rulesync 43.4.2 → 43.5.0

package/dist/{import-ClFasGQ6.cjs → import-CAePeHTT.cjs}

@@ -8400,17 +8400,29 @@ const CodewhalePermissionsOverrideSchema = zod_mini.z.looseObject({
 	rules: zod_mini.z.optional(zod_mini.z.array(CodewhalePermissionRuleSchema))
 });
 /**
-* The starting permission level VS Code Copilot Chat gives new chat sessions
-* (`chat.permissions.default`). Values are VS Code's own: `default` (Default
+* The values VS Code's `chat.permissions.default` setting accepts: the starting
+* permission level of new Local-harness chat sessions — `default` (Default
 * Permissions), `autoApprove` (Bypass Approvals) and `autopilot` (Autopilot).
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
-const COPILOT_DEFAULT_PERMISSION_MODES = [
+const COPILOT_LOCAL_PERMISSION_LEVELS = [
 	"default",
 	"autoApprove",
 	"autopilot"
 ];
+/**
+* The starting permission level the `copilot.defaultPermissionMode` override
+* sets for new chat sessions: the {@link COPILOT_LOCAL_PERMISSION_LEVELS}, plus
+* `assisted` (Assisted permissions, GA for Copilot-harness sessions since VS
+* Code 1.144 and unavailable to Local sessions). Each value is written to both
+* `chat.permissions.default` (Local sessions) and the `approvals` / `mode` of
+* `chat.defaultConfiguration` (Copilot-harness sessions, VS Code 1.144+).
+*
+* @see https://code.visualstudio.com/updates/v1_144
+* @see https://github.com/microsoft/vscode/blob/1.144.0/src/vs/workbench/contrib/chat/browser/chat.shared.contribution.ts
+*/
+const COPILOT_DEFAULT_PERMISSION_MODES = [...COPILOT_LOCAL_PERMISSION_LEVELS, "assisted"];
 /** `chat.agent.sandbox.enabled`: `"off"` or `"on"`. */
 const CopilotSandboxEnabledSchema = zod_mini.z.enum(["off", "on"]);
 /** `chat.agent.sandbox.fileSystem.userConfiguredPaths`. */
@@ -8451,7 +8463,7 @@ const CopilotSandboxSchema = zod_mini.z.strictObject({
 /**
 * Tool-scoped override block for GitHub Copilot in VS Code.
 * `defaultPermissionMode` writes the workspace `chat.permissions.default`
-* setting, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
+* and `chat.defaultConfiguration` settings, and `sandbox` writes the `chat.agent.sandbox.*` settings; neither
 * has a canonical category.
 */
 const CopilotPermissionsOverrideSchema = zod_mini.z.looseObject({
@@ -9333,6 +9345,7 @@ const TaktPermissionsOverrideSchema = zod_mini.z.looseObject({
 	})),
 	workflow_runtime_prepare: zod_mini.z.optional(zod_mini.z.object({ custom_scripts: zod_mini.z.optional(zod_mini.z.boolean()) })),
 	workflow_command_gates: zod_mini.z.optional(zod_mini.z.object({ custom_scripts: zod_mini.z.optional(zod_mini.z.boolean()) })),
+	workflow_system_commands: zod_mini.z.optional(zod_mini.z.object({ custom_scripts: zod_mini.z.optional(zod_mini.z.boolean()) })),
 	sync_conflict_resolver: zod_mini.z.optional(zod_mini.z.object({ auto_approve_tools: zod_mini.z.optional(zod_mini.z.boolean()) })),
 	allow_git_hooks: zod_mini.z.optional(zod_mini.z.boolean()),
 	allow_git_filters: zod_mini.z.optional(zod_mini.z.boolean())
@@ -9600,6 +9613,7 @@ const CodexSandboxModeSchema = zod_mini.z.enum([
 	"workspace-write",
 	"danger-full-access"
 ]);
+const CODEX_U32_MAX = 4294967295;
 /**
 * Codex CLI's reviewer for approval requests. `guardian_subagent` is a legacy
 * value Codex still accepts for backward compatibility, so it is included so
@@ -9668,6 +9682,9 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 *   | `guardian_subagent`), or a table for the richer reviewer config.
 *   Defaults to `auto_review` when neither the override nor the existing
 *   config sets it.
+* - `auto_review` — the `[auto_review]` table that configures the reviewer
+*   `approvals_reviewer = "auto_review"` selects (`policy`, `extra_policy`,
+*   `timeout_ms`, …). A loose table, shallow-merged like `apps` / `tui`.
 * - `git_write_rules` — whether the managed profile's `:workspace_roots` table
 *   emits the default `.git` carve-out (`".git/**" = "write"`). Codex's
 *   `:workspace` baseline makes `.git` read-only, which denies basic git
@@ -9681,7 +9698,8 @@ const CodexBasePermissionProfileSchema = zod_mini.z.enum(CODEX_BASE_PERMISSION_P
 * The keys written to `config.toml` are an **allowlist**, not verbatim
 * passthrough: only `CODEXCLI_OVERRIDE_KEYS`
 * (`src/constants/codexcli-paths.ts` — `approval_policy`, `sandbox_mode`,
-* `sandbox_workspace_write`, `apps`, `approvals_reviewer`) are emitted, and
+* `sandbox_workspace_write`, `apps`, `approvals_reviewer`, `auto_review`,
+* `tui`) are emitted, and
 * `computeCodexcliOverridePatch` skips anything else with a warning.
 * `base_permission_profile` and `git_write_rules` are consumed by the profile
 * builder rather than written, as described above, and `permission` is the
@@ -9713,6 +9731,26 @@ const CodexcliPermissionsOverrideSchema = zod_mini.z.looseObject({
 	apps: zod_mini.z.optional(zod_mini.z.looseObject({})),
 	approvals_reviewer: zod_mini.z.optional(zod_mini.z.union([CodexApprovalsReviewerSchema, zod_mini.z.looseObject({})])),
 	/**
+	* The `[auto_review]` table of `config.toml`, which configures the reviewer
+	* that `approvals_reviewer = "auto_review"` (Rulesync's default) selects:
+	* `policy` / `extra_policy` (text inserted into the reviewer prompt),
+	* `timeout_ms` (the review budget, Codex 0.165.0+; `0` waits without a
+	* deadline), `circuit_break_action` (`default` | `strict`) and
+	* `conversation_history_max_output_tokens` (a positive token cap). Codex
+	* rejects the whole config file when one of these has the wrong type or is
+	* out of range (`timeout_ms` is a `u32`, the token cap a `NonZeroUsize`), so
+	* they are checked here; every other key passes through verbatim.
+	*
+	* @see https://github.com/openai/codex/blob/rust-v0.166.0/codex-rs/config/src/config_toml.rs (`AutoReviewToml`)
+	*/
+	auto_review: zod_mini.z.optional(zod_mini.z.looseObject({
+		policy: zod_mini.z.optional(zod_mini.z.string()),
+		extra_policy: zod_mini.z.optional(zod_mini.z.string()),
+		timeout_ms: zod_mini.z.optional(zod_mini.z.int().check(zod_mini.z.nonnegative(), zod_mini.z.lte(CODEX_U32_MAX))),
+		circuit_break_action: zod_mini.z.optional(zod_mini.z.enum(["default", "strict"])),
+		conversation_history_max_output_tokens: zod_mini.z.optional(zod_mini.z.int().check(zod_mini.z.positive()))
+	})),
+	/**
 	* The `[tui]` table of `config.toml` (e.g. `vim_mode_default`, `keymap.*`).
 	* Not a permission surface, but like `apps` it is a top-level table with no
 	* canonical category, and Codex adds keys to it faster than an explicit model
@@ -12319,6 +12357,7 @@ const CODEXCLI_OVERRIDE_KEYS = [
 	"sandbox_workspace_write",
 	"apps",
 	"approvals_reviewer",
+	"auto_review",
 	"tui"
 ];
 // src/constants/takt-paths.ts
@@ -13741,6 +13780,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 					"workflow_arpeggio",
 					"workflow_runtime_prepare",
 					"workflow_command_gates",
+					"workflow_system_commands",
 					"sync_conflict_resolver",
 					"allow_git_hooks",
 					"allow_git_filters"
@@ -13882,6 +13922,7 @@ const SHARED_CONFIG_OWNERSHIP = {
 				"chat.tools.edits.autoApprove",
 				"chat.tools.urls.autoApprove",
 				"chat.permissions.default",
+				"chat.defaultConfiguration",
 				"chat.agent.sandbox.enabled",
 				"chat.agent.sandbox.network.allowNetwork",
 				"chat.agent.sandbox.network.allowLocalNetwork",
@@ -34123,7 +34164,7 @@ function normalizeAugmentcodeToolList(value) {
 	return tools.length > 0 ? tools : void 0;
 }
 const AugmentcodeSubagentFrontmatterSchema = zod_mini.z.looseObject({
-	name: zod_mini.z.string(),
+	name: zod_mini.z.optional(zod_mini.z.string()),
 	description: zod_mini.z.optional(zod_mini.z.string()),
 	color: zod_mini.z.optional(zod_mini.z.string()),
 	model: zod_mini.z.optional(zod_mini.z.string()),
@@ -34182,7 +34223,7 @@ var AugmentcodeSubagent = class AugmentcodeSubagent extends ToolSubagent {
 			outputRoot: ".",
 			frontmatter: {
 				targets: ["*"],
-				name,
+				name: name ?? (0, node_path.basename)(this.getRelativeFilePath(), (0, node_path.extname)(this.getRelativeFilePath())),
 				description,
 				...Object.keys(augmentcodeSection).length > 0 && { augmentcode: augmentcodeSection }
 			},
@@ -34248,7 +34289,8 @@ var AugmentcodeSubagent = class AugmentcodeSubagent extends ToolSubagent {
 		const dirPath = relativeDirPath ?? this.getSettablePaths({ global }).relativeDirPath;
 		const filePath = (0, node_path.join)(outputRoot, dirPath, relativeFilePath);
 		const fileContent = await readFileContent(filePath);
-		const { frontmatter, body: content } = parseFrontmatter(fileContent, filePath);
+		const { frontmatter, body: content, hasFrontmatter } = parseFrontmatter(fileContent, filePath);
+		if (!hasFrontmatter) throw new Error(`Missing frontmatter in ${filePath}`);
 		const result = AugmentcodeSubagentFrontmatterSchema.safeParse(frontmatter);
 		if (!result.success) throw new Error(`Invalid frontmatter in ${filePath}: ${formatError(result.error)}`);
 		return new AugmentcodeSubagent({
@@ -41831,7 +41873,23 @@ function sanitizeOpencodeMcpNamePart(value) {
 * key that matches nothing.
 */
 function opencodeMcpToolPermissionKey(serverName, toolName) {
-	return `${sanitizeOpencodeMcpNamePart(serverName)}_${toolName.replace(/[^a-zA-Z0-9_\-*?]/g, "_")}`;
+	return `${opencodeMcpServerKeyPrefix(serverName)}${toolName.replace(/[^a-zA-Z0-9_\-*?]/g, "_")}`;
+}
+/** The sanitized `<server>_` prefix every permission key of the server's tools starts with. */
+function opencodeMcpServerKeyPrefix(serverName) {
+	return `${sanitizeOpencodeMcpNamePart(serverName)}_`;
+}
+/**
+* Whether `key` is exactly the sanitized `<server>_` prefix of one of
+* `serverNames` (e.g. `a_b_` for server `a.b` or `a_b`). No tool has an empty
+* name, so such a key filters nothing of that server, and
+* {@link findOpencodeMcpToolKeyOwner} gives it no owner. Read as an unlisted
+* server's filter instead, it would be split at the first `_` into a phantom
+* server (`a` with tool `b_`), so importers leave it out of the rulesync
+* config, and the OpenCode family's generate keeps it in the file as it was.
+*/
+function isBareOpencodeMcpServerPrefix({ key, serverNames }) {
+	return serverNames.some((serverName) => key === opencodeMcpServerKeyPrefix(serverName));
 }
 /**
 * The server among `serverNames` whose tool a permission key names, with the
@@ -41845,7 +41903,7 @@ function findOpencodeMcpToolKeyOwner({ key, serverNames, builtinKeys, acceptRawP
 	if (builtinKeys.has(key)) return;
 	let owner;
 	for (const serverName of serverNames) {
-		const sanitized = `${sanitizeOpencodeMcpNamePart(serverName)}_`;
+		const sanitized = opencodeMcpServerKeyPrefix(serverName);
 		const prefixes = acceptRawPrefix ? (0, es_toolkit.uniq)([sanitized, `${serverName}_`]) : [sanitized];
 		for (const prefix of prefixes) if (key.length > prefix.length && key.startsWith(prefix) && (owner === void 0 || prefix.length > owner.prefix.length)) owner = {
 			serverName,
@@ -42306,7 +42364,10 @@ function convertFromKiloFormat(kiloMcp, tools, permission) {
 	const serverNames = Object.keys(kiloMcp);
 	return {
 		...Object.fromEntries(Object.entries(kiloMcp).map(([serverName, serverConfig]) => [serverName, kiloServerToRulesync(serverName, serverConfig, splitKiloServerTools(serverName, serverNames, filters))])),
-		...orphanMcpToolFiltersToRulesync(kiloMcp, tools)
+		...orphanMcpToolFiltersToRulesync(kiloMcp, Object.fromEntries(Object.entries(tools ?? {}).filter(([key]) => !findKiloMcpToolKeyOwner(key, serverNames) && !isBareOpencodeMcpServerPrefix({
+			key,
+			serverNames
+		}))))
 	};
 }
 /**
@@ -42824,16 +42885,20 @@ function convertFromOpencodeFormat(opencodeMcp, tools, remoteType) {
 		...orphanMcpToolFiltersToRulesync(opencodeMcp, Object.fromEntries(Object.entries(tools ?? {}).filter(([key]) => !findOpencodeToolOwner({
 			key,
 			serverNames
+		}) && !isBareOpencodeMcpServerPrefix({
+			key,
+			serverNames
 		})))),
 		...convertOpencodeServers(opencodeMcp, tools, remoteType)
 	};
 }
+const OPENCODE_MCP_BUILTIN_TOOL_KEYS = /* @__PURE__ */ new Set();
 /** Recognize both OpenCode's sanitized names and keys older rulesync versions wrote. */
 function findOpencodeToolOwner({ key, serverNames }) {
 	return findOpencodeMcpToolKeyOwner({
 		key,
 		serverNames,
-		builtinKeys: /* @__PURE__ */ new Set(),
+		builtinKeys: OPENCODE_MCP_BUILTIN_TOOL_KEYS,
 		acceptRawPrefix: true
 	});
 }
@@ -43003,6 +43068,40 @@ function convertToOpencodeFormat(mcpServers, existingMcp, configShape, logger) {
 		tools
 	};
 }
+/**
+* Copy each key of `existingTools` that is a bare sanitized `<server>_` prefix
+* of one of `serverNames` into `tools`, unless a generated filter already
+* writes the same key or another listed server owns it (`a_b_` is tool `b_` of
+* server `a` when `a` is listed too). An owned key is the rulesync config's to
+* write, so carrying it over would keep a filter the user removed. Mutates
+* `tools` in place.
+*/
+function preserveBareOpencodeMcpServerPrefixKeys({ tools, existingTools, serverNames }) {
+	for (const [key, enabled] of Object.entries(existingTools ?? {})) if (!Object.hasOwn(tools, key) && isBareOpencodeMcpServerPrefix({
+		key,
+		serverNames
+	}) && !findOpencodeToolOwner({
+		key,
+		serverNames
+	})) tools[key] = enabled;
+}
+/**
+* When the existing file does not pass the schema, its `tools` map cannot be
+* read, so a bare `<server>_` key in it is not carried over. Say so rather
+* than lift the deny it may hold without a word.
+*/
+function warnAboutUnreadableBareOpencodeMcpServerPrefixKeys({ existingJson, serverNames, logger }) {
+	const rawTools = isRecord(existingJson) ? existingJson.tools : void 0;
+	if (!isRecord(rawTools)) return;
+	const bareKeys = Object.keys(rawTools).filter((key) => isBareOpencodeMcpServerPrefix({
+		key,
+		serverNames
+	}) && !findOpencodeToolOwner({
+		key,
+		serverNames
+	}));
+	if (bareKeys.length > 0) logger?.warn(`OpenCode MCP: the existing config does not match the expected schema, so the bare server-prefix tool ${bareKeys.length === 1 ? "key" : "keys"} ${bareKeys.map(quoteValueForWarning).join(", ")} ${bareKeys.length === 1 ? "is" : "are"} not kept in "tools".`);
+}
 const OpencodeMcpFeatureOptionsSchema = zod_mini.z.looseObject({ configShape: zod_mini.z.optional(zod_mini.z.enum(["v1", "v2"])) });
 var OpencodeMcp = class extends ToolMcp {
 	/** Directory layout; OpenCode forks (MiMo Code) override it. */
@@ -43135,6 +43234,16 @@ var OpencodeMcp = class extends ToolMcp {
 			convertedMcp,
 			mcpServers: transformedServers
 		});
+		if (existingMcp.success) preserveBareOpencodeMcpServerPrefixKeys({
+			tools: mcpTools,
+			existingTools: existingMcp.data.tools,
+			serverNames: Object.keys(transformedServers)
+		});
+		else warnAboutUnreadableBareOpencodeMcpServerPrefixKeys({
+			existingJson: this.lowerConfig(existingJson),
+			serverNames: Object.keys(transformedServers),
+			logger
+		});
 		if (this.layout.configVersion === "v2") warnAboutOpencodeV2SseServers({
 			mcpServers: transformedServers,
 			convertedMcp,
@@ -51689,6 +51798,7 @@ var RulesProcessor = class extends FeatureProcessor {
 			factory
 		});
 		await this.warnForWarpLegacyRootFile(toolRules);
+		this.warnForAugmentcodePluginRules(toolRules);
 		await this.warnForInstructionBudget({
 			toolRules,
 			meta
@@ -52080,6 +52190,20 @@ var RulesProcessor = class extends FeatureProcessor {
 		this.logger.warn(`Writing ${stripControlCharacters(rootFileRelativePath)} for ${this.toolTarget} means ${listedNames.join(", ")}${remainingCount > 0 ? ` and ${remainingCount} more` : ""} will no longer be read. Run \`rulesync import --targets ${this.toolTarget}\` first to carry that content into ${RULESYNC_RULES_RELATIVE_DIR_PATH}, or delete ${listedNames.length === 1 ? "it" : "them"} once you have checked the content is already in the root file.`);
 	}
 	/**
+	* Auggie 1.x (still a prerelease on npm at the time of writing; the stable
+	* line is 0.36.0) no longer loads `rules/` from plugins: "Rules shipped in
+	* plugins (`rules/` in a plugin)" is listed among the removed features, while
+	* commands, agents, skills, hooks and MCP servers still load. The rule files
+	* are still written, because the stable 0.x CLI reads them, but under 1.x the
+	* bundle silently loses them, so say so.
+	* @see https://docs.augmentcode.com/cli/whats-new
+	* @see https://docs.augmentcode.com/cli/v0/plugins
+	*/
+	warnForAugmentcodePluginRules(toolRules) {
+		if (this.toolTarget !== "augmentcode-plugin" || toolRules.length === 0) return;
+		this.logger.warn(`augmentcode-plugin: plugin rules (rules/*.md) are loaded by Auggie 0.x only; Auggie 1.x no longer reads rules/ from plugins, so these ${toolRules.length} rule file(s) have no effect there. Ship instructions that must reach Auggie 1.x users as a skill, or have them generate the augmentcode target in their project.`);
+	}
+	/**
 	* Warp still reads a legacy `WARP.md`, and when both `WARP.md` and
 	* `AGENTS.md` sit in the same directory, `WARP.md` takes priority — so an
 	* `AGENTS.md` this run writes next to one would never be read. That holds for
@@ -82322,6 +82446,57 @@ function matchesGlobStep(step, character) {
 	const admitted = step.members.has(character) || step.ranges.some(([low, high]) => code >= low && code <= high);
 	return step.negated ? !admitted : admitted;
 }
+/**
+* Whether `value` matches `glob` in full, with `*`, `?` and `[...]` carrying
+* their usual meaning. The glob comes first, unlike Node's own
+* `path.matchesGlob(path, pattern)`.
+*
+* The glob is walked step by step rather than translated to a regex, because
+* both sides of a comparison can come from a file a repository carries: `*a*a*a*a*b`
+* translated to `^.*a.*a.*a.*a.*b$` takes minutes against a forty-character
+* name, while walking the steps is linear in the name per `*`. Remembering only
+* the most recent `*` to fall back to is enough — an earlier one can always give
+* up whatever the later one needed.
+*/
+function matchesGlob(glob, value) {
+	return compileGlob(glob)(value);
+}
+/**
+* Parse `glob` once and return a predicate that walks it, for a caller that
+* tests the same glob against a whole list of names.
+*/
+function compileGlob(glob) {
+	const steps = parseGlob(glob);
+	return (value) => matchesParsedGlob(steps, value);
+}
+function matchesParsedGlob(steps, value) {
+	const characters = [...value];
+	let stepIndex = 0;
+	let characterIndex = 0;
+	let starStepIndex = -1;
+	let starCharacterIndex = 0;
+	while (characterIndex < characters.length) {
+		const step = steps[stepIndex];
+		if (step?.kind === "star") {
+			starStepIndex = stepIndex;
+			starCharacterIndex = characterIndex;
+			stepIndex += 1;
+			continue;
+		}
+		if (step !== void 0 && matchesGlobStep(step, characters[characterIndex] ?? "")) {
+			stepIndex += 1;
+			characterIndex += 1;
+			continue;
+		}
+		if (starStepIndex < 0) return false;
+		starCharacterIndex += 1;
+		stepIndex = starStepIndex + 1;
+		characterIndex = starCharacterIndex;
+	}
+	let remaining = stepIndex;
+	while (steps[remaining]?.kind === "star") remaining += 1;
+	return remaining === steps.length;
+}
 /** Whether two single-character steps can both match one same character. */
 function stepsShareACharacter(left, right) {
 	if (left.kind === "any" || right.kind === "any") return true;
@@ -83858,9 +84033,13 @@ const CANONICAL_TO_AUGMENT_TOOL_NAMES = {
 const AUGMENT_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_AUGMENT_TOOL_NAMES).map(([k, v]) => [v, k]));
 const CURRENT_TO_LEGACY_AUGMENT_TOOL_NAMES = {
 	terminal: "launch-process",
+	bash: "launch-process",
+	shell: "launch-process",
 	read: "view",
 	edit: "str-replace-editor",
-	write: "save-file"
+	str_replace_editor: "str-replace-editor",
+	write: "save-file",
+	save_file: "save-file"
 };
 function toAugmentToolName(canonical) {
 	return lookupOwn({
@@ -84012,6 +84191,7 @@ function isShellRegexRoundtrippable(regex) {
 	while (i < body.length) {
 		const ch = body[i];
 		if (ch === "\\" && i + 1 < body.length) {
+			if (isGlobSpecial(body[i + 1])) return false;
 			i += 2;
 			continue;
 		}
@@ -84028,6 +84208,37 @@ function isShellRegexRoundtrippable(regex) {
 	}
 	return true;
 }
+/** Characters a glob reads as syntax (wildcards or the start of a character class). */
+function isGlobSpecial(ch) {
+	return ch === "*" || ch === "?" || ch === "[";
+}
+/**
+* Whether `shellRegexToGlob` can approximate a `shellInputRegex` without widening it. The lossy
+* conversion keeps regex quantifiers as characters, and a `*` or `?` left in the glob becomes a
+* wildcard: `^rm -rf /tmp/a*$` (a run of `a`s) would turn into the glob `rm -rf /tmp/a*`, which
+* matches `rm -rf /tmp/a /home`. So a regex is unsafe when it has an escaped literal `\*` / `\?` /
+* `\[` (a `[` would open a character class in targets whose globs support one),
+* or a bare quantifier `*` / `?` / `+` / `{` that is not part of a `.*` run (which the glob `*`
+* reproduces faithfully).
+*/
+function canApproximateShellRegexWithoutWidening(regex) {
+	let i = 0;
+	while (i < regex.length) {
+		const ch = regex[i];
+		if (ch === "\\" && i + 1 < regex.length) {
+			if (isGlobSpecial(regex[i + 1])) return false;
+			i += 2;
+			continue;
+		}
+		if (ch === "." && regex[i + 1] === "*") {
+			i += 2;
+			continue;
+		}
+		if (ch === "*" || ch === "?" || ch === "+" || ch === "{") return false;
+		i += 1;
+	}
+	return true;
+}
 const MANAGED_AUGMENT_TOOL_NAMES = new Set(Object.values(CANONICAL_TO_AUGMENT_TOOL_NAMES));
 var AugmentcodePermissions = class AugmentcodePermissions extends ToolPermissions {
 	constructor(params) {
@@ -84464,12 +84675,18 @@ function convertAugmentToRulesyncPermissions({ entries, logger }) {
 		if (legacyToolName === "launch-process" && entry.shellInputRegex) {
 			const regex = entry.shellInputRegex;
 			if (isShellRegexRoundtrippable(regex)) pattern = shellRegexToGlob(regex);
-			else if (action === "deny") {
-				logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as the catch-all '*' pattern (fail-closed) so the deny rule cannot be silently narrowed on regenerate.`);
-				pattern = "*";
-			} else {
-				pattern = shellRegexToGlob(regex);
-				logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as glob '${pattern}'; the rule may match a different set of inputs after regenerate.`);
+			else {
+				if (action !== "deny" && !canApproximateShellRegexWithoutWidening(regex)) {
+					logger?.warn(`AugmentCode permissions: skipping ${action} entry for tool '${entry.toolName}': shellInputRegex '${regex}' uses a quantifier or a literal '*' / '?' that a glob cannot express, and converting it would widen the rule. The entry is not imported.`);
+					continue;
+				}
+				if (action === "deny") {
+					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as the catch-all '*' pattern (fail-closed) so the deny rule cannot be silently narrowed on regenerate.`);
+					pattern = "*";
+				} else {
+					pattern = shellRegexToGlob(regex);
+					logger?.warn(`AugmentCode permissions: shellInputRegex '${regex}' on tool '${entry.toolName}' is not faithfully roundtrippable to a glob. Importing as glob '${pattern}'; the rule may match a different set of inputs after regenerate.`);
+				}
 			}
 		} else pattern = "*";
 		if (isPrototypePollutionKey(pattern)) {
@@ -85962,15 +86179,19 @@ const CLAUDECODE_ENV_IGNORED_IN_EVERY_FILE = /* @__PURE__ */ new Set([
 * `env` variables a project or local settings file cannot set, because a
 * checked-out repository should not control them: where Claude Code stores its
 * own files, what session content it exports, where telemetry goes, how it
-* starts or syncs, the timers on an unanswered dialog, and whether it processes
-* attachments or expands `@` file mentions, and the screen reader (`CLAUDE_AX_*`) variables. Claude Code drops them there, so they are skipped at project scope and emitted only under `--global`.
+* starts or syncs, which claude.ai sign-in it uses, the timers on an unanswered
+* dialog, and whether it processes attachments or expands `@` file mentions,
+* and the screen reader (`CLAUDE_AX_*`) variables. Claude Code drops them there, so they are skipped at project scope and emitted only under `--global`.
 *
-* Only the names the settings reference lists are covered; its directory and
-* Windows groups are introduced with "such as", so an unlisted member of those
+* Only the names the settings reference lists are covered; its directory,
+* Windows and sign-in groups are introduced with "such as", so an unlisted member of those
 * families is still written. Windows variable names are case-insensitive, so
-* that group is matched without regard to case.
+* that group is matched without regard to case. `ALLUSERSPROFILE`,
+* `SystemDrive` and the `CommonProgramFiles` family are ignored there since
+* Claude Code v2.1.285.
 *
 * @see https://code.claude.com/docs/en/settings-reference#variables-claude-code-ignores-in-env
+* @see https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
 */
 const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"BETA_TRACING_ENDPOINT",
@@ -85980,6 +86201,9 @@ const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"CLAUDE_CODE_DISABLE_FILE_MENTIONS",
 	"CLAUDE_CODE_ENABLE_TELEMETRY",
 	"CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
+	"CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+	"CLAUDE_CODE_OAUTH_SCOPES",
+	"CLAUDE_CODE_OAUTH_TOKEN",
 	"CLAUDE_CODE_PLUGIN_CACHE_DIR",
 	"CLAUDE_CODE_PLUGIN_SEED_DIR",
 	"CLAUDE_CODE_PROCESS_WRAPPER",
@@ -86000,14 +86224,23 @@ const CLAUDECODE_ENV_PROJECT_IGNORED_NAMES = /* @__PURE__ */ new Set([
 	"TMPDIR"
 ]);
 const CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_NAMES = /* @__PURE__ */ new Set([
+	"ALLUSERSPROFILE",
+	"COMMONPROGRAMW6432",
 	"COMSPEC",
 	"LOCALAPPDATA",
 	"PATHEXT",
 	"PROGRAMDATA",
 	"PROGRAMW6432",
 	"PSMODULEPATH",
+	"SYSTEMDRIVE",
 	"SYSTEMROOT"
 ]);
+/**
+* Windows name prefixes matched as whole families: `ProgramFiles*` and
+* `CommonProgramFiles*`. `ProgramW6432` and `CommonProgramW6432` are exact
+* names in the set above.
+*/
+const CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_PREFIXES = ["PROGRAMFILES", "COMMONPROGRAMFILES"];
 const CLAUDECODE_ENV_OTLP_IGNORED_SUFFIXES = [
 	"_ENDPOINT",
 	"_HEADERS",
@@ -86052,7 +86285,7 @@ const CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES = {
 function isProjectIgnoredEnvVariable(name, value) {
 	if (CLAUDECODE_ENV_PROJECT_IGNORED_NAMES.has(name) || name.startsWith("XDG_") || name.startsWith("CLAUDE_AX_")) return true;
 	const upper = name.toUpperCase();
-	if (CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_NAMES.has(upper) || upper.startsWith("PROGRAMFILES")) return true;
+	if (CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_NAMES.has(upper) || CLAUDECODE_ENV_PROJECT_IGNORED_WINDOWS_PREFIXES.some((prefix) => upper.startsWith(prefix))) return true;
 	if (name.startsWith("OTEL_EXPORTER_OTLP_") && CLAUDECODE_ENV_OTLP_IGNORED_SUFFIXES.some((suffix) => name.endsWith(suffix))) return true;
 	if (Object.hasOwn(CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES, name)) {
 		const offValues = CLAUDECODE_ENV_PROJECT_HONORED_OFF_VALUES[name];
@@ -86084,7 +86317,7 @@ function stripIgnoredEnvVariables({ env, global, relativeFilePath, logger }) {
 		kept[name] = value;
 	}
 	if (ignoredEverywhere.length > 0) logger?.warn(`Claude Code permissions: Claude Code ignores ${ignoredEverywhere.map((name) => `'env.${name}'`).join(", ")} in every settings file, so ${ignoredEverywhere.length === 1 ? "it is" : "they are"} not written to ${relativeFilePath}. Set ${ignoredEverywhere.length === 1 ? "it" : "them"} in the environment Claude Code starts from instead, and check ${relativeFilePath} for a stale value an earlier generate may have left there.`);
-	if (ignoredAtProjectScope.length > 0) logger?.warn(`Claude Code permissions: ${ignoredAtProjectScope.map((name) => `'env.${name}'`).join(", ")} ${ignoredAtProjectScope.length === 1 ? "is" : "are"} not honored in the project-scoped ${relativeFilePath}, so ${ignoredAtProjectScope.length === 1 ? "it is" : "they are"} not written there — Claude Code ignores variables there that choose where it writes its files, export session content or telemetry, change how it starts or syncs, set dialog timers, turn attachments or file mentions off, or turn Claude in Chrome on (a value that turns telemetry or Chrome off, such as "none" or "0", is still written). Author ${ignoredAtProjectScope.length === 1 ? "it" : "them"} in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
+	if (ignoredAtProjectScope.length > 0) logger?.warn(`Claude Code permissions: ${ignoredAtProjectScope.map((name) => `'env.${name}'`).join(", ")} ${ignoredAtProjectScope.length === 1 ? "is" : "are"} not honored in the project-scoped ${relativeFilePath}, so ${ignoredAtProjectScope.length === 1 ? "it is" : "they are"} not written there — Claude Code ignores variables there that choose where it writes its files, export session content or telemetry, change how it starts or syncs, set the claude.ai sign-in, set dialog timers, turn attachments or file mentions off, or turn Claude in Chrome on (a value that turns telemetry or Chrome off, such as "none" or "0", is still written). Author ${ignoredAtProjectScope.length === 1 ? "it" : "them"} in the global scope instead, and check that file for a stale value an earlier generate may have left there.`);
 	return kept;
 }
 /**
@@ -86734,7 +86967,7 @@ const CODEBUDDY_RULE_LISTS = [
 	"ask",
 	"deny"
 ];
-const CATCH_ALL_PATTERN$13 = "*";
+const CATCH_ALL_PATTERN$14 = "*";
 const MCP_CATEGORY = "mcp";
 const MCP_RULE_PREFIX = "mcp__";
 const ALL_MCP_RULE = "mcp__*";
@@ -86804,7 +87037,7 @@ function categoryOfRule$2(rule) {
 *   and reach the `Bash` rules through `honorAllToolsOnBash`.
 */
 function buildCodebuddyRule({ category, pattern, action, logger }) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$13;
+	const catchAll = pattern === CATCH_ALL_PATTERN$14;
 	if (category === MCP_CATEGORY) {
 		if (catchAll && action === "allow") {
 			logger?.warn(`CodeBuddy permissions: skipping the 'mcp' allow rule '*' — CodeBuddy honors the all-MCP wildcard 'mcp__*' in deny and ask only. Allow servers by name instead (for example 'mcp__github').`);
@@ -86813,7 +87046,7 @@ function buildCodebuddyRule({ category, pattern, action, logger }) {
 		return catchAll ? ALL_MCP_RULE : `${MCP_RULE_PREFIX}${pattern}`;
 	}
 	if (category === "*") {
-		if (catchAll) return CATCH_ALL_PATTERN$13;
+		if (catchAll) return CATCH_ALL_PATTERN$14;
 		logger?.warn(`CodeBuddy permissions: skipping the all-tools '*' rule '${pattern}' — CodeBuddy's standalone '*' rule takes no specifier. Write it under the category it is meant for (for example 'bash' or 'read').`);
 		return null;
 	}
@@ -86831,7 +87064,7 @@ function parseCodebuddyRule(rule) {
 	const { specifier } = splitCodebuddyRule(rule);
 	if (specifier === void 0) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$13
+		pattern: CATCH_ALL_PATTERN$14
 	};
 	const trimmed = specifier.trim();
 	return trimmed === "" ? null : {
@@ -89157,8 +89390,8 @@ function mapBashActionToDecision(action) {
 // src/features/permissions/commandcode-permissions.ts
 /** Top-level key of `.commandcode/settings.json` that rulesync owns. */
 const COMMANDCODE_PERMISSIONS_KEY = "permissions";
-const CATCH_ALL_PATTERN$12 = "*";
-const MCP_CANONICAL_PREFIX$7 = "mcp__";
+const CATCH_ALL_PATTERN$13 = "*";
+const MCP_CANONICAL_PREFIX$8 = "mcp__";
 const COMMANDCODE_ALL_MCP_RULE = "mcp__*";
 const CATEGORY_TO_COMMANDCODE_TOOL = {
 	bash: "Shell",
@@ -89203,10 +89436,10 @@ const PADDED_SHELL_WILDCARD_REASON = "a pattern narrower than the bare 'Shell' (
 * restrictions and reach the `Shell` entries through `honorAllToolsOnBash`.
 */
 function buildCommandcodeRule(category, pattern) {
-	const catchAll = pattern === CATCH_ALL_PATTERN$12 || pattern === "";
-	if (category.startsWith(MCP_CANONICAL_PREFIX$7)) return catchAll ? category : `${category}(${pattern})`;
-	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$7}${pattern}`;
-	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$12 : null;
+	const catchAll = pattern === CATCH_ALL_PATTERN$13 || pattern === "";
+	if (category.startsWith(MCP_CANONICAL_PREFIX$8)) return catchAll ? category : `${category}(${pattern})`;
+	if (category === "mcp") return catchAll ? COMMANDCODE_ALL_MCP_RULE : `${MCP_CANONICAL_PREFIX$8}${pattern}`;
+	if (category === "*") return catchAll ? CATCH_ALL_PATTERN$13 : null;
 	const tool = Object.hasOwn(CATEGORY_TO_COMMANDCODE_TOOL, category) ? CATEGORY_TO_COMMANDCODE_TOOL[category] : void 0;
 	if (tool === void 0) return null;
 	return catchAll ? tool : `${tool}(${pattern})`;
@@ -89242,7 +89475,7 @@ function splitCommandcodeRule(rule) {
 }
 /** Whether a specifier means "no specifier" to Command Code: only `` and `*` do. */
 function isCatchAllSpecifier(inner) {
-	return inner === "" || inner === CATCH_ALL_PATTERN$12;
+	return inner === "" || inner === CATCH_ALL_PATTERN$13;
 }
 /**
 * Read an MCP-shaped rule the way Command Code does (`command-code` 1.54.0,
@@ -89276,34 +89509,34 @@ function parseMcpCommandcodeRule({ tool, inner }) {
 	if (server.length === 0) return null;
 	const everyServer = {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: true
 	};
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$7)) {
-		if (server === CATCH_ALL_PATTERN$12) return everyServer;
-		if (server.includes(CATCH_ALL_PATTERN$12)) return null;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$8)) {
+		if (server === CATCH_ALL_PATTERN$13) return everyServer;
+		if (server.includes(CATCH_ALL_PATTERN$13)) return null;
 		return {
-			category: rest === "" || rest === CATCH_ALL_PATTERN$12 ? `${MCP_CANONICAL_PREFIX$7}${server}` : `${MCP_CANONICAL_PREFIX$7}${remainder}`,
-			pattern: CATCH_ALL_PATTERN$12,
+			category: rest === "" || rest === CATCH_ALL_PATTERN$13 ? `${MCP_CANONICAL_PREFIX$8}${server}` : `${MCP_CANONICAL_PREFIX$8}${remainder}`,
+			pattern: CATCH_ALL_PATTERN$13,
 			notInAllow: false
 		};
 	}
-	const category = `${MCP_CANONICAL_PREFIX$7}${remainder}`;
-	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$12);
+	const category = `${MCP_CANONICAL_PREFIX$8}${remainder}`;
+	const namesTool = separator !== -1 && rest.length > 0 && !remainder.includes(CATCH_ALL_PATTERN$13);
 	if (!isCatchAllSpecifier(inner)) return namesTool ? {
 		category,
 		pattern: inner,
 		notInAllow: true
 	} : null;
-	if (remainder === CATCH_ALL_PATTERN$12) return everyServer;
-	if (rest === CATCH_ALL_PATTERN$12 && !server.includes(CATCH_ALL_PATTERN$12)) return {
-		category: `${MCP_CANONICAL_PREFIX$7}${server}`,
-		pattern: CATCH_ALL_PATTERN$12,
+	if (remainder === CATCH_ALL_PATTERN$13) return everyServer;
+	if (rest === CATCH_ALL_PATTERN$13 && !server.includes(CATCH_ALL_PATTERN$13)) return {
+		category: `${MCP_CANONICAL_PREFIX$8}${server}`,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: true
 	};
 	return namesTool ? {
 		category,
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: false
 	} : null;
 }
@@ -89327,14 +89560,14 @@ function friendlyToolRule({ category, inner }) {
 	if (category === "bash") {
 		if (isCatchAllSpecifier(inner)) return {
 			category,
-			pattern: CATCH_ALL_PATTERN$12,
+			pattern: CATCH_ALL_PATTERN$13,
 			notInAllow: false
 		};
 		const normalized = inner.trim().replace(/\s+/g, " ");
 		if (normalized === "" || normalized === ":*") return null;
 		return isCatchAllSpecifier(normalized) ? {
 			category,
-			pattern: CATCH_ALL_PATTERN$12,
+			pattern: CATCH_ALL_PATTERN$13,
 			notInAllow: true
 		} : {
 			category,
@@ -89344,7 +89577,7 @@ function friendlyToolRule({ category, inner }) {
 	}
 	if (isCatchAllSpecifier(inner)) return {
 		category,
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: false
 	};
 	return isCatchAllSpecifier(inner.trim()) ? null : {
@@ -89363,13 +89596,13 @@ function friendlyToolRule({ category, inner }) {
 */
 function parseCommandcodeRule(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	if (tool === CATCH_ALL_PATTERN$12) return isCatchAllSpecifier(inner) ? {
+	if (tool === CATCH_ALL_PATTERN$13) return isCatchAllSpecifier(inner) ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$12,
+		pattern: CATCH_ALL_PATTERN$13,
 		notInAllow: true
 	} : null;
 	const lowered = tool.toLowerCase();
-	if (lowered.startsWith(MCP_CANONICAL_PREFIX$7)) return parseMcpCommandcodeRule({
+	if (lowered.startsWith(MCP_CANONICAL_PREFIX$8)) return parseMcpCommandcodeRule({
 		tool,
 		inner
 	});
@@ -89387,12 +89620,12 @@ function parseCommandcodeRule(rule) {
 */
 function isFoldedMcpToolNameRule({ rule, category }) {
 	const { tool } = splitCommandcodeRule(rule);
-	return category.startsWith(MCP_CANONICAL_PREFIX$7) && !tool.startsWith(MCP_CANONICAL_PREFIX$7);
+	return category.startsWith(MCP_CANONICAL_PREFIX$8) && !tool.startsWith(MCP_CANONICAL_PREFIX$8);
 }
 /** The `Tool` half of `Tool(specifier)`, when the rule is an exact-prefix MCP rule with a specifier. */
 function scopedMcpRuleTool(rule) {
 	const { tool, inner } = splitCommandcodeRule(rule);
-	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$7) ? tool : null;
+	return !isCatchAllSpecifier(inner) && tool.startsWith(MCP_CANONICAL_PREFIX$8) ? tool : null;
 }
 /**
 * The string entries of a Command Code permission list. Command Code reads
@@ -89435,7 +89668,7 @@ function preservedRules({ existingPermissions, key, managedCategories, written,
 	}).filter((rule) => {
 		const parsed = parseCommandcodeRule(rule);
 		if (parsed === null || !managedCategories.has(parsed.category)) return true;
-		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$12})`);
+		const replacement = written.get(`${parsed.category}(${parsed.pattern})`) ?? written.get(`${parsed.category}(${CATCH_ALL_PATTERN$13})`);
 		if (key !== "allow" && isStricterAction({
 			action: key,
 			existing: replacement
@@ -89492,7 +89725,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 	const ranked = /* @__PURE__ */ new Map();
 	const managedCategories = /* @__PURE__ */ new Set();
 	for (const [category, rules] of Object.entries(permission)) {
-		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$12);
+		const categoryRule = buildCommandcodeRule(category, CATCH_ALL_PATTERN$13);
 		const managedCategory = categoryRule === null ? null : parseCommandcodeRule(categoryRule);
 		if (managedCategory !== null) managedCategories.add(managedCategory.category);
 		for (const [pattern, action] of Object.entries(rules)) {
@@ -89561,7 +89794,7 @@ function buildCommandcodeRuleLists({ config, existingPermissions, logger }) {
 function skippedAllowImportMessage({ rule, category }) {
 	const { tool, inner } = splitCommandcodeRule(rule);
 	if (category === "bash") return `Command Code reads '${rule}' in "allow" as ${PADDED_SHELL_WILDCARD_REASON}, which rulesync cannot import without widening the grant to every command, so it was not imported.`;
-	if (tool.startsWith(MCP_CANONICAL_PREFIX$7) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
+	if (tool.startsWith(MCP_CANONICAL_PREFIX$8) || isCatchAllSpecifier(inner)) return `Command Code ignores '${rule}' in "allow" (an allow rule must name what it grants), so it was not imported.`;
 	return `Command Code globs the specifier of '${rule}' in "allow" against the call's arguments, which rulesync cannot import without widening the grant to the whole tool, so it was not imported.`;
 }
 /**
@@ -89756,7 +89989,7 @@ function parseCommandcodeSettings({ fileContent, relativePath }) {
 }
 // src/features/permissions/continue-permissions.ts
 const CONTINUE_GLOBAL_ONLY_MESSAGE = "Continue permissions are global-only; use --global to sync ~/.continue/permissions.yaml";
-const CATCH_ALL_PATTERN$11 = "*";
+const CATCH_ALL_PATTERN$12 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Continue
 * would match `Tool(**)` against every argument just as the bare tool name
@@ -89764,7 +89997,7 @@ const CATCH_ALL_PATTERN$11 = "*";
 * the bare entry instead of being skipped as a pattern-specific rule.
 */
 function normalizeCatchAllPattern$1(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$11 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$12 : pattern;
 }
 const CANONICAL_TO_CONTINUE_TOOL_NAMES = {
 	bash: "Bash",
@@ -89808,7 +90041,7 @@ function parseContinuePermissionEntry(entry) {
 	if (toolName === "") return;
 	return {
 		toolName,
-		pattern: pattern === "" ? CATCH_ALL_PATTERN$11 : pattern
+		pattern: pattern === "" ? CATCH_ALL_PATTERN$12 : pattern
 	};
 }
 /**
@@ -89973,7 +90206,7 @@ function convertRulesyncToContinuePermissions({ config, logger }) {
 				logger?.warn(`Continue permissions.yaml cannot hold a parenthesis inside a pattern, so the "${action}" rule for "${category}" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
-			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$11) {
+			if (toolName === "*" && pattern !== CATCH_ALL_PATTERN$12) {
 				logger?.warn(`Continue permissions.yaml cannot scope a pattern to every tool, so the "${action}" rule for "*" (pattern ${quoteValueForWarning(pattern)}) was skipped.`);
 				continue;
 			}
@@ -90029,13 +90262,116 @@ const AUTO_APPROVE_KEYS = {
 	webfetch: "chat.tools.urls.autoApprove"
 };
 /**
-* The workspace setting holding the starting permission level of new chat
-* sessions, authored through the `copilot.defaultPermissionMode` override.
+* The workspace setting holding the starting permission level of new Local
+* (`local` harness) chat sessions, authored through the
+* `copilot.defaultPermissionMode` override. VS Code 1.144 narrowed it to Local
+* sessions; the Copilot harness reads {@link DEFAULT_CONFIGURATION_KEY}.
 *
 * @see https://code.visualstudio.com/docs/agents/reference/ai-settings
 */
 const DEFAULT_PERMISSION_MODE_KEY$1 = "chat.permissions.default";
 /**
+* The workspace setting holding the starting `mode` (`interactive` / `plan` /
+* `autopilot`) and `approvals` (`manual` / `assisted` / `allowAll`) of new
+* agent sessions such as the Copilot harness, the default since VS Code 1.143.
+* It shipped in stable VS Code 1.144 as an object setting with
+* `additionalProperties: false`; older releases ignore it.
+*
+* @see https://github.com/microsoft/vscode/blob/1.144.0/src/vs/workbench/contrib/chat/browser/chat.shared.contribution.ts
+* @see https://github.com/microsoft/vscode/blob/1.144.0/src/vs/workbench/contrib/chat/common/constants.ts
+*/
+const DEFAULT_CONFIGURATION_KEY = "chat.defaultConfiguration";
+/**
+* What each `copilot.defaultPermissionMode` value writes. `local` goes to
+* `chat.permissions.default`; `approvals` and `autopilot` go to
+* `chat.defaultConfiguration`. The Local picker has no Assisted level, so
+* `assisted` starts Local sessions with Default Permissions — the stricter
+* fallback. Autopilot is a permission level in the Local picker but a `mode`
+* in `chat.defaultConfiguration`, where it runs with every tool call approved.
+*/
+const DEFAULT_PERMISSION_MODE_MAPPINGS = {
+	default: {
+		local: "default",
+		approvals: "manual",
+		autopilot: false
+	},
+	autoApprove: {
+		local: "autoApprove",
+		approvals: "allowAll",
+		autopilot: false
+	},
+	autopilot: {
+		local: "autopilot",
+		approvals: "allowAll",
+		autopilot: true
+	},
+	assisted: {
+		local: "default",
+		approvals: "assisted",
+		autopilot: false
+	}
+};
+/**
+* The `chat.defaultConfiguration` value for `mode`. Rulesync owns only whether
+* the mode is Autopilot: authoring Autopilot sets it, and any other value
+* removes any Autopilot mode in the file (whether an earlier run or a person
+* wrote it, since the two cannot be told apart), while an `interactive` or
+* `plan` mode is kept.
+*/
+function buildDefaultConfigurationValue({ defaultPermissionMode, existingSettings }) {
+	const { approvals, autopilot } = DEFAULT_PERMISSION_MODE_MAPPINGS[defaultPermissionMode];
+	const existing = existingSettings[DEFAULT_CONFIGURATION_KEY];
+	const value = { ...isPlainObject(existing) ? existing : {} };
+	if (autopilot) value.mode = "autopilot";
+	else if (value.mode === "autopilot") delete value.mode;
+	value.approvals = approvals;
+	return value;
+}
+/**
+* The `copilot.defaultPermissionMode` values from least to most permissive,
+* used to settle a file whose two keys disagree.
+*/
+const DEFAULT_PERMISSION_MODE_RANK = {
+	default: 0,
+	assisted: 1,
+	autoApprove: 2,
+	autopilot: 3
+};
+/**
+* The `copilot.defaultPermissionMode` a `chat.defaultConfiguration` value
+* stands for. Autopilot is recognized only together with `allowAll`, the pair
+* Rulesync writes for it: an Autopilot mode with stricter approvals is read
+* from `approvals` alone, so that regenerating never escalates it to Allow
+* All. An object without `approvals` is read as `default`, since VS Code then
+* starts sessions with Manual permissions.
+*/
+function readDefaultConfigurationMode(configuration) {
+	if (!isPlainObject(configuration)) return;
+	switch (configuration.approvals) {
+		case void 0:
+		case "manual": return "default";
+		case "assisted": return "assisted";
+		case "allowAll": return configuration.mode === "autopilot" ? "autopilot" : "autoApprove";
+		default: return;
+	}
+}
+/**
+* Read `copilot.defaultPermissionMode` back from the settings. When the two
+* keys agree — `chat.permissions.default` holds the Local level Rulesync
+* writes for the `chat.defaultConfiguration` value — the latter is returned,
+* since only it can say `assisted`. When they disagree, the less permissive of
+* the two is returned, so regenerating never raises either harness's starting
+* permissions. Either key alone is read as it stands.
+*/
+function readDefaultPermissionMode(settings) {
+	const fromConfiguration = readDefaultConfigurationMode(settings[DEFAULT_CONFIGURATION_KEY]);
+	const localValue = settings[DEFAULT_PERMISSION_MODE_KEY$1];
+	const fromLocal = COPILOT_LOCAL_PERMISSION_LEVELS.find((level) => level === localValue);
+	if (fromConfiguration === void 0 || fromLocal === void 0) return fromConfiguration ?? fromLocal;
+	if (DEFAULT_PERMISSION_MODE_MAPPINGS[fromConfiguration].local === fromLocal) return fromConfiguration;
+	return DEFAULT_PERMISSION_MODE_RANK[fromLocal] < DEFAULT_PERMISSION_MODE_RANK[fromConfiguration] ? fromLocal : fromConfiguration;
+}
+/**
 * The prefix every Agent Host sandbox setting shares. A `copilot.sandbox` leaf
 * at path `a.b` is written to `chat.agent.sandbox.a.b`.
 */
@@ -90222,9 +90558,6 @@ function readSandboxFromSettings(settings) {
 	}
 	return Object.keys(sandbox).length > 0 ? sandbox : void 0;
 }
-function isCopilotDefaultPermissionMode(value) {
-	return COPILOT_DEFAULT_PERMISSION_MODES.some((mode) => mode === value);
-}
 function asAutoApproveMap(value) {
 	if (!isPlainObject(value)) return {};
 	const result = {};
@@ -90268,9 +90601,11 @@ function buildAutoApproveValue({ category, rules }) {
 * `false`. A key whose canonical category is absent entirely
 * is left untouched, so authoring only `bash` rules never disturbs a
 * hand-written edits or urls map.
-* The `copilot.defaultPermissionMode` override writes `chat.permissions.default`
-* (the starting permission level of new chat sessions); without it the key is
-* left untouched. The `copilot.sandbox` override writes the Agent Host sandbox
+* The `copilot.defaultPermissionMode` override writes both
+* `chat.permissions.default` (Local sessions) and `chat.defaultConfiguration`
+* (Copilot-harness sessions, VS Code 1.144+; see
+* {@link DEFAULT_PERMISSION_MODE_MAPPINGS}); without it both keys are left
+* untouched. The `copilot.sandbox` override writes the Agent Host sandbox
 * settings (`chat.agent.sandbox.*`, see {@link SANDBOX_LEAVES}) per key, and
 * warns about every value it writes that loosens the sandbox.
 * Only project scope is modeled: VS Code's user-scope settings.json lives at a
@@ -90321,17 +90656,24 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 				rules
 			});
 		}
+		const existingSettings = () => parseSharedConfig({
+			format: "jsonc",
+			fileContent: existingContent,
+			filePath
+		});
 		const defaultPermissionMode = config.copilot?.defaultPermissionMode;
-		if (defaultPermissionMode !== void 0) patch[DEFAULT_PERMISSION_MODE_KEY$1] = defaultPermissionMode;
+		if (defaultPermissionMode !== void 0) {
+			patch[DEFAULT_PERMISSION_MODE_KEY$1] = DEFAULT_PERMISSION_MODE_MAPPINGS[defaultPermissionMode].local;
+			patch[DEFAULT_CONFIGURATION_KEY] = buildDefaultConfigurationValue({
+				defaultPermissionMode,
+				existingSettings: existingSettings()
+			});
+		}
 		const sandbox = config.copilot?.sandbox;
 		if (sandbox !== void 0) {
 			Object.assign(patch, buildSandboxPatch({
 				sandbox,
-				existingSettings: parseSharedConfig({
-					format: "jsonc",
-					fileContent: existingContent,
-					filePath
-				})
+				existingSettings: existingSettings()
 			}));
 			warnOnTrustAffectingEntries({
 				toolLabel: COPILOT_TOOL_LABEL,
@@ -90378,10 +90720,10 @@ var CopilotPermissions = class CopilotPermissions extends ToolPermissions {
 			for (const [pattern, flag] of Object.entries(autoApprove)) rules[pattern] = flag ? "allow" : "deny";
 			if (Object.keys(rules).length > 0) permission[category] = rules;
 		}
-		const defaultPermissionMode = settings[DEFAULT_PERMISSION_MODE_KEY$1];
+		const defaultPermissionMode = readDefaultPermissionMode(settings);
 		const sandbox = readSandboxFromSettings(settings);
 		const copilot = {
-			...isCopilotDefaultPermissionMode(defaultPermissionMode) && { defaultPermissionMode },
+			...defaultPermissionMode !== void 0 && { defaultPermissionMode },
 			...sandbox !== void 0 && { sandbox }
 		};
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify({
@@ -90579,14 +90921,14 @@ var CopilotcliPermissions = class CopilotcliPermissions extends ToolPermissions
 	}
 };
 // src/features/permissions/crush-permissions.ts
-const CATCH_ALL_PATTERN$10 = "*";
+const CATCH_ALL_PATTERN$11 = "*";
 /**
 * A run of `*` (`**`, `***`) is the catch-all spelled another way: Crush has no
 * argument patterns at all, so it is the only pattern a rule can carry and
 * still be written.
 */
 function normalizeCatchAllPattern(pattern) {
-	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$10 : pattern;
+	return /^\*+$/.test(pattern) ? CATCH_ALL_PATTERN$11 : pattern;
 }
 const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	bash: "bash",
@@ -90598,11 +90940,11 @@ const CANONICAL_TO_CRUSH_TOOL_NAMES = {
 	webfetch: "fetch"
 };
 const CRUSH_TO_CANONICAL_TOOL_NAMES = Object.fromEntries(Object.entries(CANONICAL_TO_CRUSH_TOOL_NAMES).map(([k, v]) => [v, k]));
-const MCP_CANONICAL_PREFIX$6 = "mcp__";
+const MCP_CANONICAL_PREFIX$7 = "mcp__";
 const MCP_CRUSH_PREFIX = "mcp_";
 function toCrushToolName(canonical) {
 	if (Object.hasOwn(CANONICAL_TO_CRUSH_TOOL_NAMES, canonical)) return CANONICAL_TO_CRUSH_TOOL_NAMES[canonical] ?? canonical;
-	if (canonical.startsWith(MCP_CANONICAL_PREFIX$6) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
+	if (canonical.startsWith(MCP_CANONICAL_PREFIX$7) && canonical.length > 5) return `${MCP_CRUSH_PREFIX}${canonical.slice(5).replaceAll("__", "_")}`;
 	return canonical;
 }
 function toCanonicalToolName$5(crushName) {
@@ -90776,7 +91118,7 @@ function resolveCategoryAction({ category, toolName, rules, logger }) {
 	for (const [rawPattern, action] of Object.entries(rules)) {
 		if (isPrototypePollutionKey(rawPattern)) continue;
 		const pattern = normalizeCatchAllPattern(rawPattern);
-		if (pattern === CATCH_ALL_PATTERN$10) {
+		if (pattern === CATCH_ALL_PATTERN$11) {
 			catchAllAction = action;
 			continue;
 		}
@@ -90849,11 +91191,11 @@ function convertCrushListsToRulesync({ allowed, disabled }) {
 	};
 	for (const entry of disabled) {
 		if (entry === "" || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$10] = "deny";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$11] = "deny";
 	}
 	for (const entry of allowed) {
 		if (entry === "" || entry.includes(":") || isPrototypePollutionKey(entry)) continue;
-		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$10] ??= "allow";
+		bucketFor(toCanonicalToolName$5(entry))[CATCH_ALL_PATTERN$11] ??= "allow";
 	}
 	return { permission };
 }
@@ -90899,13 +91241,13 @@ const CURSOR_TYPE_TO_CANONICAL = {
 	WebFetch: "webfetch",
 	Mcp: "mcp"
 };
-const MCP_CANONICAL_PREFIX$5 = "mcp__";
+const MCP_CANONICAL_PREFIX$6 = "mcp__";
 /**
 * Returns true if the canonical category is the per-tool MCP form
 * `mcp__<server>__<tool>`.
 */
 function isMcpScopedCategory(canonical) {
-	return canonical.startsWith(MCP_CANONICAL_PREFIX$5) && canonical.length > 5;
+	return canonical.startsWith(MCP_CANONICAL_PREFIX$6) && canonical.length > 5;
 }
 function toCursorType(canonical) {
 	if (isMcpScopedCategory(canonical)) return "Mcp";
@@ -90939,7 +91281,7 @@ function toCanonicalCategory$1(cursorType, pattern) {
 		if (match) {
 			const server = match[1] ?? "*";
 			const tool = match[2] ?? "*";
-			return `${MCP_CANONICAL_PREFIX$5}${server}__${tool}`;
+			return `${MCP_CANONICAL_PREFIX$6}${server}__${tool}`;
 		}
 		return CURSOR_TYPE_TO_CANONICAL[cursorType] ?? cursorType.toLowerCase();
 	}
@@ -91201,7 +91543,7 @@ function convertCursorToRulesyncPermissions(params) {
 			const { toolName: type, pattern } = parseToolPatternEntry(entry);
 			const canonical = toCanonicalCategory$1(type, pattern);
 			if (!permission[canonical]) permission[canonical] = {};
-			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$5) ? "*" : pattern;
+			const canonicalPattern = type === "Mcp" && canonical.startsWith(MCP_CANONICAL_PREFIX$6) ? "*" : pattern;
 			permission[canonical][canonicalPattern] = action;
 		}
 	};
@@ -92700,7 +93042,7 @@ function convertFactorydroidToRulesyncPermissions({ allow, deny }) {
 // src/features/permissions/goose-permissions.ts
 const GOOSE_GLOBAL_ONLY_MESSAGE = "Goose permissions are global-only; use --global to sync ~/.config/goose/permission.yaml";
 const GOOSE_USER_KEY = "user";
-const CATCH_ALL_PATTERN$9 = "*";
+const CATCH_ALL_PATTERN$10 = "*";
 const RULESYNC_TO_GOOSE_TOOL_NAME = { bash: "shell" };
 const GOOSE_TO_RULESYNC_TOOL_NAMES = {
 	shell: ["bash"],
@@ -92849,7 +93191,7 @@ function convertRulesyncToGoosePermissionConfig({ config, logger }) {
 	const assigned = /* @__PURE__ */ new Map();
 	for (const [category, rules] of Object.entries(honorAllToolsOnBash(config.permission))) {
 		const toolName = RULESYNC_TO_GOOSE_TOOL_NAME[category] ?? category;
-		for (const [pattern, action] of Object.entries(rules)) if (pattern !== CATCH_ALL_PATTERN$9) logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
+		for (const [pattern, action] of Object.entries(rules)) if (pattern !== CATCH_ALL_PATTERN$10) logger?.warn(`Goose permission.yaml lists whole tool names, so the per-pattern "${action}" rule for "${category}" (pattern "${pattern}") cannot be expressed and was skipped.`);
 		const { action, downgraded } = failSafeCatchAllAction({
 			rules,
 			allToolsRules: category === "*" ? void 0 : config.permission["*"]
@@ -92882,7 +93224,7 @@ function convertGoosePermissionConfigToRulesync(userPermission) {
 		const action = GOOSE_LIST_TO_ACTION[key];
 		for (const toolName of toolNames) for (const category of GOOSE_TO_RULESYNC_TOOL_NAMES[toolName] ?? [toolName]) {
 			permission[category] ??= {};
-			permission[category][CATCH_ALL_PATTERN$9] = action;
+			permission[category][CATCH_ALL_PATTERN$10] = action;
 		}
 	}
 	return { permission };
@@ -92892,8 +93234,8 @@ const GROKCLI_UI_KEY = "ui";
 const GROKCLI_PERMISSION_MODE_KEY = "permission_mode";
 const GROKCLI_PERMISSION_KEY = "permission";
 const GROKCLI_AUTO_PERMISSION_MODE = "auto";
-const CATCH_ALL_PATTERN$8 = "*";
-const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const CATCH_ALL_PATTERN$9 = "*";
+const MCP_CANONICAL_PREFIX$5 = "mcp__";
 const CATEGORY_TO_GROK_TOOL = {
 	bash: "Bash",
 	read: "Read",
@@ -92925,6 +93267,25 @@ const GROK_TOOL_TO_CATEGORY_LOWER = {
 };
 const GROK_MCP_TOOL_ALIASES = /* @__PURE__ */ new Set(["mcp", GROK_MCP_TOOL.toLowerCase()]);
 const GROKCLI_PERMISSION_RULES_KEY = "rules";
+const GROK_PATH_PATTERN_CATEGORIES = /* @__PURE__ */ new Set([
+	"read",
+	"edit",
+	"write",
+	"grep",
+	"glob"
+]);
+const CLAUDE_ABSOLUTE_PATH_PREFIX = "//";
+/**
+* Rewrite a canonical path pattern into the anchor Grok understands. A
+* Claude-style `//abs` absolute pattern becomes `/abs`; without this the rule
+* would match nothing on Grok, so a `deny` or `ask` rule would silently give
+* no protection. Every other pattern is returned unchanged.
+*/
+function toGrokPathPattern(category, pattern) {
+	if (!GROK_PATH_PATTERN_CATEGORIES.has(category)) return pattern;
+	if (!pattern.startsWith(CLAUDE_ABSOLUTE_PATH_PREFIX)) return pattern;
+	return `/${pattern.replace(/^\/+/, "")}`;
+}
 /**
 * Build a Grok Claude-style permission entry (e.g. `Bash(git *)`, `Read`,
 * `MCPTool(server__tool)`) from a canonical category + pattern. Returns `null`
@@ -92935,18 +93296,20 @@ const GROKCLI_PERMISSION_RULES_KEY = "rules";
 * `MCPTool`. For every other tool, a `*` pattern emits the bare tool name and a
 * concrete pattern emits `Tool(pattern)`. The all-tools `*` category becomes
 * Grok's bare `*` rule for its catch-all pattern only; a narrower pattern
-* under it has no Grok spelling and returns `null`.
+* under it has no Grok spelling and returns `null`. A Claude-style `//abs`
+* path pattern on a file tool is rewritten to Grok's `/abs` (see
+* `toGrokPathPattern`).
 */
 function buildGrokEntry(category, pattern) {
-	if (category === "*") return pattern === CATCH_ALL_PATTERN$8 ? GROK_ALL_TOOLS_ENTRY : null;
-	if (category.startsWith(MCP_CANONICAL_PREFIX$4)) {
+	if (category === "*") return pattern === CATCH_ALL_PATTERN$9 ? GROK_ALL_TOOLS_ENTRY : null;
+	if (category.startsWith(MCP_CANONICAL_PREFIX$5)) {
 		const remainder = category.slice(5);
 		return remainder.length > 0 ? `${GROK_MCP_TOOL}(${remainder})` : GROK_MCP_TOOL;
 	}
-	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$8 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
+	if (category === "mcp") return pattern === CATCH_ALL_PATTERN$9 || pattern === "" ? GROK_MCP_TOOL : `${GROK_MCP_TOOL}(${pattern})`;
 	const tool = CATEGORY_TO_GROK_TOOL[category];
 	if (tool === void 0) return null;
-	return pattern === CATCH_ALL_PATTERN$8 || pattern === "" ? tool : `${tool}(${pattern})`;
+	return pattern === CATCH_ALL_PATTERN$9 || pattern === "" ? tool : `${tool}(${toGrokPathPattern(category, pattern)})`;
 }
 /**
 * Parse a Grok Claude-style permission entry back into a canonical category +
@@ -92968,21 +93331,21 @@ function parseGrokEntry(entry) {
 	}
 	if (parenIndex === -1 && tool === GROK_ALL_TOOLS_ENTRY) return {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$8
+		pattern: CATCH_ALL_PATTERN$9
 	};
-	if (parenIndex === -1 && tool.startsWith(MCP_CANONICAL_PREFIX$4)) return parseClaudeStyleMcpEntry(tool);
+	if (parenIndex === -1 && tool.startsWith(MCP_CANONICAL_PREFIX$5)) return parseClaudeStyleMcpEntry(tool);
 	if (tool === GROK_MCP_TOOL) return inner.length > 0 ? {
-		category: `${MCP_CANONICAL_PREFIX$4}${inner}`,
-		pattern: CATCH_ALL_PATTERN$8
+		category: `${MCP_CANONICAL_PREFIX$5}${inner}`,
+		pattern: CATCH_ALL_PATTERN$9
 	} : {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$8
+		pattern: CATCH_ALL_PATTERN$9
 	};
 	const category = GROK_TOOL_TO_CATEGORY[tool];
 	if (category === void 0) return null;
 	return {
 		category,
-		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$8
+		pattern: inner.length > 0 ? inner : CATCH_ALL_PATTERN$9
 	};
 }
 /**
@@ -92999,14 +93362,14 @@ function parseGrokEntry(entry) {
 function parseClaudeStyleMcpEntry(entry) {
 	const rest = entry.slice(5);
 	if (rest.length === 0) return null;
-	if (rest === CATCH_ALL_PATTERN$8) return {
+	if (rest === CATCH_ALL_PATTERN$9) return {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$8
+		pattern: CATCH_ALL_PATTERN$9
 	};
 	const address = rest.includes("__") ? rest : `${rest}__*`;
 	return {
-		category: `${MCP_CANONICAL_PREFIX$4}${address}`,
-		pattern: CATCH_ALL_PATTERN$8
+		category: `${MCP_CANONICAL_PREFIX$5}${address}`,
+		pattern: CATCH_ALL_PATTERN$9
 	};
 }
 /**
@@ -93027,20 +93390,20 @@ function parseGrokRule(rule) {
 	if (typeof tool !== "string") return null;
 	if (pattern !== void 0 && typeof pattern !== "string") return null;
 	const trimmedPattern = pattern?.trim() ?? "";
-	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$8;
+	const resolvedPattern = trimmedPattern.length > 0 ? trimmedPattern : CATCH_ALL_PATTERN$9;
 	const lowerTool = tool.trim().toLowerCase();
-	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$8 ? {
+	if (lowerTool === GROK_VERBOSE_ANY_TOOL) return resolvedPattern === CATCH_ALL_PATTERN$9 ? {
 		category: "*",
-		pattern: CATCH_ALL_PATTERN$8,
+		pattern: CATCH_ALL_PATTERN$9,
 		action
 	} : null;
-	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$8 ? {
+	if (GROK_MCP_TOOL_ALIASES.has(lowerTool)) return resolvedPattern === CATCH_ALL_PATTERN$9 ? {
 		category: "mcp",
-		pattern: CATCH_ALL_PATTERN$8,
+		pattern: CATCH_ALL_PATTERN$9,
 		action
 	} : {
-		category: `${MCP_CANONICAL_PREFIX$4}${resolvedPattern}`,
-		pattern: CATCH_ALL_PATTERN$8,
+		category: `${MCP_CANONICAL_PREFIX$5}${resolvedPattern}`,
+		pattern: CATCH_ALL_PATTERN$9,
 		action
 	};
 	if (!Object.hasOwn(GROK_TOOL_TO_CATEGORY_LOWER, lowerTool)) return null;
@@ -93190,7 +93553,7 @@ var GrokcliPermissions = class GrokcliPermissions extends ToolPermissions {
 			throw new Error(`Failed to parse Grok config.toml content in ${(0, node_path.join)(this.getRelativeDirPath(), this.getRelativeFilePath())}: ${formatError(error)}`, { cause: error });
 		}
 		const fineGrained = parseGrokPermissionArrays(isRecord(parsed[GROKCLI_PERMISSION_KEY]) ? parsed[GROKCLI_PERMISSION_KEY] : {});
-		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$8]: legacyModeAction(parsed) } } };
+		const rulesyncConfig = fineGrained ? { permission: fineGrained } : { permission: { bash: { [CATCH_ALL_PATTERN$9]: legacyModeAction(parsed) } } };
 		return this.toRulesyncPermissionsDefault({ fileContent: JSON.stringify(rulesyncConfig, null, 2) });
 	}
 	static forDeletion({ outputRoot = process.cwd(), relativeDirPath, relativeFilePath, global = false }) {
@@ -93375,6 +93738,195 @@ function ensureCategory(permission, category) {
 function removeEmptyCategories(permission) {
 	for (const [category, rules] of Object.entries(permission)) if (Object.keys(rules).length === 0) delete permission[category];
 }
+/** The prefix Hermes's MCP trust gate keys its persisted "Always" answers with. */
+const MCP_ALLOWLIST_PREFIX = "mcp:";
+const MCP_CANONICAL_PREFIX$4 = "mcp__";
+const CATCH_ALL_PATTERN$8 = "*";
+/**
+* Whether a `command_allowlist` entry is an MCP trust-gate grant rather than a
+* shell-command pattern. Since Hermes Agent v0.22.6, answering **Always** to
+* the approval prompt of a `trust: untrusted` MCP server appends
+* `mcp:<server>/<tool>` to `command_allowlist` (`_trust_approval_key` in
+* `tools/mcp_tool_handlers.py`), and the gate looks the key up by exact set
+* membership, so no `mcp:` entry is ever a command.
+*/
+function isMcpAllowlistEntry(entry) {
+	return entry.startsWith(MCP_ALLOWLIST_PREFIX);
+}
+/**
+* The canonical category (`mcp__<server>__<tool>`) a Hermes `mcp:<server>/<tool>`
+* grant stands for, or `null` when it has none: a malformed entry, a server
+* name containing `__` (the canonical name would read back as another server),
+* or a `*` in either name (Hermes compares the key literally, while a canonical
+* `*` is a wildcard).
+*/
+function mcpAllowlistEntryToCategory(entry) {
+	const parsed = parseMcpAllowlistEntry(entry);
+	if (parsed === null) return null;
+	const { server, tool } = parsed;
+	if (server.includes("__") || server.includes(CATCH_ALL_PATTERN$8)) return null;
+	if (tool.includes(CATCH_ALL_PATTERN$8)) return null;
+	return `${MCP_CANONICAL_PREFIX$4}${server}__${tool}`;
+}
+/** The server and tool an `mcp:<server>/<tool>` entry names, or `null` when it is malformed. */
+function parseMcpAllowlistEntry(entry) {
+	if (!isMcpAllowlistEntry(entry)) return null;
+	const rest = entry.slice(4);
+	const slash = rest.indexOf("/");
+	const server = slash === -1 ? "" : rest.slice(0, slash);
+	const tool = slash === -1 ? "" : rest.slice(slash + 1);
+	return server.length === 0 || tool.length === 0 ? null : {
+		server,
+		tool
+	};
+}
+/**
+* The server and tool a canonical `mcp__<server>__<tool>` category names, or
+* `null` when it names no single tool (a whole server, a wildcard, or the bare
+* `mcp` category). Only such a category can become one Hermes grant.
+*/
+function parseMcpToolCategory(category) {
+	if (!category.startsWith(MCP_CANONICAL_PREFIX$4)) return null;
+	const remainder = category.slice(5);
+	const separator = remainder.indexOf("__");
+	if (separator <= 0) return null;
+	const server = remainder.slice(0, separator);
+	const tool = remainder.slice(separator + 2);
+	if (tool.length === 0 || server.includes("/") || server.includes(CATCH_ALL_PATTERN$8) || tool.includes(CATCH_ALL_PATTERN$8)) return null;
+	return {
+		server,
+		tool
+	};
+}
+function isMcpCategory$1(category) {
+	return category === "mcp" || category.startsWith(MCP_CANONICAL_PREFIX$4);
+}
+function isRestricting(action) {
+	return action === "deny" || action === "ask";
+}
+/** The first `deny` or `ask` rule of a category, as `<category>: <pattern> (<action>)`. */
+function firstRestrictingRule(category, rules, covers = () => true) {
+	const found = Object.entries(rules ?? {}).find(([pattern, action]) => isRestricting(action) && covers(pattern));
+	return found ? `${category}: ${found[0]} (${found[1]})` : null;
+}
+/**
+* Whether an MCP name glob (the remainder of an `mcp__...` category, or a
+* pattern of the bare `mcp` category) covers `server`'s tool `tool`: it names
+* the tool (`github__delete_repo`, `github__*`, `*__delete_repo`, `*`) or the
+* whole server (`github`).
+*/
+function mcpNameGlobCovers(glob, server, tool) {
+	return glob === `${server}__${tool}` || glob === server || matchesGlob(glob, `${server}__${tool}`) || matchesGlob(glob, server);
+}
+/**
+* The `deny` or `ask` rule that outranks an allow on `server`'s tool `tool`, or
+* `null` when none does: any one under the all-tools `*` category (a rule there
+* applies to every tool, so even a narrower pattern restricts some of the
+* tool's calls), one under the bare `mcp` category whose pattern covers the
+* tool, or any one in an `mcp__...` category whose name covers the tool — its
+* own category included, since a deny or ask scoped to some of its calls still
+* forbids approving all of them. A Hermes grant approves every call of the
+* tool and Hermes has no ask tier, so such an allow is withheld, the same way
+* a `bash` allow a stricter rule covers is.
+*/
+function findMcpToolRestriction(permission, server, tool) {
+	for (const [category, rules] of Object.entries(permission)) {
+		let found = null;
+		if (category === "*") found = firstRestrictingRule(category, rules);
+		else if (category === "mcp") found = firstRestrictingRule(category, rules, (pattern) => mcpNameGlobCovers(pattern, server, tool));
+		else if (category.startsWith(MCP_CANONICAL_PREFIX$4) && mcpNameGlobCovers(category.slice(5), server, tool)) found = firstRestrictingRule(category, rules);
+		if (found !== null) return found;
+	}
+	return null;
+}
+function isMcpToolRestricted(permission, server, tool) {
+	return findMcpToolRestriction(permission, server, tool) !== null;
+}
+/**
+* Translate the canonical MCP `allow` rules into Hermes trust-gate grants: a
+* `*` allow on `mcp__<server>__<tool>` becomes `mcp:<server>/<tool>`. Every
+* other MCP allow (a whole server, a wildcard, a narrower pattern) has no
+* Hermes spelling, and an allow a deny or ask covers is withheld.
+*/
+function collectMcpAllowlistEntries(permission) {
+	const entries = [];
+	const withheldCategories = [];
+	const unexpressedRules = [];
+	for (const [category, rules] of Object.entries(permission)) {
+		if (!isMcpCategory$1(category)) continue;
+		const parsed = parseMcpToolCategory(category);
+		for (const pattern of patternsByAction(rules, "allow")) if (parsed === null || pattern !== CATCH_ALL_PATTERN$8) unexpressedRules.push(`${category}: ${pattern}`);
+		else {
+			const restriction = findMcpToolRestriction(permission, parsed.server, parsed.tool);
+			if (restriction === null) entries.push(`${MCP_ALLOWLIST_PREFIX}${parsed.server}/${parsed.tool}`);
+			else withheldCategories.push(`${category} (covered by ${restriction})`);
+		}
+	}
+	return {
+		entries,
+		withheldCategories,
+		unexpressedRules
+	};
+}
+function warnAboutUnwrittenMcpAllows({ withheldCategories, unexpressedRules, logger }) {
+	if (withheldCategories.length > 0) warnWithFallback(logger, `Hermes Agent's command_allowlist was not given the MCP allow rule(s) for ${withheldCategories.join(", ")}: a deny or ask rule covers each, a Hermes grant approves every call of the tool, and Hermes has no ask tier.`);
+	if (unexpressedRules.length > 0) warnWithFallback(logger, `Hermes Agent grants MCP tools one at a time (command_allowlist entries 'mcp:<server>/<tool>'), so only a '*' allow on an 'mcp__<server>__<tool>' category can be written; the MCP allow rule(s) ${unexpressedRules.join(", ")} were skipped and survive only in the permissions.rulesync round-trip block.`);
+}
+/**
+* Make the native `mcp:<server>/<tool>` grants authoritative for the canonical
+* single-tool MCP allows they can speak for. An allow the generator withheld
+* because a deny or ask covers it was never written, so its absence
+* is not a retraction and it is kept, as is every MCP allow with no Hermes
+* spelling. A grant with no canonical spelling stays only in Hermes, where
+* generation keeps it (see `setFileContent`).
+*/
+function reconcileMcpAllowlist({ permission, mcpEntries, logger }) {
+	for (const [category, rules] of Object.entries(permission)) {
+		const parsed = parseMcpToolCategory(category);
+		if (parsed !== null && rules[CATCH_ALL_PATTERN$8] === "allow" && !isMcpToolRestricted(permission, parsed.server, parsed.tool)) delete rules[CATCH_ALL_PATTERN$8];
+	}
+	const keptRestrictions = [];
+	for (const entry of mcpEntries) {
+		const category = mcpAllowlistEntryToCategory(entry);
+		if (category === null) continue;
+		const rules = ensureCategory(permission, category);
+		if (isRestricting(rules[CATCH_ALL_PATTERN$8])) {
+			keptRestrictions.push(entry);
+			continue;
+		}
+		rules[CATCH_ALL_PATTERN$8] = "allow";
+	}
+	if (keptRestrictions.length > 0) warnWithFallback(logger, `Hermes Agent's command_allowlist grants ${keptRestrictions.join(", ")}, but the permissions.rulesync block denies or asks for those MCP tools; the canonical rule was kept and the grant was not imported.`);
+}
+/**
+* The `mcp:` grants in an existing `command_allowlist` that rulesync does not
+* manage and must keep when it rewrites the list: Hermes appends one whenever
+* the user answers **Always** on an untrusted MCP server, so dropping it would
+* silently revoke the grant. A grant is managed — and so retracted with its
+* canonical rule — when the previous or the new canonical block has a rule
+* for its `mcp__<server>__<tool>` category, or when the new block restricts
+* the tool in any way.
+*/
+function unmanagedMcpAllowlistEntries({ existing, previousPermission, nextPermission, nextAllowlist }) {
+	return (isStringArray(existing.command_allowlist) ? existing.command_allowlist : []).filter((entry) => {
+		if (!isMcpAllowlistEntry(entry) || nextAllowlist.includes(entry)) return false;
+		const parsed = parseMcpAllowlistEntry(entry);
+		if (parsed !== null && isMcpToolRestricted(nextPermission, parsed.server, parsed.tool)) return false;
+		const category = mcpAllowlistEntryToCategory(entry);
+		return category === null || !Object.hasOwn(previousPermission, category) && !Object.hasOwn(nextPermission, category);
+	});
+}
+/** The validated canonical `permission` block of a config's `permissions.rulesync` blob. */
+function canonicalPermissionOf(config) {
+	const parsed = RulesyncPermissionsFileSchema.safeParse({ permission: provenancePermissionOf(config) });
+	return parsed.success ? parsed.data.permission : {};
+}
+/** The canonical `permission` block of a config's `permissions.rulesync` blob, if any. */
+function provenancePermissionOf(config) {
+	const permissionsRoot = isRecord(config.permissions) ? config.permissions : {};
+	const provenance = isRecord(permissionsRoot.rulesync) ? permissionsRoot.rulesync : {};
+	return isRecord(provenance.permission) ? provenance.permission : {};
+}
 /**
 * Make the native `command_allowlist` authoritative for the `bash` allow rules
 * it can speak for, and for those only. The allowlist is a list of shell-command
@@ -93392,8 +93944,9 @@ function reconcileCommandAllowlist({ permission, commandAllowlist }) {
 		writesAllToolsDeny: false
 	});
 	const withheld = new Set(shadowedAllowPatterns);
+	const isWithheld = (pattern) => withheld.has(pattern) || isMcpAllowlistEntry(pattern);
 	const rules = ensureCategory(permission, SHELL_PERMISSION_CATEGORY);
-	for (const [pattern, action] of Object.entries(rules)) if (action === "allow" && !withheld.has(pattern)) delete rules[pattern];
+	for (const [pattern, action] of Object.entries(rules)) if (action === "allow" && !isWithheld(pattern)) delete rules[pattern];
 	for (const pattern of commandAllowlist) rules[pattern] = "allow";
 }
 /**
@@ -93481,17 +94034,31 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		return true;
 	}
 	setFileContent(fileContent) {
+		const patch = parseSharedConfig({
+			format: "yaml",
+			fileContent: this.fileContent
+		});
+		if (isStringArray(patch.command_allowlist)) {
+			const existing = parseSharedConfig({
+				format: "yaml",
+				fileContent
+			});
+			const kept = unmanagedMcpAllowlistEntries({
+				existing,
+				previousPermission: provenancePermissionOf(existing),
+				nextPermission: canonicalPermissionOf(patch),
+				nextAllowlist: patch.command_allowlist
+			});
+			if (kept.length > 0) patch.command_allowlist = [...patch.command_allowlist, ...kept];
+		}
 		this.fileContent = applySharedConfigPatch({
 			fileKey: getHermesagentConfigSharedFileKey({ global: this.global }),
 			feature: "permissions",
 			existingContent: fileContent,
-			patch: parseSharedConfig({
-				format: "yaml",
-				fileContent: this.fileContent
-			})
+			patch
 		});
 	}
-	toRulesyncPermissions() {
+	toRulesyncPermissions({ logger } = {}) {
 		const config = parseSharedConfig({
 			format: "yaml",
 			fileContent: this.getFileContent()
@@ -93503,9 +94070,15 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 		}) : rawProvenance);
 		const provenance = parsedProvenance.success ? parsedProvenance.data : { permission: {} };
 		const permission = clonePermissionBlock(provenance.permission);
+		const commandAllowlist = isStringArray(config.command_allowlist) ? config.command_allowlist : [];
 		reconcileCommandAllowlist({
 			permission,
-			commandAllowlist: isStringArray(config.command_allowlist) ? config.command_allowlist : []
+			commandAllowlist: commandAllowlist.filter((entry) => !isMcpAllowlistEntry(entry))
+		});
+		reconcileMcpAllowlist({
+			permission,
+			mcpEntries: commandAllowlist.filter(isMcpAllowlistEntry),
+			logger
 		});
 		const approvals = isRecord(config.approvals) ? config.approvals : {};
 		reconcileNativeDenies({
@@ -93563,8 +94136,16 @@ var HermesagentPermissions = class HermesagentPermissions extends ToolPermission
 			logger
 		});
 		const webfetchDeny = patternsByAction(permissionBlock[WEBFETCH_PERMISSION_CATEGORY], "deny");
+		const mcpAllows = collectMcpAllowlistEntries(permissionBlock);
+		warnAboutUnwrittenMcpAllows({
+			...mcpAllows,
+			logger
+		});
+		const bashMcpAllows = commandAllowlist.filter(isMcpAllowlistEntry);
+		if (bashMcpAllows.length > 0) warnWithFallback(logger, `Hermes Agent reads 'mcp:' entries in command_allowlist as MCP tool grants, so the bash allow rule(s) ${bashMcpAllows.join(", ")} were skipped; write them as a '*' allow on an 'mcp__<server>__<tool>' category instead.`);
+		const allowlist = [...commandAllowlist.filter((entry) => !isMcpAllowlistEntry(entry)), ...mcpAllows.entries];
 		let config = {};
-		if (commandAllowlist.length > 0) config.command_allowlist = commandAllowlist;
+		if (allowlist.length > 0) config.command_allowlist = allowlist;
 		if (bashDeny.length > 0) config.approvals = { deny: bashDeny };
 		if (webfetchDeny.length > 0) config.security = { website_blocklist: {
 			enabled: true,
@@ -100405,6 +100986,7 @@ const TAKT_SECURITY_POLICIES = {
 	],
 	workflow_runtime_prepare: ["custom_scripts"],
 	workflow_command_gates: ["custom_scripts"],
+	workflow_system_commands: ["custom_scripts"],
 	sync_conflict_resolver: ["auto_approve_tools"],
 	allow_git_hooks: null,
 	allow_git_filters: null