rulesync 43.1.2 → 43.3.0

package/dist/{import-D2uYjAdc.js → import-BQNLyW5s.js}

@@ -5522,24 +5522,27 @@ const AUGMENTCODE_HOOK_EVENTS = [
 * Hook events supported by Mistral Vibe (mistral-vibe).
 *
 * Vibe exposes three hook events in `.vibe/hooks.toml`: `pre_tool` ←
-* `preToolUse`, `post_tool` ← `postToolUse`, and `post_agent` ← `stop` (fires
-* after every assistant turn that ends without pending tool calls — the closest
-* canonical equivalent to a "turn end"/"stop" event, matching how
-* codexcli/copilot map their stop events). Only the tool events
-* (`pre_tool`/`post_tool`) carry the `match` tool-name matcher (fnmatch glob or
-* `re:` regex) and the `strict` flag; `post_agent` carries neither. Only
-* `type: "command"` hooks are relevant.
+* `preToolUse`, `post_tool` ← `postToolUse`, and `post_agent` ← `stop` /
+* `subagentStop`. `post_agent` fires after every assistant turn that ends
+* without pending tool calls, for the main agent and (since v3.0.2) for every
+* subagent. v3.0.3 lets a `post_agent` hook take a `match` on the agent that
+* finished its turn: the reserved alias `main` selects the main agent, so
+* canonical `stop` becomes `post_agent` with `match = "main"`, and a canonical
+* `subagentStop` with a matcher becomes `post_agent` with that agent name as
+* `match`. Only the tool events (`pre_tool`/`post_tool`) carry the `strict`
+* flag. Only `type: "command"` hooks are relevant.
 *
 * v2.21.0 graduated hooks from experimental and renamed all three types
 * (`before_tool` → `pre_tool`, `after_tool` → `post_tool`, `post_agent_turn` →
 * `post_agent`). `HookType` is a strict enum, so an entry using an old name is
 * rejected outright and reported as a `HookConfigIssue`.
-* @see https://github.com/mistralai/mistral-vibe/blob/main/README.md
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
 */
 const VIBE_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
-	"stop"
+	"stop",
+	"subagentStop"
 ];
 /**
 * Hook events supported by Codewhale.
@@ -7007,9 +7010,10 @@ const JUNIE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_JUNIE_EVENT
 /**
 * Map canonical camelCase event names to Mistral Vibe snake_case.
 *
-* Vibe documents three hook events. The canonical `stop` event maps to Vibe's
-* `post_agent` (fires after every assistant turn ending without pending tool
-* calls) — the closest documented "turn end"/"stop" equivalent.
+* Vibe documents three hook events. The canonical `stop` and `subagentStop`
+* events both map to Vibe's `post_agent` (fires after every assistant turn
+* ending without pending tool calls); the adapter tells them apart with the
+* hook's `match` on the agent name (`main` for the main agent).
 *
 * These are the v2.21.0 names; the pre-2.21.0 spellings (`before_tool`,
 * `after_tool`, `post_agent_turn`) are rejected by Vibe's strict `HookType`
@@ -7019,7 +7023,8 @@ const JUNIE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_JUNIE_EVENT
 const CANONICAL_TO_VIBE_EVENT_NAMES = {
 	preToolUse: "pre_tool",
 	postToolUse: "post_tool",
-	stop: "post_agent"
+	stop: "post_agent",
+	subagentStop: "post_agent"
 };
 /**
 * Map Mistral Vibe snake_case event names to canonical camelCase.
@@ -7032,6 +7037,7 @@ const CANONICAL_TO_VIBE_EVENT_NAMES = {
 */
 const VIBE_TO_CANONICAL_EVENT_NAMES = {
 	...invertEventNames(CANONICAL_TO_VIBE_EVENT_NAMES),
+	post_agent: "stop",
 	before_tool: "preToolUse",
 	after_tool: "postToolUse",
 	post_agent_turn: "stop"
@@ -8382,6 +8388,32 @@ const CopilotPermissionsOverrideSchema = z.looseObject({
 	sandbox: z.optional(CopilotSandboxSchema)
 });
 /**
+* The permission mode the GitHub Copilot CLI starts new interactive sessions
+* in (`defaultPermissionMode` of `~/.copilot/settings.json`): `manual` prompts
+* for every request not already allowed, `assisted` lets a model review
+* eligible requests (Assisted Permissions, non-experimental since v1.0.104),
+* and `allow-all` is equivalent to `--allow-all`. These are the CLI's own
+* values and differ from the VS Code `copilot` target's
+* {@link COPILOT_DEFAULT_PERMISSION_MODES}.
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+*/
+const COPILOTCLI_DEFAULT_PERMISSION_MODES = [
+	"manual",
+	"assisted",
+	"allow-all"
+];
+/**
+* Tool-scoped override block for the GitHub Copilot CLI.
+* `defaultPermissionMode` writes the user-scope `defaultPermissionMode` key of
+* `~/.copilot/settings.json`; it has no canonical category, and the repository
+* settings file does not accept it.
+*/
+const CopilotcliPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	defaultPermissionMode: z.optional(z.enum(COPILOTCLI_DEFAULT_PERMISSION_MODES))
+});
+/**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
 * before prompting. `always-ask` auto-approves only read-only tools,
 * `always-ask-cached` (Ask and remember) also prompts before file reads and
@@ -8398,11 +8430,14 @@ const OMP_APPROVAL_MODES = [
 ];
 /**
 * Tool-scoped override block for oh-my-pi (`omp`). `approvalMode` writes the
-* `tools.approvalMode` key of `config.yml`, which has no canonical category.
+* `tools.approvalMode` key of `config.yml`, and `restrictedFolders` the
+* `tools.restrictedFolders` list (folders where every action prompts in every
+* approval mode, `yolo` included); neither has a canonical category.
 */
 const OmpPermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
-	approvalMode: z.optional(z.enum(OMP_APPROVAL_MODES))
+	approvalMode: z.optional(z.enum(OMP_APPROVAL_MODES)),
+	restrictedFolders: z.optional(z.array(z.string()))
 });
 const KimiCodePermissionsOverrideSchema = z.looseObject({
 	permission: z.optional(ToolScopedPermissionSchema),
@@ -8854,6 +8889,48 @@ const QoderPermissionsOverrideSchema = z.looseObject({
 	agentsMdExcludes: z.optional(z.array(z.string()))
 });
 /**
+* Tool-scoped override block for CodeBuddy Code. The shared `permission` block
+* continues to drive `permissions.allow`/`ask`/`deny` of
+* `.codebuddy/settings.json` (project) / `~/.codebuddy/settings.json` (global).
+*
+* The other documented settings with no canonical category are authored here
+* and merged into the same file, key by key, over what the file already
+* holds:
+*
+* - `autoReview` (`policy` replaces the built-in security policy of the `auto`
+*   permission mode, `extraPolicy` is appended to it) and the legacy
+*   `autoMode` rules (`environment` / `allow` / `soft_deny` / `hard_deny`).
+*   CodeBuddy reads both from the user and project-local settings only, never
+*   from the shared project file, so they are written by `--global` generate
+*   alone.
+* - `memory.parentDiscovery`: whether project instruction files
+*   (`CODEBUDDY.md` / `AGENTS.md`) are also discovered in parent directories.
+*
+* Only the keys listed here are written; any other key of these groups is
+* skipped with a warning. Removing a key from the override leaves the
+* previously written value in place.
+*
+* @see https://www.codebuddy.ai/docs/cli/settings
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @example
+* { "autoReview": { "extraPolicy": "Allow dev namespace releases" },
+*   "memory": { "parentDiscovery": false } }
+*/
+const CodebuddyPermissionsOverrideSchema = z.looseObject({
+	permission: z.optional(ToolScopedPermissionSchema),
+	autoReview: z.optional(z.looseObject({
+		policy: z.optional(z.string()),
+		extraPolicy: z.optional(z.string())
+	})),
+	autoMode: z.optional(z.looseObject({
+		environment: z.optional(z.array(z.string())),
+		allow: z.optional(z.array(z.string())),
+		soft_deny: z.optional(z.array(z.string())),
+		hard_deny: z.optional(z.array(z.string()))
+	})),
+	memory: z.optional(z.looseObject({ parentDiscovery: z.optional(z.boolean()) }))
+});
+/**
 * One native Factory Droid permission rule. `match.prefix` positions are either
 * a single token or a non-empty list of alternative tokens.
 *
@@ -9736,13 +9813,13 @@ const PermissionsConfigSchema = z.looseObject({
 	zed: z.optional(ZedPermissionsOverrideSchema),
 	devin: z.optional(DevinPermissionsOverrideSchema),
 	qoder: z.optional(QoderPermissionsOverrideSchema),
+	copilotcli: z.optional(CopilotcliPermissionsOverrideSchema),
 	"antigravity-ide": z.optional(CanonicalPermissionsOverrideSchema),
 	continue: z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: z.optional(CopilotPermissionsOverrideSchema),
-	codebuddy: z.optional(CanonicalPermissionsOverrideSchema),
+	codebuddy: z.optional(CodebuddyPermissionsOverrideSchema),
 	commandcode: z.optional(CanonicalPermissionsOverrideSchema),
 	lettacode: z.optional(CanonicalPermissionsOverrideSchema),
-	copilotcli: z.optional(CanonicalPermissionsOverrideSchema),
 	crush: z.optional(CanonicalPermissionsOverrideSchema),
 	goose: z.optional(CanonicalPermissionsOverrideSchema),
 	omp: z.optional(OmpPermissionsOverrideSchema),
@@ -10229,6 +10306,10 @@ const RulesyncRuleFrontmatterSchema = z.object({
 		enabled: z.optional(z.boolean()),
 		description: z.optional(z.string())
 	})),
+	cline: z.optional(z.looseObject({
+		disabled: z.optional(z.boolean()),
+		enabled: z.optional(z.boolean())
+	})),
 	continue: z.optional(z.looseObject({
 		alwaysApply: z.optional(z.boolean()),
 		description: z.optional(z.string()),
@@ -11565,7 +11646,8 @@ const RulesyncSkillFrontmatterSchema = z.looseObject({
 		license: z.optional(z.string()),
 		compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
 		metadata: z.optional(z.looseObject({})),
-		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+		"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
+		"disable-model-invocation": z.optional(z.boolean())
 	})),
 	hermesagent: z.optional(z.looseObject({})),
 	vibe: z.optional(z.looseObject({
@@ -13708,7 +13790,11 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["allowedUrls", "deniedUrls"]
+				ownedKeys: [
+					"allowedUrls",
+					"deniedUrls",
+					"defaultPermissionMode"
+				]
 			}
 		}
 	},
@@ -13887,7 +13973,12 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions"]
+				ownedKeys: [
+					"permissions",
+					"autoReview",
+					"autoMode",
+					"memory"
+				]
 			}
 		}
 	},
@@ -14197,7 +14288,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 					"tools",
 					"enabled_tools",
 					"disabled_tools",
-					"enable_subagents"
+					"enable_subagents",
+					"outside_workdir"
 				]
 			}
 		}
@@ -19509,7 +19601,8 @@ const AgentsSkillsSkillFrontmatterSchema = z.looseObject({
 	license: z.optional(z.string()),
 	compatibility: z.optional(z.union([z.string(), z.looseObject({})])),
 	metadata: z.optional(z.looseObject({})),
-	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())]))
+	"allowed-tools": z.optional(z.union([z.string(), z.array(z.string())])),
+	"disable-model-invocation": z.optional(z.boolean())
 });
 const COMPATIBILITY_MAX_LENGTH = 500;
 const AGENT_SKILLS_SPEC = "the Agent Skills spec";
@@ -19650,6 +19743,38 @@ function toSpecConformantAgentSkillFields(section, { coerceMetadata = true } = {
 		...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
 	};
 }
+/**
+* The opt-in `disable-model-invocation` flag of the `agentsskills` block.
+*
+* The key is not part of the Agent Skills specification, so `skills-ref
+* validate` rejects a `SKILL.md` that carries it, but several clients reading
+* `.agents/skills/` (e.g. pi) honor it. To keep the default output
+* spec-conformant, only an explicit `agentsskills.disable-model-invocation`
+* value is written; the root-level rulesync flag is deliberately not inherited.
+*
+* Kept apart from {@link toSpecConformantAgentSkillFields} because that helper
+* is shared with writers of other tools' own locations, which have their own
+* sections for tool-specific keys. Only writers of the shared `.agents/skills/`
+* root (see {@link isSharedAgentSkillsRoot}) — the native target, GitLab Duo's
+* project scope and the simulated `agentsmd` — spread this, so they all emit
+* the same frontmatter for that file.
+*/
+function toAgentsSkillsInvocationField(section) {
+	const value = section?.["disable-model-invocation"];
+	return value === void 0 ? {} : { "disable-model-invocation": value };
+}
+/**
+* Whether a skill directory lives in the cross-client `.agents/skills/` root
+* (project, or `~/.agents/skills/` in global scope). The
+* `agentsskills.disable-model-invocation` opt-in exists for the clients that
+* read that root, so it is written and imported only there — not by the
+* subclasses that reuse this class for a tool's own location (Trae, Qoder, Xum,
+* …), where the key would otherwise leak into the `agentsskills` section on
+* import and from there into every `.agents/skills/` output.
+*/
+function isSharedAgentSkillsRoot(relativeDirPath) {
+	return toPosixPath(relativeDirPath) === toPosixPath(AGENTSMD_SKILLS_DIR_PATH);
+}
 /** The `SKILL.md` a diagnostic should point at, in the scope it is written to. */
 function agentSkillFilePath({ outputRoot, relativeDirPath, dirName }) {
 	return join(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
@@ -19731,7 +19856,8 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 			...frontmatter.license !== void 0 && { license: frontmatter.license },
 			...frontmatter.compatibility !== void 0 && { compatibility: frontmatter.compatibility },
 			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata },
-			...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
+			...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools },
+			...isSharedAgentSkillsRoot(this.getRelativeDirPath()) && frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -19757,7 +19883,8 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 		const agentsSkillsFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter))
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter)),
+			...isSharedAgentSkillsRoot(settablePaths.relativeDirPath) && toAgentsSkillsInvocationField(rulesyncFrontmatter.agentsskills)
 		};
 		AgentsSkillsSkill.reportSpecViolations({
 			outputRoot,
@@ -24831,7 +24958,8 @@ var AgentsmdSkill = class AgentsmdSkill extends SimulatedSkill {
 		const relativeDirPath = this.getSettablePaths().relativeDirPath;
 		const frontmatter = {
 			...defaults.frontmatter,
-			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(params.rulesyncSkill.getFrontmatter()))
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(params.rulesyncSkill.getFrontmatter())),
+			...toAgentsSkillsInvocationField(params.rulesyncSkill.getFrontmatter().agentsskills)
 		};
 		AgentsSkillsSkill.reportSpecViolations({
 			outputRoot: params.outputRoot ?? process.cwd(),
@@ -30550,7 +30678,10 @@ var QwencodeSkill = class QwencodeSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: QWENCODE_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: QWENCODE_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return QwencodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -39571,6 +39702,16 @@ var VibePluginSubagent = class VibePluginSubagent extends ToolSubagent {
 */
 const VIBE_PROMPTS_DIR_PATH = join(".vibe", "prompts");
 /**
+* The agent name Vibe reserves for `post_agent` hook matching (v3.0.3+).
+* `AgentProfile.from_toml` refuses a file whose stem matches it case-insensitively, so an
+* agent written as `main.toml` would never load.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/vibe/core/agents/models.py
+*/
+const VIBE_RESERVED_AGENT_NAME = "main";
+function isReservedVibeAgentFileName(relativeFilePath) {
+	return basename(relativeFilePath).replace(/\.(md|toml)$/, "").toLowerCase() === VIBE_RESERVED_AGENT_NAME;
+}
+/**
 * Vibe resolves a `system_prompt_id` by file name, and
 * `VibeConfigSchema._check_system_prompt` evaluates it during validation — an
 * unresolvable id raises and the agent is dropped at discovery. The id must
@@ -39685,9 +39826,17 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	* evaluates the property during validation, so an unresolvable
 	* `system_prompt_id` raises and `AgentRegistry._try_load` drops the agent
 	* with a warning.
+	*
+	* A subagent named `main` is skipped with a warning: Vibe reserves that name
+	* for hook matching and does not load an agent file called `main.toml`.
 	*/
-	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false }) {
+	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false, logger }) {
 		return rulesyncSubagents.flatMap((rulesyncSubagent) => {
+			const sourcePath = rulesyncSubagent.getRelativeFilePath();
+			if (isReservedVibeAgentFileName(sourcePath)) {
+				logger?.warn(`Skipping Vibe subagent ${sourcePath}: Vibe reserves the agent name '${VIBE_RESERVED_AGENT_NAME}' for hook matching and does not load an agent file named '${VIBE_RESERVED_AGENT_NAME}'. Rename the subagent file.`);
+				return [];
+			}
 			const agentFile = VibeSubagent.fromRulesyncSubagent({
 				outputRoot,
 				relativeDirPath: VibeSubagent.getSettablePaths({ global }).relativeDirPath,
@@ -44974,17 +45123,49 @@ var ClaudecodeRule = class ClaudecodeRule extends ToolRule {
 * - `alwaysApply: true`: force the rule to always load (equivalent to a file
 *   with no frontmatter at all).
 * - `description`: label surfaced in the rule toggle UI.
+* - `disabled: true` (or `enabled: false`): the rule is switched off. Since
+*   Cline v4.1.26 (cline/cline#14605) the rule toggle writes this flag into the
+*   rule file itself instead of keeping it only in extension state.
 *
 * Rules without frontmatter are always active. Uses `z.looseObject()` so
-* forward-compatible fields added upstream are preserved on round-trip.
+* forward-compatible fields added upstream are preserved on round-trip: every
+* key other than `paths` / `alwaysApply` / `description` is carried in the
+* rulesync `cline:` section.
 *
 * @see https://docs.cline.bot/customization/cline-rules
+* @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/extensions/config/user-instruction-config-loader.ts
 */
 const ClineRuleFrontmatterSchema = z.looseObject({
 	paths: z.optional(z.union([z.array(z.string()), z.string()])),
 	alwaysApply: z.optional(z.boolean()),
 	description: z.optional(z.string())
 });
+const CLINE_RULE_FIELD_TYPES = {
+	disabled: "boolean",
+	enabled: "boolean"
+};
+const CANONICAL_CLINE_RULE_KEYS = [
+	"paths",
+	"alwaysApply",
+	"description"
+];
+/** Returns a copy of `record` without the canonical `paths` / `alwaysApply` / `description` keys. */
+function omitCanonicalClineRuleKeys(record) {
+	return Object.fromEntries(Object.entries(record ?? {}).filter(([key]) => !CANONICAL_CLINE_RULE_KEYS.includes(key)));
+}
+/**
+* Splits a Cline rule frontmatter into the keys that have canonical rulesync
+* homes (`paths` / `alwaysApply` / `description`) and the rest, which are
+* lifted into the rulesync `cline:` section.
+*/
+function extractClineSection({ frontmatter, relativeFilePath }) {
+	return Object.fromEntries(Object.entries(omitCanonicalClineRuleKeys(frontmatter)).filter(([key, value]) => {
+		const expected = Object.hasOwn(CLINE_RULE_FIELD_TYPES, key) ? CLINE_RULE_FIELD_TYPES[key] : void 0;
+		if (expected === void 0 || value === void 0 || typeof value === expected) return true;
+		warnWithFallback(void 0, `Cline rules: dropping ${key} from ${relativeFilePath}: Cline rejects the whole rule unless it is a ${expected}.`);
+		return false;
+	}));
+}
 function isNonRootParams$1(params) {
 	return "frontmatter" in params && "body" in params;
 }
@@ -45059,6 +45240,10 @@ var ClineRule = class ClineRule extends ToolRule {
 	toRulesyncRule() {
 		if (this.isRoot()) return this.toRulesyncRuleDefault();
 		const globs = this.frontmatter?.alwaysApply === true ? ["**/*"] : normalizePaths$1(this.frontmatter?.paths);
+		const cline = extractClineSection({
+			frontmatter: this.frontmatter,
+			relativeFilePath: this.getRelativeFilePath()
+		});
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
@@ -45067,7 +45252,8 @@ var ClineRule = class ClineRule extends ToolRule {
 				root: false,
 				targets: ["*"],
 				description: this.frontmatter?.description,
-				globs
+				globs,
+				...Object.keys(cline).length > 0 && { cline }
 			},
 			body: this.body ?? this.getFileContent()
 		});
@@ -45112,16 +45298,22 @@ var ClineRule = class ClineRule extends ToolRule {
 	* universal match-everything globs mean "always", so they map to
 	* `alwaysApply: true` instead of a `paths` list; specific globs become
 	* conditional `paths`; an empty globs list leaves the rule always-active with
-	* no `paths`/`alwaysApply`.
+	* no `paths`/`alwaysApply`. Every key of the rulesync `cline:` section
+	* (e.g. `disabled: true`) is written into the frontmatter too; the canonical
+	* `paths` / `alwaysApply` / `description` win over same-named keys there.
 	*/
 	static buildNonRootRule({ outputRoot, rulesyncRule, validate, relativeDirPath }) {
 		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
 		const globs = normalizePaths$1(rulesyncFrontmatter.globs);
 		const isUniversal = globs.length > 0 && globs.every((glob) => glob === "**/*" || glob === "*");
+		const rawClineSection = rulesyncFrontmatter.cline ?? {};
+		for (const key of CANONICAL_CLINE_RULE_KEYS) if (Object.hasOwn(rawClineSection, key)) warnWithFallback(void 0, `Cline rules: ignoring cline.${key} in ${rulesyncRule.getRelativeFilePath()}: set the canonical ${key === "description" ? "description" : "globs"} instead.`);
+		const clineSection = omitCanonicalClineRuleKeys(rawClineSection);
 		const frontmatter = {
 			paths: globs.length > 0 && !isUniversal ? globs : void 0,
 			alwaysApply: isUniversal ? true : void 0,
-			description: rulesyncFrontmatter.description || void 0
+			description: rulesyncFrontmatter.description || void 0,
+			...clineSection
 		};
 		return new ClineRule({
 			outputRoot,
@@ -55808,6 +56000,14 @@ function applyCommandPrefix({ def, converterConfig }) {
 	if (isExecForm) return `${bracePlaceholder(converterConfig.projectDirVar)}/${stripSurroundingQuotes(relativeCommand)}`;
 	return anchorInline(`"${converterConfig.projectDirVar}"/${relativeCommand}`);
 }
+/** Whether a field restricted to some events applies on this one. */
+function isEventApplicable({ events, eventName }) {
+	return events === void 0 || events.has(eventName);
+}
+/** Quote and comma-join a set of names (events, hook types) for a warning. */
+function describeEvents(names) {
+	return [...names].map((name) => `"${name}"`).join(", ");
+}
 /**
 * Whether a field registered for `command` hooks only applies to this hook.
 * Applied on both export and import: a value imported into a canonical field
@@ -55829,7 +56029,7 @@ function isFieldApplicable({ commandOnly, hookType }) {
 * silence — the mirror of the import side.
 */
 function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn }) {
-	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag } of fields) {
+	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag, events } of fields) {
 		const value = def[canonical];
 		if (value === void 0) continue;
 		if (!isFieldApplicable({
@@ -55839,6 +56039,13 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not generated.`);
 			continue;
 		}
+		if (events !== void 0 && !isEventApplicable({
+			events,
+			eventName
+		})) {
+			if (value !== false) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${describeEvents(events)} only, so it is not generated.`);
+			continue;
+		}
 		if (!isValid({
 			value,
 			canonical
@@ -55852,9 +56059,12 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long${collapseWhitespaceForLength ? " after collapsing whitespace" : ""}; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
 		}
 	}
-	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
+	return Object.fromEntries(fields.filter(({ canonical, commandOnly, events }) => isFieldApplicable({
 		commandOnly,
 		hookType
+	}) && isEventApplicable({
+		events,
+		eventName
 	}) && isValid({
 		value: def[canonical],
 		canonical
@@ -55867,16 +56077,24 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 * kind has a rule an authored file can plausibly violate — turns a rejected
 * value into a warning instead of a silent drop.
 */
-function importPassthroughFields({ h, hookType, fields, isValid, describeInvalid, warn }) {
-	const applicable = fields.filter(({ commandOnly }) => isFieldApplicable({
+function importPassthroughFields({ h, hookType, eventName, fields, isValid, describeInvalid, warn }) {
+	const typeApplicable = fields.filter(({ commandOnly }) => isFieldApplicable({
 		commandOnly,
 		hookType
 	}));
+	const applicable = typeApplicable.filter(({ events }) => isEventApplicable({
+		events,
+		eventName
+	}));
 	const skipped = fields.filter(({ commandOnly }) => !isFieldApplicable({
 		commandOnly,
 		hookType
 	}));
 	for (const { tool } of skipped) if (h[tool] !== void 0) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook: this tool documents it on "command" hooks only, so it is not imported.`);
+	for (const { tool, events } of typeApplicable) if (events !== void 0 && !isEventApplicable({
+		events,
+		eventName
+	}) && h[tool] !== void 0 && h[tool] !== false) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook on "${eventName}": this tool honours it on ${describeEvents(events)} only, so it is not imported.`);
 	for (const { tool, canonical } of applicable) if (describeInvalid !== void 0 && h[tool] !== void 0 && !isValid({
 		value: h[tool],
 		canonical
@@ -56044,11 +56262,11 @@ function isKeywordFieldApplicable({ spec, hookType, eventName, flags, direction,
 		return false;
 	}
 	if (hookTypes !== void 0 && !hookTypes.has(hookType)) {
-		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${[...hookTypes].map((type) => `"${type}"`).join(", ")} hooks only, so it is not ${direction}.`);
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${describeEvents(hookTypes)} hooks only, so it is not ${direction}.`);
 		return false;
 	}
 	if (events !== void 0 && !events.has(eventName)) {
-		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${describeEvents(events)} only, so it is not ${direction}.`);
 		return false;
 	}
 	if (ignoredEvents?.has(eventName)) {
@@ -56494,6 +56712,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.booleanPassthroughFields ?? [],
 			isValid: isBooleanValue,
 			warn
@@ -56508,6 +56727,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.numberPassthroughFields ?? [],
 			isValid: isImportableNumber,
 			describeInvalid: describeInvalidScalar,
@@ -56516,6 +56736,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.stringPassthroughFields ?? [],
 			isValid: isImportableString,
 			describeInvalid: describeInvalidScalar,
@@ -56524,6 +56745,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.arrayPassthroughFields ?? [],
 			isValid: isImportableArray,
 			describeInvalid: describeInvalidArray,
@@ -56532,6 +56754,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.recordPassthroughFields ?? [],
 			isValid: isEmittableRecord,
 			describeInvalid: describeInvalidRecord,
@@ -56540,6 +56763,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.objectPassthroughFields ?? [],
 			isValid: isImportableObject,
 			describeInvalid: describeInvalidObject,
@@ -61372,6 +61596,11 @@ const GROKCLI_CONVERTER_CONFIG = {
 		tool: "env",
 		commandOnly: true
 	}],
+	booleanPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "failClosed",
+		events: /* @__PURE__ */ new Set(["preToolUse", "beforeSubmitPrompt"])
+	}],
 	arrayPassthroughFields: [{
 		canonical: "args",
 		tool: "args",
@@ -63021,6 +63250,15 @@ const LETTACODE_CONVERTER_CONFIG = {
 	timeoutUnit: "milliseconds"
 };
 /**
+* Letta Code documents settings-file hooks as deprecated in favor of Mods
+* (https://docs.letta.com/reference/deprecated/hooks) but still ships the
+* loader, so rulesync keeps emitting them and tells the user once per run.
+* Mods are not modeled: they are JS/TS code modules loaded only from
+* `~/.letta/mods/` or an agent's memory directory, with no declarative or
+* project-local form a canonical hook could be translated into.
+*/
+const LETTACODE_HOOKS_DEPRECATION_WARNING = "Letta Code documents settings.json hooks as deprecated in favor of Mods and may remove them in a future release; rulesync still writes them while Letta Code loads them. See https://docs.letta.com/reference/deprecated/hooks";
+/**
 * Letta Code keeps a boolean `disabled` switch beside the event arrays inside
 * `hooks`. rulesync owns the whole `hooks` key, so the switch is read back from
 * the existing file and carried into the generated one instead of being lost.
@@ -63079,6 +63317,11 @@ function parseLettacodeSettings$1(fileContent, filePath) {
 * and UI preferences, ...), so generation merges the `hooks` key into the
 * existing file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
 *
+* Letta Code marks this surface deprecated in favor of Mods (see
+* `LETTACODE_HOOKS_DEPRECATION_WARNING`); generation warns once per run when it
+* writes any hook.
+*
+* @see https://docs.letta.com/reference/deprecated/hooks
 * @see https://github.com/letta-ai/letta-code/blob/main/src/hooks/types.ts
 * @see https://github.com/letta-ai/letta-code/blob/main/src/hooks/loader.ts
 */
@@ -63123,6 +63366,7 @@ var LettacodeHooks = class LettacodeHooks extends ToolHooks {
 			converterConfig: LETTACODE_CONVERTER_CONFIG,
 			logger
 		});
+		if (Object.keys(hooks).length > 0) warnOnceWithFallback(logger, LETTACODE_HOOKS_DEPRECATION_WARNING);
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
@@ -65120,11 +65364,38 @@ const VIBE_DIR = ".vibe";
 const VIBE_HOOKS_FILE_NAME = "hooks.toml";
 /**
 * Vibe scopes the tool-name `match` glob and the `strict` flag to tool hooks
-* (`pre_tool` / `post_tool`) only; `post_agent` fires after every
-* assistant turn and carries no matcher.
-* @see https://github.com/mistralai/mistral-vibe/blob/main/README.md
+* (`pre_tool` / `post_tool`). `post_agent` takes a `match` too since v3.0.3,
+* but on the name of the agent that finished its turn, not a tool name (see
+* {@link VIBE_MAIN_AGENT_MATCH}).
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
 */
 const VIBE_TOOL_EVENTS = /* @__PURE__ */ new Set(["pre_tool", "post_tool"]);
+/** The Vibe event both canonical `stop` and `subagentStop` become. */
+const VIBE_POST_AGENT_EVENT = "post_agent";
+/**
+* The reserved agent alias a `post_agent` hook's `match` uses to run only
+* after the main agent. Without a `match`, `post_agent` runs after every
+* agent, subagents included (v3.0.2+), whereas canonical `stop` is
+* main-agent-only — so `stop` is written with this match.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+*/
+const VIBE_MAIN_AGENT_MATCH = "main";
+/**
+* The `post_agent` `match` for a canonical `subagentStop` hook, or null to
+* skip it. Vibe has no selector for "every subagent but not the main agent",
+* so a matcher naming the subagent is required.
+*/
+function toVibeSubagentMatch({ matcher, logger }) {
+	if (typeof matcher !== "string" || matcher === "" || matcher === "*") {
+		logger?.warn("Vibe hooks: skipping a \"subagentStop\" hook without an agent-name matcher. Vibe's post_agent cannot select every subagent without also running after the main agent; set \"matcher\" to the subagent name.");
+		return null;
+	}
+	if (matcher.toLowerCase() === VIBE_MAIN_AGENT_MATCH) {
+		logger?.warn("Vibe hooks: skipping a \"subagentStop\" hook whose matcher is \"main\". Vibe reserves \"main\" for the main agent; use a \"stop\" hook instead.");
+		return null;
+	}
+	return matcher;
+}
 const SUPPORTED_VIBE_EVENTS = new Set(VIBE_HOOK_EVENTS);
 /**
 * The `match` a canonical `Bash` matcher becomes. Vibe tests `match` against a
@@ -65148,7 +65419,8 @@ function fromVibeHookMatch(match) {
 /**
 * Build the flat `[[hooks]]` array for `.vibe/hooks.toml` from a canonical
 * hooks config. Vibe uses a flat array where each entry carries its own event
-* `type`, tool-name `match` glob/regex, and `command`. Only `type: "command"`
+* `type`, `match` glob/regex (a tool name for tool hooks, an agent name
+* for `post_agent`), and `command`. Only `type: "command"`
 * canonical hooks are emitted: a Vibe hook is a shell command line. (v2.25.1
 * to v2.25.4 briefly exec'd it without a shell under the unified harness and
 * skipped any command containing a backslash; v2.25.5 restored shell
@@ -65156,7 +65428,7 @@ function fromVibeHookMatch(match) {
 * now run through the shell" — and dropped the backslash skip.)
 * @see https://github.com/mistralai/mistral-vibe/blob/v3.0.2/README.md
 */
-function canonicalToVibeHooks({ config, toolOverride }) {
+function canonicalToVibeHooks({ config, toolOverride, logger }) {
 	const shared = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_VIBE_EVENTS.has(event)) shared[event] = defs;
 	const effective = {
@@ -65164,30 +65436,40 @@ function canonicalToVibeHooks({ config, toolOverride }) {
 		...toolOverride
 	};
 	const hooks = [];
+	const nextIndexByVibeEvent = /* @__PURE__ */ new Map();
 	for (const [event, defs] of Object.entries(effective)) {
 		if (!SUPPORTED_VIBE_EVENTS.has(event)) continue;
 		const vibeEvent = lookupOwn({
 			record: CANONICAL_TO_VIBE_EVENT_NAMES,
 			key: event
 		}) ?? event;
-		let index = 0;
 		for (const def of defs) {
 			if ((def.type ?? "command") !== "command") continue;
 			if (typeof def.command !== "string") continue;
-			const name = typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`;
 			const isToolEvent = VIBE_TOOL_EVENTS.has(vibeEvent);
+			let match;
+			if (isToolEvent) match = toVibeHookMatch(def.matcher);
+			else if (event === "subagentStop") {
+				const subagentMatch = toVibeSubagentMatch({
+					matcher: def.matcher,
+					logger
+				});
+				if (subagentMatch === null) continue;
+				match = subagentMatch;
+			} else match = VIBE_MAIN_AGENT_MATCH;
+			const index = nextIndexByVibeEvent.get(vibeEvent) ?? 0;
 			const entry = {
-				name,
+				name: typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`,
 				type: vibeEvent,
+				match,
 				command: def.command
 			};
-			if (isToolEvent) entry.match = toVibeHookMatch(def.matcher);
 			if (typeof def.timeout === "number") entry.timeout = def.timeout;
 			const strict = def.strict;
 			if (isToolEvent && typeof strict === "boolean") entry.strict = strict;
 			if (typeof def.description === "string") entry.description = def.description;
 			hooks.push(entry);
-			index += 1;
+			nextIndexByVibeEvent.set(vibeEvent, index + 1);
 		}
 	}
 	return { hooks };
@@ -65199,14 +65481,22 @@ function vibeEntryToCanonicalDef(raw) {
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
 	if (isPrototypePollutionKey(vibeEvent)) return null;
-	const canonicalEvent = lookupOwn({
+	let canonicalEvent = lookupOwn({
 		record: VIBE_TO_CANONICAL_EVENT_NAMES,
 		key: vibeEvent
 	}) ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
-	const matcher = fromVibeHookMatch(entry.match);
-	if (matcher !== void 0) def.matcher = matcher;
+	if (vibeEvent === VIBE_POST_AGENT_EVENT) {
+		const agentMatch = typeof entry.match === "string" ? entry.match : "";
+		if (agentMatch !== "" && agentMatch !== "*" && agentMatch.toLowerCase() !== VIBE_MAIN_AGENT_MATCH) {
+			canonicalEvent = "subagentStop";
+			def.matcher = agentMatch;
+		}
+	} else {
+		const matcher = fromVibeHookMatch(entry.match);
+		if (matcher !== void 0) def.matcher = matcher;
+	}
 	if (typeof entry.timeout === "number") def.timeout = entry.timeout;
 	if (typeof entry.name === "string") def.name = entry.name;
 	if (typeof entry.description === "string") def.description = entry.description;
@@ -65237,6 +65527,26 @@ function vibeHooksToCanonical(parsed) {
 	}
 	return canonical;
 }
+/** Vibe reads a `match` with a `re:` prefix or glob metacharacters as a pattern. */
+const VIBE_PATTERN_MATCH = /^re:|[*?[]/;
+/**
+* Move the imported `subagentStop` hooks into the `vibe` override when any of
+* them matches agents by a regex or glob rather than by a literal name. Such a
+* pattern can also select the main agent (a main session answers to its mode
+* name, e.g. `accept-edits`), and other tools would read it as their own
+* matcher syntax, so it is kept Vibe-only. The override replaces the shared
+* list for its event, so the whole list moves to keep every entry on Vibe.
+*/
+function takeVibeOnlySubagentStop({ hooks, logger }) {
+	const defs = lookupOwn({
+		record: hooks,
+		key: "subagentStop"
+	});
+	if (defs === void 0 || !defs.some((def) => typeof def.matcher === "string" && VIBE_PATTERN_MATCH.test(def.matcher))) return;
+	delete hooks.subagentStop;
+	logger?.warn("Vibe hooks: a post_agent hook matches agents by a pattern, so its subagentStop hooks are imported into the vibe override instead of the shared hooks.");
+	return defs;
+}
 function parseVibeToml(fileContent) {
 	const parsed = smolToml.parse(fileContent || smolToml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -65276,12 +65586,13 @@ var VibeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
 		const vibeHooks = canonicalToVibeHooks({
 			config,
-			toolOverride: config.vibe?.hooks
+			toolOverride: config.vibe?.hooks,
+			logger
 		});
 		const fileContent = smolToml.stringify(vibeHooks);
 		return new this({
@@ -65292,15 +65603,30 @@ var VibeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks(options = {}) {
 		const hooks = vibeHooksToCanonical(this.parseFileContentOrThrow({
 			displayName: "Vibe",
 			parse: (fileContent) => parseVibeToml(fileContent)
 		}));
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+		const vibeOnlySubagentStop = takeVibeOnlySubagentStop({
+			hooks,
+			logger: options.logger
+		});
+		const config = buildImportedHooksConfig({
 			hooks,
 			overrideKey: "vibe"
-		}), null, 2) });
+		});
+		if (vibeOnlySubagentStop !== void 0) {
+			const override = config.vibe ?? {};
+			config.vibe = {
+				...override,
+				hooks: {
+					...override.hooks,
+					subagentStop: vibeOnlySubagentStop
+				}
+			};
+		}
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
 		try {
@@ -76917,6 +77243,12 @@ const REASONIX_PLUGIN_FIELDS = [
 	"load",
 	"oauth_allow_missing_pkce_metadata"
 ];
+/**
+* The `load` mode that puts a server's tools in the provider schema. Reasonix
+* compares it case-insensitively after trimming (`normalizeMCPLoad`).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.53.0/internal/contract/config/mcp_load.go
+*/
+const REASONIX_MCP_LOAD_ALWAYS = "always";
 /** The `[[plugins]]` key that canonical `disabledTools` is written to and read from. */
 const REASONIX_DISABLED_TOOLS_KEY = "disabled_tools";
 var ReasonixMcp = class ReasonixMcp extends ToolMcp {
@@ -77081,7 +77413,9 @@ function hasExpectedType(value, expected) {
 * `concurrency` string decodes fine but is ignored in favor of the server-name
 * default, so it is dropped too rather than written as a setting that does
 * nothing. An unknown `load` string is read as `deferred`, the default, so it
-* passes through as authored.
+* passes through as authored. A project `load = "always"` also passes through,
+* but is warned about in `writePassthroughFields`: see the v2.53.0 note on
+* `REASONIX_PLUGIN_FIELDS`.
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/v2.31.0/internal/contract/config/plugin_entry.go
 */
 function invalidPassthroughFieldReason(field, value) {
@@ -77121,6 +77455,7 @@ function writePassthroughFields({ name, server, plugin, global, logger }) {
 			continue;
 		}
 		if (field === "oauth_allow_missing_pkce_metadata" && value === true) logger?.warn(`Reasonix MCP: "${name}" sets "oauth_allow_missing_pkce_metadata", which lets OAuth proceed with an authorization server that does not advertise PKCE support.` + (global ? "" : ` Reasonix honours it only from the user config, not a project reasonix.toml.`));
+		if (field === "load" && !global && server.disabled !== true && typeof value === "string" && value.trim().toLowerCase() === REASONIX_MCP_LOAD_ALWAYS) logger?.warn(`Reasonix MCP: "${name}" sets "load" to "always" in the project reasonix.toml. Reasonix 2.53.0 and later ignore a project-declared load mode and defer the server; set it in the user config (the server's "load" or [tools.mcp_load]) instead.`);
 		plugin[field] = value;
 	}
 }
@@ -86059,6 +86394,41 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 // src/features/permissions/codebuddy-permissions.ts
 /** Top-level key of `.codebuddy/settings.json` that rulesync owns. */
 const CODEBUDDY_PERMISSIONS_KEY = "permissions";
+/**
+* The top-level settings groups the `codebuddy` override may author, each with
+* the only keys of that group rulesync writes and imports. A group's other
+* keys are kept as the file has them; an override key not listed here is
+* skipped with a warning.
+*
+* - `autoReview`: the `auto` permission mode's review policy (`policy`
+*   replaces the built-in security policy, `extraPolicy` is appended to it).
+* - `autoMode`: the legacy natural-language `auto` rules, still read as
+*   additional policy.
+* - `memory.parentDiscovery`: whether `CODEBUDDY.md` / `AGENTS.md` are also
+*   discovered in parent directories of the launch directory.
+*
+* @see https://www.codebuddy.ai/docs/cli/settings
+* @see https://www.codebuddy.ai/docs/cli/memory
+*/
+const CODEBUDDY_OVERRIDE_GROUP_KEYS = {
+	autoReview: ["policy", "extraPolicy"],
+	autoMode: [
+		"environment",
+		"allow",
+		"soft_deny",
+		"hard_deny"
+	],
+	memory: ["parentDiscovery"]
+};
+const CODEBUDDY_OVERRIDE_GROUPS = Object.keys(CODEBUDDY_OVERRIDE_GROUP_KEYS);
+/**
+* Groups CodeBuddy reads from the user and project-local settings only: the
+* shared project `.codebuddy/settings.json` is not read for them, so a checked-in
+* repository cannot relax the review of its own actions. They are written and
+* imported in global mode alone.
+* @see https://www.codebuddy.ai/docs/cli/settings
+*/
+const CODEBUDDY_USER_ONLY_GROUPS = /* @__PURE__ */ new Set(["autoReview", "autoMode"]);
 /** The rule lists under `permissions`, one per canonical action. */
 const CODEBUDDY_RULE_LISTS = [
 	"allow",
@@ -86212,6 +86582,87 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 	return lists;
 }
 /**
+* Whether a settings value has the shape the `codebuddy` override schema
+* accepts for that key, so an off-spec value is left in the file instead of
+* being written or making the imported permissions file fail validation.
+*/
+function isLiftableCodebuddyValue(key, value) {
+	switch (key) {
+		case "policy":
+		case "extraPolicy": return typeof value === "string";
+		case "parentDiscovery": return typeof value === "boolean";
+		default: return isStringArray(value);
+	}
+}
+/** Name every written override setting that can make the `auto` review more lenient. */
+function announceCodebuddyReviewSettings({ picked, group, where, logger }) {
+	if (group === "autoReview" && typeof picked.policy === "string") logger?.warn(`CodeBuddy permissions: codebuddy.autoReview.policy was written to ${where}, so it replaces CodeBuddy's built-in security policy for the 'auto' permission mode.`);
+	if (group === "autoReview" && typeof picked.extraPolicy === "string") logger?.warn(`CodeBuddy permissions: codebuddy.autoReview.extraPolicy was written to ${where}, so it is appended to the security policy CodeBuddy's 'auto' permission mode reviews actions against.`);
+	if (group === "autoMode" && toStringArray$1(picked.allow).length > 0) logger?.warn(`CodeBuddy permissions: codebuddy.autoMode.allow was written to ${where}, so CodeBuddy's 'auto' permission mode leans toward approving the actions it describes.`);
+}
+/**
+* The top-level keys the `codebuddy` override contributes to the settings
+* patch, besides `permissions`. Each group is the existing group with the
+* authored keys laid over it; a group is only in the patch when authored, so
+* a hand-set value survives an unrelated regeneration.
+*/
+function buildCodebuddyOverridePatch({ override, existing, global, where, logger }) {
+	const patch = {};
+	if (override === void 0) return patch;
+	for (const group of CODEBUDDY_OVERRIDE_GROUPS) {
+		const authored = override[group];
+		if (!isRecord(authored)) continue;
+		if (CODEBUDDY_USER_ONLY_GROUPS.has(group) && !global) {
+			logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group} in project mode — CodeBuddy does not read ${group} from the shared project .codebuddy/settings.json. Run 'rulesync generate --global' to write it to ~/.codebuddy/settings.json.`);
+			continue;
+		}
+		const allowedKeys = CODEBUDDY_OVERRIDE_GROUP_KEYS[group];
+		const picked = {};
+		for (const [key, value] of Object.entries(authored)) {
+			if (isPrototypePollutionKey(key) || value === void 0) continue;
+			if (!allowedKeys.includes(key)) {
+				logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group}.${key} — Rulesync writes only ${allowedKeys.map((k) => `${group}.${k}`).join(", ")} from the codebuddy override; set other keys in ${where} by hand.`);
+				continue;
+			}
+			picked[key] = value;
+		}
+		if (Object.keys(picked).length === 0) continue;
+		const existingValue = existing[group];
+		if (existingValue !== void 0 && !isRecord(existingValue)) {
+			logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group} — ${group} in ${where} is not an object, so Rulesync leaves it as it is. Fix it by hand to let Rulesync write ${group}.`);
+			continue;
+		}
+		patch[group] = {
+			...existingValue,
+			...picked
+		};
+		announceCodebuddyReviewSettings({
+			picked,
+			group,
+			where,
+			logger
+		});
+	}
+	return patch;
+}
+/**
+* Lift the settings the `codebuddy` override authors back out of a settings
+* file. `autoReview` and `autoMode` are lifted only from the user file, the
+* one of the two rulesync manages that CodeBuddy reads them from.
+*/
+function liftCodebuddyOverride({ settings, global }) {
+	const lifted = {};
+	for (const group of CODEBUDDY_OVERRIDE_GROUPS) {
+		if (CODEBUDDY_USER_ONLY_GROUPS.has(group) && !global) continue;
+		const existingGroup = settings[group];
+		if (!isRecord(existingGroup)) continue;
+		const picked = {};
+		for (const key of CODEBUDDY_OVERRIDE_GROUP_KEYS[group]) if (Object.hasOwn(existingGroup, key) && isLiftableCodebuddyValue(key, existingGroup[key])) picked[key] = existingGroup[key];
+		if (Object.keys(picked).length > 0) lifted[group] = picked;
+	}
+	return lifted;
+}
+/**
 * CodeBuddy Code permissions.
 *
 * Rules live under the `permissions` key of `.codebuddy/settings.json`
@@ -86222,7 +86673,10 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 * writes go through the shared-config gateway, the sibling keys of the rule
 * lists (`defaultMode`, `additionalDirectories`, `trustedDirectories`, ...)
 * are kept, and the file is never deleted. The gitignored
-* `.codebuddy/settings.local.json` layer is left to CodeBuddy.
+* `.codebuddy/settings.local.json` layer is left to CodeBuddy. The
+* `codebuddy` override's other settings (`autoReview`, `autoMode`,
+* `memory.parentDiscovery`) go through `buildCodebuddyOverridePatch` /
+* `liftCodebuddyOverride`.
 *
 * @see https://www.codebuddy.ai/docs/cli/permissions
 * @see https://www.codebuddy.ai/docs/cli/settings
@@ -86261,8 +86715,9 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 			relativePath: join(paths.relativeDirPath, paths.relativeFilePath)
 		});
 		const existingPermissions = isRecord(existing[CODEBUDDY_PERMISSIONS_KEY]) ? existing[CODEBUDDY_PERMISSIONS_KEY] : {};
+		const config = rulesyncPermissions.getJson();
 		const lists = buildCodebuddyRuleLists({
-			config: rulesyncPermissions.getJson(),
+			config,
 			existingPermissions,
 			logger
 		});
@@ -86277,7 +86732,16 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
 				existingContent,
-				patch: { [CODEBUDDY_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0 },
+				patch: {
+					[CODEBUDDY_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0,
+					...buildCodebuddyOverridePatch({
+						override: config.codebuddy,
+						existing,
+						global,
+						where: `${join(paths.relativeDirPath, paths.relativeFilePath)}${global ? " in the home directory" : ""}`,
+						logger
+					})
+				},
 				filePath
 			}),
 			validate: true,
@@ -86298,7 +86762,14 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 			const existing = rules[parsed.pattern];
 			if (existing === void 0 || PERMISSION_ACTION_PRIORITY[action] > PERMISSION_ACTION_PRIORITY[existing]) rules[parsed.pattern] = action;
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const codebuddy = liftCodebuddyOverride({
+			settings,
+			global: this.global
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...Object.keys(codebuddy).length > 0 && { codebuddy }
+		}, null, 2) });
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		return new CodebuddyPermissions({
@@ -89264,7 +89735,7 @@ const AUTO_APPROVE_KEYS = {
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
-const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+const DEFAULT_PERMISSION_MODE_KEY$1 = "chat.permissions.default";
 /**
 * The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
 * at path `a.b` is written to `chat.agent.sandbox.a.b`.
@@ -89552,7 +90023,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			});
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
-		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY$1] = defaultPermissionMode;
 		const sandbox = config.copilot?.sandbox;
 		if (sandbox !== void 0) {
 			Object.assign(patch, buildSandboxPatch({
@@ -89608,7 +90079,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			for (const [pattern, flag] of Object.entries(autoApprove)) rules[pattern] = flag ? "allow" : "deny";
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
-		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY$1];
 		const sandbox = readSandboxFromSettings(settings);
 		const copilot = {
 			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
@@ -89641,6 +90112,16 @@ const WEBFETCH_CATEGORY$1 = "webfetch";
 /** `~/.copilot/settings.json` and `.github/copilot/settings.json` keys. */
 const ALLOWED_URLS_KEY = "allowedUrls";
 const DENIED_URLS_KEY = "deniedUrls";
+/**
+* `~/.copilot/settings.json` only: the startup permission mode for new
+* interactive sessions, authored through the `copilotcli.defaultPermissionMode`
+* override. It is a user setting — the repository settings file does not list
+* it among its repo-overridable keys.
+*/
+const DEFAULT_PERMISSION_MODE_KEY = "defaultPermissionMode";
+function isCopilotcliDefaultPermissionMode(value) {
+	return COPILOTCLI_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
+}
 function toUrlList(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => typeof entry === "string");
@@ -89682,6 +90163,13 @@ function splitUrlRules(rules) {
 * top-level keys in the user `settings.json`, so only documented keys are ever
 * emitted there either.)
 *
+* The `copilotcli.defaultPermissionMode` override (`manual` | `assisted` |
+* `allow-all`) writes the user-scope `defaultPermissionMode` key in global mode
+* only; in project mode it is skipped with a warning, since the repository
+* settings file does not accept it. It is patched only when authored, so a mode
+* the user picked through `/settings` otherwise survives. Writing `allow-all`
+* warns, because it makes new sessions skip every approval prompt.
+*
 * @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
 * @see https://github.com/github/copilot-cli/blob/main/changelog.md
 */
@@ -89724,7 +90212,8 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const paths = CopilotcliPermissions.getSettablePaths({ global });
 		const filePath = join(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const rules = rulesyncPermissions.getJson().permission[WEBFETCH_CATEGORY$1];
+		const config = rulesyncPermissions.getJson();
+		const rules = config.permission[WEBFETCH_CATEGORY$1];
 		const patch = {};
 		if (rules !== void 0) {
 			const { allowedUrls, deniedUrls } = splitUrlRules(rules);
@@ -89732,6 +90221,13 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 			if (global) patch[ALLOWED_URLS_KEY] = allowedUrls.length > 0 ? allowedUrls : void 0;
 			else if (allowedUrls.length > 0) logger?.warn(`Copilot CLI permissions: dropping ${allowedUrls.length} "webfetch" allow rule(s) at project scope — ${join(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${ALLOWED_URLS_KEY}" (repository settings may only add denials). Author allow rules in global scope (\`--global\`) instead.`);
 		}
+		const defaultPermissionMode = config.copilotcli?.defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) {
+			if (global) {
+				patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+				if (defaultPermissionMode === "allow-all") logger?.warn(`Copilot CLI permissions: writing "${DEFAULT_PERMISSION_MODE_KEY}": "allow-all" to ${join(paths.relativeDirPath, paths.relativeFilePath)} — new interactive sessions will start with every tool, path and URL approved without prompting (equivalent to \`--allow-all\`). Deny rules and enterprise policy still apply.`);
+			} else logger?.warn(`Copilot CLI permissions: skipping "copilotcli.${DEFAULT_PERMISSION_MODE_KEY}" at project scope — ${join(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${DEFAULT_PERMISSION_MODE_KEY}" (it is a user setting). Author it in global scope (\`--global\`) instead.`);
+		}
 		return new CopilotcliPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -89753,7 +90249,11 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
 		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
 		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY$1]: rules } : {};
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const defaultPermissionMode = this.global ? settings[DEFAULT_PERMISSION_MODE_KEY] : void 0;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...isCopilotcliDefaultPermissionMode(defaultPermissionMode) && { copilotcli: { defaultPermissionMode } }
+		}, null, 2) });
 	}
 	parseSettings() {
 		const relativePath = join(this.getRelativeDirPath(), this.getRelativeFilePath());
@@ -95258,6 +95758,7 @@ var MimocodePermissions = class extends OpencodePermissions {
 // src/features/permissions/omp-permissions.ts
 const CATCH_ALL_PATTERN$5 = "*";
 const APPROVAL_MODE_KEY = "approvalMode";
+const RESTRICTED_FOLDERS_KEY = "restrictedFolders";
 const ACTION_TO_OMP_APPROVAL = {
 	allow: "allow",
 	ask: "prompt",
@@ -95296,9 +95797,9 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *
 * - `tools.approval.<tool>: allow | prompt | deny` is a per-tool policy honored
 *   in every approval mode. A category's catch-all `*` rule maps here
-*   (`ask` → `prompt`). oh-my-pi has no per-path matcher, so a non-bash category
-*   with pattern-specific rules collapses to one action (deny > ask > allow, with
-*   an implicit `ask` when there is no catch-all) and a warning.
+*   (`ask` → `prompt`). `tools.approval` has no per-path matcher, so a non-bash
+*   category with pattern-specific rules collapses to one action (deny > ask >
+*   allow, with an implicit `ask` when there is no catch-all) and a warning.
 * - `bash.patterns: [{ match, approval }]` is an ordered, first-match-wins list
 *   of command globs (only `*` is a wildcard). Every `bash` rule except a
 *   catch-all `allow` is written there, ordered deny → prompt → allow so that
@@ -95315,12 +95816,15 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
 * `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
-* import a recognized value is read back into the override.
+* import a recognized value is read back into the override. Likewise the
+* `omp.restrictedFolders` override writes `tools.restrictedFolders` (folders
+* where every action prompts in every approval mode, `yolo` included), is left
+* alone when absent, and is read back on import.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
 * (the keys rulesync manages), `bash.patterns` and an authored
-* `tools.approvalMode` are rewritten; sibling keys such as `bash.enabled` are
-* kept, and the file is never deleted.
+* `tools.approvalMode` or `tools.restrictedFolders` are rewritten; sibling
+* keys such as `bash.enabled` are kept, and the file is never deleted.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/settings.md
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
@@ -95369,6 +95873,7 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 			logger
 		});
 		const approvalMode = config.omp?.approvalMode;
+		const restrictedFolders = config.omp?.restrictedFolders;
 		const existingTools = isRecord(existing.tools) ? existing.tools : {};
 		const nextApproval = {
 			...isRecord(existingTools.approval) ? Object.fromEntries(Object.entries(existingTools.approval).filter(([tool]) => !MANAGED_OMP_TOOLS.has(tool) && !Object.hasOwn(approval, tool)).map(([tool, value]) => [tool, raisedApproval(value, floor)])) : {},
@@ -95376,6 +95881,7 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 		};
 		const toolsSiblings = withoutKey(existingTools, "approval");
 		if (approvalMode !== void 0) toolsSiblings[APPROVAL_MODE_KEY] = approvalMode;
+		if (restrictedFolders !== void 0) toolsSiblings[RESTRICTED_FOLDERS_KEY] = restrictedFolders;
 		const nextTools = Object.keys(nextApproval).length > 0 ? {
 			...toolsSiblings,
 			approval: nextApproval
@@ -95626,11 +96132,26 @@ function convertOmpToRulesync(config) {
 	}
 	if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
 	const approvalMode = tools[APPROVAL_MODE_KEY];
+	const restrictedFolders = importRestrictedFolders(tools[RESTRICTED_FOLDERS_KEY]);
+	const omp = {
+		...isOmpApprovalMode(approvalMode) && { approvalMode },
+		...restrictedFolders !== void 0 && { restrictedFolders }
+	};
 	return {
 		permission,
-		...isOmpApprovalMode(approvalMode) && { omp: { approvalMode } }
+		...Object.keys(omp).length > 0 && { omp }
 	};
 }
+/**
+* `tools.restrictedFolders` as the override list: its string entries, or
+* `undefined` when it is unset or no entry survives (so a list of non-strings
+* is not imported as `[]` and then rewritten as an empty list).
+*/
+function importRestrictedFolders(value) {
+	if (!Array.isArray(value)) return;
+	const folders = value.filter((entry) => typeof entry === "string");
+	return folders.length === 0 && value.length > 0 ? void 0 : folders;
+}
 function isOmpApprovalMode(value) {
 	return OMP_APPROVAL_MODES.some((mode) => mode === value);
 }
@@ -100727,19 +101248,31 @@ const CANONICAL_TO_VIBE_TOOL_NAMES = {
 };
 /**
 * The tables earlier rulesync versions wrote for canonical categories that
-* Vibe 3.x no longer reads: `[tools.grep]` (Vibe warns that it "has no
-* effect") and `[tools.task]` for the subagent tool v3.0.0 renamed to
-* `agents.*`. A regenerate that configures the category removes them — and
+* Vibe 3.x does not read: `[tools.grep]` (Vibe warns that it "has no
+* effect"), `[tools.task]` for the subagent tool v3.0.0 renamed to
+* `agents.*`, and `[tools.external_directory]` — Vibe has no such tool, and
+* its unused-settings check skips unknown tool names as custom/MCP tools, so
+* that deny was silently inert. A regenerate that configures the category removes them — and
 * the matching `disabled_tools` entry — instead of leaving an inert table.
 * Import still reads them (see {@link VIBE_TO_CANONICAL_TOOL_NAMES}), so a
 * Vibe 2.x config is lifted into the canonical categories rather than lost.
 */
 const VIBE_RETIRED_TOOL_TABLES = {
 	grep: "grep",
-	agent: "task"
+	agent: "task",
+	external_directory: "external_directory"
 };
 /** The canonical category Vibe's `enable_subagents` switch expresses. */
 const VIBE_SUBAGENT_CATEGORY = "agent";
+/** The canonical category Vibe's top-level `outside_workdir` setting expresses. */
+const VIBE_OUTSIDE_WORKDIR_CATEGORY = "external_directory";
+/**
+* The values of Vibe's `outside_workdir` (v3.0.3+). There is no allow value:
+* access outside the working directory is granted per path through a tool's
+* `allowlist` (`vibe-path:...`) or `--add-dir`.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+*/
+const VIBE_OUTSIDE_WORKDIR_VALUES = /* @__PURE__ */ new Set(["ask", "deny"]);
 const VIBE_TO_CANONICAL_TOOL_NAMES = {
 	bash: "bash",
 	read_file: "read",
@@ -100815,7 +101348,8 @@ const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
 	"grep",
 	"glob",
 	"notebookedit",
-	"agent"
+	"agent",
+	"external_directory"
 ]);
 var VibePermissions = class VibePermissions extends ToolPermissions {
 	toml;
@@ -100896,7 +101430,11 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			rules: permission[VIBE_SUBAGENT_CATEGORY],
 			logger
 		});
-		const tableCategories = Object.entries(permission).filter(([category]) => category !== VIBE_SUBAGENT_CATEGORY);
+		const outsideWorkdirPatch = resolveOutsideWorkdirPatch({
+			rules: permission[VIBE_OUTSIDE_WORKDIR_CATEGORY],
+			logger
+		});
+		const tableCategories = Object.entries(permission).filter(([category]) => category !== VIBE_SUBAGENT_CATEGORY && category !== VIBE_OUTSIDE_WORKDIR_CATEGORY);
 		for (const [category, rules] of tableCategories) {
 			const vibeToolNames = resolveNames(category);
 			if (vibeToolNames === void 0) {
@@ -100970,7 +101508,8 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 						enabledTools
 					}),
 					disabled_tools: disabledTools.size > 0 ? [...disabledTools].toSorted() : void 0,
-					...enableSubagentsPatch
+					...enableSubagentsPatch,
+					...outsideWorkdirPatch
 				},
 				filePath
 			}),
@@ -101014,6 +101553,8 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		}
 		for (const category of silencedCategories) ensurePermission(permission, category)["*"] = "deny";
 		if (this.toml.enable_subagents === false) ensurePermission(permission, VIBE_SUBAGENT_CATEGORY)["*"] = "deny";
+		const outsideWorkdir = this.toml.outside_workdir;
+		if (typeof outsideWorkdir === "string" && VIBE_OUTSIDE_WORKDIR_VALUES.has(outsideWorkdir)) ensurePermission(permission, VIBE_OUTSIDE_WORKDIR_CATEGORY)["*"] = outsideWorkdir === "deny" ? "deny" : "ask";
 		warnOnUnresolvableDisabledTools({
 			entries: disabledToolEntries,
 			tools: this.toml.tools
@@ -101090,7 +101631,7 @@ function retireLegacyToolTables({ permission, tools, disabledTools, logger }) {
 		}
 		if (disabledTools.delete(legacyToolName)) removed.push(`disabled_tools entry '${legacyToolName}'`);
 	}
-	if (removed.length > 0) logger?.warn(`Removed ${removed.join(", ")} from the Vibe config: Vibe 3.x no longer reads [tools.grep] or the former 'task' subagent tool, so those entries had no effect.`);
+	if (removed.length > 0) logger?.warn(`Removed ${removed.join(", ")} from the Vibe config: Vibe 3.x does not read [tools.grep], the former 'task' subagent tool or an 'external_directory' tool (the 'external_directory' category is written to outside_workdir instead), so those entries had no effect.`);
 }
 /**
 * Report the rules of a category that has no Vibe tool table. `grep` gets its
@@ -101126,6 +101667,30 @@ function resolveEnableSubagentsPatch({ rules, logger }) {
 	return { enable_subagents: action === "deny" ? false : void 0 };
 }
 /**
+* Translate the canonical `external_directory` category into Vibe's top-level
+* `outside_workdir` setting (v3.0.3+), which decides whether a file or shell
+* tool call reaching outside the working directory prompts (`"ask"`, the
+* default) or is refused with a tool error (`"deny"`). A `*` deny or ask writes
+* that value; a `*` allow has no Vibe value, so it is warned about and the key
+* is removed, leaving Vibe's default prompt. Without a `*` rule the key is left
+* as the file has it. Pattern rules are skipped with a warning: path grants go
+* in a tool's `allowlist` (`vibe-path:...`) instead.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/vibe/app_server/_unified_permissions.py
+*/
+function resolveOutsideWorkdirPatch({ rules, logger }) {
+	if (rules === void 0) return {};
+	const patternCount = Object.keys(rules).filter((pattern) => pattern !== "*").length;
+	if (patternCount > 0) logger?.warn(`Vibe's outside_workdir applies to every path outside the working directory; skipping ${patternCount} pattern rule(s) of the '${VIBE_OUTSIDE_WORKDIR_CATEGORY}' category. Grant a path through a tool's allowlist ("vibe-path:...") in the Vibe config instead.`);
+	const action = rules["*"];
+	if (action === void 0) return {};
+	if (action === "allow") {
+		logger?.warn(`Vibe's outside_workdir only takes "ask" or "deny"; the '${VIBE_OUTSIDE_WORKDIR_CATEGORY}' category's "*": "allow" leaves Vibe's default, which prompts before reaching outside the working directory.`);
+		return { outside_workdir: void 0 };
+	}
+	return { outside_workdir: action };
+}
+/**
 * Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
 * escalate to ASK even when the base permission is ALWAYS). rulesync owns this
 * list for any category the override names: a present list is set, an empty
@@ -106475,4 +107040,4 @@ async function importChecksCore(params) {
 }
 export { RulesyncPermissions as $, formatError as $n, isSymlink as $t, CODEBUDDY_DIR as A, MAX_FILE_SIZE as An, withFallbackLoggerTarget as At, CLAUDECODE_LOCAL_RULE_FILE_NAME as B, RULESYNC_LOCAL_CONFIG_RELATIVE_FILE_PATH as Bn, assertTreeContainsNoSymlinks as Bt, QWENCODE_LOCAL_RULE_FILE_NAME as C, PACKAGING_TOOL_TARGETS as Cn, getSourceTransport as Ct, FACTORYDROID_SETTINGS_LOCAL_FILE_NAME as D, DEPRECATED_FEATURE_REPLACEMENTS as Dn, WarningCollectingLogger as Dt, FACTORYDROID_DIR as E, ALL_FEATURES_WITH_WILDCARD as En, JsonLogger as Et, groupSpellingsByCaseFoldedIdentity as F, RULESYNC_CONFIG_SCHEMA_URL as Fn, PathOutsideRootError as Ft, toInstructionBudgetFile as G, RULESYNC_PERMISSIONS_SCHEMA_URL as Gn, ensureDir as Gt, CLAUDECODE_SETTINGS_LOCAL_FILE_NAME as H, RULESYNC_MCP_SCHEMA_URL as Hn, checkPathTraversal as Ht, CODEXCLI_BASH_RULES_FILE_NAME as I, RULESYNC_CURATED_RULES_RELATIVE_DIR_PATH as In, applyFileMode as It, RulesyncSubagentFrontmatterSchema as J, RULESYNC_SKILLS_RELATIVE_DIR_PATH as Jn, findFilesByGlobs as Jt, getLocalSkillDirNames as K, RULESYNC_RELATIVE_DIR_PATH as Kn, fileExists as Kt, CODEXCLI_DIR as L, RULESYNC_CURATED_SKILLS_RELATIVE_DIR_PATH as Ln, assertDirectoryIfExists as Lt, AUGMENTCODE_DIR as M, RULESYNC_CHECKS_RELATIVE_DIR_PATH as Mn, withWarnOnceScope as Mt, AUGMENTCODE_SETTINGS_LOCAL_FILE_NAME as N, RULESYNC_COMMANDS_RELATIVE_DIR_PATH as Nn, CLIError as Nt, COMMANDCODE_DIR as O, CURATED_RULES_FEATURE_SUBDIR as On, fallbackLogger as Ot, caseFoldIdentity as P, RULESYNC_CONFIG_RELATIVE_FILE_PATH as Pn, ErrorCodes as Pt, RulesyncRuleFrontmatterSchema as Q, RULESYNC_XDG_CONFIG_HOME_DEFAULT_DIR_NAME as Qn, isFileSystemError as Qt, CLAUDECODE_AGENT_MEMORY_LOCAL_DIR_NAME as R, RULESYNC_HOOKS_RELATIVE_FILE_PATH as Rn, assertNoSymlinkBelowRoot as Rt, QWENCODE_DIR as S, ALL_TOOL_TARGETS_WITH_WILDCARD as Sn, assertTargetsFeaturesExclusive as St, LETTACODE_SETTINGS_LOCAL_FILE_NAME as T, ALL_FEATURES as Tn, ConsoleLogger as Tt, CLAUDECODE_SKILLS_DIR_PATH as U, RULESYNC_NPM_SOURCES_LOCK_RELATIVE_FILE_PATH as Un, createTempDirectory as Ut, CLAUDECODE_MEMORIES_DIR_NAME as V, RULESYNC_MCP_RELATIVE_FILE_PATH as Vn, assertWritablePathInsideRoot as Vt, findProjectInstructionBudgetFindings as W, RULESYNC_PERMISSIONS_RELATIVE_FILE_PATH as Wn, directoryExists as Wt, RulesyncSkillFrontmatterSchema as X, RULESYNC_SUBAGENTS_RELATIVE_DIR_PATH as Xn, getHomeDirectory as Xt, RulesyncSkill as Y, RULESYNC_SOURCES_LOCK_RELATIVE_FILE_PATH as Yn, getFileSizeAndExecutableBit as Yt, RulesyncRule as Z, RULESYNC_USER_CONFIG_DIR_NAME as Zn, isFileNotFoundError as Zt, SubagentsProcessor as _, toPosixPath as _n, resolveEffectiveInputRoots as _t, convertFromTool as a, readFileContent as an, stripControlCharactersKeepingLineFeeds as ar, parseJsonc as at, CommandsProcessor as b, mapWithConcurrency as bn, GITIGNORE_DESTINATION_KEY as bt, parseCommaSeparatedList as c, removeDirectoryStrict as cn, RulesyncCheck as ct, shortenToWidth as d, removeFileWithoutFollowingSymlinks as dn, loadYaml as dt, listDirectoryEntryNames as en, truncateText as er, RulesyncMcp as et, McpProcessor as f, removeTempDirectory as fn, isRecord as ft, RulesProcessor as g, splitPathSegments as gn, mergeInputRootConfigs as gt, ChecksProcessor as h, runWithDirectoryRollback as hn, ConfigResolver as ht, inspectInputRoots as i, posixRelativePathEscapesRoot as in, stripControlCharacters as ir, resolveRulesyncSourceWritePath as it, CODEBUDDY_LOCAL_RULE_FILE_NAME as j, RULESYNC_AIIGNORE_RELATIVE_FILE_PATH as jn, resetRunWarningState as jt, COMMANDCODE_SETTINGS_LOCAL_FILE_NAME as k, FEATURE_SOURCE_TREE_ENTRIES as kn, warnOnConflictingFlags as kt, ELLIPSIS_WIDTH as l, removeFile as ln, RulesyncCheckFrontmatterSchema as lt, HooksProcessor as m, resolvedRelativePath as mn, SKILL_FILE_NAME as mt, formatSourceLoadFailure as n, listSubdirectoryNames as nn, hasEnclosingMarkOutsideKeycap as nr, RulesyncHooks as nt, isPackagingToolTarget as o, readFileContentOrNull as on, stripControlCharactersKeepingLineFeedsAndTabs as or, RulesyncCommand as ot, IgnoreProcessor as p, resolvePath as pn, SHARED_USER_MANAGED_CONFIG_PATHS as pt, RulesyncSubagent as q, RULESYNC_RULES_RELATIVE_DIR_PATH as qn, fileExistsStrict as qt, generate as r, pathEscapesRoot as rn, quoteForLog as rr, getRulesyncSourceCandidates as rt, getProcessorRegistryEntry as s, removeDirectory as sn, stripHiddenCharacters as sr, RulesyncCommandFrontmatterSchema as st, importFromTool as t, listFilePathsRecursively as tn, hasDeceptiveHiddenCharacters as tr, RulesyncIgnore as tt, displayWidthOf as u, removeFileStrict as un, stringifyFrontmatter as ut, SkillsProcessor as v, writeFileBuffer as vn, CONFLICTING_TARGET_PAIRS as vt, LETTACODE_DIR as w, ToolTargetSchema as wn, findControlCharacter as wt, REASONIX_LOCAL_RULE_FILE_NAME as x, ALL_TOOL_TARGETS as xn, SourceEntrySchema as xt, CRUSH_LOCAL_RULE_FILE_NAME as y, writeFileContent as yn, ConfigFileSchema as yt, CLAUDECODE_DIR as z, RULESYNC_IGNORE_RELATIVE_FILE_PATH as zn, assertPathResolvesInsideRoot as zt };
 
-//# sourceMappingURL=import-D2uYjAdc.js.map
+//# sourceMappingURL=import-BQNLyW5s.js.map