rulesync 43.1.2 → 43.3.0

package/dist/{import-BTqYh7nP.cjs → import-CedO1sFP.cjs}

@@ -5544,24 +5544,27 @@ const AUGMENTCODE_HOOK_EVENTS = [
 * Hook events supported by Mistral Vibe (mistral-vibe).
 *
 * Vibe exposes three hook events in `.vibe/hooks.toml`: `pre_tool` ←
-* `preToolUse`, `post_tool` ← `postToolUse`, and `post_agent` ← `stop` (fires
-* after every assistant turn that ends without pending tool calls — the closest
-* canonical equivalent to a "turn end"/"stop" event, matching how
-* codexcli/copilot map their stop events). Only the tool events
-* (`pre_tool`/`post_tool`) carry the `match` tool-name matcher (fnmatch glob or
-* `re:` regex) and the `strict` flag; `post_agent` carries neither. Only
-* `type: "command"` hooks are relevant.
+* `preToolUse`, `post_tool` ← `postToolUse`, and `post_agent` ← `stop` /
+* `subagentStop`. `post_agent` fires after every assistant turn that ends
+* without pending tool calls, for the main agent and (since v3.0.2) for every
+* subagent. v3.0.3 lets a `post_agent` hook take a `match` on the agent that
+* finished its turn: the reserved alias `main` selects the main agent, so
+* canonical `stop` becomes `post_agent` with `match = "main"`, and a canonical
+* `subagentStop` with a matcher becomes `post_agent` with that agent name as
+* `match`. Only the tool events (`pre_tool`/`post_tool`) carry the `strict`
+* flag. Only `type: "command"` hooks are relevant.
 *
 * v2.21.0 graduated hooks from experimental and renamed all three types
 * (`before_tool` → `pre_tool`, `after_tool` → `post_tool`, `post_agent_turn` →
 * `post_agent`). `HookType` is a strict enum, so an entry using an old name is
 * rejected outright and reported as a `HookConfigIssue`.
-* @see https://github.com/mistralai/mistral-vibe/blob/main/README.md
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
 */
 const VIBE_HOOK_EVENTS = [
 	"preToolUse",
 	"postToolUse",
-	"stop"
+	"stop",
+	"subagentStop"
 ];
 /**
 * Hook events supported by Codewhale.
@@ -7029,9 +7032,10 @@ const JUNIE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_JUNIE_EVENT
 /**
 * Map canonical camelCase event names to Mistral Vibe snake_case.
 *
-* Vibe documents three hook events. The canonical `stop` event maps to Vibe's
-* `post_agent` (fires after every assistant turn ending without pending tool
-* calls) — the closest documented "turn end"/"stop" equivalent.
+* Vibe documents three hook events. The canonical `stop` and `subagentStop`
+* events both map to Vibe's `post_agent` (fires after every assistant turn
+* ending without pending tool calls); the adapter tells them apart with the
+* hook's `match` on the agent name (`main` for the main agent).
 *
 * These are the v2.21.0 names; the pre-2.21.0 spellings (`before_tool`,
 * `after_tool`, `post_agent_turn`) are rejected by Vibe's strict `HookType`
@@ -7041,7 +7045,8 @@ const JUNIE_TO_CANONICAL_EVENT_NAMES = invertEventNames(CANONICAL_TO_JUNIE_EVENT
 const CANONICAL_TO_VIBE_EVENT_NAMES = {
 	preToolUse: "pre_tool",
 	postToolUse: "post_tool",
-	stop: "post_agent"
+	stop: "post_agent",
+	subagentStop: "post_agent"
 };
 /**
 * Map Mistral Vibe snake_case event names to canonical camelCase.
@@ -7054,6 +7059,7 @@ const CANONICAL_TO_VIBE_EVENT_NAMES = {
 */
 const VIBE_TO_CANONICAL_EVENT_NAMES = {
 	...invertEventNames(CANONICAL_TO_VIBE_EVENT_NAMES),
+	post_agent: "stop",
 	before_tool: "preToolUse",
 	after_tool: "postToolUse",
 	post_agent_turn: "stop"
@@ -8404,6 +8410,32 @@ const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
 	sandbox: zod_mini.z.optional(CopilotSandboxSchema)
 });
 /**
+* The permission mode the GitHub Copilot CLI starts new interactive sessions
+* in (`defaultPermissionMode` of `~/.copilot/settings.json`): `manual` prompts
+* for every request not already allowed, `assisted` lets a model review
+* eligible requests (Assisted Permissions, non-experimental since v1.0.104),
+* and `allow-all` is equivalent to `--allow-all`. These are the CLI's own
+* values and differ from the VS Code `copilot` target's
+* {@link COPILOT_DEFAULT_PERMISSION_MODES}.
+*
+* @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
+*/
+const COPILOTCLI_DEFAULT_PERMISSION_MODES = [
+	"manual",
+	"assisted",
+	"allow-all"
+];
+/**
+* Tool-scoped override block for the GitHub Copilot CLI.
+* `defaultPermissionMode` writes the user-scope `defaultPermissionMode` key of
+* `~/.copilot/settings.json`; it has no canonical category, and the repository
+* settings file does not accept it.
+*/
+const CopilotcliPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	defaultPermissionMode: zod_mini.z.optional(zod_mini.z.enum(COPILOTCLI_DEFAULT_PERMISSION_MODES))
+});
+/**
 * oh-my-pi's `tools.approvalMode` values: the tool tiers it auto-approves
 * before prompting. `always-ask` auto-approves only read-only tools,
 * `always-ask-cached` (Ask and remember) also prompts before file reads and
@@ -8420,11 +8452,14 @@ const OMP_APPROVAL_MODES = [
 ];
 /**
 * Tool-scoped override block for oh-my-pi (`omp`). `approvalMode` writes the
-* `tools.approvalMode` key of `config.yml`, which has no canonical category.
+* `tools.approvalMode` key of `config.yml`, and `restrictedFolders` the
+* `tools.restrictedFolders` list (folders where every action prompts in every
+* approval mode, `yolo` included); neither has a canonical category.
 */
 const OmpPermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
-	approvalMode: zod_mini.z.optional(zod_mini.z.enum(OMP_APPROVAL_MODES))
+	approvalMode: zod_mini.z.optional(zod_mini.z.enum(OMP_APPROVAL_MODES)),
+	restrictedFolders: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 const KimiCodePermissionsOverrideSchema = zod_mini.z.looseObject({
 	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
@@ -8876,6 +8911,48 @@ const QoderPermissionsOverrideSchema = zod_mini.z.looseObject({
 	agentsMdExcludes: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
 });
 /**
+* Tool-scoped override block for CodeBuddy Code. The shared `permission` block
+* continues to drive `permissions.allow`/`ask`/`deny` of
+* `.codebuddy/settings.json` (project) / `~/.codebuddy/settings.json` (global).
+*
+* The other documented settings with no canonical category are authored here
+* and merged into the same file, key by key, over what the file already
+* holds:
+*
+* - `autoReview` (`policy` replaces the built-in security policy of the `auto`
+*   permission mode, `extraPolicy` is appended to it) and the legacy
+*   `autoMode` rules (`environment` / `allow` / `soft_deny` / `hard_deny`).
+*   CodeBuddy reads both from the user and project-local settings only, never
+*   from the shared project file, so they are written by `--global` generate
+*   alone.
+* - `memory.parentDiscovery`: whether project instruction files
+*   (`CODEBUDDY.md` / `AGENTS.md`) are also discovered in parent directories.
+*
+* Only the keys listed here are written; any other key of these groups is
+* skipped with a warning. Removing a key from the override leaves the
+* previously written value in place.
+*
+* @see https://www.codebuddy.ai/docs/cli/settings
+* @see https://www.codebuddy.ai/docs/cli/memory
+* @example
+* { "autoReview": { "extraPolicy": "Allow dev namespace releases" },
+*   "memory": { "parentDiscovery": false } }
+*/
+const CodebuddyPermissionsOverrideSchema = zod_mini.z.looseObject({
+	permission: zod_mini.z.optional(ToolScopedPermissionSchema),
+	autoReview: zod_mini.z.optional(zod_mini.z.looseObject({
+		policy: zod_mini.z.optional(zod_mini.z.string()),
+		extraPolicy: zod_mini.z.optional(zod_mini.z.string())
+	})),
+	autoMode: zod_mini.z.optional(zod_mini.z.looseObject({
+		environment: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		allow: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		soft_deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string())),
+		hard_deny: zod_mini.z.optional(zod_mini.z.array(zod_mini.z.string()))
+	})),
+	memory: zod_mini.z.optional(zod_mini.z.looseObject({ parentDiscovery: zod_mini.z.optional(zod_mini.z.boolean()) }))
+});
+/**
 * One native Factory Droid permission rule. `match.prefix` positions are either
 * a single token or a non-empty list of alternative tokens.
 *
@@ -9758,13 +9835,13 @@ const PermissionsConfigSchema = zod_mini.z.looseObject({
 	zed: zod_mini.z.optional(ZedPermissionsOverrideSchema),
 	devin: zod_mini.z.optional(DevinPermissionsOverrideSchema),
 	qoder: zod_mini.z.optional(QoderPermissionsOverrideSchema),
+	copilotcli: zod_mini.z.optional(CopilotcliPermissionsOverrideSchema),
 	"antigravity-ide": zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	continue: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	copilot: zod_mini.z.optional(CopilotPermissionsOverrideSchema),
-	codebuddy: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
+	codebuddy: zod_mini.z.optional(CodebuddyPermissionsOverrideSchema),
 	commandcode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	lettacode: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
-	copilotcli: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	crush: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	goose: zod_mini.z.optional(CanonicalPermissionsOverrideSchema),
 	omp: zod_mini.z.optional(OmpPermissionsOverrideSchema),
@@ -10251,6 +10328,10 @@ const RulesyncRuleFrontmatterSchema = zod_mini.z.object({
 		enabled: zod_mini.z.optional(zod_mini.z.boolean()),
 		description: zod_mini.z.optional(zod_mini.z.string())
 	})),
+	cline: zod_mini.z.optional(zod_mini.z.looseObject({
+		disabled: zod_mini.z.optional(zod_mini.z.boolean()),
+		enabled: zod_mini.z.optional(zod_mini.z.boolean())
+	})),
 	continue: zod_mini.z.optional(zod_mini.z.looseObject({
 		alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
 		description: zod_mini.z.optional(zod_mini.z.string()),
@@ -11587,7 +11668,8 @@ const RulesyncSkillFrontmatterSchema = zod_mini.z.looseObject({
 		license: zod_mini.z.optional(zod_mini.z.string()),
 		compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
 		metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
-		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+		"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+		"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
 	})),
 	hermesagent: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	vibe: zod_mini.z.optional(zod_mini.z.looseObject({
@@ -13730,7 +13812,11 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["allowedUrls", "deniedUrls"]
+				ownedKeys: [
+					"allowedUrls",
+					"deniedUrls",
+					"defaultPermissionMode"
+				]
 			}
 		}
 	},
@@ -13909,7 +13995,12 @@ const SHARED_CONFIG_OWNERSHIP = {
 			},
 			permissions: {
 				kind: "replace-owned-keys",
-				ownedKeys: ["permissions"]
+				ownedKeys: [
+					"permissions",
+					"autoReview",
+					"autoMode",
+					"memory"
+				]
 			}
 		}
 	},
@@ -14219,7 +14310,8 @@ const SHARED_CONFIG_OWNERSHIP = {
 					"tools",
 					"enabled_tools",
 					"disabled_tools",
-					"enable_subagents"
+					"enable_subagents",
+					"outside_workdir"
 				]
 			}
 		}
@@ -19531,7 +19623,8 @@ const AgentsSkillsSkillFrontmatterSchema = zod_mini.z.looseObject({
 	license: zod_mini.z.optional(zod_mini.z.string()),
 	compatibility: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.looseObject({})])),
 	metadata: zod_mini.z.optional(zod_mini.z.looseObject({})),
-	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())]))
+	"allowed-tools": zod_mini.z.optional(zod_mini.z.union([zod_mini.z.string(), zod_mini.z.array(zod_mini.z.string())])),
+	"disable-model-invocation": zod_mini.z.optional(zod_mini.z.boolean())
 });
 const COMPATIBILITY_MAX_LENGTH = 500;
 const AGENT_SKILLS_SPEC = "the Agent Skills spec";
@@ -19672,6 +19765,38 @@ function toSpecConformantAgentSkillFields(section, { coerceMetadata = true } = {
 		...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
 	};
 }
+/**
+* The opt-in `disable-model-invocation` flag of the `agentsskills` block.
+*
+* The key is not part of the Agent Skills specification, so `skills-ref
+* validate` rejects a `SKILL.md` that carries it, but several clients reading
+* `.agents/skills/` (e.g. pi) honor it. To keep the default output
+* spec-conformant, only an explicit `agentsskills.disable-model-invocation`
+* value is written; the root-level rulesync flag is deliberately not inherited.
+*
+* Kept apart from {@link toSpecConformantAgentSkillFields} because that helper
+* is shared with writers of other tools' own locations, which have their own
+* sections for tool-specific keys. Only writers of the shared `.agents/skills/`
+* root (see {@link isSharedAgentSkillsRoot}) — the native target, GitLab Duo's
+* project scope and the simulated `agentsmd` — spread this, so they all emit
+* the same frontmatter for that file.
+*/
+function toAgentsSkillsInvocationField(section) {
+	const value = section?.["disable-model-invocation"];
+	return value === void 0 ? {} : { "disable-model-invocation": value };
+}
+/**
+* Whether a skill directory lives in the cross-client `.agents/skills/` root
+* (project, or `~/.agents/skills/` in global scope). The
+* `agentsskills.disable-model-invocation` opt-in exists for the clients that
+* read that root, so it is written and imported only there — not by the
+* subclasses that reuse this class for a tool's own location (Trae, Qoder, Xum,
+* …), where the key would otherwise leak into the `agentsskills` section on
+* import and from there into every `.agents/skills/` output.
+*/
+function isSharedAgentSkillsRoot(relativeDirPath) {
+	return toPosixPath(relativeDirPath) === toPosixPath(AGENTSMD_SKILLS_DIR_PATH);
+}
 /** The `SKILL.md` a diagnostic should point at, in the scope it is written to. */
 function agentSkillFilePath({ outputRoot, relativeDirPath, dirName }) {
 	return (0, node_path.join)(outputRoot, relativeDirPath, dirName, SKILL_FILE_NAME);
@@ -19753,7 +19878,8 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 			...frontmatter.license !== void 0 && { license: frontmatter.license },
 			...frontmatter.compatibility !== void 0 && { compatibility: frontmatter.compatibility },
 			...frontmatter.metadata !== void 0 && { metadata: frontmatter.metadata },
-			...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools }
+			...allowedTools !== void 0 && allowedTools.length > 0 && { "allowed-tools": allowedTools },
+			...isSharedAgentSkillsRoot(this.getRelativeDirPath()) && frontmatter["disable-model-invocation"] !== void 0 && { "disable-model-invocation": frontmatter["disable-model-invocation"] }
 		};
 		const rulesyncFrontmatter = {
 			name: frontmatter.name,
@@ -19779,7 +19905,8 @@ var AgentsSkillsSkill = class AgentsSkillsSkill extends ToolSkill {
 		const agentsSkillsFrontmatter = {
 			name: rulesyncFrontmatter.name,
 			description: rulesyncFrontmatter.description,
-			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter))
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(rulesyncFrontmatter)),
+			...isSharedAgentSkillsRoot(settablePaths.relativeDirPath) && toAgentsSkillsInvocationField(rulesyncFrontmatter.agentsskills)
 		};
 		AgentsSkillsSkill.reportSpecViolations({
 			outputRoot,
@@ -24853,7 +24980,8 @@ var AgentsmdSkill = class AgentsmdSkill extends SimulatedSkill {
 		const relativeDirPath = this.getSettablePaths().relativeDirPath;
 		const frontmatter = {
 			...defaults.frontmatter,
-			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(params.rulesyncSkill.getFrontmatter()))
+			...toSpecConformantAgentSkillFields(resolveAgentsSkillsSection(params.rulesyncSkill.getFrontmatter())),
+			...toAgentsSkillsInvocationField(params.rulesyncSkill.getFrontmatter().agentsskills)
 		};
 		AgentsSkillsSkill.reportSpecViolations({
 			outputRoot: params.outputRoot ?? process.cwd(),
@@ -30572,7 +30700,10 @@ var QwencodeSkill = class QwencodeSkill extends ToolSkill {
 		}
 	}
 	static getSettablePaths({ global: _global = false } = {}) {
-		return { relativeDirPath: QWENCODE_SKILLS_DIR_PATH };
+		return {
+			relativeDirPath: QWENCODE_SKILLS_DIR_PATH,
+			importOnlySkillRoots: [AGENTSMD_SKILLS_DIR_PATH]
+		};
 	}
 	getFrontmatter() {
 		return QwencodeSkillFrontmatterSchema.parse(this.requireMainFileFrontmatter());
@@ -39593,6 +39724,16 @@ var VibePluginSubagent = class VibePluginSubagent extends ToolSubagent {
 */
 const VIBE_PROMPTS_DIR_PATH = (0, node_path.join)(".vibe", "prompts");
 /**
+* The agent name Vibe reserves for `post_agent` hook matching (v3.0.3+).
+* `AgentProfile.from_toml` refuses a file whose stem matches it case-insensitively, so an
+* agent written as `main.toml` would never load.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/vibe/core/agents/models.py
+*/
+const VIBE_RESERVED_AGENT_NAME = "main";
+function isReservedVibeAgentFileName(relativeFilePath) {
+	return (0, node_path.basename)(relativeFilePath).replace(/\.(md|toml)$/, "").toLowerCase() === VIBE_RESERVED_AGENT_NAME;
+}
+/**
 * Vibe resolves a `system_prompt_id` by file name, and
 * `VibeConfigSchema._check_system_prompt` evaluates it during validation — an
 * unresolvable id raises and the agent is dropped at discovery. The id must
@@ -39707,9 +39848,17 @@ var VibeSubagent = class VibeSubagent extends ToolSubagent {
 	* evaluates the property during validation, so an unresolvable
 	* `system_prompt_id` raises and `AgentRegistry._try_load` drops the agent
 	* with a warning.
+	*
+	* A subagent named `main` is skipped with a warning: Vibe reserves that name
+	* for hook matching and does not load an agent file called `main.toml`.
 	*/
-	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false }) {
+	static fromRulesyncSubagents({ rulesyncSubagents, outputRoot = process.cwd(), global = false, logger }) {
 		return rulesyncSubagents.flatMap((rulesyncSubagent) => {
+			const sourcePath = rulesyncSubagent.getRelativeFilePath();
+			if (isReservedVibeAgentFileName(sourcePath)) {
+				logger?.warn(`Skipping Vibe subagent ${sourcePath}: Vibe reserves the agent name '${VIBE_RESERVED_AGENT_NAME}' for hook matching and does not load an agent file named '${VIBE_RESERVED_AGENT_NAME}'. Rename the subagent file.`);
+				return [];
+			}
 			const agentFile = VibeSubagent.fromRulesyncSubagent({
 				outputRoot,
 				relativeDirPath: VibeSubagent.getSettablePaths({ global }).relativeDirPath,
@@ -44996,17 +45145,49 @@ var ClaudecodeRule = class ClaudecodeRule extends ToolRule {
 * - `alwaysApply: true`: force the rule to always load (equivalent to a file
 *   with no frontmatter at all).
 * - `description`: label surfaced in the rule toggle UI.
+* - `disabled: true` (or `enabled: false`): the rule is switched off. Since
+*   Cline v4.1.26 (cline/cline#14605) the rule toggle writes this flag into the
+*   rule file itself instead of keeping it only in extension state.
 *
 * Rules without frontmatter are always active. Uses `z.looseObject()` so
-* forward-compatible fields added upstream are preserved on round-trip.
+* forward-compatible fields added upstream are preserved on round-trip: every
+* key other than `paths` / `alwaysApply` / `description` is carried in the
+* rulesync `cline:` section.
 *
 * @see https://docs.cline.bot/customization/cline-rules
+* @see https://github.com/cline/cline/blob/main/sdk/packages/core/src/extensions/config/user-instruction-config-loader.ts
 */
 const ClineRuleFrontmatterSchema = zod_mini.z.looseObject({
 	paths: zod_mini.z.optional(zod_mini.z.union([zod_mini.z.array(zod_mini.z.string()), zod_mini.z.string()])),
 	alwaysApply: zod_mini.z.optional(zod_mini.z.boolean()),
 	description: zod_mini.z.optional(zod_mini.z.string())
 });
+const CLINE_RULE_FIELD_TYPES = {
+	disabled: "boolean",
+	enabled: "boolean"
+};
+const CANONICAL_CLINE_RULE_KEYS = [
+	"paths",
+	"alwaysApply",
+	"description"
+];
+/** Returns a copy of `record` without the canonical `paths` / `alwaysApply` / `description` keys. */
+function omitCanonicalClineRuleKeys(record) {
+	return Object.fromEntries(Object.entries(record ?? {}).filter(([key]) => !CANONICAL_CLINE_RULE_KEYS.includes(key)));
+}
+/**
+* Splits a Cline rule frontmatter into the keys that have canonical rulesync
+* homes (`paths` / `alwaysApply` / `description`) and the rest, which are
+* lifted into the rulesync `cline:` section.
+*/
+function extractClineSection({ frontmatter, relativeFilePath }) {
+	return Object.fromEntries(Object.entries(omitCanonicalClineRuleKeys(frontmatter)).filter(([key, value]) => {
+		const expected = Object.hasOwn(CLINE_RULE_FIELD_TYPES, key) ? CLINE_RULE_FIELD_TYPES[key] : void 0;
+		if (expected === void 0 || value === void 0 || typeof value === expected) return true;
+		warnWithFallback(void 0, `Cline rules: dropping ${key} from ${relativeFilePath}: Cline rejects the whole rule unless it is a ${expected}.`);
+		return false;
+	}));
+}
 function isNonRootParams$1(params) {
 	return "frontmatter" in params && "body" in params;
 }
@@ -45081,6 +45262,10 @@ var ClineRule = class ClineRule extends ToolRule {
 	toRulesyncRule() {
 		if (this.isRoot()) return this.toRulesyncRuleDefault();
 		const globs = this.frontmatter?.alwaysApply === true ? ["**/*"] : normalizePaths$1(this.frontmatter?.paths);
+		const cline = extractClineSection({
+			frontmatter: this.frontmatter,
+			relativeFilePath: this.getRelativeFilePath()
+		});
 		return new RulesyncRule({
 			outputRoot: process.cwd(),
 			relativeDirPath: RULESYNC_RULES_RELATIVE_DIR_PATH,
@@ -45089,7 +45274,8 @@ var ClineRule = class ClineRule extends ToolRule {
 				root: false,
 				targets: ["*"],
 				description: this.frontmatter?.description,
-				globs
+				globs,
+				...Object.keys(cline).length > 0 && { cline }
 			},
 			body: this.body ?? this.getFileContent()
 		});
@@ -45134,16 +45320,22 @@ var ClineRule = class ClineRule extends ToolRule {
 	* universal match-everything globs mean "always", so they map to
 	* `alwaysApply: true` instead of a `paths` list; specific globs become
 	* conditional `paths`; an empty globs list leaves the rule always-active with
-	* no `paths`/`alwaysApply`.
+	* no `paths`/`alwaysApply`. Every key of the rulesync `cline:` section
+	* (e.g. `disabled: true`) is written into the frontmatter too; the canonical
+	* `paths` / `alwaysApply` / `description` win over same-named keys there.
 	*/
 	static buildNonRootRule({ outputRoot, rulesyncRule, validate, relativeDirPath }) {
 		const rulesyncFrontmatter = rulesyncRule.getFrontmatter();
 		const globs = normalizePaths$1(rulesyncFrontmatter.globs);
 		const isUniversal = globs.length > 0 && globs.every((glob) => glob === "**/*" || glob === "*");
+		const rawClineSection = rulesyncFrontmatter.cline ?? {};
+		for (const key of CANONICAL_CLINE_RULE_KEYS) if (Object.hasOwn(rawClineSection, key)) warnWithFallback(void 0, `Cline rules: ignoring cline.${key} in ${rulesyncRule.getRelativeFilePath()}: set the canonical ${key === "description" ? "description" : "globs"} instead.`);
+		const clineSection = omitCanonicalClineRuleKeys(rawClineSection);
 		const frontmatter = {
 			paths: globs.length > 0 && !isUniversal ? globs : void 0,
 			alwaysApply: isUniversal ? true : void 0,
-			description: rulesyncFrontmatter.description || void 0
+			description: rulesyncFrontmatter.description || void 0,
+			...clineSection
 		};
 		return new ClineRule({
 			outputRoot,
@@ -55830,6 +56022,14 @@ function applyCommandPrefix({ def, converterConfig }) {
 	if (isExecForm) return `${bracePlaceholder(converterConfig.projectDirVar)}/${stripSurroundingQuotes(relativeCommand)}`;
 	return anchorInline(`"${converterConfig.projectDirVar}"/${relativeCommand}`);
 }
+/** Whether a field restricted to some events applies on this one. */
+function isEventApplicable({ events, eventName }) {
+	return events === void 0 || events.has(eventName);
+}
+/** Quote and comma-join a set of names (events, hook types) for a warning. */
+function describeEvents(names) {
+	return [...names].map((name) => `"${name}"`).join(", ");
+}
 /**
 * Whether a field registered for `command` hooks only applies to this hook.
 * Applied on both export and import: a value imported into a canonical field
@@ -55851,7 +56051,7 @@ function isFieldApplicable({ commandOnly, hookType }) {
 * silence — the mirror of the import side.
 */
 function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn }) {
-	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag } of fields) {
+	for (const { canonical, tool, commandOnly, maxLength, collapseWhitespaceForLength, onlyWithFlag, events } of fields) {
 		const value = def[canonical];
 		if (value === void 0) continue;
 		if (!isFieldApplicable({
@@ -55861,6 +56061,13 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on "command" hooks only, so it is not generated.`);
 			continue;
 		}
+		if (events !== void 0 && !isEventApplicable({
+			events,
+			eventName
+		})) {
+			if (value !== false) warn?.(`Dropping "${canonical}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${describeEvents(events)} only, so it is not generated.`);
+			continue;
+		}
 		if (!isValid({
 			value,
 			canonical
@@ -55874,9 +56081,12 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 			if (length > maxLength) warn?.(`"${canonical}" on a "${hookType}" hook on "${eventName}" is ${length} characters long${collapseWhitespaceForLength ? " after collapsing whitespace" : ""}; this tool caps "${tool}" at ${maxLength} characters and will shorten it.`);
 		}
 	}
-	return Object.fromEntries(fields.filter(({ canonical, commandOnly }) => isFieldApplicable({
+	return Object.fromEntries(fields.filter(({ canonical, commandOnly, events }) => isFieldApplicable({
 		commandOnly,
 		hookType
+	}) && isEventApplicable({
+		events,
+		eventName
 	}) && isValid({
 		value: def[canonical],
 		canonical
@@ -55889,16 +56099,24 @@ function emitPassthroughFields({ def, hookType, eventName, fields, isValid, warn
 * kind has a rule an authored file can plausibly violate — turns a rejected
 * value into a warning instead of a silent drop.
 */
-function importPassthroughFields({ h, hookType, fields, isValid, describeInvalid, warn }) {
-	const applicable = fields.filter(({ commandOnly }) => isFieldApplicable({
+function importPassthroughFields({ h, hookType, eventName, fields, isValid, describeInvalid, warn }) {
+	const typeApplicable = fields.filter(({ commandOnly }) => isFieldApplicable({
 		commandOnly,
 		hookType
 	}));
+	const applicable = typeApplicable.filter(({ events }) => isEventApplicable({
+		events,
+		eventName
+	}));
 	const skipped = fields.filter(({ commandOnly }) => !isFieldApplicable({
 		commandOnly,
 		hookType
 	}));
 	for (const { tool } of skipped) if (h[tool] !== void 0) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook: this tool documents it on "command" hooks only, so it is not imported.`);
+	for (const { tool, events } of typeApplicable) if (events !== void 0 && !isEventApplicable({
+		events,
+		eventName
+	}) && h[tool] !== void 0 && h[tool] !== false) warn?.(`Dropping "${tool}" from an imported "${hookType}" hook on "${eventName}": this tool honours it on ${describeEvents(events)} only, so it is not imported.`);
 	for (const { tool, canonical } of applicable) if (describeInvalid !== void 0 && h[tool] !== void 0 && !isValid({
 		value: h[tool],
 		canonical
@@ -56066,11 +56284,11 @@ function isKeywordFieldApplicable({ spec, hookType, eventName, flags, direction,
 		return false;
 	}
 	if (hookTypes !== void 0 && !hookTypes.has(hookType)) {
-		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${[...hookTypes].map((type) => `"${type}"`).join(", ")} hooks only, so it is not ${direction}.`);
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool documents "${tool}" on ${describeEvents(hookTypes)} hooks only, so it is not ${direction}.`);
 		return false;
 	}
 	if (events !== void 0 && !events.has(eventName)) {
-		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${[...events].map((event) => `"${event}"`).join(", ")} only, so it is not ${direction}.`);
+		warn?.(`Dropping "${field}" from a "${hookType}" hook on "${eventName}": this tool honours "${tool}" on ${describeEvents(events)} only, so it is not ${direction}.`);
 		return false;
 	}
 	if (ignoredEvents?.has(eventName)) {
@@ -56516,6 +56734,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.booleanPassthroughFields ?? [],
 			isValid: isBooleanValue,
 			warn
@@ -56530,6 +56749,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.numberPassthroughFields ?? [],
 			isValid: isImportableNumber,
 			describeInvalid: describeInvalidScalar,
@@ -56538,6 +56758,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.stringPassthroughFields ?? [],
 			isValid: isImportableString,
 			describeInvalid: describeInvalidScalar,
@@ -56546,6 +56767,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.arrayPassthroughFields ?? [],
 			isValid: isImportableArray,
 			describeInvalid: describeInvalidArray,
@@ -56554,6 +56776,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.recordPassthroughFields ?? [],
 			isValid: isEmittableRecord,
 			describeInvalid: describeInvalidRecord,
@@ -56562,6 +56785,7 @@ function importAllPassthroughFields({ h, hookType, eventName, converterConfig, w
 		...importPassthroughFields({
 			h,
 			hookType,
+			eventName,
 			fields: converterConfig.objectPassthroughFields ?? [],
 			isValid: isImportableObject,
 			describeInvalid: describeInvalidObject,
@@ -61394,6 +61618,11 @@ const GROKCLI_CONVERTER_CONFIG = {
 		tool: "env",
 		commandOnly: true
 	}],
+	booleanPassthroughFields: [{
+		canonical: "failClosed",
+		tool: "failClosed",
+		events: /* @__PURE__ */ new Set(["preToolUse", "beforeSubmitPrompt"])
+	}],
 	arrayPassthroughFields: [{
 		canonical: "args",
 		tool: "args",
@@ -63043,6 +63272,15 @@ const LETTACODE_CONVERTER_CONFIG = {
 	timeoutUnit: "milliseconds"
 };
 /**
+* Letta Code documents settings-file hooks as deprecated in favor of Mods
+* (https://docs.letta.com/reference/deprecated/hooks) but still ships the
+* loader, so rulesync keeps emitting them and tells the user once per run.
+* Mods are not modeled: they are JS/TS code modules loaded only from
+* `~/.letta/mods/` or an agent's memory directory, with no declarative or
+* project-local form a canonical hook could be translated into.
+*/
+const LETTACODE_HOOKS_DEPRECATION_WARNING = "Letta Code documents settings.json hooks as deprecated in favor of Mods and may remove them in a future release; rulesync still writes them while Letta Code loads them. See https://docs.letta.com/reference/deprecated/hooks";
+/**
 * Letta Code keeps a boolean `disabled` switch beside the event arrays inside
 * `hooks`. rulesync owns the whole `hooks` key, so the switch is read back from
 * the existing file and carried into the generated one instead of being lost.
@@ -63101,6 +63339,11 @@ function parseLettacodeSettings$1(fileContent, filePath) {
 * and UI preferences, ...), so generation merges the `hooks` key into the
 * existing file (see `SHARED_CONFIG_OWNERSHIP`) instead of overwriting it.
 *
+* Letta Code marks this surface deprecated in favor of Mods (see
+* `LETTACODE_HOOKS_DEPRECATION_WARNING`); generation warns once per run when it
+* writes any hook.
+*
+* @see https://docs.letta.com/reference/deprecated/hooks
 * @see https://github.com/letta-ai/letta-code/blob/main/src/hooks/types.ts
 * @see https://github.com/letta-ai/letta-code/blob/main/src/hooks/loader.ts
 */
@@ -63145,6 +63388,7 @@ var LettacodeHooks = class LettacodeHooks extends ToolHooks {
 			converterConfig: LETTACODE_CONVERTER_CONFIG,
 			logger
 		});
+		if (Object.keys(hooks).length > 0) warnOnceWithFallback(logger, LETTACODE_HOOKS_DEPRECATION_WARNING);
 		const fileContent = applySharedConfigPatch({
 			fileKey: sharedConfigFileKey(paths),
 			feature: "hooks",
@@ -65142,11 +65386,38 @@ const VIBE_DIR = ".vibe";
 const VIBE_HOOKS_FILE_NAME = "hooks.toml";
 /**
 * Vibe scopes the tool-name `match` glob and the `strict` flag to tool hooks
-* (`pre_tool` / `post_tool`) only; `post_agent` fires after every
-* assistant turn and carries no matcher.
-* @see https://github.com/mistralai/mistral-vibe/blob/main/README.md
+* (`pre_tool` / `post_tool`). `post_agent` takes a `match` too since v3.0.3,
+* but on the name of the agent that finished its turn, not a tool name (see
+* {@link VIBE_MAIN_AGENT_MATCH}).
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
 */
 const VIBE_TOOL_EVENTS = /* @__PURE__ */ new Set(["pre_tool", "post_tool"]);
+/** The Vibe event both canonical `stop` and `subagentStop` become. */
+const VIBE_POST_AGENT_EVENT = "post_agent";
+/**
+* The reserved agent alias a `post_agent` hook's `match` uses to run only
+* after the main agent. Without a `match`, `post_agent` runs after every
+* agent, subagents included (v3.0.2+), whereas canonical `stop` is
+* main-agent-only — so `stop` is written with this match.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+*/
+const VIBE_MAIN_AGENT_MATCH = "main";
+/**
+* The `post_agent` `match` for a canonical `subagentStop` hook, or null to
+* skip it. Vibe has no selector for "every subagent but not the main agent",
+* so a matcher naming the subagent is required.
+*/
+function toVibeSubagentMatch({ matcher, logger }) {
+	if (typeof matcher !== "string" || matcher === "" || matcher === "*") {
+		logger?.warn("Vibe hooks: skipping a \"subagentStop\" hook without an agent-name matcher. Vibe's post_agent cannot select every subagent without also running after the main agent; set \"matcher\" to the subagent name.");
+		return null;
+	}
+	if (matcher.toLowerCase() === VIBE_MAIN_AGENT_MATCH) {
+		logger?.warn("Vibe hooks: skipping a \"subagentStop\" hook whose matcher is \"main\". Vibe reserves \"main\" for the main agent; use a \"stop\" hook instead.");
+		return null;
+	}
+	return matcher;
+}
 const SUPPORTED_VIBE_EVENTS = new Set(VIBE_HOOK_EVENTS);
 /**
 * The `match` a canonical `Bash` matcher becomes. Vibe tests `match` against a
@@ -65170,7 +65441,8 @@ function fromVibeHookMatch(match) {
 /**
 * Build the flat `[[hooks]]` array for `.vibe/hooks.toml` from a canonical
 * hooks config. Vibe uses a flat array where each entry carries its own event
-* `type`, tool-name `match` glob/regex, and `command`. Only `type: "command"`
+* `type`, `match` glob/regex (a tool name for tool hooks, an agent name
+* for `post_agent`), and `command`. Only `type: "command"`
 * canonical hooks are emitted: a Vibe hook is a shell command line. (v2.25.1
 * to v2.25.4 briefly exec'd it without a shell under the unified harness and
 * skipped any command containing a backslash; v2.25.5 restored shell
@@ -65178,7 +65450,7 @@ function fromVibeHookMatch(match) {
 * now run through the shell" — and dropped the backslash skip.)
 * @see https://github.com/mistralai/mistral-vibe/blob/v3.0.2/README.md
 */
-function canonicalToVibeHooks({ config, toolOverride }) {
+function canonicalToVibeHooks({ config, toolOverride, logger }) {
 	const shared = {};
 	for (const [event, defs] of Object.entries(config.hooks)) if (SUPPORTED_VIBE_EVENTS.has(event)) shared[event] = defs;
 	const effective = {
@@ -65186,30 +65458,40 @@ function canonicalToVibeHooks({ config, toolOverride }) {
 		...toolOverride
 	};
 	const hooks = [];
+	const nextIndexByVibeEvent = /* @__PURE__ */ new Map();
 	for (const [event, defs] of Object.entries(effective)) {
 		if (!SUPPORTED_VIBE_EVENTS.has(event)) continue;
 		const vibeEvent = lookupOwn({
 			record: CANONICAL_TO_VIBE_EVENT_NAMES,
 			key: event
 		}) ?? event;
-		let index = 0;
 		for (const def of defs) {
 			if ((def.type ?? "command") !== "command") continue;
 			if (typeof def.command !== "string") continue;
-			const name = typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`;
 			const isToolEvent = VIBE_TOOL_EVENTS.has(vibeEvent);
+			let match;
+			if (isToolEvent) match = toVibeHookMatch(def.matcher);
+			else if (event === "subagentStop") {
+				const subagentMatch = toVibeSubagentMatch({
+					matcher: def.matcher,
+					logger
+				});
+				if (subagentMatch === null) continue;
+				match = subagentMatch;
+			} else match = VIBE_MAIN_AGENT_MATCH;
+			const index = nextIndexByVibeEvent.get(vibeEvent) ?? 0;
 			const entry = {
-				name,
+				name: typeof def.name === "string" ? def.name : `${vibeEvent}-${index}`,
 				type: vibeEvent,
+				match,
 				command: def.command
 			};
-			if (isToolEvent) entry.match = toVibeHookMatch(def.matcher);
 			if (typeof def.timeout === "number") entry.timeout = def.timeout;
 			const strict = def.strict;
 			if (isToolEvent && typeof strict === "boolean") entry.strict = strict;
 			if (typeof def.description === "string") entry.description = def.description;
 			hooks.push(entry);
-			index += 1;
+			nextIndexByVibeEvent.set(vibeEvent, index + 1);
 		}
 	}
 	return { hooks };
@@ -65221,14 +65503,22 @@ function vibeEntryToCanonicalDef(raw) {
 	const vibeEvent = typeof entry.type === "string" ? entry.type : void 0;
 	if (vibeEvent === void 0) return null;
 	if (isPrototypePollutionKey(vibeEvent)) return null;
-	const canonicalEvent = lookupOwn({
+	let canonicalEvent = lookupOwn({
 		record: VIBE_TO_CANONICAL_EVENT_NAMES,
 		key: vibeEvent
 	}) ?? vibeEvent;
 	const def = { type: "command" };
 	if (typeof entry.command === "string") def.command = entry.command;
-	const matcher = fromVibeHookMatch(entry.match);
-	if (matcher !== void 0) def.matcher = matcher;
+	if (vibeEvent === VIBE_POST_AGENT_EVENT) {
+		const agentMatch = typeof entry.match === "string" ? entry.match : "";
+		if (agentMatch !== "" && agentMatch !== "*" && agentMatch.toLowerCase() !== VIBE_MAIN_AGENT_MATCH) {
+			canonicalEvent = "subagentStop";
+			def.matcher = agentMatch;
+		}
+	} else {
+		const matcher = fromVibeHookMatch(entry.match);
+		if (matcher !== void 0) def.matcher = matcher;
+	}
 	if (typeof entry.timeout === "number") def.timeout = entry.timeout;
 	if (typeof entry.name === "string") def.name = entry.name;
 	if (typeof entry.description === "string") def.description = entry.description;
@@ -65259,6 +65549,26 @@ function vibeHooksToCanonical(parsed) {
 	}
 	return canonical;
 }
+/** Vibe reads a `match` with a `re:` prefix or glob metacharacters as a pattern. */
+const VIBE_PATTERN_MATCH = /^re:|[*?[]/;
+/**
+* Move the imported `subagentStop` hooks into the `vibe` override when any of
+* them matches agents by a regex or glob rather than by a literal name. Such a
+* pattern can also select the main agent (a main session answers to its mode
+* name, e.g. `accept-edits`), and other tools would read it as their own
+* matcher syntax, so it is kept Vibe-only. The override replaces the shared
+* list for its event, so the whole list moves to keep every entry on Vibe.
+*/
+function takeVibeOnlySubagentStop({ hooks, logger }) {
+	const defs = lookupOwn({
+		record: hooks,
+		key: "subagentStop"
+	});
+	if (defs === void 0 || !defs.some((def) => typeof def.matcher === "string" && VIBE_PATTERN_MATCH.test(def.matcher))) return;
+	delete hooks.subagentStop;
+	logger?.warn("Vibe hooks: a post_agent hook matches agents by a pattern, so its subagentStop hooks are imported into the vibe override instead of the shared hooks.");
+	return defs;
+}
 function parseVibeToml(fileContent) {
 	const parsed = smol_toml.parse(fileContent || smol_toml.stringify({}));
 	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
@@ -65298,12 +65608,13 @@ var VibeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false }) {
+	static async fromRulesyncHooks({ outputRoot = process.cwd(), rulesyncHooks, validate = true, global = false, logger }) {
 		const paths = this.getSettablePaths({ global });
 		const config = rulesyncHooks.getJson();
 		const vibeHooks = canonicalToVibeHooks({
 			config,
-			toolOverride: config.vibe?.hooks
+			toolOverride: config.vibe?.hooks,
+			logger
 		});
 		const fileContent = smol_toml.stringify(vibeHooks);
 		return new this({
@@ -65314,15 +65625,30 @@ var VibeHooks = class extends ToolHooks {
 			validate
 		});
 	}
-	toRulesyncHooks() {
+	toRulesyncHooks(options = {}) {
 		const hooks = vibeHooksToCanonical(this.parseFileContentOrThrow({
 			displayName: "Vibe",
 			parse: (fileContent) => parseVibeToml(fileContent)
 		}));
-		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(buildImportedHooksConfig({
+		const vibeOnlySubagentStop = takeVibeOnlySubagentStop({
+			hooks,
+			logger: options.logger
+		});
+		const config = buildImportedHooksConfig({
 			hooks,
 			overrideKey: "vibe"
-		}), null, 2) });
+		});
+		if (vibeOnlySubagentStop !== void 0) {
+			const override = config.vibe ?? {};
+			config.vibe = {
+				...override,
+				hooks: {
+					...override.hooks,
+					subagentStop: vibeOnlySubagentStop
+				}
+			};
+		}
+		return this.toRulesyncHooksDefault({ fileContent: JSON.stringify(config, null, 2) });
 	}
 	validate() {
 		try {
@@ -76939,6 +77265,12 @@ const REASONIX_PLUGIN_FIELDS = [
 	"load",
 	"oauth_allow_missing_pkce_metadata"
 ];
+/**
+* The `load` mode that puts a server's tools in the provider schema. Reasonix
+* compares it case-insensitively after trimming (`normalizeMCPLoad`).
+* @see https://github.com/esengine/DeepSeek-Reasonix/blob/studio-v2.53.0/internal/contract/config/mcp_load.go
+*/
+const REASONIX_MCP_LOAD_ALWAYS = "always";
 /** The `[[plugins]]` key that canonical `disabledTools` is written to and read from. */
 const REASONIX_DISABLED_TOOLS_KEY = "disabled_tools";
 var ReasonixMcp = class ReasonixMcp extends ToolMcp {
@@ -77103,7 +77435,9 @@ function hasExpectedType(value, expected) {
 * `concurrency` string decodes fine but is ignored in favor of the server-name
 * default, so it is dropped too rather than written as a setting that does
 * nothing. An unknown `load` string is read as `deferred`, the default, so it
-* passes through as authored.
+* passes through as authored. A project `load = "always"` also passes through,
+* but is warned about in `writePassthroughFields`: see the v2.53.0 note on
+* `REASONIX_PLUGIN_FIELDS`.
 * @see https://github.com/esengine/DeepSeek-Reasonix/blob/v2.31.0/internal/contract/config/plugin_entry.go
 */
 function invalidPassthroughFieldReason(field, value) {
@@ -77143,6 +77477,7 @@ function writePassthroughFields({ name, server, plugin, global, logger }) {
 			continue;
 		}
 		if (field === "oauth_allow_missing_pkce_metadata" && value === true) logger?.warn(`Reasonix MCP: "${name}" sets "oauth_allow_missing_pkce_metadata", which lets OAuth proceed with an authorization server that does not advertise PKCE support.` + (global ? "" : ` Reasonix honours it only from the user config, not a project reasonix.toml.`));
+		if (field === "load" && !global && server.disabled !== true && typeof value === "string" && value.trim().toLowerCase() === REASONIX_MCP_LOAD_ALWAYS) logger?.warn(`Reasonix MCP: "${name}" sets "load" to "always" in the project reasonix.toml. Reasonix 2.53.0 and later ignore a project-declared load mode and defer the server; set it in the user config (the server's "load" or [tools.mcp_load]) instead.`);
 		plugin[field] = value;
 	}
 }
@@ -86081,6 +86416,41 @@ var ClinePermissions = class ClinePermissions extends ToolPermissions {
 // src/features/permissions/codebuddy-permissions.ts
 /** Top-level key of `.codebuddy/settings.json` that rulesync owns. */
 const CODEBUDDY_PERMISSIONS_KEY = "permissions";
+/**
+* The top-level settings groups the `codebuddy` override may author, each with
+* the only keys of that group rulesync writes and imports. A group's other
+* keys are kept as the file has them; an override key not listed here is
+* skipped with a warning.
+*
+* - `autoReview`: the `auto` permission mode's review policy (`policy`
+*   replaces the built-in security policy, `extraPolicy` is appended to it).
+* - `autoMode`: the legacy natural-language `auto` rules, still read as
+*   additional policy.
+* - `memory.parentDiscovery`: whether `CODEBUDDY.md` / `AGENTS.md` are also
+*   discovered in parent directories of the launch directory.
+*
+* @see https://www.codebuddy.ai/docs/cli/settings
+* @see https://www.codebuddy.ai/docs/cli/memory
+*/
+const CODEBUDDY_OVERRIDE_GROUP_KEYS = {
+	autoReview: ["policy", "extraPolicy"],
+	autoMode: [
+		"environment",
+		"allow",
+		"soft_deny",
+		"hard_deny"
+	],
+	memory: ["parentDiscovery"]
+};
+const CODEBUDDY_OVERRIDE_GROUPS = Object.keys(CODEBUDDY_OVERRIDE_GROUP_KEYS);
+/**
+* Groups CodeBuddy reads from the user and project-local settings only: the
+* shared project `.codebuddy/settings.json` is not read for them, so a checked-in
+* repository cannot relax the review of its own actions. They are written and
+* imported in global mode alone.
+* @see https://www.codebuddy.ai/docs/cli/settings
+*/
+const CODEBUDDY_USER_ONLY_GROUPS = /* @__PURE__ */ new Set(["autoReview", "autoMode"]);
 /** The rule lists under `permissions`, one per canonical action. */
 const CODEBUDDY_RULE_LISTS = [
 	"allow",
@@ -86234,6 +86604,87 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 	return lists;
 }
 /**
+* Whether a settings value has the shape the `codebuddy` override schema
+* accepts for that key, so an off-spec value is left in the file instead of
+* being written or making the imported permissions file fail validation.
+*/
+function isLiftableCodebuddyValue(key, value) {
+	switch (key) {
+		case "policy":
+		case "extraPolicy": return typeof value === "string";
+		case "parentDiscovery": return typeof value === "boolean";
+		default: return isStringArray(value);
+	}
+}
+/** Name every written override setting that can make the `auto` review more lenient. */
+function announceCodebuddyReviewSettings({ picked, group, where, logger }) {
+	if (group === "autoReview" && typeof picked.policy === "string") logger?.warn(`CodeBuddy permissions: codebuddy.autoReview.policy was written to ${where}, so it replaces CodeBuddy's built-in security policy for the 'auto' permission mode.`);
+	if (group === "autoReview" && typeof picked.extraPolicy === "string") logger?.warn(`CodeBuddy permissions: codebuddy.autoReview.extraPolicy was written to ${where}, so it is appended to the security policy CodeBuddy's 'auto' permission mode reviews actions against.`);
+	if (group === "autoMode" && toStringArray$1(picked.allow).length > 0) logger?.warn(`CodeBuddy permissions: codebuddy.autoMode.allow was written to ${where}, so CodeBuddy's 'auto' permission mode leans toward approving the actions it describes.`);
+}
+/**
+* The top-level keys the `codebuddy` override contributes to the settings
+* patch, besides `permissions`. Each group is the existing group with the
+* authored keys laid over it; a group is only in the patch when authored, so
+* a hand-set value survives an unrelated regeneration.
+*/
+function buildCodebuddyOverridePatch({ override, existing, global, where, logger }) {
+	const patch = {};
+	if (override === void 0) return patch;
+	for (const group of CODEBUDDY_OVERRIDE_GROUPS) {
+		const authored = override[group];
+		if (!isRecord(authored)) continue;
+		if (CODEBUDDY_USER_ONLY_GROUPS.has(group) && !global) {
+			logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group} in project mode — CodeBuddy does not read ${group} from the shared project .codebuddy/settings.json. Run 'rulesync generate --global' to write it to ~/.codebuddy/settings.json.`);
+			continue;
+		}
+		const allowedKeys = CODEBUDDY_OVERRIDE_GROUP_KEYS[group];
+		const picked = {};
+		for (const [key, value] of Object.entries(authored)) {
+			if (isPrototypePollutionKey(key) || value === void 0) continue;
+			if (!allowedKeys.includes(key)) {
+				logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group}.${key} — Rulesync writes only ${allowedKeys.map((k) => `${group}.${k}`).join(", ")} from the codebuddy override; set other keys in ${where} by hand.`);
+				continue;
+			}
+			picked[key] = value;
+		}
+		if (Object.keys(picked).length === 0) continue;
+		const existingValue = existing[group];
+		if (existingValue !== void 0 && !isRecord(existingValue)) {
+			logger?.warn(`CodeBuddy permissions: skipping codebuddy.${group} — ${group} in ${where} is not an object, so Rulesync leaves it as it is. Fix it by hand to let Rulesync write ${group}.`);
+			continue;
+		}
+		patch[group] = {
+			...existingValue,
+			...picked
+		};
+		announceCodebuddyReviewSettings({
+			picked,
+			group,
+			where,
+			logger
+		});
+	}
+	return patch;
+}
+/**
+* Lift the settings the `codebuddy` override authors back out of a settings
+* file. `autoReview` and `autoMode` are lifted only from the user file, the
+* one of the two rulesync manages that CodeBuddy reads them from.
+*/
+function liftCodebuddyOverride({ settings, global }) {
+	const lifted = {};
+	for (const group of CODEBUDDY_OVERRIDE_GROUPS) {
+		if (CODEBUDDY_USER_ONLY_GROUPS.has(group) && !global) continue;
+		const existingGroup = settings[group];
+		if (!isRecord(existingGroup)) continue;
+		const picked = {};
+		for (const key of CODEBUDDY_OVERRIDE_GROUP_KEYS[group]) if (Object.hasOwn(existingGroup, key) && isLiftableCodebuddyValue(key, existingGroup[key])) picked[key] = existingGroup[key];
+		if (Object.keys(picked).length > 0) lifted[group] = picked;
+	}
+	return lifted;
+}
+/**
 * CodeBuddy Code permissions.
 *
 * Rules live under the `permissions` key of `.codebuddy/settings.json`
@@ -86244,7 +86695,10 @@ function buildCodebuddyRuleLists({ config, existingPermissions, logger }) {
 * writes go through the shared-config gateway, the sibling keys of the rule
 * lists (`defaultMode`, `additionalDirectories`, `trustedDirectories`, ...)
 * are kept, and the file is never deleted. The gitignored
-* `.codebuddy/settings.local.json` layer is left to CodeBuddy.
+* `.codebuddy/settings.local.json` layer is left to CodeBuddy. The
+* `codebuddy` override's other settings (`autoReview`, `autoMode`,
+* `memory.parentDiscovery`) go through `buildCodebuddyOverridePatch` /
+* `liftCodebuddyOverride`.
 *
 * @see https://www.codebuddy.ai/docs/cli/permissions
 * @see https://www.codebuddy.ai/docs/cli/settings
@@ -86283,8 +86737,9 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 			relativePath: (0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)
 		});
 		const existingPermissions = isRecord(existing[CODEBUDDY_PERMISSIONS_KEY]) ? existing[CODEBUDDY_PERMISSIONS_KEY] : {};
+		const config = rulesyncPermissions.getJson();
 		const lists = buildCodebuddyRuleLists({
-			config: rulesyncPermissions.getJson(),
+			config,
 			existingPermissions,
 			logger
 		});
@@ -86299,7 +86754,16 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 				fileKey: sharedConfigFileKey(paths),
 				feature: "permissions",
 				existingContent,
-				patch: { [CODEBUDDY_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0 },
+				patch: {
+					[CODEBUDDY_PERMISSIONS_KEY]: Object.keys(permissions).length > 0 ? permissions : void 0,
+					...buildCodebuddyOverridePatch({
+						override: config.codebuddy,
+						existing,
+						global,
+						where: `${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)}${global ? " in the home directory" : ""}`,
+						logger
+					})
+				},
 				filePath
 			}),
 			validate: true,
@@ -86320,7 +86784,14 @@ var CodebuddyPermissions = class CodebuddyPermissions extends ToolPermissions {
 			const existing = rules[parsed.pattern];
 			if (existing === void 0 || PERMISSION_ACTION_PRIORITY[action] > PERMISSION_ACTION_PRIORITY[existing]) rules[parsed.pattern] = action;
 		}
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const codebuddy = liftCodebuddyOverride({
+			settings,
+			global: this.global
+		});
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...Object.keys(codebuddy).length > 0 && { codebuddy }
+		}, null, 2) });
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
 		return new CodebuddyPermissions({
@@ -89286,7 +89757,7 @@ const AUTO_APPROVE_KEYS = {
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
-const DEFAULT_PERMISSION_MODE_KEY = "chat.permissions.default";
+const DEFAULT_PERMISSION_MODE_KEY$1 = "chat.permissions.default";
 /**
 * The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
 * at path `a.b` is written to `chat.agent.sandbox.a.b`.
@@ -89574,7 +90045,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			});
 		}
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
-		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY$1] = defaultPermissionMode;
 		const sandbox = config.copilot?.sandbox;
 		if (sandbox !== void 0) {
 			Object.assign(patch, buildSandboxPatch({
@@ -89630,7 +90101,7 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			for (const [pattern, flag] of Object.entries(autoApprove)) rules[pattern] = flag ? "allow" : "deny";
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
-		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY];
+		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY$1];
 		const sandbox = readSandboxFromSettings(settings);
 		const copilot = {
 			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
@@ -89663,6 +90134,16 @@ const WEBFETCH_CATEGORY$1 = "webfetch";
 /** `~/.copilot/settings.json` and `.github/copilot/settings.json` keys. */
 const ALLOWED_URLS_KEY = "allowedUrls";
 const DENIED_URLS_KEY = "deniedUrls";
+/**
+* `~/.copilot/settings.json` only: the startup permission mode for new
+* interactive sessions, authored through the `copilotcli.defaultPermissionMode`
+* override. It is a user setting — the repository settings file does not list
+* it among its repo-overridable keys.
+*/
+const DEFAULT_PERMISSION_MODE_KEY = "defaultPermissionMode";
+function isCopilotcliDefaultPermissionMode(value) {
+	return COPILOTCLI_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
+}
 function toUrlList(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((entry) => typeof entry === "string");
@@ -89704,6 +90185,13 @@ function splitUrlRules(rules) {
 * top-level keys in the user `settings.json`, so only documented keys are ever
 * emitted there either.)
 *
+* The `copilotcli.defaultPermissionMode` override (`manual` | `assisted` |
+* `allow-all`) writes the user-scope `defaultPermissionMode` key in global mode
+* only; in project mode it is skipped with a warning, since the repository
+* settings file does not accept it. It is patched only when authored, so a mode
+* the user picked through `/settings` otherwise survives. Writing `allow-all`
+* warns, because it makes new sessions skip every approval prompt.
+*
 * @see https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-config-dir-reference
 * @see https://github.com/github/copilot-cli/blob/main/changelog.md
 */
@@ -89746,7 +90234,8 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		const paths = CopilotcliPermissions.getSettablePaths({ global });
 		const filePath = (0, node_path.join)(outputRoot, paths.relativeDirPath, paths.relativeFilePath);
 		const existingContent = await readFileContentOrNull(filePath) ?? "{}";
-		const rules = rulesyncPermissions.getJson().permission[WEBFETCH_CATEGORY$1];
+		const config = rulesyncPermissions.getJson();
+		const rules = config.permission[WEBFETCH_CATEGORY$1];
 		const patch = {};
 		if (rules !== void 0) {
 			const { allowedUrls, deniedUrls } = splitUrlRules(rules);
@@ -89754,6 +90243,13 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 			if (global) patch[ALLOWED_URLS_KEY] = allowedUrls.length > 0 ? allowedUrls : void 0;
 			else if (allowedUrls.length > 0) logger?.warn(`Copilot CLI permissions: dropping ${allowedUrls.length} "webfetch" allow rule(s) at project scope — ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${ALLOWED_URLS_KEY}" (repository settings may only add denials). Author allow rules in global scope (\`--global\`) instead.`);
 		}
+		const defaultPermissionMode = config.copilotcli?.defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) {
+			if (global) {
+				patch[DEFAULT_PERMISSION_MODE_KEY] = defaultPermissionMode;
+				if (defaultPermissionMode === "allow-all") logger?.warn(`Copilot CLI permissions: writing "${DEFAULT_PERMISSION_MODE_KEY}": "allow-all" to ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} — new interactive sessions will start with every tool, path and URL approved without prompting (equivalent to \`--allow-all\`). Deny rules and enterprise policy still apply.`);
+			} else logger?.warn(`Copilot CLI permissions: skipping "copilotcli.${DEFAULT_PERMISSION_MODE_KEY}" at project scope — ${(0, node_path.join)(paths.relativeDirPath, paths.relativeFilePath)} does not accept "${DEFAULT_PERMISSION_MODE_KEY}" (it is a user setting). Author it in global scope (\`--global\`) instead.`);
+		}
 		return new CopilotcliPermissions({
 			outputRoot,
 			relativeDirPath: paths.relativeDirPath,
@@ -89775,7 +90271,11 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 		for (const pattern of toUrlList(settings[DENIED_URLS_KEY])) rules[pattern] = "deny";
 		if (this.global) for (const pattern of toUrlList(settings[ALLOWED_URLS_KEY])) rules[pattern] ??= "allow";
 		const permission = Object.keys(rules).length > 0 ? { [WEBFETCH_CATEGORY$1]: rules } : {};
-		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({ permission }, null, 2) });
+		const defaultPermissionMode = this.global ? settings[DEFAULT_PERMISSION_MODE_KEY] : void 0;
+		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
+			permission,
+			...isCopilotcliDefaultPermissionMode(defaultPermissionMode) && { copilotcli: { defaultPermissionMode } }
+		}, null, 2) });
 	}
 	parseSettings() {
 		const relativePath = (0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath());
@@ -95280,6 +95780,7 @@ var MimocodePermissions = class extends OpencodePermissions {
 // src/features/permissions/omp-permissions.ts
 const CATCH_ALL_PATTERN$5 = "*";
 const APPROVAL_MODE_KEY = "approvalMode";
+const RESTRICTED_FOLDERS_KEY = "restrictedFolders";
 const ACTION_TO_OMP_APPROVAL = {
 	allow: "allow",
 	ask: "prompt",
@@ -95318,9 +95819,9 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *
 * - `tools.approval.<tool>: allow | prompt | deny` is a per-tool policy honored
 *   in every approval mode. A category's catch-all `*` rule maps here
-*   (`ask` → `prompt`). oh-my-pi has no per-path matcher, so a non-bash category
-*   with pattern-specific rules collapses to one action (deny > ask > allow, with
-*   an implicit `ask` when there is no catch-all) and a warning.
+*   (`ask` → `prompt`). `tools.approval` has no per-path matcher, so a non-bash
+*   category with pattern-specific rules collapses to one action (deny > ask >
+*   allow, with an implicit `ask` when there is no catch-all) and a warning.
 * - `bash.patterns: [{ match, approval }]` is an ordered, first-match-wins list
 *   of command globs (only `*` is a wildcard). Every `bash` rule except a
 *   catch-all `allow` is written there, ordered deny → prompt → allow so that
@@ -95337,12 +95838,15 @@ const MANAGED_OMP_TOOLS = /* @__PURE__ */ new Set([
 *
 * The `omp.approvalMode` override writes `tools.approvalMode` (`always-ask`,
 * `always-ask-cached`, `write` or `yolo`); without it the key is left as it is in the file, and on
-* import a recognized value is read back into the override.
+* import a recognized value is read back into the override. Likewise the
+* `omp.restrictedFolders` override writes `tools.restrictedFolders` (folders
+* where every action prompts in every approval mode, `yolo` included), is left
+* alone when absent, and is read back on import.
 *
 * `config.yml` carries every other oh-my-pi setting, so only `tools.approval`
 * (the keys rulesync manages), `bash.patterns` and an authored
-* `tools.approvalMode` are rewritten; sibling keys such as `bash.enabled` are
-* kept, and the file is never deleted.
+* `tools.approvalMode` or `tools.restrictedFolders` are rewritten; sibling
+* keys such as `bash.enabled` are kept, and the file is never deleted.
 *
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/settings.md
 * @see https://github.com/can1357/oh-my-pi/blob/main/docs/approval-mode.md
@@ -95391,6 +95895,7 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 			logger
 		});
 		const approvalMode = config.omp?.approvalMode;
+		const restrictedFolders = config.omp?.restrictedFolders;
 		const existingTools = isRecord(existing.tools) ? existing.tools : {};
 		const nextApproval = {
 			...isRecord(existingTools.approval) ? Object.fromEntries(Object.entries(existingTools.approval).filter(([tool]) => !MANAGED_OMP_TOOLS.has(tool) && !Object.hasOwn(approval, tool)).map(([tool, value]) => [tool, raisedApproval(value, floor)])) : {},
@@ -95398,6 +95903,7 @@ var OmpPermissions = class OmpPermissions extends ToolPermissions {
 		};
 		const toolsSiblings = withoutKey(existingTools, "approval");
 		if (approvalMode !== void 0) toolsSiblings[APPROVAL_MODE_KEY] = approvalMode;
+		if (restrictedFolders !== void 0) toolsSiblings[RESTRICTED_FOLDERS_KEY] = restrictedFolders;
 		const nextTools = Object.keys(nextApproval).length > 0 ? {
 			...toolsSiblings,
 			approval: nextApproval
@@ -95648,11 +96154,26 @@ function convertOmpToRulesync(config) {
 	}
 	if (Object.keys(bashRules).length > 0) permission.bash = bashRules;
 	const approvalMode = tools[APPROVAL_MODE_KEY];
+	const restrictedFolders = importRestrictedFolders(tools[RESTRICTED_FOLDERS_KEY]);
+	const omp = {
+		...isOmpApprovalMode(approvalMode) && { approvalMode },
+		...restrictedFolders !== void 0 && { restrictedFolders }
+	};
 	return {
 		permission,
-		...isOmpApprovalMode(approvalMode) && { omp: { approvalMode } }
+		...Object.keys(omp).length > 0 && { omp }
 	};
 }
+/**
+* `tools.restrictedFolders` as the override list: its string entries, or
+* `undefined` when it is unset or no entry survives (so a list of non-strings
+* is not imported as `[]` and then rewritten as an empty list).
+*/
+function importRestrictedFolders(value) {
+	if (!Array.isArray(value)) return;
+	const folders = value.filter((entry) => typeof entry === "string");
+	return folders.length === 0 && value.length > 0 ? void 0 : folders;
+}
 function isOmpApprovalMode(value) {
 	return OMP_APPROVAL_MODES.some((mode) => mode === value);
 }
@@ -100749,19 +101270,31 @@ const CANONICAL_TO_VIBE_TOOL_NAMES = {
 };
 /**
 * The tables earlier rulesync versions wrote for canonical categories that
-* Vibe 3.x no longer reads: `[tools.grep]` (Vibe warns that it "has no
-* effect") and `[tools.task]` for the subagent tool v3.0.0 renamed to
-* `agents.*`. A regenerate that configures the category removes them — and
+* Vibe 3.x does not read: `[tools.grep]` (Vibe warns that it "has no
+* effect"), `[tools.task]` for the subagent tool v3.0.0 renamed to
+* `agents.*`, and `[tools.external_directory]` — Vibe has no such tool, and
+* its unused-settings check skips unknown tool names as custom/MCP tools, so
+* that deny was silently inert. A regenerate that configures the category removes them — and
 * the matching `disabled_tools` entry — instead of leaving an inert table.
 * Import still reads them (see {@link VIBE_TO_CANONICAL_TOOL_NAMES}), so a
 * Vibe 2.x config is lifted into the canonical categories rather than lost.
 */
 const VIBE_RETIRED_TOOL_TABLES = {
 	grep: "grep",
-	agent: "task"
+	agent: "task",
+	external_directory: "external_directory"
 };
 /** The canonical category Vibe's `enable_subagents` switch expresses. */
 const VIBE_SUBAGENT_CATEGORY = "agent";
+/** The canonical category Vibe's top-level `outside_workdir` setting expresses. */
+const VIBE_OUTSIDE_WORKDIR_CATEGORY = "external_directory";
+/**
+* The values of Vibe's `outside_workdir` (v3.0.3+). There is no allow value:
+* access outside the working directory is granted per path through a tool's
+* `allowlist` (`vibe-path:...`) or `--add-dir`.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+*/
+const VIBE_OUTSIDE_WORKDIR_VALUES = /* @__PURE__ */ new Set(["ask", "deny"]);
 const VIBE_TO_CANONICAL_TOOL_NAMES = {
 	bash: "bash",
 	read_file: "read",
@@ -100837,7 +101370,8 @@ const CANONICAL_PERMISSION_CATEGORIES = /* @__PURE__ */ new Set([
 	"grep",
 	"glob",
 	"notebookedit",
-	"agent"
+	"agent",
+	"external_directory"
 ]);
 var VibePermissions = class VibePermissions extends ToolPermissions {
 	toml;
@@ -100918,7 +101452,11 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 			rules: permission[VIBE_SUBAGENT_CATEGORY],
 			logger
 		});
-		const tableCategories = Object.entries(permission).filter(([category]) => category !== VIBE_SUBAGENT_CATEGORY);
+		const outsideWorkdirPatch = resolveOutsideWorkdirPatch({
+			rules: permission[VIBE_OUTSIDE_WORKDIR_CATEGORY],
+			logger
+		});
+		const tableCategories = Object.entries(permission).filter(([category]) => category !== VIBE_SUBAGENT_CATEGORY && category !== VIBE_OUTSIDE_WORKDIR_CATEGORY);
 		for (const [category, rules] of tableCategories) {
 			const vibeToolNames = resolveNames(category);
 			if (vibeToolNames === void 0) {
@@ -100992,7 +101530,8 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 						enabledTools
 					}),
 					disabled_tools: disabledTools.size > 0 ? [...disabledTools].toSorted() : void 0,
-					...enableSubagentsPatch
+					...enableSubagentsPatch,
+					...outsideWorkdirPatch
 				},
 				filePath
 			}),
@@ -101036,6 +101575,8 @@ var VibePermissions = class VibePermissions extends ToolPermissions {
 		}
 		for (const category of silencedCategories) ensurePermission(permission, category)["*"] = "deny";
 		if (this.toml.enable_subagents === false) ensurePermission(permission, VIBE_SUBAGENT_CATEGORY)["*"] = "deny";
+		const outsideWorkdir = this.toml.outside_workdir;
+		if (typeof outsideWorkdir === "string" && VIBE_OUTSIDE_WORKDIR_VALUES.has(outsideWorkdir)) ensurePermission(permission, VIBE_OUTSIDE_WORKDIR_CATEGORY)["*"] = outsideWorkdir === "deny" ? "deny" : "ask";
 		warnOnUnresolvableDisabledTools({
 			entries: disabledToolEntries,
 			tools: this.toml.tools
@@ -101112,7 +101653,7 @@ function retireLegacyToolTables({ permission, tools, disabledTools, logger }) {
 		}
 		if (disabledTools.delete(legacyToolName)) removed.push(`disabled_tools entry '${legacyToolName}'`);
 	}
-	if (removed.length > 0) logger?.warn(`Removed ${removed.join(", ")} from the Vibe config: Vibe 3.x no longer reads [tools.grep] or the former 'task' subagent tool, so those entries had no effect.`);
+	if (removed.length > 0) logger?.warn(`Removed ${removed.join(", ")} from the Vibe config: Vibe 3.x does not read [tools.grep], the former 'task' subagent tool or an 'external_directory' tool (the 'external_directory' category is written to outside_workdir instead), so those entries had no effect.`);
 }
 /**
 * Report the rules of a category that has no Vibe tool table. `grep` gets its
@@ -101148,6 +101689,30 @@ function resolveEnableSubagentsPatch({ rules, logger }) {
 	return { enable_subagents: action === "deny" ? false : void 0 };
 }
 /**
+* Translate the canonical `external_directory` category into Vibe's top-level
+* `outside_workdir` setting (v3.0.3+), which decides whether a file or shell
+* tool call reaching outside the working directory prompts (`"ask"`, the
+* default) or is refused with a tool error (`"deny"`). A `*` deny or ask writes
+* that value; a `*` allow has no Vibe value, so it is warned about and the key
+* is removed, leaving Vibe's default prompt. Without a `*` rule the key is left
+* as the file has it. Pattern rules are skipped with a warning: path grants go
+* in a tool's `allowlist` (`vibe-path:...`) instead.
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/README.md
+* @see https://github.com/mistralai/mistral-vibe/blob/v3.0.3/vibe/app_server/_unified_permissions.py
+*/
+function resolveOutsideWorkdirPatch({ rules, logger }) {
+	if (rules === void 0) return {};
+	const patternCount = Object.keys(rules).filter((pattern) => pattern !== "*").length;
+	if (patternCount > 0) logger?.warn(`Vibe's outside_workdir applies to every path outside the working directory; skipping ${patternCount} pattern rule(s) of the '${VIBE_OUTSIDE_WORKDIR_CATEGORY}' category. Grant a path through a tool's allowlist ("vibe-path:...") in the Vibe config instead.`);
+	const action = rules["*"];
+	if (action === void 0) return {};
+	if (action === "allow") {
+		logger?.warn(`Vibe's outside_workdir only takes "ask" or "deny"; the '${VIBE_OUTSIDE_WORKDIR_CATEGORY}' category's "*": "allow" leaves Vibe's default, which prompts before reaching outside the working directory.`);
+		return { outside_workdir: void 0 };
+	}
+	return { outside_workdir: action };
+}
+/**
 * Apply the Vibe-scoped override's per-tool `sensitive_patterns` (patterns that
 * escalate to ASK even when the base permission is ALWAYS). rulesync owns this
 * list for any category the override names: a present list is set, an empty