stop` is
+* main-agent-only — so `stop` is written with this match.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+*/
+const VIBE_MAIN_AGENT_MATCH = "main";
+/**
+* The `post_agent` `match` for a canonical `subagentStop` hook, or null to
+* skip it. Vibe has no selector for "every subagent but not the main agent",
+* so a matcher naming the subagent is required.
+*/
+function toVibeSubagentMatch({ matcher, logger }) {
+	if (typeof matcher !== "string" || matcher === "" || matcher === "*") {
+		logger?.warn("Vibe hooks: skipping a \"subagentStop\" hook without an agent-name matcher. Vibe's post_agent cannot select every subagent without also running after the main agent; set \"matcher\" to the subagent name.");
+		return null;
+	}
+	if (matcher.toLowerCase() === VIBE_MAIN_AGENT_MATCH) {
+		logger?.warn("Vibe hooks: skipping a \"subagentStop\" hook whose matcher is \"main\". Vibe reserves \"main\" for the main agent; use a \"stop\" hook instead.");
+		return null;
+	}
+	return matcher;
+}
 const SUPPORTED_VIBE_EVENTS = new Set(VIBE_HOOK_EVENTS);
 /**
 * The `match` a canonical `Bash` matcher becomes. Vibe tests `match` against a
@@ -65160,7 +65404,8 @@ function fromVibeHookMatch(match) {
 /**
 * Build the flat `[[hooks]]` array for `.vibe/hooks.toml` from a canonical
 * hooks config. Vibe uses a flat array where each entry carries its own event
-* `type`, tool-name `match` glob/regex, and `command`. Only `type: "command"`
+* `type`, `match` glob/regex (a tool name for tool hooks, an agent name
+* for `post_agent`), and `command`. Only `type: "command"`
 * canonical hooks are emitted: a Vibe hook is a shell command line. (v2.25.1
 * to v2.25.4 briefly exec'd it without a shell under the unified harness and
 * skipped any command containing a backslash; v2.25.5 restored shell
@@ -65168,7 +65413,7 @@ function fromVibeHookMatch(match) {
 * now run through the shell" — and dropped the backslash skip.)
 * @see https://github.com/mistralai/mistral-vibe/blob/v3.0.2/README.md
 */
-function canonicalToVibeHooks({ config, toolOverride }) {
+function canonicalToVibeHooks({ config, toolOverride, logger }) {
 	const shared = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_VIBE_EVENTS.has(event)) shared[event] = defs;
 	const effective = {
@@ -65176,30 +65421,40 @@ function canonicalToVibeHooks({ config, toolOverride }) {
 		...toolOverride
 	};
 	const hooks = [];
+	const nextIndexByVibeEvent = /* @__PURE__ */ new Map();
 	for (const [event, defs] of Object.entries(effective)) {
 		if (!SUPPORTED_VIBE_EVENTS.has(event)) continue;
 		const vibeEvent = lookupOwn({
 			record: CANONICAL_TO_VIBE_EVENT_NAMES,
 			key: event
 		}) ?? event;
-		let index = 0;
 		for (const def of defs) {
 			if ((def.type ?? "command") !== "command") continue;
 			if (typeof def.command !== "string") continue;
-			const name = typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`;
 			const isToolEvent = VIBE_TOOL_EVENTS.has(vibeEvent);
+			let match;
+			if (isToolEvent) match = toVibeHookMatch(def.matcher);
+			else if (event === "subagentStop") {
+				const subagentMatch = toVibeSubagentMatch({
+					matcher: def.matcher,
+					logger
+				});
+				if (subagentMatch === null) continue;
+				match = subagentMatch;
+			} else match = VIBE_MAIN_AGENT_MATCH;
+			const index = nextIndexByVibeEvent.get(vibeEvent) ?? 0;
 			const entry = {
-				name,
+				name: typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`,
 				type: vibeEvent,
+				match,
 				command: def.command
 			};
-			if (isToolEvent) entry.match = toVibeHookMatch(def.matcher);
 			if (typeof def.timeout === "number") entry.timeout = def.timeout;
 			const strict = def.strict;
 			if (isToolEvent && typeof strict === "boolean") entry.strict = strict;
 			if (typeof def.description === "string") entry.description = def.description;
 			hooks.push(entry);
-			index += 1;
+			nextIndexByVibeEvent.set(vibeEvent, index + 1);
 		}
 	}
 	return { hooks };
@@ -65211,14 +65466,22 @@ function vibeEntryToCanonicalDef(raw) {
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
 	if (isPrototypePollutionKey(vibeEvent)) return null;
-	const canonicalEvent = lookupOwn({
+	let canonicalEvent = lookupOwn({
 		record: VIBE_TO_CANONICAL_EVENT_NAMES,
 		key: vibeEvent
 	}) ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
-	const matcher = fromVibeHookMatch(entry.match);
-	if (matcher !== void 0) def.matcher = matcher;
+	if (vibeEvent === VIBE_POST_AGENT_EVENT) {
+		const agentMatch = typeof entry.match === "string" ? entry.match : "";
+		if (agentMatch !== "" && agentMatch !== "*" && agentMatch.toLowerCase() !== VIBE_MAIN_AGENT_MATCH) {
+			canonicalEvent = "subagentStop";
+			def.matcher = agentMatch;
+		}
+	} else {
+		const matcher = fromVibeHookMatch(entry.match);
+		if (matcher !== void 0) def.matcher = matcher;
+	}
 	if (typeof entry.timeout === "number") def.timeout = entry.timeout;
 	if (typeof entry.name === "string") def.name = entry.name;
 	if (typeof entry.description === "string") def.description = entry.description;
@@ -65249,6 +65512,26 @@ function vibeHooksToCanonical(parsed) {
 	}
 	return canonical;
 }
+/** Vibe reads a `match` with a `re:` prefix or glob metacharacters as a pattern. */
+const VIBE_PATTERN_MATCH = /^re:|[*?[]/;
+/**
+* Move the imported `subagentStop` hooks into the `vibe` override when any of
+* them matches agents by a regex or glob rather than by a literal name. Such a
+* pattern can also select the main agent (a main session answers to its mode
+* name, e.g. `accept-edits`), and other tools would read it as their own
+* matcher syntax, so it is kept Vibe-only. The override replaces the shared
+* list for its event, so the whole list moves to keep every entry on Vibe.
+*/
+function takeVibeOnlySubagentStop({ hooks, logger }) {
+	const defs = lookupOwn({
+		record: hooks,
+		key: "subagentStop"
+	});
+	if (defs === void 0 || !defs.some((def) => typeof def.matcher === "string" && VIBE_PATTERN_MATCH.test(def.matcher))) return;
+	delete hooks.subagentStop;
+	logger?.warn("Vibe hooks: a post_agent hook matches agents by a pattern, so its subagentStop hooks are imported into the vibe override instead of the shared hooks.");
+	return defs;
+}
 function parseVibeToml(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -65288,12 +65571,13 @@ var VibeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
 		const vibeHooks = canonicalToVibeHooks({
 			config,
-			toolOverride: config.vibe?.hooks
+			toolOverride: config.vibe?.hooks,
+			logger
 		});
 		const fileContent = smol_toml.stringify(vibeHooks);
 		return new this({
@@ -65304,15 +65588,30 @@ var VibeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks(options = {}) {
 		const hooks = vibeHooksToCanonical(this.parseFileContentOrThrow({
 			displayName: "Vibe",
 			parse: (fileContent) => parseVibeToml(fileContent)
 		}));
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+		const vibeOnlySubagentStop = takeVibeOnlySubagentStop({
+			hooks,
+			logger: options.logger
+		});
+		const config = buildImportedHooksConfig({
 			hooks,
 			overrideKey: "vibe"
-		}), null, 2) });
+		});
+		if (vibeOnlySubagentStop !== void 0) {
+			const override = config.vibe ?? {};
+			config.vibe = {
+				...override,
+				hooks: {
+					...override.hooks,
+					subagentStop: vibeOnlySubagentStop
+				}
+			};
+		}
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
 		try {
@@ -69651,7 +69950,7 @@ var CodebuddyMcp = class CodebuddyMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/codebuff-mcp.ts
-const TOOL_NAME$1 = "codebuff";
+const TOOL_NAME$2 = "codebuff";
 const MAPPED_KEYS = /* @__PURE__ */ new Set([
 	"type",
 	"transport",
@@ -69686,14 +69985,14 @@ function toCodebuffEnv({ name, env, logger }) {
 		}
 		if (value.startsWith("$")) {
 			warnAndSkipMcpServer({
-				toolName: TOOL_NAME$1,
+				toolName: TOOL_NAME$2,
 				serverName: name,
 				reason: `env ${quoteValueForWarning(key)} starting with "$" that is not a whole \${VAR} reference, which Codebuff would resolve as a variable name and fail to load the whole mcp.json`,
 				logger
 			});
 			return null;
 		}
-		if (CANONICAL_ENV_REF.test(value)) logger?.warn(`${TOOL_NAME$1} MCP: env ${quoteValueForWarning(key)} of server ${quoteValueForWarning(name)} embeds a \${VAR} reference; Codebuff only resolves a whole-value \$VAR, so it is written as literal text.`);
+		if (CANONICAL_ENV_REF.test(value)) logger?.warn(`${TOOL_NAME$2} MCP: env ${quoteValueForWarning(key)} of server ${quoteValueForWarning(name)} embeds a \${VAR} reference; Codebuff only resolves a whole-value \$VAR, so it is written as literal text.`);
 		converted.push([key, value]);
 	}
 	return Object.fromEntries(converted);
@@ -69710,31 +70009,31 @@ function toCodebuffEnv({ name, env, logger }) {
 */
 function toCodebuffServer({ name, server, logger }) {
 	if (server.disabled === true) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "disabled: true, which Codebuff has no per-server switch for",
 		logger
 	});
 	const transport = server.type ?? server.transport;
 	if (transport === "ws") return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "the WebSocket transport, which Codebuff does not support",
 		logger
 	});
 	const dropped = Object.keys(server).filter((key) => !MAPPED_KEYS.has(key));
-	if (dropped.length > 0) logger?.warn(`${TOOL_NAME$1} MCP: dropping ${dropped.map((key) => quoteValueForWarning(key)).join(", ")} from server ${quoteValueForWarning(name)}; Codebuff rejects keys outside its server schema.`);
+	if (dropped.length > 0) logger?.warn(`${TOOL_NAME$2} MCP: dropping ${dropped.map((key) => quoteValueForWarning(key)).join(", ")} from server ${quoteValueForWarning(name)}; Codebuff rejects keys outside its server schema.`);
 	if (isRemoteMcpServer(server)) {
 		const url = resolveRemoteMcpUrl(server);
 		if (url === void 0) return warnAndSkipMcpServer({
-			toolName: TOOL_NAME$1,
+			toolName: TOOL_NAME$2,
 			serverName: name,
 			reason: "a remote transport without a url",
 			logger
 		});
 		const params = server.params;
 		const validParams = isRecord(params) && Object.values(params).every((value) => typeof value === "string");
-		if (params !== void 0 && !validParams) logger?.warn(`${TOOL_NAME$1} MCP: dropping params from server ${quoteValueForWarning(name)}; Codebuff accepts only a map of string values.`);
+		if (params !== void 0 && !validParams) logger?.warn(`${TOOL_NAME$2} MCP: dropping params from server ${quoteValueForWarning(name)}; Codebuff accepts only a map of string values.`);
 		return {
 			type: transport === "sse" ? "sse" : "http",
 			url,
@@ -69744,7 +70043,7 @@ function toCodebuffServer({ name, server, logger }) {
 	}
 	const [command, ...args] = resolveLocalMcpCommand(server);
 	if (command === void 0) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME$1,
+		toolName: TOOL_NAME$2,
 		serverName: name,
 		reason: "no command to spawn",
 		logger
@@ -72414,7 +72713,7 @@ var CursorMcp = class CursorMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/deepagents-mcp.ts
-const TOOL_NAME = "deepagents";
+const TOOL_NAME$1 = "deepagents";
 /**
 * Map a canonical transport onto the three dcode accepts.
 *
@@ -72455,7 +72754,7 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 			return true;
 		}
 		warnAndSkipMcpServer({
-			toolName: TOOL_NAME,
+			toolName: TOOL_NAME$1,
 			serverName: name,
 			reason: "an empty command list, which leaves deepagents nothing to spawn",
 			logger
@@ -72483,7 +72782,7 @@ function applyDeepagentsCommand({ name, server, converted, logger }) {
 */
 function toDeepagentsOauth({ name, oauth, converted, logger }) {
 	if (!isSlackOauthServer(converted)) {
-		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
+		logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth on "${name}"; deepagents reads it only on a Slack (slack.com) server with auth: "oauth" and skips any other server that sets it.`);
 		return;
 	}
 	const source = isRecord(oauth) ? oauth : {};
@@ -72492,18 +72791,18 @@ function toDeepagentsOauth({ name, oauth, converted, logger }) {
 		if (PROTOTYPE_POLLUTION_KEYS.has(key)) continue;
 		const nativeKey = key === "clientId" ? "client_id" : key;
 		if (nativeKey !== "client_id" && nativeKey !== "client_secret") {
-			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
+			logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth.${key} on "${name}"; deepagents accepts only client_id and client_secret.`);
 			continue;
 		}
 		if (nativeKey !== key && isDeepagentsOauthValue(source[nativeKey])) continue;
 		if (!isDeepagentsOauthValue(value)) {
-			logger?.warn(`${TOOL_NAME} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
+			logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth.${key} on "${name}"; deepagents requires a non-empty string without control characters.`);
 			continue;
 		}
 		result[nativeKey] = value;
 	}
 	if (result.client_id === void 0) {
-		logger?.warn(`${TOOL_NAME} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
+		logger?.warn(`${TOOL_NAME$1} MCP: dropping oauth on "${name}"; deepagents requires oauth.client_id (canonical clientId) and skips a server without it.`);
 		return;
 	}
 	return result;
@@ -72532,14 +72831,14 @@ function isSlackOauthServer(server) {
 */
 function toDeepagentsServer({ name, server, logger }) {
 	if (server.disabled === true) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "disabled: true, which deepagents does not read from .mcp.json (the server would still run)",
 		logger
 	});
 	const rawTransport = server.transport ?? server.type;
 	if (rawTransport === "ws") return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "the WebSocket transport, which deepagents does not support",
 		logger
@@ -72569,21 +72868,21 @@ function toDeepagentsServer({ name, server, logger }) {
 		if (deepagentsOauth !== void 0) converted.oauth = deepagentsOauth;
 	}
 	if (enabledTools !== void 0 && disabledTools !== void 0) return warnAndSkipMcpServer({
-		toolName: TOOL_NAME,
+		toolName: TOOL_NAME$1,
 		serverName: name,
 		reason: "both enabledTools and disabledTools, which deepagents rejects — pick one",
 		logger
 	});
 	if (enabledTools !== void 0) {
 		if (enabledTools.length === 0) return warnAndSkipMcpServer({
-			toolName: TOOL_NAME,
+			toolName: TOOL_NAME$1,
 			serverName: name,
 			reason: "an empty enabledTools list, which allows no tools at all and which deepagents rejects",
 			logger
 		});
 		converted.allowedTools = enabledTools;
 	} else if (disabledTools !== void 0) {
-		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
+		if (disabledTools.length === 0) logger?.warn(`${TOOL_NAME$1} MCP: dropping the empty disabledTools list on "${name}"; it denies nothing, and deepagents rejects the empty form.`);
 		else converted.disabledTools = disabledTools;
 	}
 	return converted;
@@ -73235,6 +73534,32 @@ var DshMcp = class DshMcp extends ToolMcp {
 	}
 };
 // src/features/mcp/factorydroid-mcp.ts
+const TOOL_NAME = "factorydroid";
+/**
+* Drop servers whose `enabledTools` allowlist is empty.
+*
+* Canonically an empty allowlist allows no tools, but Droid applies
+* `enabledTools` only "when the list is non-empty"
+* (https://docs.factory.com/harness/mcp), so writing `[]` would load every
+* tool the server reports. Skipping the server is the only form that does not
+* hand the model more tools than the canonical config allows.
+*/
+function skipEmptyAllowlistServers({ mcpServers, logger }) {
+	const kept = {};
+	for (const [name, server] of Object.entries(mcpServers)) {
+		if (server.enabledTools?.length === 0) {
+			warnAndSkipMcpServer({
+				toolName: TOOL_NAME,
+				serverName: name,
+				reason: "an empty enabledTools list, which allows no tools at all but which Factory Droid treats as no filter",
+				logger
+			});
+			continue;
+		}
+		kept[name] = server;
+	}
+	return kept;
+}
 var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 	json;
 	constructor(params) {
@@ -73260,8 +73585,11 @@ var FactorydroidMcp = class FactorydroidMcp extends ToolMcp {
 			validate
 		});
 	}
-	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true }) {
-		const factorydroidConfig = { mcpServers: rulesyncMcp.getMcpServers() };
+	static fromRulesyncMcp({ outputRoot = process.cwd(), rulesyncMcp, validate = true, logger }) {
+		const factorydroidConfig = { mcpServers: skipEmptyAllowlistServers({
+			mcpServers: rulesyncMcp.getMcpServers(),
+			logger
+		}) };
 		const fileContent = JSON.stringify(factorydroidConfig, null, 2);
 		return new FactorydroidMcp({
 			outputRoot,
@@ -76900,6 +77228,12 @@ const REASONIX_PLUGIN_FIELDS = [
 	"load",
 	"oauth_allow_missing_pkce_metadata"
 ];
+/**
+* The `load` mode that puts a server's tools in the provider schema. Reasonix
+* compares it case-insensitively after trimming (`normalizeMCPLoad`).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.53.0/internal/contract/config/mcp_load.go
+*/
+const REASONIX_MCP_LOAD_ALWAYS = "always";
 /** The `[[plugins]]` key that canonical `disabledTools` is written to and read from. */
 const REASONIX_DISABLED_TOOLS_KEY = "disabled_tools";
 var ReasonixMcp = class ReasonixMcp extends ToolMcp {
@@ -77064,7 +77398,9 @@ function hasExpectedType(value, expected) {
 * `concurrency` string decodes fine but is ignored in favor of the server-name
 * default, so it is dropped too rather than written as a setting that does
 * nothing. An unknown `load` string is read as `deferred`, the default, so it
-* passes through as authored.
+* passes through as authored. A project `load = "always"` also passes through,
+* but is warned about in `writePassthroughFields`: see the v2.53.0 note on
+* `REASONIX_PLUGIN_FIELDS`.
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/v2.31.0/internal/contract/config/plugin_entry.go
 */
 function invalidPassthroughFieldReason(field, value) {
@@ -77104,6 +77440,7 @@ function writePassthroughFields({ name, server, plugin, global, logger }) {
 			continue;
 		}
 		if (field === "oauth_allow_missing_pkce_metadata" && value === true) logger?.warn(`Reasonix MCP: "${name}" sets "oauth_allow_missing_pkce_metadata", which lets OAuth proceed with an authorization server that does not advertise PKCE support.` + (global ? "" : ` Reasonix honours it only from the user config, not a project reasonix.toml.`));
+		if (field === "load" && !global && server.disabled !== true && typeof value === "string" && value.trim().toLowerCase() === REASONIX_MCP_LOAD_ALWAYS) logger?.warn(`Reasonix MCP: "${name}" sets "load" to "always" in the project reasonix.toml. Reasonix 2.53.0 and later ignore a project-declared load mode and defer the server; set it in the user config (the server's "load" or [tools.mcp_load]) instead.`);
 		plugin[field] = value;
 	}
 }
@@ -86042,6 +86379,41 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 // src/features/permissions/codebuddy-permissions.ts
 /** Top-level key of `.codebuddy/settings.json` that rulesync owns. */
 const CODEBUDDY_PERMISSIONS_KEY = "permissions";
+/**
+* The top-level settings groups the `codebuddy` override may author, each with
+* the only keys of that group rulesync writes and imports. A group's other
+* keys are kept as the file has them; an override key not listed here is
+* skipped with a warning.
+*
+* - `autoReview`: the `auto` permission mode's review policy (`policy`
+*   replaces the built-in security policy, `extraPolicy` is appended to it).
+* - `autoMode`: the legacy natural-language `auto` rules, still read as
+*   additional policy.
+* - `memory.parentDiscovery`: whether `CODEBUDDY.md` / `AGENTS.md` are also
+*   discovered in parent directories of the launch directory.
+*
+* @see https://www.codebuddy.ai/docs/cli/settings
+* @see https://www.codebuddy.ai/docs/cli/memory
+*/
+const CODEBUDDY_OVERRIDE_GROUP_KEYS = {
+	autoReview: ["policy", "extraPolicy"],
+	autoMode: [
+		"environment",
+		"allow",
+		"soft_deny",
+		"hard_deny"
+	],
+	memory: ["parentDiscovery"]
+};
+const CODEBUDDY_OVERRIDE_GROUPS = Object.keys(CODEBUDDY_OVERRIDE_GROUP_KEYS);
+/**
+* Groups CodeBuddy reads from the user and project-local settings only: the
+* shared project `.codebuddy/settings.json` is not read for them, so a checked-in
+* repository cannot relax the review of its own actions. They are written and
+* imported in global mode alone.
+* @see https://www.codebuddy.ai/docs/cli/settings
+*/
+const CODEBUDDY_USER_ONLY_GROUPS = /* @__PURE__ */ new Set(["autoReview", "autoMode"]);
 /** The rule lists under `permissions`, one per canonical action. */
 const CODEBUDDY_RULE_LISTS = [
 	"allow",
@@ -86195,6 +86567,87 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 	return lists;
 }
 /**
+* Whether a settings value has the shape the `codebuddy` override schema
+* accepts for that key, so an off-spec value is left in the file instead of
+* being written or making the imported permissions file fail validation.
+*/
+function isLiftableCodebuddyValue(key, value) {
+	switch (key) {
+		case "policy":
+		case "extraPolicy": return typeof value === "string";
+		case "parentDiscovery": return typeof value === "boolean";
+		default: return isStringArray(value);
+	}
+}
+/** Name every written override setting that can make the `auto` review more lenient. */
+function announceCodebuddyReviewSettings({ picked, group, where, logger }) {
+	if (group === "autoReview" && typeof picked.policy === "string") logger?.warn(`CodeBuddy permissions: codebuddy.autoReview.policy was written to ${where}, so it replaces CodeBuddy's built-in security policy for the 'auto' permission mode.`);
+	if (group === "autoReview" && typeof picked.extraPolicy === "string") logger?.warn(`CodeBuddy permissions: codebuddy.autoReview.extraPolicy was written to ${where}, so it is appended to the security policy CodeBuddy's 'auto' permission mode reviews actions against.`);
+	if (group === "autoMode" && toStringArray$1(picked.allow).length > 0) logger?.warn(`CodeBuddy permissions: codebuddy.autoMode.allow was written to ${where}, so CodeBuddy's 'auto' permission mode leans toward approving the actions it describes.`);
+}
+/**
+* The top-level keys the `codebuddy` override contributes to the settings
+* patch, besides `permissions`. Each group is the existing group with the
+* authored keys laid over it; a group is only in the patch when authored, so
+* a hand-set value survives an unrelated regeneration.
+*/
+function buildCodebuddyOverridePatch({ override, existing, global, where, logger }) {
+	const patch = {};
+	if (override === void 0) return patch;
+	for (const group of CODEBUDDY_OVERRIDE_GROUPS) {
+		const authored = override[group];
+		if (!isRecord(authored)) continue;
+		if (CODEBUDDY_USER_ONLY_GROUPS.has(group) && !global) {
+			logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group} in project mode — CodeBuddy does not read ${group} from the shared project .codebuddy/settings.json. Run 'rulesync generate --global' to write it to ~/.codebuddy/settings.json.`);
+			continue;
+		}
+		const allowedKeys = CODEBUDDY_OVERRIDE_GROUP_KEYS[group];
+		const picked = {};
+		for (const [key, value] of Object.entries(authored)) {
+			if (isPrototypePollutionKey(key) || value === void 0) continue;
+			if (!allowedKeys.includes(key)) {
+				logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group}.${key} — Rulesync writes only ${allowedKeys.map((k) => `${group}.${k}`).join(", ")} from the codebuddy override; set other keys in ${where} by hand.`);
+				continue;
+			}
+			picked[key] = value;
+		}
+		if (Object.keys(picked).length === 0) continue;
+		const existingValue = existing[group];
+		if (existingValue !== void 0 && !isRecord(existingValue)) {
+			logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group} — ${group} in ${where} is not an object, so Rulesync leaves it as it is. Fix it by hand to let Rulesync write ${group}.`);
+			continue;
+		}
+		patch[group] = {
+			...existingValue,
+			...picked
+		};
+		announceCodebuddyReviewSettings({
+			picked,
+			group,
+			where,
+			logger
+		});
+	}
+	return patch;
+}
+/**
+* Lift the settings the `codebuddy` override authors back out of a settings
+* file. `autoReview` and `autoMode` are lifted only from the user file, the
+* one of the two rulesync manages that CodeBuddy reads them from.
+*/
+function liftCodebuddyOverride({ settings, global }) {
+	const lifted = {};
+	for (const group of CODEBUDDY_OVERRIDE_GROUPS) {
+		if (CODEBUDDY_USER_ONLY_GROUPS.has(group) && !global) continue;
+		const existingGroup = settings[group];
+		if (!isRecord(existingGroup)) continue;
+		const picked = {};
+		for (const key of CODEBUDDY_OVERRIDE_GROUP_KEYS[group]) if (Object.hasOwn(existingGroup, key) && isLiftableCodebuddyValue(key, existingGroup[key])) picked[key] = existingGroup[key];
+		if (Object.keys(picked).length > 0) lifted[group] = picked;
+	}
+	return lifted;
+}
+/**
 * CodeBuddy Code permissions.
 *
 * Rules live under the `permissions` key of `.codebuddy/settings.json`
@@ -86205,7 +86658,10 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 * writes go through the shared-config gateway, the sibling keys of the rule
 * lists (`defaultMode`, `additionalDirectories`, `trustedDirectories`, ...)
 * are kept, and the file is never deleted. The gitignored
-* `.codebuddy/settings.local.json` layer is left to CodeBuddy.
+* `.codebuddy/settings.local.json` layer is left to CodeBuddy. The
+* `codebuddy` override's other settings (`autoReview`, `autoMode`,
+* `memory.parentDiscovery`) go through `buildCodebuddyOverridePatch` /
+* `liftCodebuddyOverride`.
 *
 * @see https://www.codebuddy.ai/docs/cli/permissions
 * @see https://www.codebuddy.ai/docs/cli/settings
@@ -86244,8 +86700,9 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 			relativePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)
 		});
 		const existingPermissions = isRecord(existing[CODEBUDDY_PERMISSIONS_KEY]) ? existing[CODEBUDDY_PERMISSIONS_KEY] : {};
+		const config = rulesyncPermissions.getJson();
 		const lists = buildCodebuddyRuleLists({
-			config: rulesyncPermissions.getJson(),
+			config,
 			existingPermissions,
 			logger
 		});
@@ -86260,7 +86717,16 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
 				existingContent,
-				patch: { [CODEBUDDY_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0 },
+				patch: {
+					[CODEBUDDY_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0,
+					...buildCodebuddyOverridePatch({
+						override: config.codebuddy,
+						existing,
+						global,
+						where: `${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)}${global ? " in the home directory" : ""}`,
+						logger
+					})
+				},
 				filePath
 			}),
 			validate: true,
@@ -86281,7 +86747,14 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 			const existing = rules[parsed.pattern];
 			if (existing === void 0 || PERMISSION_ACTION_PRIORITY[action] > PERMISSION_ACTION_PRIORITY[existing]) rules[parsed.pattern] = action;
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const codebuddy = liftCodebuddyOverride({
+			settings,
+			global: this.global
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...Object.keys(codebuddy).length > 0 && { codebuddy }
+		}, null, 2) });
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		return new CodebuddyPermissions({
@@ -89247,7 +89720,7 @@ const AUTO_APPROVE_KEYS = {
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
-const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+const DEFAULT_PERMISSION_MODE_KEY$1 = "chat.permissions.default";
 /**
 * The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
 * at path `a.b` is written to `chat.agent.sandbox.a.b`.
@@ -89535,7 +90008,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			});
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
-		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY$1] = defaultPermissionMode;
 		const sandbox = config.copilot?.sandbox;
 		if (sandbox !== void 0) {
 			Object.assign(patch, buildSandboxPatch({
@@ -89591,7 +90064,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			for (const [pattern, flag] of Object.entries(autoApprove)) rules[pattern] = flag ? "allow" : "deny";
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
-		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY$1];
 		const sandbox = readSandboxFromSettings(settings);
 		const copilot = {
 			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
@@ -89624,6 +90097,16 @@ const WEBFETCH_CATEGORY$1 = "webfetch";
 /** `~/.copilot/settings.json` and `.github/copilot/settings.json` keys. */
 const ALLOWED_URLS_KEY = "allowedUrls";
 const DENIED_URLS_KEY = "deniedUrls";
+/**
+* `~/.copilot/settings.json` only: the startup permission mode for new
+* interactive sessions, authored through the `copilotcli.defaultPermissionMode`
+* override. It is a user setting — the repository settings file does not list
+* it among its repo-overridable keys.
+*/
+const DEFAULT_PERMISSION_MODE_KEY = "defaultPermissionMode";
+function isCopilotcliDefaultPermissionMode(value) {
+	return COPILOTCLI_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
+}
 function toUrlList(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => typeof entry === "string");
@@ -89665,6 +90148,13 @@ function splitUrlRules(rules) {
 * top-level keys in the user `settings.json`, so only documented keys are ever
 * emitted there either.)
 *
+* The `copilotcli.defaultPermissionMode` override (`manual` | `assisted` |
+* `allow-all`) writes the user-scope `defaultPermissionMode` key in global mode
+* only; in project mode it is skipped with a warning, since the repository
+* settings file does not accept it. It is patched only when authored, so a mode
+* the user picked through `/settings` otherwise survives. Writing `allow-all`
+* warns, because it makes new sessions skip every approval prompt.
+*
 * @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
 * @see https://github.com/github/copilot-cli/blob/main/changelog.md
 */
@@ -89707,7 +90197,8 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const paths = CopilotcliPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const rules = rulesyncPermissions.getJson().permission[WEBFETCH_CATEGORY$1];
+		const config = rulesyncPermissions.getJson();
+		const rules = config.permission[WEBFETCH_CATEGORY$1];
 		const patch = {};
 		if (rules !== void 0) {
 			const { allowedUrls, deniedUrls } = splitUrlRules(rules);
@@ -89715,6 +90206,13 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 			if (global) patch[ALLOWED_URLS_KEY] = allowedUrls.length > 0 ? allowedUrls : void 0;
 			else if (allowedUrls.length > 0) logger?.warn(`Copilot CLI permissions: dropping ${allowedUrls.length} "webfetch" allow rule(s) at project scope — ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${ALLOWED_URLS_KEY}" (repository settings may only add denials). Author allow rules in global scope (\`--global\`) instead.`);
 		}
+		const defaultPermissionMode = config.copilotcli?.defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) {
+			if (global) {
+				patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+				if (defaultPermissionMode === "allow-all") logger?.warn(`Copilot CLI permissions: writing "${DEFAULT_PERMISSION_MODE_KEY}": "allow-all" to ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} — new interactive sessions will start with every tool, path and URL approved without prompting (equivalent to \`--allow-all\`). Deny rules and enterprise policy still apply.`);
+			} else logger?.warn(`Copilot CLI permissions: skipping "copilotcli.${DEFAULT_PERMISSION_MODE_KEY}" at project scope — ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${DEFAULT_PERMISSION_MODE_KEY}" (it is a user setting). Author it in global scope (\`--global\`) instead.`);
+		}
 		return new CopilotcliPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -89736,7 +90234,11 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
 		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
 		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY$1]: rules } : {};
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const defaultPermissionMode = this.global ? settings[DEFAULT_PERMISSION_MODE_KEY] : void 0;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...isCopilotcliDefaultPermissionMode(defaultPermissionMode) && { copilotcli: { defaultPermissionMode } }
+		}, null, 2) });
 	}
 	parseSettings() {
 		const relativePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
@@ -95241,6 +95743,7 @@ var MimocodePermissions = class extends OpencodePermissions {
 // src/features/permissions/omp-permissions.ts
 const CATCH_ALL_PATTERN$5 = "*";
 const APPROVAL_MODE_KEY = "approvalMode";
+const RESTRICTED_FOLDERS_KEY = "restrictedFolders";
 const ACTION_TO_OMP_APPROVAL = {
 	allow: "allow",
 	ask: "prompt",
@@ -95279,9 +95782,9 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *
 * - `tools.approval.<tool>: allow | prompt | deny` is a per-tool policy honored
 *   in every approval mode. A category's catch-all `*` rule maps here
-*   (`ask` → `prompt`). oh-my-pi has no per-path matcher, so a non-bash category
-*   with pattern-specific rules collapses to one action (deny > ask > allow, with
-*   an implicit `ask` when there is no catch-all) and a warning.
+*   (`ask` → `prompt`). `tools.approval` has no per-path matcher, so a non-bash
+*   category with pattern-specific rules collapses to one action (deny > ask >
+*   allow, with an implicit `ask` when there is no catch-all) and a warning.
 * - `bash.patterns: [{ match, approval }]` is an ordered, first-match-wins list
 *   of command globs (only `*` is a wildcard). Every `bash` rule except a
 *   catch-all `allow` is written there, ordered deny → prompt → allow so that
@@ -95298,12 +95801,15 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
 * `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
-* import a recognized value is read back into the override.
+* import a recognized value is read back into the override. Likewise the
+* `omp.restrictedFolders` override writes `tools.restrictedFolders` (folders
+* where every action prompts in every approval mode, `yolo` included), is left
+* alone when absent, and is read back on import.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
 * (the keys rulesync manages), `bash.patterns` and an authored
-* `tools.approvalMode` are rewritten; sibling keys such as `bash.enabled` are
-* kept, and the file is never deleted.
+* `tools.approvalMode` or `tools.restrictedFolders` are rewritten; sibling
+* keys such as `bash.enabled` are kept, and the file is never deleted.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/settings.md
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
@@ -95352,6 +95858,7 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 			logger
 		});
 		const approvalMode = config.omp?.approvalMode;
+		const restrictedFolders = config.omp?.restrictedFolders;
 		const existingTools = isRecord(existing.tools) ? existing.tools : {};
 		const nextApproval = {
 			...isRecord(existingTools.approval) ? Object.fromEntries(Object.entries(existingTools.approval).filter(([tool]) => !MANAGED_OMP_TOOLS.has(tool) && !Object.hasOwn(approval, tool)).map(([tool, value]) => [tool, raisedApproval(value, floor)])) : {},
@@ -95359,6 +95866,7 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 		};
 		const toolsSiblings = withoutKey(existingTools, "approval");
 		if (approvalMode !== void 0) toolsSiblings[APPROVAL_MODE_KEY] = approvalMode;
+		if (restrictedFolders !== void 0) toolsSiblings[RESTRICTED_FOLDERS_KEY] = restrictedFolders;
 		const nextTools = Object.keys(nextApproval).length > 0 ? {
 			...toolsSiblings,
 			approval: nextApproval
@@ -95609,11 +96117,26 @@ function convertOmpToRulesync(config) {
 	}
 	if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
 	const approvalMode = tools[APPROVAL_MODE_KEY];
+	const restrictedFolders = importRestrictedFolders(tools[RESTRICTED_FOLDERS_KEY]);
+	const omp = {
+		...isOmpApprovalMode(approvalMode) && { approvalMode },
+		...restrictedFolders !== void 0 && { restrictedFolders }
+	};
 	return {
 		permission,
-		...isOmpApprovalMode(approvalMode) && { omp: { approvalMode } }
+		...Object.keys(omp).length > 0 && { omp }
 	};
 }
+/**
+* `tools.restrictedFolders` as the override list: its string entries, or
+* `undefined` when it is unset or no entry survives (so a list of non-strings
+* is not imported as `[]` and then rewritten as an empty list).
+*/
+function importRestrictedFolders(value) {
+	if (!Array.isArray(value)) return;
+	const folders = value.filter((entry) => typeof entry === "string");
+	return folders.length === 0 && value.length > 0 ? void 0 : folders;
+}
 function isOmpApprovalMode(value) {
 	return OMP_APPROVAL_MODES.some((mode) => mode === value);
 }
@@ -100710,19 +101233,31 @@ const CANONICAL_TO_VIBE_TOOL_NAMES = {
 };
 /**
 * The tables earlier rulesync versions wrote for canonical categories that
-* Vibe 3.x no longer reads: `[tools.grep]` (Vibe warns that it "has no
-* effect") and `[tools.task]` for the subagent tool v3.0.0 renamed to
-* `agents.*`. A regenerate that configures the category removes them — and
+* Vibe 3.x does not read: `[tools.grep]` (Vibe warns that it "has no
+* effect"), `[tools.task]` for the subagent tool v3.0.0 renamed to
+* `agents.*`, and `[tools.external_directory]` — Vibe has no such tool, and
+* its unused-settings check skips unknown tool names as custom/MCP tools, so
+* that deny was silently inert. A regenerate that configures the category removes them — and
 * the matching `disabled_tools` entry — instead of leaving an inert table.
 * Import still reads them (see {@link VIBE_TO_CANONICAL_TOOL_NAMES}), so a
 * Vibe 2.x config is lifted into the canonical categories rather than lost.
 */
 const VIBE_RETIRED_TOOL_TABLES = {
 	grep: "grep",
-	agent: "task"
+	agent: "task",
+	external_directory: "external_directory"
 };
 /** The canonical category Vibe's `enable_subagents` switch expresses. */
 const VIBE_SUBAGENT_CATEGORY = "agent";
+/** The canonical category Vibe's top-level `outside_workdir` setting expresses. */
+const VIBE_OUTSIDE_WORKDIR_CATEGORY = "external_directory";
+/**
+* The values of Vibe's `outside_workdir` (v3.0.3+). There is no allow value:
+* access outside the working directory is granted per path through a tool's
+* `allowlist` (`vibe-path:...`) or `--add-dir`.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+*/
+const VIBE_OUTSIDE_WORKDIR_VALUES = /* @__PURE__ */ new Set(["ask", "deny"]);
 const VIBE_TO_CANONICAL_TOOL_NAMES = {
 	bash: "bash",
 	read_file: "read",
@@ -100798,7 +101333,8 @@ const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
 	"grep",
 	"glob",
 	"notebookedit",
-	"agent"
+	"agent",
+	"external_directory"
 ]);
 var VibePermissions = class VibePermissions extends ToolPermissions {
 	toml;
@@ -100879,7 +101415,11 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			rules: permission[VIBE_SUBAGENT_CATEGORY],
 			logger
 		});
-		const tableCategories = Object.entries(permission).filter(([category]) => category !== VIBE_SUBAGENT_CATEGORY);
+		const outsideWorkdirPatch = resolveOutsideWorkdirPatch({
+			rules: permission[VIBE_OUTSIDE_WORKDIR_CATEGORY],
+			logger
+		});
+		const tableCategories = Object.entries(permission).filter(([category]) => category !== VIBE_SUBAGENT_CATEGORY && category !== VIBE_OUTSIDE_WORKDIR_CATEGORY);
 		for (const [category, rules] of tableCategories) {
 			const vibeToolNames = resolveNames(category);
 			if (vibeToolNames === void 0) {
@@ -100953,7 +101493,8 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 						enabledTools
 					}),
 					disabled_tools: disabledTools.size > 0 ? [...disabledTools].toSorted() : void 0,
-					...enableSubagentsPatch
+					...enableSubagentsPatch,
+					...outsideWorkdirPatch
 				},
 				filePath
 			}),
@@ -100997,6 +101538,8 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		}
 		for (const category of silencedCategories) ensurePermission(permission, category)["*"] = "deny";
 		if (this.toml.enable_subagents === false) ensurePermission(permission, VIBE_SUBAGENT_CATEGORY)["*"] = "deny";
+		const outsideWorkdir = this.toml.outside_workdir;
+		if (typeof outsideWorkdir === "string" && VIBE_OUTSIDE_WORKDIR_VALUES.has(outsideWorkdir)) ensurePermission(permission, VIBE_OUTSIDE_WORKDIR_CATEGORY)["*"] = outsideWorkdir === "deny" ? "deny" : "ask";
 		warnOnUnresolvableDisabledTools({
 			entries: disabledToolEntries,
 			tools: this.toml.tools
@@ -101073,7 +101616,7 @@ function retireLegacyToolTables({ permission, tools, disabledTools, logger }) {
 		}
 		if (disabledTools.delete(legacyToolName)) removed.push(`disabled_tools entry '${legacyToolName}'`);
 	}
-	if (removed.length > 0) logger?.warn(`Removed ${removed.join(", ")} from the Vibe config: Vibe 3.x no longer reads [tools.grep] or the former 'task' subagent tool, so those entries had no effect.`);
+	if (removed.length > 0) logger?.warn(`Removed ${removed.join(", ")} from the Vibe config: Vibe 3.x does not read [tools.grep], the former 'task' subagent tool or an 'external_directory' tool (the 'external_directory' category is written to outside_workdir instead), so those entries had no effect.`);
 }
 /**
 * Report the rules of a category that has no Vibe tool table. `grep` gets its
@@ -101109,6 +101652,30 @@ function resolveEnableSubagentsPatch({ rules, logger }) {
 	return { enable_subagents: action === "deny" ? false : void 0 };
 }
 /**
+* Translate the canonical `external_directory` category into Vibe's top-level
+* `outside_workdir` setting (v3.0.3+), which decides whether a file or shell
+* tool call reaching outside the working directory prompts (`"ask"`, the
+* default) or is refused with a tool error (`"deny"`). A `*` deny or ask writes
+* that value; a `*` allow has no Vibe value, so it is warned about and the key
+* is removed, leaving Vibe's default prompt. Without a `*` rule the key is left
+* as the file has it. Pattern rules are skipped with a warning: path grants go
+* in a tool's `allowlist` (`vibe-path:...`) instead.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/vibe/app_server/_unified_permissions.py
+*/
+function resolveOutsideWorkdirPatch({ rules, logger }) {
+	if (rules === void 0) return {};
+	const patternCount = Object.keys(rules).filter((pattern) => pattern !== "*").length;
+	if (patternCount > 0) logger?.warn(`Vibe's outside_workdir applies to every path outside the working directory; skipping ${patternCount} pattern rule(s) of the '${VIBE_OUTSIDE_WORKDIR_CATEGORY}' category. Grant a path through a tool's allowlist ("vibe-path:...") in the Vibe config instead.`);
+	const action = rules["*"];
+	if (action === void 0) return {};
+	if (action === "allow") {
+		logger?.warn(`Vibe's outside_workdir only takes "ask" or "deny"; the '${VIBE_OUTSIDE_WORKDIR_CATEGORY}' category's "*": "allow" leaves Vibe's default, which prompts before reaching outside the working directory.`);
+		return { outside_workdir: void 0 };
+	}
+	return { outside_workdir: action };
+}
+/**
 * Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
 * escalate to ASK even when the base permission is ALWAYS). rulesync owns this
 * list for any category the override names: a present list is set, an empty